Facebook faces legal action over breach of Irish data

FACEBOOK is facing legal action over data breaches affecting more than 1.5million Irish users.

Digital Rights Ireland (DRI) has already made a complaint to the Data Protection Commission (DPC) and is now preparing to take a mass action case on behalf of individuals impacted by the breach.

It emerged earlier this month that the personal details – including the names, phone numbers and email addresses – of more than half a billion Facebook users had been scraped and posted online.

The DPC said the dataset was largely composed of data lifted from public profiles prior to the implementation of the GDPR, and combined with additional records that could be from a later period.

The DPC also criticised Facebook for failing to proactively communicate with the regulator as it attempted to establish the facts of the breach when it became public knowledge. Facebook later informed the DPC that the dataset dates back to 2018 or 2019, that it potentially stems from multiple sources, and that it had been collated by third party.

The tech giant – the CEO of which is Mark Zuckerberg, pictured – has since said it believes the ‘specific issue’ that allowed fraudsters to lift the data no longer exists as it had updated its contact importer feature.

Facebook said malicious actors had previously been able to upload large sets of phone numbers using said feature to see which ones were matched to Facebook accounts. DRI has accused Facebook of failing to implement strong enough privacy protections and breaking GDPR by failing to notify the DPC and users affected by the leak when it occurred. The group will pursue a mass action through the Irish courts, whereby a large number of people will be represented in a single complaint, with similar facts and laws applying to all of their situations. It said that awards in comparable cases in other jurisdictions had varied ‘between €300 and €12,000 for breach of one person’s rights’. ‘The scale of this breach, and the depth of personal information compromised, is gobsmacking. Those impacted deserve action and Facebook’s handling of this breach has been entirely inadequate,’ DRI director Antoin Ó Lachtnain said. He added: ‘This will be the first mass action of its kind but we’re sure it won’t be the last.

‘The laws are there to protect consumers and their personal data, and it’s time these technology giants wake up to the reality that protection of personal data must be taken seriously.’ Facebook has been contacted for comment.

Senator Mary Seery-Kearney, Seanad spokesperson on privacy rights, said the possibility of a successful class action, on top of a possible fine, would be very effective in reminding companies of their responsibilities in relation to personal data. The Fine Gael senator said: ‘There are questions to be answered by Facebook. Did they file a data processing impact assessment in relation to the feature they introduced on the platform that lead to the breach? Did the assessment not anticipate a third party utilising it for nefarious purposes?’