Meta, the parent company of Facebook, Instagram and WhatsApp, was fined 91 million euros on Friday for violating the European Data Regulation (GDPR) without transparency after a security breach affecting user passwords. In this new decision, the Irish Data Protection Commission (DPC), which acts on behalf of the European Union, criticizes Meta for not putting in place appropriate safeguards upstream and taking too long to bring the issue to his attention. The DPC launched an investigation in April 2019 after being notified by Meta Ireland about the procurement “carelessly” of “Some User Passwords” In plain text, i.e. unencrypted, without these “External Parties Notified”They said in a press release.

The security breach dates back to January 2019 and affected 36 million Facebook and Instagram users in the European Economic Area, Graham Doyle, the Irish regulator's head of communications, told AFP. DPC criticizes Meta for not being notified of the issue until March 2019. “It is widely accepted that user passwords should not be stored in clear text”Graham Doyle insisted.

“Immediate Actions”

Meta, for its part, recognizes that certain user passwords exist “Temporarily recorded in a readable format in our internal data systems”In a statement to AFP. The company claims that there is “Immediate action has been taken to correct this error”Adding that there is “There is no evidence that these passwords were misused or improperly accessed”. The company swears it has “This problem was previously reported” There is “Cooperated constructively throughout this investigation”.

The group is regularly accused in the European Union of processing users' personal data in breach of European GDPR regulations introduced in 2018 to protect consumers from the dominance of tech giants. Although numerous, these convictions don't seem like a deterrent for the Menlo Park giant. In September 2021, the group was fined 225 million for lack of transparency “Processing of information between WhatsApp and other Facebook companies”. In March 2022, 17 million fines were imposed for failure to implement data protection measures.

Lack of transparency

Six months later, in September 2022, 405 million euros for failing to process the data of minors, and then 265 million euros in November 2022, Rebelot for not adequately protecting the data of minor Facebook users. In January 2023, he received two new fines of 390 million euros for the violation. “Its Obligations on Transparency” and for the processing of personal data “For Advertising Purposes” Targeted. A few days later, the latest fine: 5.5 million for lack of transparency regarding WhatsApp.

Meta's net income rose 73% to $13.5 billion in the second quarter.