EU businesses have been fined more than €832m for GDPR breaches in 2022, down 36% on 2021’s €1.3bn. However, the year stands out not for the total sum fined but in the severity of the charges imposed on a single entity — Meta.
While not all cases are made public, the latest data extracted from Enforcementtracker and analysed by Atlas VPN reveals that as of December 2022, companies paid a total of €2.83bn in 1401 cases for violating various data protection laws.
While the heftiest sum charged for violations was recorded in Q3 of 2021, the third quarter of 2022 was also significant, as businesses were penalized €430m.
Distinctively, the majority of the penalties in 2022 were paid by a single tech behemoth, Meta.
The Data Protection Commission (DPC), an authority for GDPR enforcement in Ireland, imposed a €405m fine for Meta Platforms Ireland Limited (Instagram) on September 5th, 2022.
Two issues were found with the processing of personal data pertaining to child users of Instagram.
The children’s email addresses and phone numbers were publicly exposed when using the Instagram business account function, and Instagram profiles of kids were public-by-default.
Another hefty sum of €265m was levied against the same entity on November 25th, 2022, when the DPC declared that Meta had infringed two articles of the EU’s data protection laws after details of Facebook users from around the world were scraped from public profiles in 2018 and 2019.
Moreover, the DPC issued a “reprimand and an order” forcing Meta to “bring its processing into compliance by executing a range of specified remedial activities within a specific deadline”.
Meta complied and made the adjustments within the required timeframe. To date, Meta has paid around €1 billion for GDPR violations.
