Meta fined €265m over data protection breach that hit more than 500m users

The Data Protection Commission (DPC) said Meta had infringed two articles of the EU's data protection laws after details of Facebook users from around the world were scraped from public profiles in 2018 and 2019.

The data appeared on a hacking website last year, prompting an investigation by the DPC, which is responsible for regulating Meta across the EU. The watchdog said a "significant" number of the users were from the EU.

In addition to the fine, it "imposed a reprimand and an order" requiring Meta to "bring its processing into compliance by taking a range of specified remedial actions within a particular timeframe".

In a statement Meta said: "We made changes to our systems during the time in question, including removing the ability to scrape our features in this way using phone numbers. Unauthorised data scraping is unacceptable and against our rules."

However, one legal expert questioned whether strong enforcement of the EU's General Data Protection Regulation would have the deterrent effect that it intended.

"By any measure, these are significant fines," said David Hackett, head of data protection in the Ireland office of law firm Addleshaw Goddard. "GDPR envisaged the imposition of such fines in part to serve as a deterrent to other companies which might consider breaching the law. We are likely to see increased debate about whether such fines actually influence corporate behaviour or if some companies simply see them as an added cost of doing business."

The DPC regulates Apple, Google, TikTok and other technology platforms owing to the location of their EU headquarters in Ireland. It currently has 40 inquiries open into such companies, including 13 involving Meta.

The Irish regulator said in a statement that other relevant EU regulators agreed with the decision issued on Monday after it shared a draft ruling with them last month under the bloc's "one-stop shop" system of regulating large multinationals.