The EU privacy regulator fined Meta 91 million euros for storing passwords

The European Union’s top privacy regulator fined social media giant Meta 91 million euros ($101.5 million) on Friday for inadvertently storing some users’ passwords without protection or encryption.

The investigation was launched five years ago after Meta informed the Irish Data Protection Commission (DPC) that it had stored some passwords in ‘plaintext’. At the time, Meta publicly acknowledged the incident, and the DPC said the passwords were not accessible to outside parties.

“It is generally accepted that user passwords should not be stored in clear text, given the risks of misuse arising from individuals accessing such data,” Irish DPC Deputy Commissioner Graham Doyle said in a statement.

A Meta spokesperson said the company took immediate steps to correct the error after identifying it during a 2019 security review, and that there was no evidence that passwords had been misused or improperly accessed.

Meta cooperated constructively with the DPC throughout the investigation, the spokesman added in a statement on Friday.

The DPC is the lead EU regulator for most of the leading US Internet companies due to the location of their EU operations in the country.

It has so far fined Meta a total of €2.5 billion for breaches of the General Data Protection Regulation (GDPR), introduced in 2018, including a record fine of €1.2 billion in 2023 that Meta appealed.

© Thomson Reuters 2024

(This story was not edited by NDTV staff and was automatically generated from a syndicated feed.)