Ireland Regulates – Emerald Archives

At a Glance

Irish Process

The Irish Data Protection Commission handled several Meta matters as cross-border inquiries under the GDPR. One Instagram inquiry began on 21 September 2020 and concerned child users, while another pair of inquiries concerned Facebook and Instagram legal-basis issues and ended in a decision dated 31 December 2022. The records show that Meta Platforms Ireland Limited, formerly Facebook Ireland Limited, was the controller in these proceedings. The excerpts also note related Article 60 and Article 65 cooperation steps. ^[3] ^[4]

The European Data Protection Board appears in these materials as the body that resolved disputes after objections from other supervisory authorities. For the Instagram child-user case, the Irish authority sent a draft decision to concerned authorities, received objections from six of them, and then referred the matter to the EDPB under Article 65. The EDPB adopted a binding decision on 28 July 2022. A similar dispute mechanism is described for the Facebook transfers case in 2023. ^[4] ^[2] ^[6]

Child Accounts

The Instagram child-user inquiry focused on two kinds of processing. First, Meta Platforms Ireland Limited allowed users aged 13 to 17 to operate business accounts, and at certain times that feature required or facilitated publication of a child’s phone number or email address to the wider public. Second, some child accounts were set to public by default unless changed to private in the privacy settings. The inquiry description presents these as the specific processing operations reviewed. ^[4] ^[5]

The subsequent decision record states that the Irish authority found infringements of Articles 6(1), 5(1)(a), 5(1)(c), 12(1), 24, 25(1), 25(2), and 35(1) GDPR. It imposed administrative fines totalling 405 million euro, along with a reprimand and an order to take remedial actions. The press release says the EDPB rejected a considerable quantity of objections but required the Irish authority to add an Article 6(1) finding and to reassess fines. ^[4] ^[5] ^[1]

Legal Basis

The 2022 Facebook and Instagram legal-basis inquiries concerned whether Meta could rely on contract rather than consent for much of its processing. The Irish authority’s account says that, before 25 May 2018, Meta changed its terms of service and told users it was changing the legal basis on which it relied. Existing and new users were asked to click accept to continue using the services, and the authority described the complaints as alleging forced consent for behavioural advertising and personalised services. ^[3]

The same record says the Irish authority found transparency failures because information on the legal basis was not clearly outlined to users. It said users lacked clarity about what processing was being carried out, for what purposes, and by reference to which of the six legal bases in Article 6. The authority linked those findings to Articles 12 and 13(1)(c), and also to Article 5(1)(a), which requires lawful, fair, and transparent processing. ^[3]

Transfer Dispute

The Facebook transfers decision shows another line of Irish and European scrutiny. The EDPB document describes an own-volition inquiry into transfers of personal data outside the EU and EEA carried out on standard contractual clauses. It says the Board addressed whether additional corrective measures were warranted, including an administrative fine and a compliance order for data transferred in violation of the GDPR. The Irish authority’s national decision followed that binding ruling. ^[2] ^[6]

The register of national measures identifies the Irish decision of 22 May 2023 as the final national decision linked to Binding Decision 1/2023. It also lists the Meta Facebook and Instagram inquiries as national decisions made under the Irish Data Protection Act 2018 and Article 65, with direct links back to the relevant binding decisions. In these excerpts, the procedural relationship between the Irish decision and the EDPB ruling is explicit. ^[6] ^[2]

Security Failures

A later Meta inquiry concerned passwords stored in plaintext on internal systems. The Irish authority says the investigation began in April 2019 after Meta Platforms Ireland Limited notified it that certain user passwords had been inadvertently stored without cryptographic protection or encryption. The inquiry assessed whether the company had implemented security measures appropriate to the risk and whether it had met its duties to document and notify personal data breaches. The passwords were not made available to external parties. ^[7]

The same decision records findings of infringement under Articles 33(1), 33(5), 5(1)(f), and 32(1) GDPR. It imposed a reprimand and administrative fines totalling 91 million euro. The press release also explains that the breach related to password storage, while the accompanying explanation states that data controllers must assess risks and adopt measures to mitigate them, and must notify supervisory authorities without undue delay when a breach occurs. ^[7]

AI Monitoring

By 2025 the DPC was also dealing with Meta’s plans to train a large language model using public content shared by adults on Facebook and Instagram in the EU and EEA. The authority says Meta informed it in March 2024, paused the training in June 2024 after concerns were raised, and later provided updated plans for training to begin on 27 May 2025. The DPC sought an EDPB opinion in September 2024 to promote Europe-wide clarity. ^[8]

The 2025 statement says Meta then implemented a series of changes, including updated transparency notices, a revised objection form, a longer notice period, and controls allowing users to change public posts to private so they would not be trained on. It also says the company updated de-identification, filtering, output filters, and risk assessments, while the DPC continued monitoring the rollout of objection forms and user information. Private posts were stated to be out of scope. ^[8]