The Irish Data Protection Commission (DPC) has fined social media platform Instagram €405m for violations of the General Data Protection Regulation (GDPR).
It follows an investigation into breaches relating to children's data which was started in September 2020 on foot of information provided to the DPC by a third party, and in connection with processing identified by the DPC itself.
Instagram is owned by Facebook parent company Meta.
It is the largest fine ever imposed by the Irish Data Protection Commission.
Last year it fined WhatsApp, which is also owned by Meta, €225m for infringements of data protection rules. In March, the DPC also imposed a fine of €17m on Meta following an inquiry into a series of 12 data breach notifications.
The scope of the inquiry in relation to Instagram concerned two types of processing carried out by Facebook Ireland Limited.
The first allowed child users between the ages of 13 and 17 to operate 'business accounts' on the Instagram platform.
The DPC says that at certain times, the operation of such accounts required and/or facilitated the publication of the child user’s phone number and/or email address.
The second type of processing which was investigated saw Facebook Ireland Limited operate a user registration system for the Instagram service whereby the accounts of child users were set to "public" by default, thereby making public the social media content of child users, unless the account was otherwise set to "private" by changing the account privacy settings.
"We adopted our final decision last Friday and it does contain a fine of €405 million," said DPC Deputy Commissioner Graham Doyle.
"Full details of the decision will publish next week," Mr Doyle added.
In a statement to RTÉ a Meta spokesperson said: "This inquiry focused on old settings that we updated over a year ago, and we've since released many new features to help keep teens safe and their information private.
"Anyone under 18 automatically has their account set to private when they join Instagram, so only people they know can see what they post, and adults can’t message teens who don’t follow them.
"While we’ve engaged fully with the DPC throughout their inquiry, we disagree with how this fine was calculated and intend to appeal it. We’re continuing to carefully review the rest of the decision."
