Meta Hit with $101.5 Million Fine Over 2019 Password Leak

Meta has been fined US$101.5 million by the Irish Data Protection Commission (DPC) for a 2019 leak that exposed Facebook user passwords. The investigation found that Meta failed to adequately protect users’ passwords, breaching the European Union's (EU) General Data Protection Regulation (GDPR).

The DPC initiated the investigation in April 2019, when Meta, then known as Facebook, reported that “hundreds of millions” of user passwords had been stored in plain text on its servers. Under GDPR, personal data must be adequately protected to prevent unauthorized access, which was not met in this case. According to the DPC, the lack of encryption on the stored passwords constituted a significant vulnerability, allowing the possibility for third parties to access sensitive user information.

In addition to the lack of encryption, Meta was singled out for failing to notify the breach within the required 72-hour period, as required by the GDPR. This delay, combined with the failure to properly document the incident, contributed to the severity of the penalty imposed. Graham Doyle, deputy commissioner of the CPD, emphasized the general consensus that passwords should never be stored in plain text given the high risk of misuse.

However, Matthew Pollard, Policy Communications Manager at Meta UK, told TechCrunch that the company took “immediate action” to correct the error once it was detected, and that there is no evidence that the compromised passwords were accessed or misused. Moreover, Pollard added that Meta proactively cooperated with the DPC throughout the investigation.

The US$101.5 million fine is one of the most severe penalties imposed on Meta under the GDPR, surpassing even the US$18.6 million fine levied in 2022 for a similar breach in 2018. However, despite the size of the penalty, it represents a small fraction of Meta's annual revenue, which reached US$134.90 billion in 2023, according to Metas annual revenue report . Under the GDPR, fines can reach up to 4% of the offending company's global annual turnover, which in Meta's case could translate to around US$5.39 billion.

The accumulation of EU sanctions against Meta in recent years highlights the challenges the company faces in complying with European privacy regulations. As the DPC and other European regulators continue to strengthen GDPR enforcement, large multinational technology companies see the possibility of facing increased scrutiny, opening up the possibility of harsher penalties for non-compliance.