Dublin, Sept 27 (Reuters) – The lead European Union privacy regulator has imposed a fine of €91 million ($101.5 million) on Meta Platforms, Inc. for improperly storing some user passwords without adequate protection or encryption.

The investigation, initiated five years ago, followed Meta’s disclosure to Ireland’s Data Protection Commission (DPC) that it had stored certain passwords in ‘plaintext’. Meta publicly acknowledged the issue, and the DPC confirmed that the passwords were not accessed by external parties.

Irish DPC Deputy Commissioner Graham Doyle emphasized the seriousness of the violation, stating, “It is widely accepted that user passwords should not be stored in plaintext, considering the risks of abuse that arise from persons accessing such data.”

In response, a Meta spokesperson noted that the company took swift action to rectify the error upon discovery during a security review in 2019, asserting that there is no evidence to suggest that the passwords were misused or improperly accessed. The spokesperson also highlighted Meta’s cooperative engagement with the DPC throughout the investigation.

The DPC, which serves as the lead EU regulator for many prominent U.S. internet companies due to their operations based in Ireland, has levied a total of €2.5 billion in fines against Meta for violations under the EU’s General Data Protection Regulation (GDPR) since its implementation in 2018. This includes a record €1.2 billion fine in 2023, which Meta is currently appealing.