Irish Data Protection Commission

The Irish DPC fined Meta for continuing to transfer EU users' personal data to US servers after the Schrems II ruling, exposing that data to potential US surveillance without adequate safeguards. It is the largest GDPR fine ever issued.

The Irish DPC fined TikTok for unlawfully transferring EU users' data to China without ensuring equivalent protection, and for related transparency failures.

The DPC found that Instagram business accounts publicly exposed children's phone numbers and email addresses by default.

The DPC found that Facebook (€210M) and Instagram (€180M) relied on a terms-of-service contract, rather than valid consent, to justify personalised advertising. The decision forced a change in how Meta seeks a legal basis for ads.

The Irish DPC found that TikTok set children's accounts to public by default and had weak age-assurance safeguards, exposing young users' content.

The Irish DPC found that LinkedIn, owned by Microsoft, processed members' personal data for behavioural advertising without a valid legal basis and without adequate transparency.

The DPC found that design failures allowed the scraping of roughly 533 million users' phone numbers and personal details, which were later leaked online.

The DPC found that WhatsApp failed to properly explain to users and non-users how their data was processed and shared with other Meta companies.

The DPC fined Meta over a series of twelve data breaches in 2018, finding it had failed to have appropriate technical and organisational measures in place.