Irish Data Protection Commission Fines Meta €251 Million

The Irish Data Protection Commission (“DPC”) announced its final decisions on 17 December 2024, following two inquiries into Meta Platforms Ireland Limited (“MPIL”).

This data breach affected approximately 29 million Facebook accounts worldwide of which approximately 3 million were located within the borders of the EU/EEA (“European Economic Area”).

The categories of personal data affected include the user's full name, email address, phone number, location, place of work, date of birth, religion, gender, posts on the timeline and personal data related to children.

The DPC’s final decisions are as follows:

MPIL was reprimanded and fined €8 million for failing to provide the necessary information in its data breach notification.
MPIL was reprimanded and fined €3 million for failing to document the breaches properly and for not enabling the Supervisory Authority to verify compliance.
MPIL was reprimanded and fined €130 million for failing to uphold data protection principles in the design of its processing systems.
MPIL was reprimanded and fined €110 million for failing to ensure that, by default, only personal data necessary for specific purposes were processed.

You can access the full text of the DPC’s final decisions here.

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr