Facebook Hit With $18.6 Million GDPR Fine Over 12 Data Breaches in 2018

The Irish Data Protection Commission (DPC) on Tuesday slapped
Facebook and WhatsApp owner Meta Platforms a fine of €17 million
(~$18.6 million) for a series of security lapses that occurred in
violation of the European Union’s GDPR laws^[1]
in the region.

“The DPC found that Meta Platforms failed to have in place
appropriate technical and organizational measures which would
enable it to readily demonstrate the security measures that it
implemented in practice to protect EU users’ data, in the context
of the twelve personal data breaches,” the watchdog said^[2]
in a press release.

The decision follows the regulator’s investigation into 12
data^[3]
breach^[4]
notifications^[5]
it received over the course of a six-month period between June 7
and December 4, 2018.

“This fine is about record keeping practices from 2018 that we
have since updated, not a failure to protect people’s information,”
Meta said^[6]
in a statement shared with the Associated Press. “We take our
obligations under the GDPR seriously, and will carefully consider
this decision as our processes continue to evolve.”

The development follows a similar penalty^[7]
the DPC imposed on WhatsApp, fining the messaging service €225
million in September 2021 for failing to meet its GDPR transparency
obligations. Following the ruling, WhatsApp tweaked^[8]
its privacy policy with regards to how it handles European users’
data and shares that information with its parent, Meta.

Around the same time, the Luxembourg National Commission for
Data Protection (CNPD) also hit Amazon with an $886.6 million fine^[9]
in July 2021 for non-compliance with data-processing laws. Then
earlier this year, France fined^[10] both Meta and Google
for violating E.U. privacy rules by failing to provide users with
an easy option to reject cookie tracking technology.