Several companies have felt the impact of the stringent European General Data Protection Regulation (GDPR) as various authorities strive to uphold the highest data privacy standards. In alignment with the implementation of these regulations, Meta Platforms (META) is emerging as one of the most affected entities.

According to data gathered by Finbold as of January 17, Meta and its affiliated subsidiaries have accrued fines totaling US$2.8 billion over a span of four years due to multiple GDPR breaches. The largest fine, totaling US$1.3 billion, was imposed on Meta Platforms Ireland Limited in May 2023 for insufficient legal basis for data processing. This record-setting fine constitutes nearly half, or 48 per cent, of all penalties incurred by Meta for GDPR breaches.

Meta Platforms, Inc. incurred the second-highest fine, amounting to US$441.45 million in September 2022, while the third-largest penalty of US$425.1 million was imposed on Meta Platforms Ireland Limited in January 2023. The fourth-largest fine, totaling US$288.85 million, was recorded in November 2022, also against the Ireland entity.

Other fines included WhatsApp Ireland in September 2021 ($245.25 million), Facebook Ireland in December 2021 ($65.4 million), Meta Platforms Ireland Limited in March 2022 ($18.53 million), WhatsApp Ireland in January 2023 ($5.9 million), and Facebook Germany GmbH in December 2019 ($55,590).

Drivers of Meta’s record fines

The research report explored some of the intrigues behind the record fines affecting the Mark Zuckerberg-led company. According to the report:

“The fines levied on Meta are mainly based on the requirement for companies to store data in the country where it is collected rather than permitting unrestricted movement to global data centers. Notably, imposing fines does not necessarily mean that Meta will pay them, as the company currently has pending appeals. Successful appeals could lead to a reduction or complete elimination of the fines.”

Indeed, the fines serve as a cautionary tale for most companies, especially those dealing with vast amounts of data. Despite existing laws, the landscape of data and privacy remains an evolving domain, leaving room for additional regulations in the future.