Rulings represent 'existential threat' to Facebook parent Meta, says expert

Meta offices in Dublin. The social media giant has been fined €265m and ordered to take 'remedial action'. Picture: Leah Farrell / RollingNews.ie

A series of rulings against Facebook parent company Meta represent an “existential” threat to the tech giant, according to an Irish data protection expert.

The Data Protection Commission has fined Meta €265m and ordered it to take “remedial action” in order to bring its data processing in line with the EU’s General Data Protection Regulation.

That fine follows similar large-scale penalties handed out to Meta companies Instagram and WhatsApp over the past 14 months, bringing the total monies demanded of the company by the DPC in that time to €912m.

The latest fine concerned an incident of “data scraping” which saw the personal details of 533m Facebook users from across the globe leaked onto the internet.

Meta had initially told the DPC that the leaked dataset involved information dating from prior to the introduction of GDPR, which went live in May of 2018.

However, upon further investigation, the DPC discovered that much of the leaked information dated from 2019.

Data protection expert Daragh O’Brien of consultants Castlebridge said that the actions demanded of Meta, as opposed to the financial penalties, represent “an existential threat” to the company as “they go to the fundamentals of how they operate”.

While the DPC has followed its own precedent and not yet published its decision in full — with that publication understood to be slated for next week — Mr O’Brien said that “any large-scale remedial action will involve changes in work practices”. 

The way things are done has to change,” he said.

Meta 'reviewing decision'

A Meta spokesperson said the company had “made changes to our systems during the time in question, including removing the ability to scrape our features in this way using phone numbers”.

The spokesperson declined to state whether or not Meta will appeal the DPC’s decision, as it has done in both the WhatsApp and Instagram cases, but said merely that “we are reviewing this decision carefully”.

Mr O’Brien, however, said he is of the opinion that an appeal is “inevitable”.

Johnny Ryan, senior fellow with the Irish Council for Civil Liberties, has bemoaned the fact the DPC opted not to publish its decision in full, saying: “Until we see the detail, we can’t really say anything”.

What happens is you get a release from the DPC, then weeks or months later get something further,” he said.

“We don’t know yet what the result is from the European Data Protection Board.”

Austrian data protection campaigner Max Schrems, who himself had been involved in a near-decade-long legal wrangle with both the DPC and Facebook, tweeted his approval of the Commission’s decision, saying: “€265m is a good start”.

The decision to fine and reprimand Meta Platforms Ireland Limited — the company’s Irish entity — was formally adopted last Friday following consultation with the EU’s various national data protection regulators, the DPC said.

“Those supervisory authorities agreed with the decision of the DPC,” a spokesperson for the Commission said.

Meta faces at least three further investigations into its platforms by the DPC at present — one apiece into Facebook, Instagram, and WhatsApp.