In a recent ruling, Meta, the parent company of Facebook, has been fined €91 million (£75 million) by the Irish Data Protection Commission (DPC). The fine follows an investigation into Meta’s improper storage of user passwords without encryption, violating the General Data Protection Regulation (GDPR) multiple times. This is not the first time Meta has faced significant penalties from the DPC for mishandling user data, but the latest incident highlights ongoing concerns about how tech giants handle sensitive information.
Meta’s Password Storage Breach: What Happened?
Back in April 2019, Meta reported to the DPC that it had inadvertently stored certain social media user passwords on its internal systems without encryption. Passwords stored in this manner are often referred to as being in “clear text,” meaning they are not protected by any form of encryption or hashing. This oversight posed a significant risk to user privacy and data security, leading to an investigation by the DPC.
The investigation revealed that Meta had violated the GDPR on four different occasions, related specifically to how the company managed sensitive user information, such as passwords. In June 2024, the DPC submitted a draft decision to data protection authorities across Europe for review. None of these authorities raised objections, clearing the way for the DPC to issue its final decision.
Why Meta’s Storage of Passwords in “Clear Text” is a Major Concern
According to Graham Doyle, Deputy Commissioner of the DPC, “Given the risk of abuse posed by people accessing such data, it is generally accepted that user passwords should not be stored in clear text.” This means that storing user passwords without encryption opens them up to potential abuse by hackers or malicious actors, who could easily gain access to users’ social media accounts.
“Passwords are particularly sensitive as they provide access to users’ social media accounts, where a wealth of personal information is often stored,” Doyle added. With the growing number of data breaches and cyberattacks in recent years, the need for encryption has never been more critical.
The decision, made by Data Protection Commissioners Dr. Des Hogan and Dale Sunderland, includes both a reprimand and the €91 million fine. Meta was officially notified of the decision on September 26, 2024, marking yet another high-profile case of regulatory action against the tech giant.
Meta’s GDPR Violations: A Recurring Problem
This is not the first time Meta has faced hefty fines for mishandling user data. In fact, the company has a history of GDPR violations that have led to significant penalties. Some of the most notable cases include:
- May 2023: Meta was hit with a record-breaking fine of €1.2 billion (£1 billion) for improper handling of user data transfers between Europe and the United States. This penalty remains the largest fine ever issued under the EU’s GDPR privacy law.
- November 2022: The company was fined €265 million (£220 million) after data on 533 million users from 106 countries was scraped from Facebook and posted on a hacker forum. This incident raised serious concerns about Meta’s ability to safeguard user data from unauthorized access.
These repeated violations suggest that Meta continues to face challenges when it comes to ensuring compliance with the GDPR and adequately protecting its users’ data.
What Does This Fine Mean for Meta and Other Tech Companies?
The €91 million fine imposed on Meta is just the latest in a series of penalties levied against large tech companies for failing to comply with GDPR standards. As the primary regulator of Meta in Europe, the Irish DPC has become increasingly vigilant in holding tech giants accountable for how they handle personal data.
While this fine may not have the same financial impact as the €1.2 billion fine Meta received in 2023, it serves as a reminder that companies must prioritize the protection of sensitive user information. Data privacy is an ever-growing concern for both regulators and consumers, and tech companies like Meta need to ensure they have robust systems in place to avoid similar breaches in the future.
The Importance of GDPR Compliance in the Tech Industry
The GDPR, which came into effect in May 2018, sets strict rules on how companies collect, store, and process personal data. Non-compliance can result in severe penalties, as Meta’s various fines demonstrate. For companies operating within the EU, adhering to GDPR standards is not optional—it’s a legal requirement designed to protect the privacy of individuals.
As data breaches and cybersecurity threats become more frequent, both consumers and regulators are demanding higher standards of accountability from companies like Meta. It is crucial for tech companies to invest in secure systems and processes to handle personal data and avoid costly penalties and reputational damage.
Conclusion: Meta Faces Consequences for GDPR Violations
The €91 million fine handed to Meta by the Irish DPC underscores the importance of data protection and GDPR compliance. Meta’s failure to encrypt user passwords exposed the company to significant regulatory scrutiny and resulted in yet another high-profile fine. While Meta has made strides in improving its privacy practices, this latest penalty serves as a reminder that more work is needed to fully comply with data protection laws.
In an era where data privacy is paramount, companies must remain vigilant and proactive in protecting user information. As Meta continues to face scrutiny from regulators, it’s likely that we will see further developments in how tech companies handle personal data moving forward.
