Less than 10 percent of the 50 million users attacked in Facebook’s recent breach lived in the European Union, tweeted the Irish Data Protection Commission, which oversees privacy in the region. However, Facebook still could be liable for up to $1.63 billion in fines, or 4 percent of its $40.7 billion in annual global revenue for the prior financial year, if the EU determines it didn’t do enough to protect the security of its users. Facebook wrote in response to the IDPC’s tweet that “We’re working with regulators including the Irish Data Protection Commission to share preliminary data about Friday’s security issue. As we work to confirm the location of those potentially affected, we plan to release further info soon.” Facebook alerted regulators and the public to the breach Friday morning after discovering it Tuesday afternoon. That’s important because it came under the 72-hour deadline for announcing hacks that can trigger an additional fine of up to 2 percent of a company’s global revenue if not met. UPDATE Facebook data breach – @DPCIreland understands that the number of potentially affected EU accounts is less than 10% of the 50 million accounts in total potentially affected by the security breach. DPC Ireland statement beneath. #dataprotection #GDPR #EUdataP pic.twitter.com/oSfGy6DP2S — Data Protection Commission Ireland (@DPCIreland) October 1, 2018 That hack saw sophisticated attackers combine three bugs in Facebook’s profile, privacy and video uploading features to steal the access token of 50 million users. These access tokens could allow the attackers to take over user accounts and act as them on Facebook, Instagram, Oculus and other sites that rely on Facebook’s login system. The EU’s GDPR laws threaten heavy fines for improper security practices and are seen as stricter than those in the U.S., so its findings during this investigation carry weight. The big question remains what data was stolen and how it could potentially be misused. Unless investigators or journalists discover a nefarious application for that data, such as how Cambridge Analytica’s ill-gotten data was used to inform Donald Trump’s campaign strategy, it’s unlikely for the public to see this as more than just another of Facebook’s constant privacy scandals. It could still trigger regulation, or push partners away from using Facebook’s login system, but the world seems to be growing numb to the daily cybersecurity breaches that plague the internet.<doc-sep>A top European regulator is considering opening a formal investigation into Facebook following a data breach that hit 50 million users and which could land the social network with millions of dollars in fines under strict new rules in the region. On Friday, Facebook disclosed that it had discovered a security bug that allowed hackers to access information to around 50 million accounts. Of those 50 million accounts, less than 10 percent are based in the European Union (EU), according to the Irish Data Protection Commission (DPC). Facebook's European subsidiary is headquartered in Ireland, so the Irish DPC is the data watchdog that regulates Facebook. In a statement to CNBC on Tuesday, the Irish DPC said that it was awaiting "more detailed numbers" and that it was assessing whether to open a formal probe into Facebook. "Before we would launch any investigation there are steps that would have to be taken in relation to information gathering and preparing the scope of an inquiry. Furthermore, we would need to establish under which provisions of the Data Protection Act 2018 we would conduct it. We are currently engaged in those steps," a spokesperson for the regulator said. Facebook did not respond to a request for comment when contacted by CNBC. But it tweeted that it was working with regulators and will release more information about the breach soon. TWEET Potential $1.63 billion fine The Facebook data breach will be the first major test of Europe's tough data protection laws introduced in May and known as General Data Protection Regulation (GDPR). It regulates any companies that are handling data of EU citizens and puts strong controls on how that information is stored and used. A big part of GDPR is about data breaches and there's a punishment if companies don't notify regulators about a data breach within 72 hours of it happening. Firms can also be hit with fines if they are found to have not done enough to prevent a data breach or went against any of the principles around the processing of information laid out in GDPR legislation. Mark Zuckerberg, chief executive officer and founder of Facebook Inc., listens during a joint hearing of the Senate Judiciary and Commerce Committees in Washington, D.C., U.S., on Tuesday, April 10, 2018. Al Drago | Bloomberg | Getty Images The maximum fine Facebook could face is 4 percent of annual global turnover, if it is found to have breached GDPR. Since the social network made over $40.65 billion last year in revenue, that total fine could amount to around $1.63 billion. But it's worth noting that's the maximum fine and the EU does not have a history of invoking the harshest punishment under law. Facebook also appears to have notified regulators about the breach within the required time. Vera Jourova, the EU's justice commissioner, said she has been in "close contact" with the Irish DPC, which is "intensively working on this case." She told CNBC's that GDPR has given the EU a strong way to punish companies who fall afoul of the rules. "For these cases, I think Europe is… equipped with GDPR because we have very strict rules and we have very strong instruments to discipline the companies which deal and which handle the private data of people, which is obviously the case with Facebook. We are waiting for further information over the next… days," Jourova said Tuesday. Andrew Dyson, partner at law firm DLA Piper, said that this will be a "test case for how far" the Irish DPC is willing to assert its new regulatory powers. "Will they be willing and able to take on the might of a Silicon Valley titan? In reality it is likely to take many months before we know. For now, the focus will be on fact finding — understanding what went wrong, who was affected and whether Facebook handled the incident