Turkish DPA Fined Facebook For A Second Time, For 256.222 EUR!

Turkish Data Protection Board ("Board") fined Facebook for 256.222 EUR with its decision of September 18, 2019.

The breach is due to a system deficit causing an attacker reaching profile data of a third party if the "View As" mode is used with a video uploader.

Several important points in the decision are below:

Board decided that;

• System weakness existed for 14 months, which shows that necessary tests and controls were not made.
• The intervention was late as the patch was made 2 days later and Facebook was disabled the "View As" feature 3 days later.
• The features should have been tested before opening it to the public. Insufficient tests are a breach of data security obligation (taking administrative and technical measures to avoid data breaches)