Meta Fined €1.2M for Failing GDPR Data Access & Portability Obligations
Written by AI from the linked story. Not reviewed by an editor. How this works
Meta Platforms Ireland Limited failed to fulfill its legal obligations under GDPR Articles 15 (right of access) and 20 (right to data portability) by not providing a data subject with all personal data held in its internal 'Hive' data warehouse, citing computational infeasibility as justification. This case illustrates that technical complexity or internal architectural limitations are not acceptable excuses for non-compliance with data subject rights. Organizations must design their data infrastructure with regulatory obligations in mind, ensuring that personal data can be located, retrieved, and delivered regardless of where it resides. The €1.2 million fine underscores that regulators will hold large platforms accountable for systemic failures to honor individual rights, not just data breaches.
Tactical Insight
Immediate actions
- Conduct a full audit of all systems and data stores (including warehouses and lakes) to map where personal data is held and ensure it is retrievable on request.
- Establish a documented, tested process for responding to Data Subject Access Requests (DSARs) within GDPR-mandated timeframes.
Long-term improvements
- Architect data infrastructure with privacy-by-design principles so that personal data retrieval is computationally feasible across all storage tiers, including large-scale warehouses.
- Implement a centralized data subject rights management platform to track, fulfill, and audit all access and portability requests end-to-end.
- Embed GDPR obligations into data engineering and platform design standards so new systems are compliant from inception.
Detection & governance measures
- Assign dedicated Data Protection Officer (DPO) oversight to DSAR fulfillment workflows with escalation paths for complex or disputed requests.
- Establish KPIs and regular reporting on DSAR response rates, completeness, and timeliness to identify systemic gaps before regulators do.