Data protection violations

Meta fined millions in the EU

The US company Meta, parent company of the services Facebook, Instagram and Whatsapp, is to pay another fine in the millions for breaches of EU data protection laws. The competent Irish data protection authority (DPC) imposed a fine of 91 million euros. It accuses the company of failing to adequately protect users' passwords and not responding correctly to a security incident.

The DPC launched an investigation in April 2019 after being informed by Meta that a number of user passwords had been "inadvertently" stored unencrypted. The incident took place in January 2019 and affected 36 million Facebook and Instagram users in the countries of the European Economic Area. In particular, the DPC accuses Meta of not informing them until March 2019.

"Immediate measures"
Meta admits that some user passwords were "temporarily stored in a readable format in our internal data systems". However, "immediate action has been taken to correct this error", the company assured upon request. "There is no evidence that these passwords have been misused or accessed inappropriately."

The US company has already received a whole series of fines - all in the millions - for violations of the General Data Protection Regulation (GDPR), which has been in force since 2018. The deterrent effect appears to be limited. Meta's net profit rose by 73% year-on-year to 13.5 billion dollars in the second quarter.