The Irish Supervisory Authority, Data Protection Commission (DPC) has fined Meta-owned social media platform Instagram €405m for violating the General Data Protection Regulation (GDPR). The decision came as a result of long-running investigations started in September 2020 on the basis of information provided to the DPC by a third party, and in connection with processing identified by the DPC itself.

This is the second highest fine issued under the GDPR (first being the €746 million penalty against Amazon) and the highest one yet imposed by the Irish Data Protection Commission. Last year, DPC fined another Meta-owned platform WhatsApp €225m for infringements of data protection regulations, followed by a fine of €17m on Meta resulting from an inquiry into a series of 12 data breach notifications.

This specific case concerned two types of processing performed by Facebook Ireland Limited in relation to children’s data. The first type of processing allowed child users between the ages of 13 and 17 to have business accounts, which required and/or facilitated the publication of the child user’s phone number and/or email address. The second type of processing concerned the fact that Facebook Ireland Limited operated a user registration system for the Instagram service through which the accounts of child users were set to public by default. By doing so it made public the social media content of child users, unless their accounts were otherwise set to private by changing the account privacy settings.

Meta claims that the inquiry focused on old settings that they had updated over a year ago and they have since released multiple features to enhance the safety of children and keep their information private. In a statement to RTÉ a Meta spokesperson said: "Anyone under 18 automatically has their account set to private when they join Instagram, so only people they know can see what they post, and adults can’t message teens who don’t follow them. "While we’ve engaged fully with the DPC throughout their inquiry, we disagree with how this fine was calculated and intend to appeal it. We’re continuing to carefully review the rest of the decision."

Although Meta plans to appeal the decision, organizations working on child safety recognize the decision as a step toward safeguarding children's safety online. These organizations actively advocate for the adoption of the Online Safety Bill by the new prime minister of the UK, which is meant to give children strongest possible protection against online threats.