Irish data watchdog to investigate Facebook data leak

The regulator believes that Facebook may have infringed ‘one or more’ GDPR provisions following apparent leak of 533 million user records

The Irish Data Protection Commission (DPC) has launched an inquiry into an alleged Facebook data leak that affected an estimated 533 million users worldwide.

Due to Facebook’s European headquarters being based in Dublin, the Irish regulator is to investigate whether the tech giant had complied with its data controller responsibilities when processing the personal data of its users.

In a statement, the DPC shared that it “is of the opinion that one or more provisions of the GDPR and/or the Data Protection Act 2018 may have been, and/or are being, infringed in relation to Facebook Users’ personal data”, based on “information provided by Facebook Ireland”.

Last week, the regulator stated that, of the 533 million individuals caught up in the leak, a “significant number” are EU users, adding that much of the data appears to have been scraped some time ago from public Facebook profiles.

Facebook released a statement saying that the leaked data wasn’t obtained through hacking Facebook’s systems, but by “malicious actors” scraping it from the tech giant’s platform “prior to September 2019”. The company added that it is “confident that the specific issue that allowed them to scrape this data in 2019 no longer exists”.

The datasets, which were reportedly published in 2019 and 2018, are thought to have originated through a large-scale scraping of the social media giant’s website which reportedly occurred between June 2017 and April 2018. The timeline is important, as given that GDPR came into effect on 25 May 2018, if Facebook is able to show that this scraping had occurred before this date then any potential regulatory action would be subject to sanctions set out under the Data Protection Directive - which effectively devolved this responsibility to member states.

Simply put, if found to have breached data protection rules in any way, Facebook could avoid having to pay a substantial penalty under GDPR, which could be as high as 4% of the tech giant’s annual turnover.

Commenting on the Irish DPC’s decision to launch an inquiry into the leak, a Facebook spokesperson said that the company was “co-operating fully”, adding that the investigation “relates to features that make it easier for people to find and connect with friends on our services”.

“These features are common to many apps and we look forward to explaining them and the protections we have put in place,” the spokesperson added.

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Recommended

Senator wants social media companies held liable for spreading anti-vax lies
social media

Senator wants social media companies held liable for spreading anti-vax lies

23 Jul 2021

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Windows 11 has problems with Oracle VirtualBox
Microsoft Windows

Windows 11 has problems with Oracle VirtualBox

5 Oct 2021
What is cyber warfare?
Security

What is cyber warfare?

15 Oct 2021