Meta has taken their fight to the High Court, in opposition to the Ireland Data Protection Commission’s (DPC) decision to reprimand them with a €265 million fine for infringing on EU privacy regulations for more than 500 million Facebook users. The total penalties imposed on Meta have already surpassed €1 billion and, in January, the High Court gave them permission to challenge a €405 million fine.
On Monday, Judge Charles Meenan permitted Meta to appeal the €265 million penalty, despite being the only one notified of the application. Meta’s Senior Counsel, Andrew Fitzpatrick, argued that the DPC held them responsible for the actions of third-party “scrapers”. In addition to the High Court review, Meta has also submitted statutory appeal proceedings.
The DPC’s investigation, which commenced in April 2021, considered the Facebook Search, Facebook Messenger Contact Importer, and Instagram Contact Importer tools used between May 2018 and September 2019. The Commission determined that Meta had breached their General Data Protection Regulation (GDPR) duties in regards to data security. Other EU data protection authorities reached a similar conclusion.
Meta has contended that the DPC mistakenly concluded that the scraping entailed “unauthorised access” to user phone numbers. Meta contends that the scrapers only obtained public profile data that was in compliance with individual users’ visibility settings. It is believed that the scrapers randomly inputted digit combinations in order to find users whose privacy settings allowed their profiles to be seen.
Meta has also disputed the DPC’s verdict that they could have taken extra measures to prevent the scraping. They contend that it is impossible to stop scraping and it is not the same as hacking, which involves unauthorised entry to a computer system. They also argue that the DPC’s ruling violated various articles of the Charter of Fundamental Rights of the EU.
Meta is seeking a declaration that some sections of the Data Protection Act of 2018 are invalid when compared to the Constitution. They allege that the €265 million fine is criminal in nature and the DPC did not display the level of harm suffered by data subjects. The case was adjourned until mid-April.
