{"id":23867,"date":"2021-04-15T05:13:19","date_gmt":"2021-04-15T05:13:19","guid":{"rendered":"https:\/\/rbsitsoftwaresolution.com\/blog\/ireland-opens-gdpr-investigation-into-facebook-leak.html"},"modified":"2021-04-15T05:13:19","modified_gmt":"2021-04-15T05:13:19","slug":"ireland-opens-gdpr-investigation-into-facebook-leak","status":"publish","type":"post","link":"https:\/\/www.rbsitsoftwaresolution.in\/blog\/ireland-opens-gdpr-investigation-into-facebook-leak.html","title":{"rendered":"Ireland opens GDPR investigation into Facebook leak"},"content":{"rendered":"

Facebook\u2019s lead data supervisor in the European Union has opened an investigation into whether the tech giant violated data protection rules vis-a-vis the leak of data reported earlier this month<\/a>.<\/p>\n

Here\u2019s the Irish Data Protection Commission\u2019s statement:<\/p>\n

\n

\u201cThe Data Protection Commission (DPC) today launched an own-volition inquiry pursuant to section 110 of the Data Protection Act 2018 in relation to multiple international media reports, which highlighted that a collated dataset of Facebook user personal data had been made available on the internet. This dataset was reported to contain personal data relating to approximately 533 million Facebook users worldwide. The DPC engaged with Facebook Ireland in relation to this reported issue, raising queries in relation to GDPR compliance to which Facebook Ireland furnished a number of responses.<\/p>\n

The DPC, having considered the information provided by Facebook Ireland regarding this matter to date, is of the opinion that one or more provisions of the GDPR and\/or the Data Protection Act 2018 may have been, and\/or are being, infringed in relation to Facebook Users\u2019 personal data.<\/p>\n

Accordingly, the Commission considers it appropriate to determine whether Facebook Ireland has complied with its obligations, as data controller, in connection with the processing of personal data of its users by means of the Facebook Search, Facebook Messenger Contact Importer and Instagram Contact Importer features of its service, or whether any provision(s) of the GDPR and\/or the Data Protection Act 2018 have been, and\/or are being, infringed by Facebook in this respect.\u201d<\/p>\n<\/blockquote>\n

Facebook has been contacted for comment. Update<\/strong>: The company did not provide a statement but confirmed it\u2019s in contact with regulators to answer their questions.\u00a0Update 2:\u00a0<\/strong>Facebook has now sent this statement: \u201cWe are cooperating fully with the IDPC in its enquiry, which relates to features that make it easier for people to find and connect with friends on our services. These features are common to many apps and we look forward to explaining them and the protections we have put in place.\u201d<\/p>\n

The move comes after the European Commission intervened to apply pressure on Ireland\u2019s data protection commissioner. Justice commissioner, Didier Reynders, tweeted<\/a>\u00a0Monday that he had spoken with Helen Dixon about the Facebook data leak.<\/p>\n

\u201cThe Commission continues to follow this case closely and is committed to supporting national authorities,\u201d he added, going on to urge Facebook to \u201ccooperate actively and swiftly to shed light on the identified issues\u201d.<\/p>\n

A spokeswoman for the Commission confirmed the virtual meeting between Reynders and Dixon, saying: \u201cDixon informed the Commissioner about the issues at stake and the different tracks of work to clarify the situation.<\/p>\n

\u201cThey both urge Facebook to cooperate swiftly and to share the necessary information. It is crucial to shed light on this leak that has affected millions of European citizens.\u201d<\/p>\n

\u201cIt is up to the Irish data protection authority to\u00a0assess this case. The Commission remains available if support is needed. The situation will also have to be further analyzed for the future. Lessons should be learned,\u201d she added.<\/p>\n

The revelation that a vulnerability in Facebook\u2019s platform enabled unidentified \u2018malicious actors\u2019 to extract the personal data (including email addresses, mobile phone numbers and more) of more than 500 million Facebook accounts up until September 2019 \u2014 when Facebook claims it fixed the issue \u2014 only emerged in the wake of the data being found<\/a> for free download on a hacker forum earlier this month.<\/p>\n

\n

All 533,000,000 Facebook records were just leaked for free.<\/p>\n

This means that if you have a Facebook account, it is extremely likely the phone number used for the account was leaked.<\/p>\n

I have yet to see Facebook acknowledging this absolute negligence of your data. https:\/\/t.co\/ysGCPZm5U3<\/a> pic.twitter.com\/nM0Fu4GDY8<\/a><\/p>\n

\u2014 Alon Gal (Under the Breach) (@UnderTheBreach) April 3, 2021<\/a><\/p>\n<\/blockquote>\n

\n

Despite the European Union\u2019s data protection framework (the GDPR) baking in a regime of data breach notifications \u2014 with the risk of hefty fines for compliance failure \u2014 Facebook did not inform its lead EU data supervisory when it found and fixed the issue. Ireland\u2019s Data Protection Commission (DPC) was left to find out in the press, like everyone else.<\/p>\n

Nor has Facebook individually informed the 533M+ users that their information was taken without their knowledge or consent, saying last week it has no plans to do so \u2014 despite the heightened risk for affected users of spam and phishing attacks.<\/p>\n

Privacy experts have, meanwhile, been swift to point out that the company has still not faced any regulatory sanction under the GDPR \u2014 with a number of investigations ongoing into various Facebook businesses and practices and no decisions yet issued in those cases by Ireland\u2019s DPC. (It has so far only issued one cross-border decision, fining\u00a0Twitter<\/a> around $550k in December over a breach it disclosed back in 2019.)<\/p>\n

