Irish Data Protection Commission

The Irish DPC fined Meta for continuing to transfer EU users' personal data to US servers after the Schrems II ruling, exposing that data to potential US surveillance without adequate safeguards. It is the largest GDPR fine ever issued.

The Irish DPC fined TikTok for unlawfully transferring EU users' data to China without ensuring equivalent protection, and for related transparency failures.

The Irish DPC found that Google Ireland processed users' location data through Web & App Activity, Location History and Location Accuracy in breach of the GDPR between 25 May 2018 and 4 February 2020. The findings cover lawfulness and fairness, accountability, transparency, and keeping location data longer than necessary.

The DPC found that Instagram business accounts publicly exposed children's phone numbers and email addresses by default.

The DPC found that Facebook (€210M) and Instagram (€180M) relied on a terms-of-service contract, rather than valid consent, to justify personalised advertising. The decision forced a change in how Meta seeks a legal basis for ads.

The Irish DPC found that TikTok set children's accounts to public by default and had weak age-assurance safeguards, exposing young users' content.

The Irish DPC found that LinkedIn, owned by Microsoft, processed members' personal data for behavioural advertising without a valid legal basis and without adequate transparency.

The DPC found that design failures allowed the scraping of roughly 533 million users' phone numbers and personal details, which were later leaked online.

The Irish DPC found that a video upload feature, combined with Facebook's "View As" tool, generated access tokens that let attackers log in as other users. Between 14 and 28 September 2018 attackers exploited the flaw against about 29 million accounts worldwide, about 3 million of them in the EU and EEA. The DPC held that Meta had not built data protection into the design of its systems and had not fully notified or documented the breach.

The DPC found that WhatsApp failed to properly explain to users and non-users how their data was processed and shared with other Meta companies.

The Irish DPC found that Meta stored some users' social media passwords in plaintext on its internal systems, without encryption, and that it failed to notify and document the breach properly after reporting it in March 2019. The decision found infringements of Articles 5(1)(f), 32(1), 33(1) and 33(5) of the GDPR.

The DPC fined Meta over a series of twelve data breaches in 2018, finding it had failed to have appropriate technical and organisational measures in place.