Blog Post

In a victory for Facebook users whose data was leaked on the dark web, Digital Rights Ireland (DRI) has resolved its court case with the Data Protection Commission. This enables DRI to continue its campaign to vindicate the rights of E.U. residents whose data protection rights were violated by Meta (formerly called Facebook).

In April 2021 DRI filed a complaint with the DPC about Facebook practices which meant that information including the names, mobile phone numbers, dates of birth, and emails of users became publicly accessible. In January 2023 DRI appealed to the Irish Circuit Court against a letter from the DPC which appeared to be a final decision rejecting a central part of that complaint. The DPC’s letter stated that “there was no personal data breach”, even though personal data of over 110 million EU-resident Facebook users was leaked, in clear violation of the GDPR

As part of the settlement, the Data Protection Commission has stated that this letter was not in fact a formal decision, but merely an update for information purposes, with no legal effect.

DRI has accepted this declaration. The Irish Data Protection Commission has agreed to pay all of DRI’s legal costs concerning the case.

DRI’s complaint will now be brought forward in accordance with a procedure agreed upon by both sides.

DRI continues to advance its plans to sue for damages on behalf of E.U. victims whose data was leaked in the breach.

“We welcome this settlement today. We are glad this letter, which summarily rejected our complaint, has effectively been withdrawn and that the victims we represent will now have the benefit of a fair procedure. We hope the DPC will follow through by reforming how complaints by data subjects are dealt with,” said Dr TJ McIntyre, chairman of Digital Rights Ireland.

The text of the settlement is appended.

For further information contact:

Antoin O´Lachtnain Director, Digital Rights Ireland

+353 87 240 6691

press@digitalrights.ie

Background to the original appeal: https://www.digitalrights.ie/dri-takes-dpc-to-court-over-facebook-data-leak/

Text of settlement agreement of 2 February 2023

In full and final settlement of the proceedings it is agreed as follows:

1. The DPC hereby confirms and Digital Rights Ireland therefore accepts that the letter of the 5 December 2022 and the email of the 21 December 2022 are not decisions nor final outcomes in respect of the DRI complaint of the 6 April 2021 (the Complaint). It was an interim update the purpose of which was to notify the DRI of the decision delivered in the DPC’s own volition inquiry.

2. By way of clarification the DPC confirms that any reference to findings of fact and/or conclusions in the letter of the 5 December 2022 and the email of the 21 December 2022 are references to the DPC’s own volition inquiry only.

3. It is agreed that the Complaint is ongoing and will be determined in the normal course pursuant to Sections 109(4)(b) and 109(5) and as set out in the DPC email of the 21 December 2022.

4. The DRI agrees to withdraw the Appeal with an order for its costs as against the DPC only, with certificate for SC, to be adjudicated in default of agreement.

On the basis of the above Digital Rights Ireland agrees that this agreement will be in full and final settlement of these proceedings.