Meta has been found to have four breaches of General Data Protection Regulation (GDPR).
DPC deputy commissioner Graham Doyle said: “It is widely accepted that user passwords should not be stored in ‘plaintext’ considering the risks of abuse that arise from persons accessing such data.
“It must be borne in mind, that the passwords the subject of consideration in this case are particularly sensitive, as they would enable access to users’ social media accounts.” he added.
The decision, which was made by the commissioners for data protection, Dr Des Hogan and Dale Sunderland, and notified to Meta on 26 September, includes a reprimand and a fine.