EU Watchdog Fines Meta Millions of Euros Over 2018 Data Breach

The Irish Data Protection Commission (DPC), Meta’s lead privacy regulator in the European Union, recently announced it would fine Facebook’s parent company 251 million euros after concluding two inquiries into a 2018 breach that compromised data from about 3 million EU users and 29 million users worldwide.

The breach traced back to a bug in Facebook’s “View as” feature, which let people see their profile from someone else’s perspective. As a result, external actors generated user tokens that granted them full access to targeted profiles. A Facebook profile often displays personal details such as full names, email addresses, phone numbers, locations, birthdates, workplaces, religion, and gender expression.

According to the DPC, bad actors exploited this bug between September 14 and 28, 2018, affecting approximately 29 million accounts worldwide. Facebook removed the feature shortly after discovering the vulnerability. Since Meta’s regional headquarters are in Dublin, the DPC serves as the EU’s primary privacy watchdog for the tech giant.

Investigators concluded that Meta infringed the General Data Protection Regulation (GDPR) and imposed the 251 million euro fine as a punitive measure.

“This enforcement action highlights how the failure to build in data protection requirements throughout the design and development cycle can expose individuals to very serious risks and harms, including a risk to the fundamental rights and freedoms of individuals. […] By allowing unauthorized exposure of profile information, the vulnerabilities behind this breach caused a grave risk of misuse of these types of data,” said Graham Doyle, DPC Deputy Commissioner, in a public statement.

Meta responded to the decision in a public statement: “This decision relates to an incident from 2018. We took immediate action to fix the problem as soon as it was identified.” The company also plans to contest the fine.

This penalty is not the largest one Meta has received in the EU this year. In November, EU regulators fined the company over 797 million euros in an antitrust ruling following an investigation launched in June 2021.