Italy’s data protection authority has fined Meta €805 million over a Facebook feature that reached into the photo galleries of about 20 million Italian Android users, in what both filings describe as the largest penalty the regulator has imposed on a technology company.
The Garante, Italy’s data privacy authority, found that the Facebook app “accessed photos, videos and associated metadata stored on Italian users’ smartphones without specific consent and without informing them,” Al Jazeera reported on Saturday.
The feature
At issue is a facility Al Jazeera names as “Get suggestions from gallery when browsing Facebook,” which proposed photos and videos from a user’s own phone gallery as material they might post while browsing the app.
The regulator’s objection is not that the app asked for gallery access, but what it did with it. Hiru News, citing the BBC, reported that when the Facebook app obtained permission to reach the photo library, users were not clearly told that the same permission would also be used to generate photo-based posting suggestions.
Hiru reported that Meta has been given 60 days to switch the feature off by default and to obtain a separate, specific permission from users for it. Al Jazeera’s earlier filing records the same two remedies without stating a deadline.
The Garante said it weighed the large number of users affected, the fact that the process was still running for some of them, and a lack of cooperation from the company. Al Jazeera adds that an earlier violation, which resulted in a 2019 fine, also counted against Meta; it does not give the amount of that earlier penalty.
Meta’s response
Al Jazeera, filing on Saturday, said Meta had not yet publicly commented and had the right to appeal. By Sunday morning Hiru carried the company’s answer: a Meta spokesperson told the BBC that it strongly disagrees with the authority’s assessment of the facts, its interpretation of the law and the size of the fine.
The company argued the facility is an ordinary one that helps users post photos and videos to Facebook easily, that permission must be granted on the phone before it operates at all, and that users can change that permission at any time through their device settings. Meta said it plans to appeal.
The dollar figure
The two filings put the euro amount identically at €805 million but differ on the conversion. Al Jazeera’s body gives $887 million while its own headline says $880m; Hiru also gives close to $887 million. The euro figure is the one the regulator imposed.
Context
Hiru, citing the BBC, reported that a court in the US state of New Mexico last month ordered Meta to pay $25 billion over its handling of user data, after finding the company had misled the public for years about how it treated Facebook user information. That ruling falls outside the window of the sources cited above and is recorded here as background rather than as part of Saturday’s decision.
Not reported
Neither filing gives the legal basis or article of the GDPR relied on, the period over which the access took place, or whether the feature operated the same way on iOS. Neither says whether the Garante’s order applies beyond Italy, nor whether other European regulators are examining the same facility.
