Meta Platforms (META, Financial) has been fined €91 million ($102 million) by the Irish Data Protection Commission (DPC) following an investigation into password storage practices at its Irish subsidiary. The probe began in April 2019 after Meta reported inadvertently storing some social media users' passwords in "plain text" without encryption.
This fine supplements a €1.2 billion ($1.3 billion) penalty imposed by the European Union last year for transferring user data to the U.S.
The DPC's latest decision identified four GDPR violations, including personal data breaches and inadequate password security. A Facebook spokesperson noted that the issue was discovered during a 2019 security review and promptly fixed, with no evidence of misuse or improper access to the passwords. Meta reported the issue to the DPC and engaged constructively throughout the investigation.
DPC Deputy Commissioner Graham Doyle emphasized the risk of storing user passwords in plain text and stated that the full formal decision, along with further investigation details, will be published in due course.
