A data regulator from Ireland enforcing the EU’s data protection laws announced that it had imposed a $101 million fine on Meta, the company that owns Facebook, for violating password security measures.
The DPC accused Meta of insufficiently safeguarding user password data and also of a tardy notification to the regulatory body.
The DPC said an investigation started in April of 2019 after Meta Ireland had reportedly notified the authority that it had “accidentally stored certain social media users’ passwords” in an accessible format on its internal systems.
“It’s a long-standing principle that passwords of users must not ever be stored in plaintext, considering the risks that it would pose to misuse if unauthorized people obtain the data,” said Graham Doyle, the head communications for the DPC.
Doyle said attack took place last January 2019 and hit 36 million Facebook and Instagram users within the European Economic Area, which includes the EU countries, Iceland, Liechtenstein, and Norway.
Besides these concerns, the regulator also condemned Meta for its failure to make a report about the problem to DPC until 2019 March.
Meta admitted in a statement said that its internal systems had “temporarily stored” some Facebook users’ passwords in a “readable format”.
We acted quickly to correct the issue, and we have no evidence that any of these passwords were compromised or accessed inappropriately. We contacted our lead regulator, the Irish Data Protection Commission, in advance and have cooperated fully with the inquiry process.
Among the global tech giants, some have established their European headquarters in Dublin, such as Google, Apple, and Meta.
The appropriate authority to regulate and hold accountable these companies in Ireland is the country’s data protection authority.