\n

Facebook\u2019s tardy disclosure of breach timing raises GDPR compliance questions<\/a><\/p>\n<\/blockquote>\n

\n

Last month the European Parliament adopted a resolution<\/a> on the implementation of the GDPR which expressed \u201cgreat concern\u201d over the functioning of the mechanism \u2014 raising particular concern over the Irish data protection authority by writing that it \u201cgenerally closes most cases with a settlement instead of a sanction and that cases referred to Ireland in 2018 have not even reached the stage of a draft decision pursuant to Article 60(3) of the GDPR\u201d.<\/p>\n

The latest Facebook data scandal further amps up the pressure on the DPC \u2014 providing further succour to critics of the GDPR who argue the regulation is unworkable under the current foot-dragging enforcement structure, given the major bottlenecks in Ireland (and Luxembourg) where many tech giants choose to locate regional HQ.<\/p>\n

On Thursday Reynders made his concern over Ireland\u2019s response to the Facebook data leak public, tweeting<\/a> to say the Commission had been in contact with the DPC.<\/p>\n

He does have reason to be personally concerned. Earlier last week Politico<\/a> reported that Reynders\u2019 own digits had been among the cache of leaked data, along with those of the Luxembourg prime minister Xavier Bettel \u2014 and \u201cdozens of EU officials\u201d. However the problem of weak GDPR enforcement affects everyone across the bloc \u2014 some 446M people whose rights are not being uniformly and vigorously upheld.<\/p>\n

\u201cA strong enforcement of GDPR is of key importance,\u201d Reynders also remarked on Twitter, urging Facebook to \u201cfully cooperate with Irish authorities\u201d.<\/p>\n

Last week Italy\u2019s data protection commission<\/a> also called on Facebook to immediately offer a service for Italian users to check whether they had been affected by the breach. But Facebook made no public acknowledgment or response to the call. Under the GDPR\u2019s one-stop-shop mechanism the tech giant can limit its regulatory exposure by direct dealing only with its lead EU data supervisor in Ireland.<\/p>\n

A two-year Commission review of how the data protection regime is functioning, which reported last summer<\/a>, already drew attention to problems with patchy enforcement. A lack of progress on unblocking GDPR bottlenecks is thus a growing problem for the Commission \u2014 which is in the midst of proposing a package<\/a> of additional<\/a> digital regulations<\/a>. That makes the enforcement point a very pressing one as EU lawmakers are being asked how new digital rules<\/a> will be upheld if existing ones keep being trampled on?<\/p>\n

It\u2019s certainly notable that the EU\u2019s executive has proposed a different, centralized enforcement structure for\u00a0incoming pan-EU legislation<\/a> targeted at digital services and tech giants. Albeit, getting agreement from all the EU\u2019s institutions and elected representatives on how to reshape platform oversight looks challenging.<\/p>\n

And in the meanwhile the data leaks continue: Motherboard<\/a> reported Friday on another alarming leak of Facebook data it found being made accessible via a bot on the Telegram messaging platform that gives out the names and phone numbers of users who have liked a Facebook page (in exchange for a fee unless the page has had less than 100 likes).<\/p>\n

The publication said this data appears to be separate to the 533M+ scraped dataset \u2014 after it ran checks against the larger dataset via the breach advice site, haveibeenpwned<\/a>. It also asked Alon Gal, the person who discovered the aforementioned leaked Facebook dataset being offered for free download online, to compare data obtained via the bot and he did not find any matches.<\/p>\n

We contacted Facebook about the source of this leaked data and will update this report with any response.<\/p>\n

In his tweet<\/a> about the 500M+ Facebook data leak last week, Reynders made reference to the Europe Data Protection Board (EDPB), a steering body comprised of representatives from Member State data protection agencies which works to ensure a consistent application of the GDPR.<\/p>\n

However the body does not lead on GDPR enforcement \u2014 so it\u2019s not clear why he would invoke it. Optics is one possibility, if he was trying to encourage a perception that the EU has vigorous and uniform enforcement structures where people\u2019s data is concerned.<\/p>\n

\u201cUnder the GDPR, enforcement and the investigation of potential violations lies with the national supervisory authorities. The EDPB does not have investigative powers per se and is not involved in investigations at the national level. As such, the EDPB cannot comment on the processing activities of specific companies,\u201d an EDPB spokeswoman told us when we enquired about Reynders\u2019 remarks.<\/p>\n

But she also noted the Commission attends plenary meetings of the EDPB \u2014 adding it\u2019s possible there will be an exchange of views among members about the Facebook leak case in the future, as attending supervisory authorities \u201cregularly exchange information on cases at the national level\u201d.<\/p>\n

\n

Answers being sought from Facebook over latest data breach<\/a><\/p>\n<\/blockquote>\n

\n

\n

Europe sets out plan to boost data reuse and regulate \u2018high risk\u2019 AIs<\/a><\/p>\n<\/blockquote>\n

\n

\u00a0<\/p>\n

Article source: http:\/\/feedproxy.google.com\/~r\/techcrunch\/social\/~3\/nHp7yozD_Ms\/<\/p>","protected":false},"excerpt":{"rendered":"

Facebook\u2019s lead data supervisor in the European Union has opened an investigation into whether the tech giant violated data protection rules vis-a-vis the leak of data reported earlier this month. <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[3],"tags":[10,7,14,15,6,12,11],"class_list":["post-23867","post","type-post","status-publish","format-standard","hentry","category-latest-update","tag-computer-news","tag-downloads","tag-microsoft-download-news","tag-networking-updates","tag-technology-update","tag-wordpress-plugin-download","tag-wordpress-theme-download"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t