Wie die Irische Datenschutzbehörde in einer aktuellen Pressemitteilung erklärt, hat sie gegen das Social Media-Netzwerk Meta eine DSGVO-Geldbuße von 91 Mio. EUR verhängt, da teilweise User-Passwörter nicht verschlüsselt gespeichert worden waren.
Im Jahr 2019 meldete Meta Ireland der Irischen Datenschutzbehörde, dass es Passwörter von Nutzern ohne Verschlüsselung im Klartext gespeichert hatte.
Die Behörde verhängte ein Bußgeld iHv. rund 91 MIo. EUR, da Meta Vorgaben der DSGVO verletzt habe. da es versäumte, geeignete Sicherheitsmaßnahmen zu implementieren und die Datenschutzbehörde über den Vorfall rechtzeitig zu informieren:
"This inquiry was launched in April 2019, after MPIL notified the DPC that it had inadvertently stored certain passwords of social media users in ‘plaintext’ on its internal systems (i.e. without cryptographic protection or encryption).
The DPC submitted a draft decision to the other Concerned Supervisory Authorities across the EU/EEA in June 2024, as required under Article 60 of the GDPR. No objections to the draft decision were raised by the other authorities.
The decision, which was made by the Commissioners for Data Protection, Dr. Des Hogan and Dale Sunderland, and notified to MPIL yesterday September 26, includes a reprimand and a fine of €91million.
The DPC’s Decision records the following findings of infringement of the GDPR:
Article 33(1) GDPR, as MPIL failed to notify the DPC of a personal data breach concerning storage of user passwords in plaintext;
Article 33(5) GDPR, as MPIL failed to document personal data breaches concerning the storage of user passwords in plaintext;
Article 5(1)(f) GDPR, as MPIL did not use appropriate technical or organisational measures to ensure appropriate security of users’ passwords against unauthorised processing; and
Article 32(1) GDPR, because MPIL did not implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the ability to ensure the ongoing confidentiality of user passwords."
Die Entscheidung ist nicht rechtskräftig.