DPC Adopts Broad Interpretation of Definition of "Personal Data Breach"

The Irish Data Protection Commission ("DPC") recently imposed a €91 million fineOpens in new window on Meta Platforms Ireland Limited ("MPIL"), having found that it violated a number of provisions of the GDPR.

The decision is noteworthy, as the DPC adopted a broad interpretation of what constitutes a "personal data breach" under Article 4(12) GDPR. In particular, the DPC found that MPIL's inadvertent storage of user passwords in plaintext on its internal systems constituted a "personal data breach", in circumstances where such storage was in breach of MPIL's internal security policies (which require such passwords to be stored in encrypted format), and the plaintext passwords could have been accessed by MPIL employees. This essentially means that a breach of security, combined with potential access to personal data by unauthorised employees, may constitute a "personal data breach" under the GDPR. The DPC's decision is being appealed by MPIL, on the grounds, inter