On November 25, 2022, Ireland’s Data Protection Commission (“DPC”) released a decision fining Meta Platforms, Inc. (“Meta”) €265 million for a 2019 data leak involving the personal information of approximately 533 million Facebook users worldwide.

In the decision, the DPC argued that Meta failed to comply with the GDPR’s requirement of providing privacy “by design and default” when it failed to prevent the disclosure of users’ phone numbers, email addresses, full names, dates of birth and other personal information on an online hacking forum. The leak was a result of a hacking group exploiting a weakness in Facebook’s data processing measures to scrape public profiles and connect user profiles with email addresses.

In September, the DPC fined Meta €405 million for allowing minors to operate business accounts on Instagram, which led to the disclosure of affected users’ contact information. Meta says it plans to appeal both of the DPC’s decisions.