The Irish Data Protection Commission (DPC) has launched an inquiry into an alleged Facebook data leak that affected an estimated 533 million users worldwide.
Due to Facebook’s European headquarters being based in Dublin, the Irish regulator is to investigate whether the tech giant had complied with its data controller responsibilities when processing the personal data of its users.
In a statement, the DPC shared that it “is of the opinion that one or more provisions of the GDPR and/or the Data Protection Act 2018 may have been, and/or are being, infringed in relation to Facebook Users’ personal data”, based on “information provided by Facebook Ireland”.
Last week, the regulator stated that, of the 533 million individuals caught up in the leak, a “significant number” are EU users, adding that much of the data appears to have been scraped some time ago from public Facebook profiles.
Facebook released a statement saying that the leaked data wasn’t obtained through hacking Facebook’s systems, but by “malicious actors” scraping it from the tech giant’s platform “prior to September 2019”. The company added that it is “confident that the specific issue that allowed them to scrape this data in 2019 no longer exists”.
The datasets, which were reportedly published in 2019 and 2018, are thought to have originated through a large-scale scraping of the social media giant’s website which reportedly occurred between June 2017 and April 2018. The timeline is important, as given that GDPR came into effect on 25 May 2018, if Facebook is able to show that this scraping had occurred before this date then any potential regulatory action would be subject to sanctions set out under the Data Protection Directive - which effectively devolved this responsibility to member states.
Simply put, if found to have breached data protection rules in any way, Facebook could avoid having to pay a substantial penalty under GDPR, which could be as high as 4% of the tech giant’s annual turnover.
Commenting on the Irish DPC’s decision to launch an inquiry into the leak, a Facebook spokesperson said that the company was “co-operating fully”, adding that the investigation “relates to features that make it easier for people to find and connect with friends on our services”.
“These features are common to many apps and we look forward to explaining them and the protections we have put in place,” the spokesperson added.
