A substantial €17 million (£14.2m) GDPR fine has been levied against Meta for breaching EU data privacy laws.

The Irish Data Protection Commission (DPC) said Meta broke GDPR laws by not having in place “appropriate technical and organisational measures” to protect user data.

The Meta GDPR fine comes after a lengthy inquiry into 12 data breaches received by the DPC between 7 June 2018 and 4 December 2018.

According to a Meta spokesperson the company takes its “obligations under the GDPR seriously” and will now “carefully consider the decision as our processes continue to evolve”.

They added: “This fine is about record-keeping practices from 2018 that we have since updated, not a failure to protect people’s information.”

Two European supervisory authorities working as part of the General Data Protection Regulations (GDPR) decision-making process raised objections to the initial DPC decision.

However, the Irish commission said that “consensus was achieved through further engagement between the DPC and the supervisory authorities”.

Meta has been in trouble with the DPC before, being pulled up numerous times for issues around GDPR in Europe.

In April last year, the DPC said it was investigating after more than 500 million Facebook users in 106 countries were affected by a major data breach.

The DPC said it is looking to establish if the exposed data was from an older breach reported by the social media giant in 2019.

However, despite carrying out investigations into the tech giant in the past, the DPC has previously been accused of leniency in its fining of Meta.

A $42m fine previously issued by the DPC against Facebook for concealing how it gathers user data was attacked by privacy campaigners in October 2021.

The move was criticised for being too lenient, and also for setting a precedent that could be used to bypass GDPR.

Recommended

• Digital Xtra Fund secures £100,000 of fresh funding
• Facial recognition tech offered to Ukrainian Government
• Collaboration is key for a stronger Scottish tech for good ecosystem

Alongside the DPC fine this week, Meta is also facing possible legal issues in South Africa after the competition regulator in the country sought to prosecute the firm and its subsidiaries, WhatsApp, and Facebook South Africa, for abusing its dominance in the social media sector.

If Meta is found to have violated the country’s anti-competition rules, the regulator said, then it would be facing a fine of 10% of its revenues earned in South Africa, as well as exports from last year.

According to the commission, Meta threatened to block GovChat and #LetsTalk from using its WhatsApp Business API around July 2020.

The commission also claimed that Meta imposed “unfair restrictions” on data usage by GovChat, reducing its ability to develop new products and services to compete with Meta.

In a statement, the regulator said: “The terms and conditions governing access to WhatsApp Business API are designed to shield and insulate Facebook from potential competition, such as the potential competition presented by GovChat and enormous data it has been able to harvest which enables it to develop new services and products.”

The DIGIT Data Protection Summit 2022

​The 5th annual Data Protection Summit will take place on 24th March at Dynamic Earth in Edinburgh, and streamed through our virtual conference platform.

The conference will contextualise the latest developments within the data protection field, with insight from frontline practitioners reflecting on key trends, challenges and best practice.

For more information, visit: www.dataprotection-summit.com