Facebook’s parent company, Meta, has been fined €91m (£75m) by the Irish Data Protection Commission (DPC) for violating the General Data Protection Regulation (GDPR) regarding the storage of user passwords.
The investigation, initiated in April 2019, was a result of Meta’s admission to the DPC that it had stored certain social media users’ passwords in plain text on its internal systems without proper encryption. This serious breach of privacy, storing passwords without encryption, posed significant risks and raised grave concerns.
In June 2024, the DPC submitted its draft decision to other European data protection authorities for review. No objections were raised, allowing the decision to proceed smoothly.
Following the investigation, Meta was found to have committed four breaches of GDPR. The lack of encryption for sensitive user passwords was a fundamental violation, with the DPC emphasizing the importance of safeguarding user credentials to protect against potential abuse.
Graham Doyle, DPC deputy commissioner, stated: “It is widely accepted that user passwords should not be stored in plain text due to the risks of abuse that arise from unauthorized access to such data.”
He further highlighted the compassionate nature of the case, given that the passwords involved could provide access to users’ social media accounts, placing their personal information at risk.
Commissioners Dr Des Hogan and Dale Sunderland made the DPC’s decision, finalized on 26 September 2024. It includes a reprimand and a substantial fine of €91m.
Meta has been under continuous scrutiny in Europe over its data protection practices. This latest fine, a substantial € 91 m, underscores the company’s persistent challenges in complying with the strict privacy regulations under GDPR.
For more tech news and insights, visit Rwanda Tech News, and explore similar topics and trends in the world of technology.
