The Irish regulator has now fined Meta over €2bn in recent years
Meta CEO Mark Zuckerberg
Ireland’s data protection commissioner (DPC) has fined Meta €91m for storing passwords in plain text.
The case dates back to 2019, when Meta notified the Irish regulator that it had “inadvertently” stored certain passwords of social media users in plain text on its internal systems without cryptographic protection or encryption.
“It is widely accepted that user passwords should not be stored in plaintext, considering the risks of abuse that arise from persons accessing such data,” said Graham Doyle, deputy commissioner at the DPC.
“It must be borne in mind that the passwords [which were] the subject of consideration in this case are particularly sensitive, as they would enable access to users’ social media accounts.”
Today’s penalty brings the amount Meta has been fined by Ireland’s privacy watchdog to over €2bn.
The DPC said that its decision is for a number of breaches of GDPR law. This, it said, includes article 33(1) of the GDPR as Meta “failed to notify the DPC of a personal data breach concerning storage of user passwords in plain text”. It also includes article 33(5) of GDPR, as Meta “failed to document personal data breaches concerning the storage of user passwords in plain text.” And it includes article 5(1)(f) of GDPR, as Meta “did not use appropriate technical or organisational measures to ensure appropriate security of users’ passwords against unauthorised processing”. It also included article 32(1) of GDPR, because Meta “did not implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the ability to ensure the ongoing confidentiality of user passwords”.
