The Irish Data Protection Commission (DPC) has launched an inquiry into an alleged Facebook data leak that affected an estimated 533 million users worldwide.
Due to Facebook’s European headquarters being based in Dublin, the Irish regulator is to investigate whether the tech giant had complied with its data controller responsibilities when processing the personal data of its users.
In a statement, the DPC shared that it “is of the opinion that one or more provisions of the GDPR and/or the Data Protection Act 2018 may have been, and/or are being, infringed in relation to Facebook Users’ personal data”, based on “information provided by Facebook Ireland”.
Last week, the regulator stated that, of the 533 million individuals caught up in the leak, a “significant number” are EU users, adding that much of the data appears to have been scraped some time ago from public Facebook profiles.
Facebook released a statement saying that the leaked data wasn’t obtained through hacking Facebook’s systems, but by “malicious actors” scraping it from the tech giant’s platform “prior to September 2019”. The company added that it is “confident that the specific issue that allowed them to scrape this data in 2019 no longer exists”.
The datasets, which were reportedly published in 2019 and 2018, are thought to have originated through a large-scale scraping of the social media giant’s website which reportedly occurred between June 2017 and April 2018. The timeline is important, as given that GDPR came into effect on 25 May 2018, if Facebook is able to show that this scraping had occurred before this date then any potential regulatory action would be subject to sanctions set out under the Data Protection Directive - which effectively devolved this responsibility to member states.
Simply put, if found to have breached data protection rules in any way, Facebook could avoid having to pay a substantial penalty under GDPR, which could be as high as 4% of the tech giant’s annual turnover.
Commenting on the Irish DPC’s decision to launch an inquiry into the leak, a Facebook spokesperson said that the company was “co-operating fully”, adding that the investigation “relates to features that make it easier for people to find and connect with friends on our services”.
“These features are common to many apps and we look forward to explaining them and the protections we have put in place,” the spokesperson added.
-
India’s new data protection bill continues to “facilitate state surveillance”News Although data localisation requirements have now been removed, it’s down to the Indian government to select which countries data is allowed to be sent to
-
LinkedIn denies data breach that reportedly exposed 700 million user recordsNews Report claims 'breach' led to profiles belonging to 92% of LinkedIn users being put up for sale on a popular hacker forum
-
Privacy campaigners rally against "illegal" Clearview AI data scrapingNews The notorious facial recognition firm claims to have a database of more than three billion images scraped from social media sites
-
Germany bans Facebook from using WhatsApp data over GDPR concernsNews Hamburg's data protection commissioner issues three-month ban days before the app's new privacy policy rolls out
-
Facebook faces 'mass action' lawsuit over data breachNews Digital Rights Ireland is urging European Facebook users who have been affected to sign up
-
EU might force tech giants to share data with smaller rivalsNews The Digital Services Act draft also suggests that firms may be banned from giving their own services preferential treatment
-
Irish data watchdog orders Facebook to halt EU user data transfers to the USNews Nick Clegg suggests cancelling its transfer mechanism could cause chaos for businesses and the global economy
-
What is the Data Protection Act 1998?In-depth Although data protection regulations have been updated, businesses may still find themselves sanctioned under the Data Protection Act 1998
