[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fv3R5k3Cz3A5is7J-s6HfXTdvP3rlp5qe-2IyN_jEDkw":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":108},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"47121ccd-f620-4dd5-ad9c-3f815840c2d0","High Court - 2016 IEHC 323","high-court-2016-iehc-323-62d5bd","← Older revision Revision as of 10:07, 26 August 2026 Line 133: Line 133: === Facts === === Facts === On 25 May 2018, Michael Veale, the data subject, submitted an access and data portability request to Meta Platforms Ireland Limited (then Facebook Ireland Limited), the controller. He requested access to all personal data concerning him stored in the controller's internal \"Hive\" data warehouse under [[Article 15 GDPR]], including the data in raw form and information on its processing. He also requested relevant personal data in a structured, commonly used and machine-readable format under [[Article 20 GDPR]]. On 25 May 2018, Michael Veale, the data subject, submitted an access and data portability request to Meta Platforms Ireland Limited (MPIL) (then Facebook Ireland Limited), the controller. He requested access to all personal data concerning him stored in the controller's internal \"Hive\" data warehouse under [[Article 15 GDPR]], including the data in raw form and information on its processing. He also requested relevant personal data in a structured, commonly used and machine-readable format under [[Article 20 GDPR]]. On 19 July 2018, the controller refused to provide the raw Hive data. Among other grounds, it relied on [[Article 12 GDPR|Article 12(5) GDPR]], [[Article 15 GDPR|Article 15(4) GDPR]] and [[Article 20 GDPR|Article 20(4) GDPR]]. The data subject subsequently lodged a complaint with the Data Protection Commission (DPC), the DPA, arguing that the controller had failed to comply with his rights under [[Article 15 GDPR|Articles 15]] and [[Article 20 GDPR|20 GDPR]] and had unjustifiably relied on restrictions to those rights. On 19 July 2018, the controller refused to provide the raw Hive data. Among other grounds, it relied on [[Article 12 GDPR|Article 12(5) GDPR]], [[Article 15 GDPR|Article 15(4) GDPR]] and [[Article 20 GDPR|Article 20(4) GDPR]]. The data subject subsequently lodged a complaint with the Data the DPA arguing that the controller had failed to comply with his rights under [[Article 15 GDPR|Articles 15]] and [[Article 20 GDPR|20 GDPR]] and had unjustifiably relied on restrictions to those rights. On 27 July 2018, the DPA opened a complaint-based inquiry under [https:\u002F\u002Fwww.legislation.gov.uk\u002Fukpga\u002F2018\u002F12\u002Fcontents Section 110(1) Data Protection Act 2018]. The inquiry examined the controller's compliance with its obligations concerning the data subject's request. During the investigation, the controller explained that its approach to Hive data was generally applicable to its users and argued, inter alia, that extracting user-specific log-level data from Hive was computationally unfeasible. In August 2023, the DPA issued its Final Inquiry Report. The investigator considered that the controller had failed to provide the data subject with information required under [[Article 15 GDPR|Article 15(1)(a)]], [[Article 15 GDPR|(d)]] and [[Article 15 GDPR|(g) GDPR]]. On 27 July 2018, the DPA opened a complaint-based inquiry under [https:\u002F\u002Fwww.legislation.gov.uk\u002Fukpga\u002F2018\u002F12\u002Fcontents Section 110(1) Data Protection Act 2018]. The inquiry examined the controller's compliance with its obligations concerning the data subject's request. During the investigation, the controller explained that its approach to Hive data was generally applicable to its users and argued, inter alia, that extracting user-specific log-level data from Hive was computationally unfeasible. In August 2023, the DPA issued its Final Inquiry Report. The investigator considered that the controller had failed to provide the data subject with information required under [[Article 15 GDPR|Article 15(1)(a)]], [[Article 15 GDPR|(d)]] and [[Article 15 GDPR|(g) GDPR]].","Meta Platforms Ireland Limited (MPIL) has been fined €1.2 million by Ireland's Data Protection Commission (DPC) for failing to comply with GDPR access and portability requests. The DPC found that MPIL, formerly Facebook Ireland Limited, did not provide a data subject with all the personal data requested from its internal 'Hive' data warehouse, citing computational infeasibility. The DPC's inquiry concluded that MPIL failed to meet its obligations under Articles 15 and 20 of the GDPR.","Meta fined €1.2M by Ireland's DPC for GDPR violations related to data access requests.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=High_Court_-_2016_IEHC_323&diff=52803&oldid=52801","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-08-26T10:07:35+00:00","2026-08-26T12:00:30.416979+00:00",7,[17,20],{"name":18,"type":19},"Meta Platforms Ireland Limited","vendor",{"name":21,"type":19},"Facebook Ireland Limited","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":22,"icon":24,"name":25,"slug":26},null,"GDPR","gdpr",[28,30,35,40],{"category":29},{"id":22,"icon":24,"name":25,"slug":26},{"category":31},{"id":32,"icon":24,"name":33,"slug":34},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":36},{"id":37,"icon":24,"name":38,"slug":39},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":41},{"id":42,"icon":24,"name":43,"slug":44},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18,21],{"controls":48,"vendors":107},[49,78],{"slug":50,"name":51,"problem":52,"products":53},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"slug":79,"name":80,"problem":81,"products":82},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",[],{"slug":109,"title":110,"body":111,"framework_refs":112,"framework_notes":122},"meta-fined-12m-for-failing-gdpr-data-access-portability-obligations","Meta Fined €1.2M for Failing GDPR Data Access & Portability Obligations","Meta Platforms Ireland Limited failed to fulfill its legal obligations under GDPR Articles 15 (right of access) and 20 (right to data portability) by not providing a data subject with all personal data held in its internal 'Hive' data warehouse, citing computational infeasibility as justification. This case illustrates that technical complexity or internal architectural limitations are not acceptable excuses for non-compliance with data subject rights. Organizations must design their data infrastructure with regulatory obligations in mind, ensuring that personal data can be located, retrieved, and delivered regardless of where it resides. The €1.2 million fine underscores that regulators will hold large platforms accountable for systemic failures to honor individual rights, not just data breaches.",[113,114,115,116,117,118,119,120,121],"GDPR Article 15 – Right of Access","GDPR Article 20 – Right to Data Portability","GDPR Article 5(1)(a) – Lawfulness, Fairness and Transparency","GDPR Article 83 – General Conditions for Imposing Fines","NIST Privacy Framework PR.DS-P3 – Data Minimization and Retrieval","NIST SP 800-53 IP-1 – Consent \u002F IP-2 – Individual Access","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management (PIMS)","ITIL Service Design – Data Management Policies",{}]