Irish Data Protection Imposes EUR 405m Fine on Instagram

Nov 11, 2022 Benn-Ibler Rechtsanwälte

In a press release, the Irish Data Protection Commission DPC recently announced that social network Instagram will have to pay a fine of EUR 405 million for publishing personal data of minors in Ireland.

The inquiry by the DPC involved the use of personal data from underage users by social networking service Instagram. According to the DPC, Instagram had allowed underage users to use the business account feature. Thus, the inquiry examined, in particular, the public disclosure of email addresses and/or phone numbers of children using the Instagram business account feature and a public-by-default setting for personal Instagram accounts of children.

Following its investigation, the DPC submitted a draft decision to the supervisory authorities concerned pursuant to Art 60 of the GDPR, to which six national regulators objected. No consensus could be reached, which is why the dispute was resolved by the European Data Protection Board (EDPB) in accordance with Art 65 of the GDPR.

The European Data Protection Board adopted its binding decision on 28 July 2022 and requested the Irish Data Protection Commission to amend its draft decision accordingly.

Subsequently, the decision of the DPC was adopted on 2 September 2022. The decision found infringements of Articles 5(1)(a), 5(1)(c), 6(1), 12(1), 24, 25(1), 25(2) and 35(1) of the GDPR.

Data Protection Commission announces decision in Instagram Inquiry | 15/09/2022 | Data Protection Commission