Facebook Faces Investigation Over Data Breach

The Irish supervisory authority for the General Data Protection Regulation (GDPR) is set to launch an investigation into a data leak in which the personal information which included phone numbers and addresses of hundreds of millions of Facebook users were published online and had previously been looking into claims from Facebook that the data was old, from a previously reported leak in 2019. But it now says that there could have been a breach of data laws.

Facebook has reassured that it was “cooperating fully”, in a statement, the firm said the inquiry “relates to features that make it easier for people to find and connect with friends on our services”. It added: “These features are common to many apps and we look forward to explaining them and the protections we have put in place.” The Irish Data Protection Commission is a key one in such investigations as Facebook’s European Headquarters are in Dublin and firms found to be in breach of GDPR face fines of up to 4% of their annual global turnover.

‘Cause for concern’

The dataset of 533 million people from 106 countries was published on a hacking forum earlier this month, although the data had initially been scraped from Facebook some years earlier. The feature that was manipulated to access the data was changed in 2019 after Facebook became aware that it was being abused. Although not every piece of data was available for every user, the large scale of the leak was a cause for concern among privacy experts.

In a statement, the DPC said it had looked at the evidence and was “of the opinion that one or more provisions of the GDPR and/or the Data Protection Act may have been, and/or are being, infringed in relation to Facebook users’ personal data. Accordingly, the Commission considers it appropriate to determine whether Facebook Ireland has complied with its obligations, as data controller, in connection with the processing of personal data of its users.”