EU Fines Meta 91 Million Euros Over Password Storage Violations

The European Union has taken a significant step in enforcing data protection regulations by imposing a hefty fine on Meta, the parent company of Facebook and Instagram. On Friday, the lead EU privacy regulator announced that Meta would be fined 91 million euros, which is approximately 101.5 million dollars. This fine stems from a serious issue regarding the way Meta stored user passwords, which were kept without proper protection or encryption.

This investigation began five years ago when Meta informed Ireland’s Data Protection Commission (DPC) that it had stored some user passwords in "plaintext." Storing passwords in plaintext means that they were kept in a readable format, making them vulnerable to unauthorized access. The DPC, which oversees data protection for many major U.S. internet companies operating in Europe, emphasized the importance of safeguarding user passwords. Graham Doyle, the Deputy Commissioner of the DPC, stated, "It is widely accepted that user passwords should not be stored in plaintext, considering the risks of abuse that arise from persons accessing such data." This highlights the critical need for companies to implement robust security measures to protect user information.

In response to the incident, a spokesperson for Meta indicated that the company took immediate action to rectify the error once it was discovered during a security review in 2019. They assured the public that there is no evidence suggesting that the exposed passwords were misused or accessed improperly. Furthermore, the spokesperson noted that Meta had cooperated fully with the DPC throughout the inquiry process, demonstrating a commitment to transparency and accountability.

It is important to note that this fine is not an isolated incident. Since the introduction of the General Data Protection Regulation (GDPR) in 2018, the DPC has imposed a total of 2.5 billion euros in fines on Meta for various breaches. This includes a record fine of 1.2 billion euros in 2023, which Meta is currently appealing. Such actions reflect the EU's stringent approach to data protection and its determination to hold companies accountable for their handling of personal information.

As we navigate an increasingly digital world, the importance of data privacy cannot be overstated. Users must remain vigilant about how their information is stored and protected by companies. This incident serves as a reminder that even the largest tech giants are not immune to scrutiny and must prioritize the security of their users' data. In the end, it is the responsibility of both companies and users to foster a safer online environment.