The Data Protection Commission found that the social media giant infringed Article 33(1) and 33(5) of the EU General Data Protection Regulation (GDPR) in terms of a failure to notify the breach on time to the DPC and a failure to adequately document the breach.

The draft decision in the inquiry became the first one to go through the dispute resolution process set out under Article 65 of the GDPR.

It was also the first draft decision in a “big tech” case on which all EU supervisory authorities were consulted as concerned supervisory authorities.

The DPC said its administrative fine of €450,000 is “an effective, proportionate and dissuasive measure”.