Meta has been fined €265 million ($275.5 million) by the Irish data protection commission (DPC) for the data leak suffered by Facebook in 2021 which exposed the data of millions of Facebook users.
The Data Protection Commission is also imposing a range of corrective measures on Meta.
The fines follow an inquiry initiated by the European regulator on April 14, 2021, for the leak of a collated dataset of Facebook personal data that had been made available on the internet.
On April 3rd, 2021, a user leaked the phone numbers and personal data of 533 million Facebook users in a hacking forum for free.
The data of Facebook users from 106 countries were available for free, with over 32 million records belonging to users from the US, 11 from the UK, and 6 million users from India.
The leaked data included phone numbers, Facebook IDs, full names, locations, birthdates and bios of users and for some accounts the associated email addresses as well.
Soon after the disclosures of the data leak, the Irish DPC launched an investigation of potential GDPR violations by Meta. The threat actors obtained the data by exploiting a vulnerability fixed in 2019 that allowed data scraping from the social network.
The company, at the time known as Facebook, said the data had been gathered by malicious actors who misused a Facebook tool called “Contact Importer” to upload a large volume of phone numbers to uncover matches.
Facebook has since removed the ability to use phone numbers to retrieve information via scraping as of August 2019.
Meta declared that it has made several changes to better safeguard users’ data since the incident took place.
Now DPC concluded the investigation and stated that Meta violated the GDPR for not implementing appropriate technical and organizational measures, and not adopting the necessary safeguards as required by the European Regulation.
The decision also imposed a reprimand and an order requiring MPIL to bring its processing into compliance by taking a range of specified remedial actions within a particular timeframe.
Comments