responsibly," Dyson told CNBC by email on Tuesday. "If the answers are satisfactory then we may hear little more about this (at least from the regulator) but given the profile it seems likely this will run for some time and there will be a desire to send a clear message to the market." The EU has been cracking down hard on U.S. technology companies. Last year, it fined Google 2.4 billion euros ($2.77 billion) after it said the search engine giant violated antitrust rules with its online shopping practices. The regulators then hit Google with a 4.34 billion euro fine earlier this year, accusing it of abusing its dominant position with its Android mobile operating system. These were antitrust fines, however, and not under GDPR. Regulatory scrutiny<doc-sep>Embroiled in another massive data breach, Facebook may face $1.63 billion (roughly Rs. 11,900 crores) in fine from the European Union (EU) privacy watchdog, the media reported. According to a report in The Wall Street Journal on Sunday, Ireland's Data Protection Commission which is Facebook's lead privacy regulator in Europe, has asked Facebook to submit more details in the incident where data of over 50 million users were hacked via "Access Tokens" or digital keys. The "privacy watchdog could fine Facebook as much as $1.63 billion for the data breach", the report added. "We are concerned at the fact that this breach was discovered on Tuesday (last week) and affects many millions of user accounts but Facebook is unable to clarify the nature of the breach and the risk for users at this point," the regulator was quoted as saying. A Facebook spokeswoman said the social media giant will respond to questions from the EU watchdog. In the biggest-ever security breach after Cambridge Analytica scandal, Facebook on Friday admitted hackers broke into nearly 50 million users' accounts by stealing their "access tokens" or digital keys. This allowed them to steal Facebook access tokens which they could then use to take over people's accounts. Access tokens are the equivalent of digital keys that keep people logged in to Facebook so they do not need to re-enter their password every time they use the app. Senator Mark R. Warner has also called for a full probe into the incident. Vice Chairman of the Senate Select Committee on Intelligence and co-chair of the Senate Cybersecurity Caucus, Warner said it was high time the Congress stepped up and took action to protect privacy and security of social media users. Facebook also said it was taking precautionary step to reset access tokens for another 40 million accounts that have been subject to a "View As" look-up in the 2017. As a result, around 90 million people will now have to log back into Facebook, or any of their apps that use Facebook login. Reacting to the new data breach, CEO Mark Zuckerberg said: "While I'm glad we found this, fixed the vulnerability, and secured the accounts that may be at risk, the reality is we need to continue developing new tools to prevent this from happening in the first place." Zuckerberg and Facebook COO Sheryl Sandberg have already faced hearings at US Congress over Cambridge Analytica data breach that affected 87 million users.<doc-sep>
Facebook may be fined as much as $1.63 billion by a European Union privacy watchdog for a data breach announced Friday that compromised the personal information of up to 50 million users. The hack may have violated the EU's new privacy law, the General Data Protection Regulation, which would result in a hefty fine if EU citizens were affected. Under the law, companies that don't sufficiently protect user data face maximum fines of 20 million euros ($23 million) or 4% of the company's global annual revenue from the prior year, depending on which sum is larger. We know of at least two high-profile victims in the data breach: Facebook's CEO, Mark Zuckerberg, and chief operating officer, Sheryl Sandberg. Facebook may be fined as much as $1.63 billion by a European Union privacy watchdog for a recent data breach announced Friday that compromised the personal information of up to 50 million user accounts. According to The Wall Street Journal, Ireland's Data Protection Commission, Facebook's lead regulator in Europe, said on Saturday that it demanded more information about the nature and scope of the hack, which may have violated the EU's new privacy law, the General Data Protection Regulation. The strict new regulation, which took effect in May, aims to safeguard user data for residents of the European Union. Under the law, companies that don't sufficiently protect user data face maximum fines of 20 million euros ($23 million) or 4% of the companies' global annual revenue from the prior year, depending on which sum is larger. In Facebook's case, the maximum fine would be $1.63 billion, according to The Journal. The case would most likely center on whether Facebook took appropriate steps to safeguard its user data before the breach, it added. Companies are also required to notify regulators within three days of a potential breach, facing a maximum fine of 2% of their global revenue. Ireland's Data Protection Commission said Facebook notified it of the breach within that time frame, though the report "lacked detail," The Journal added. The occurrence of a security breach in itself is not enough to warrant a fine, and the new privacy law's fines have yet to be tested. According to The Journal, EU regulators often decline to issue a maximum fine when a company has cooperated at least in part with an investigation. The tech firm publicly revealed on Friday that it had detected a security breach in which attackers gained access to the personal information of about 50 million Facebook users. The hackers also gained access to personal information from third-party apps and services like Tinder, Spotify, Airbnb, and Instagram, which allow users to sign up using their Facebook log-in. It remains unclear who was behind the attack and whether specific people were targeted. We do know of at least two high-profile victims in the data breach: Facebook's CEO, Mark Zuckerberg, and chief operating officer, Sheryl Sandberg. A company representative confirmed to Business Insider that the two top execs had been affected.