Turkish Personal Data Protection Authority fined Facebook for Photo API bug

Pierluigi Paganini May 12, 2019

The Turkish Personal Data Protection Authority fined Facebook $270,000 for the Photo API bug that exposed personal photos of 300,000 Turkish users.

The Turkish Personal Data Protection Authority (KVKK) has fined Facebook 1.65 million Turkish lira ($270,000) for the Photo API bug that exposed personal photos of 300,000 Turkish users.

In December, Facebook announced that photos of 6.8 Million users might have been exposed by a bug in the Photo API allowing third-party apps to access them.  The bug impacted up over 870 developers, only apps granted access to photos by the user could have exploited the bug. 
According to Facebook, the flaw exposed user photos for 12 days, between September 13 and September 25, 2018.

KVKK fined the social network giant for failing to quickly address the issue and for neglecting to notify Turkish authorities of the incident. The fine is composed of 1 million for failure to address the issue in time, while the rest is for failing to notify the KVKK of impact on Turkish Facebook users.

Turkish Personal Data Protection Authority

The Turkish KVKK is also investigating Facebook Facebook hack that in September 2018 exposed access tokens of 50 Million Users.

This means that the KVKK Facebook may fine again the social network.

[adrotate banner=”9″] [adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – KVKK Authority , Facebook)

[adrotate banner=”5″]

[adrotate banner=”13″]



you might also like

leave a comment