Facebook is facing a GDPR probe over massive data leak

Millions of users had their data exposed in a Facebook data leak earlier this year.

What you need to know

• Facebook is facing an investigation in Ireland over a recently publicized data leak.
• The Irish DPC believes that Facebook has broken one or more provisions of the General Data Protection Regulations.
• Facebook has confirmed it has spoken to investigators regarding the issues raised.

Facebook recently suffered a large data leak where a cache of data, initially breached five years ago, was now made publicly available. This cache included “phone numbers, Facebook IDs, full names, locations, birthdates, bios, and, in some cases, email addresses.” Facebook came under fire for declining to notify affected customers about the breach, and now Ireland’s Data Protection Commission, or DPC, is stepping in to investigate Faceook over potential GDPR breaches.

The DPC shared the following statement this afternoon, saying:

The Data Protection Commission (DPC) today launched an own-volition inquiry pursuant to section 110 of the Data Protection Act 2018 in relation to multiple international media reports, which highlighted that a collated dataset of Facebook user personal data had been made available on the internet. This dataset was reported to contain personal data relating to approximately 533 million Facebook users worldwide. The DPC engaged with Facebook Ireland in relation to this reported issue, raising queries in relation to GDPR compliance to which Facebook Ireland furnished a number of responses.

The DPC also says that it believes Facebook has broken one or more provisions of the GDPR and wants to look into “whether Facebook Ireland has complied with its obligations, as data controller, in connection with the processing of personal data of its users.”

Facebook has confirmed to TechCrunch that it remains in contact with investigators.

At the same time, EU Commissioner for Justice, Didier Reynders, weighed in on Twitter, saying:

Today I spoke with Helen Dixon [from the Data Protection Commission] about the [Facebook Leak]. The Commission continues to follow this case closely and is committed to supporting national authorities. We also call on [Facebook] to cooperate actively and swiftly to shed light on the identified issues.