Irish data authority probes Facebook photo breach

DUBLIN: The Irish data watchdog on Friday launched an investigation into Facebook, after the social media titan admitted a “bug” may have exposed unposted photos from up to 6.8 million users.

The Irish Data Protection Commission (DPC) probe will take place under strict new European privacy laws outlined in the General Data Protection Regulation (GDPR).

It follows a similar probe launched in October — when Facebook admitted a security breach exposed 50 million user accounts.

“The Irish DPC has received a number of breach notifications from Facebook since the introduction of the GDPR on May 25, 2018,” said head of communications Graham Doyle.

“With reference to these data breaches, including the breach in question, we have this week commenced a statutory inquiry examining Facebook’s compliance with the relevant provisions of the GDPR.”

The Irish DPC has primary European jurisdiction over Facebook as the California-based firm has established its international headquarters in Dublin.

GDPR legislation gives regulators vast powers to sanction firms failing to sufficiently secure personal data.

Corporations can be fined up to four percent of their annual global turnover if they neglect to conform.

That means Facebook faces a theoretical fine of 1.4 billion euros ($1.6 billion), based on its 2017 annual revenue of 35.2 billion euros ($40.6 billion).

On Friday Facebook said using the social media login and granting permission to third-party applications to access photos may have led to the unintended breach between September 13 and 25.

“When someone gives permission for an app to access their photos on Facebook, we usually only grant the app access to photos people share on their timeline,” engineering director Tomer Bar announced in a message to developers.

“In this case, the bug potentially gave developers access to other photos, such as those shared on Marketplace or Facebook Stories.”

The earlier October DPC investigation was launched after Facebook admitted attackers exploited a vulnerability in the website’s code in a manner which could have granted access to private accounts.

That probe has been touted as the first major test of GDPR legislation. Facebook is already under scrutiny as a result of its role in the Cambridge Analytica (CA) data scandal.