Meta Platforms Ireland Limited

DPC (Ireland) case IN-19-4-1, decided 2024-09-26. EUR 91,000,000.

What the regulator decided

Meta inadvertently stored the passwords of "hundreds of millions" of Facebook users in plaintext on internal systems, breaching Articles 5(1)(f) and 32(1) GDPR for failing to ensure appropriate security of processing; and failed to notify the personal data breach within 72 hours and to document it adequately, breaching Articles 33(1) and 33(5) GDPR.

Primary source

Regulator-owned URL. Quote this in legal briefs and academic citations.

https://www.dataprotection.ie/sites/default/files/uploads/2024-12/Meta-Final-Decision-IN-19-4-1-Redacted.pdf

Archived snapshot

Wayback Machine snapshot of the primary source. Use this when the regulator URL might be refactored or expire.

https://web.archive.org/web/20250519055655/https://www.dataprotection.ie/sites/default/files/uploads/2024-12/Meta-Final-Decision-IN-19-4-1-Redacted.pdf

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

Composite fine: EUR 8M (Art 33(1)) + EUR 8M (Art 33(5)) + EUR 75M (Art 5(1)(f) and 32(1)). The decision turns on the security of processing principle rather than on any external access to the passwords - relevant when arguing that an internal-only data flow still triggers Article 32 obligations.

Verification trail

Verified by: donal
Verified at: 2026-05-27
Review due: 2026-11-27

Cite this case

Pick the format that matches where you are pasting. The methodology version is preserved in every variant so the citation stays verifiable after future methodology changes.

BibTeX

@misc{consentmark-precedent-dpc-in-19-4-1,
  author       = {{ConsentMark}},
  year         = {2024},
  title        = {DPC (Ireland) IN-19-4-1 - Meta Platforms Ireland Limited},
  howpublished = {\url{https://www.consentmark.com/precedent/dpc-in-19-4-1}},
  note         = {ConsentMark methodology v1.3}
}

APA

ConsentMark. (2024, September 26). DPC (Ireland) IN-19-4-1 - Meta Platforms Ireland Limited. Methodology v1.3. https://www.consentmark.com/precedent/dpc-in-19-4-1

Markdown

[DPC (Ireland) IN-19-4-1 - Meta Platforms Ireland Limited - ConsentMark](https://www.consentmark.com/precedent/dpc-in-19-4-1)

Plain text

DPC (Ireland) IN-19-4-1 - Meta Platforms Ireland Limited - ConsentMark, 2024-09-26, methodology v1.3, https://www.consentmark.com/precedent/dpc-in-19-4-1