Data Protection Commission Fines Meta €91 Million

The Data Protection Commission (DPC) inquiry into Meta Platforms Ireland Limited (Meta), which commenced in April 2019 has now been concluded. The DPC announced its final decision to impose an administrative fine of €91 million on Meta on 27 September 2024.

The decision follows an investigation by the DPC in respect of the storage of certain passwords of social media users in 'plaintext' on Meta internal systems, without any cryptographic protection or encryption. The fine represents the latest in a series of fines levied on Meta over the last number of years for infringements of the GDPR: In May 2023, Meta was fined €1.2 billion for mishandling the personal data of users when transferring data between Europe and the United States, the largest fine ever imposed under the GDPR. In September 2022, the DPC issued a €405 million fine on Meta concerning the unlawful processing of children's personal data.