Irish data authority probes Facebook over breach of 50M accounts
DUBLIN, Ireland – Ireland's data protection authority launched an investigation into Facebook Wednesday, bringing stringent new European privacy laws to bear on the tech titan after a security breach exposed 50 million accounts.
The move comes after the social media firm admitted to the data breach in a blog post last Friday, saying attackers exploited a vulnerability in the website's code in September in a way that could have given them access to people's accounts.
"The Irish Data Protection Commission (DPC) has today, 3 October 2018, commenced an investigation... into the Facebook data breach," a DPC spokesman said in a statement. (READ: What we know: Facebook's September 2018 security breach)
"In particular, the investigation will examine Facebook's compliance with its obligation under the General Data Protection Regulation (GDPR) to implement appropriate technical and organizational measures to ensure the security and safeguarding of the personal data it processes."
The Irish probe has been touted as the first major test of the reformed European regulation which came into effect in May.
GDPR gives regulators sweeping powers to sanction organizations which fail to adhere to heightened standards of security when processing personal data.
Firms can be fined up to 4% of annual global turnover if they fail to abide by the rules – meaning Facebook faces a theoretical fine of 1.4 billion euros ($1.6 billion), based on its 2017 annual revenue of 35.2 billion euros ($40.6 billion). (READ: Facebook may get $1.63 billion fine in EU due to recent hack)
But on Tuesday the EU's top data privacy official said the social media giant was unlikely to face the maximum penalty because it had adhered to rules requiring notification of the data breach within 72 hours.
This "is one of the factors which might result in lower sanctions", EU Justice and Consumer Affairs Commissioner Vera Jourova told AFP in Luxembourg.
"But this is only theoretical", she added.
"We have been in close contact with the Irish Data Protection Commission since we have become aware of the security attack and will continue to cooperate with their investigation," Facebook said in a statement. (READ: 50M Facebook users hacked? ‘Tip of the iceberg’ – expert)
In its post on Friday Facebook said the data breach happened on September 25.
"This allowed them to steal Facebook access tokens which they could then use to take over people's accounts," VP of Product Management Guy Rosen wrote.
"We have yet to determine whether these accounts were misused or any information accessed. We also don't know who's behind these attacks or where they're based."
On Monday, Ireland's DPC said staff believe that of the total profiles potentially impacted, less than 10% are EU accounts. (READ: What to do after the massive Facebook hack)
Facebook – which has established its international headquarters in Ireland – is already suffering from a tainted reputation on data security following the Cambridge Analytica (CA) scandal.
In that case, tens of millions of users had their personal data hijacked by CA, a political firm working for Donald Trump in 2016. – Rappler.com