Ireland’s Data Protection Commission (DPC) has announced a €91 million fine against Meta Platforms Ireland Limited (MPIL) following an inquiry into the company’s handling of user passwords.

This decision marks a significant development in the enforcement of the General Data Protection Regulation (GDPR), highlighting the importance of secure data handling practices by major tech companies.

The inquiry, which began in April 2019, was initiated after MPIL reported that it had inadvertently stored certain users’ social media passwords in plaintext on its internal systems.

Plaintext storage means the passwords were not encrypted or protected using cryptographic measures, leaving them vulnerable to unauthorized access.

Although the incident was contained within Meta’s internal systems and no external parties gained access to the passwords, the company’s failure to ensure proper security led to a series of GDPR violations.

Findings and Violations

The DPC’s investigation concluded that MPIL had breached several key provisions of the GDPR:

Failure to Notify the DPC of the Breach: MPIL violated Article 33(1) of the GDPR by failing to promptly inform the DPC of the personal data breach concerning the storage of user passwords in plaintext.

Failure to Document the Breach: According to Article 33(5) GDPR, MPIL failed to properly document the breach, which is required to ensure transparency and accountability in data handling.

Inadequate Security Measures: MPIL violated Article 5(1)(f) and Article 32(1) of the GDPR by not implementing appropriate technical and organizational measures to secure user passwords, leaving them susceptible to unauthorized processing.

These violations underscore the company’s inadequate response to the risks posed by insecure password storage and its failure to meet the regulatory standards set by GDPR.

Decision and Penalties

On September 26, 2024, the DPC issued its final decision, which included both a reprimand and a €91 million fine.

The decision was reached after the draft was reviewed by Concerned Supervisory Authorities across the EU/EEA, as required under GDPR’s Article 60. No objections were raised, confirming the widespread support for the ruling.

Deputy Commissioner Graham Doyle emphasized the severity of the incident, noting that “user passwords should not be stored in plaintext, given the risk of abuse.”

He stressed that the sensitivity of these passwords, which allow access to personal social media accounts, made it crucial for companies to implement robust security measures.

Series of Fines

This is not the first time Meta is facing fines under GDPR. In 2023, the company was hit with a massive $1.3 billion penalty for breaching EU data privacy regulations.

Additionally, in 2022, Meta was fined $276 million following a 2021 data breach that compromised the personal information of over 533 million users.

^{Nigeria Deposit Insurance Corporation (NDIC) has announced the adoption of the Nigeria Inter-Bank Settlement System (NIBSS) for payment of insured depositors of the defunct Heritage Bank, citing limitations of the Remita payment platform.}

^{NDIC disclosed this through Pamela Roberts,  its deputy director at the Enugu Zonal Office at the workshop for business editors and members of the Finance Correspondents Association of Nigeria (FICAN) in Lagos.}

^{She said the NDIC relied on Remita for payments since 2013, adding that the platform is having challenges handling large-scale payments.}

^{Roberts said, “The Corporation had used Remita to effect payments from 2013 which had a few limitations in terms of uploading of payments, validity of account name and number etc.}

^{“During the insured payments of Heritage Bank, the Corporation explored the option of using the NIBSS payment platform to facilitate larger number of payments at one time.”}

^{Recall that following the revocation of Heritage Bank’s banking license by the Central Bank of Nigeria (CBN) on June 3, 2024, the NDIC was appointed as liquidator and the Corporation, in accordance with Section 12(2) of BOFIA 2020 and Section 55 subsections 1 & 2 of the NDIC Act 2023.}

^{The corporation said in discharge of its deposit guarantee mandate, it began the payment of the insured deposits of N5m maximum per depositor within a record time of four (4) days of the bank closure.}

^{NDIC had said, “This was achieved using Bank Verification Numbers (BVN) as a unique identifier to locate depositors’ alternate accounts in other banks.}

^{“However, depositors with balances exceeding Five Million Naira have been paid the initial insured sum of FN5m, while the remaining balances (classified as uninsured deposits) will be paid as liquidation dividends upon realization of the defunct bank’s assets and recovery of debts owed to the defunct bank.}

^{“This unprecedented achievement of direct payment through BVN-linked alternate accounts without the need for depositors to visit NDIC offices or fill out forms, marks a historic shift for the NDIC in the prompt reimbursement of depositors with payment of about 82.36 per cent of the total insured deposit to date.”}

National Broadcasting Commission (NBC), did not withdraw the license of EBS TV, Edo state’s broadcasting television, according to Crusoe Osagie, special adviser to governor Godwin Obaseki on Media Projects.

Godwin Obaseki

Osagie, in a statement urged the public to disregard the false claims describing it as the handiwork of mischief-makers

He explained that against claims that the license of EBS has been withdrawn over statutory failures, the Channel 55 under which the station operates on falls within the 700 megahertz band that is being repurposed by the federal government following an international treaty established by the International Telecommunications Union in 2015, of which Nigeria is signatory.

He disclosed that the NBC has, however, reassigned a new Channel 45 to Edo Broadcasting Service TV, while plans are in progress for the compensation for EBS by the NBC.

Osagie revealed that letters were written to the Broadcasting Stations within the band to inform them of the developments, notify them of new channels to relocate to, and provide their compensation needs for payment.

Affected Broadcasting stations were negotiated with beginning from around 2020 and 2021.

On the issue of licence fee, the Special Adviser said the Station was heavily indebted for over a decade, before Governor Obaseki came into office, adding that in June, 2022, the Governor approved and began to clear EBS indebtedness to the regulatory authorities.