Facebook has discovered a bug that may have affected up to 6.8 million people and given third-party apps wider access to user photos on the social network.
The Irish Data Protection Commission has begun a statutory investigation into the company's compliance with European GDPR rules, following news of the bug.
The social media firm said the bug was found in software that used Facebook login to give third-party apps on the platform permission to access a user's photos, and was active for 12 days between 13 and 25 September.
The bug meant access was granted to a broader set of user images than intended, Facebook said, including images uploaded to the site but never posted.
We need your consent to load this rte-player contentWe use rte-player to manage extra content that can set cookies on your device and collect data about your activity. Please review their details and accept them to load the content.Manage Preferences
A spokesperson for the Irish Data Protection Commission said it had received a number of breach notifications from Facebook since GDPR regulations came into force on 25 May of this year.
It said: "With reference to these data breaches, including the breach in question, we have this week commenced a statutory inquiry examining Facebook's compliance with the relevant provisions of the GDPR."
A spokesperson for Facebook said: "We've been in close touch with the Irish Data Protection Commission, our lead regulator in the EU and we'll continue working with them as their investigation continues."
Users who may have been affected by the bug will be notified by Facebook using an alert on the social network.
Facebook's Tomer Bar said: "When someone gives permission for an app to access their photos on Facebook, we usually only grant the app access to photos people share on their timeline.
"In this case, the bug potentially gave developers access to other photos, such as those shared on Marketplace or Facebook Stories.
"The bug also impacted photos that people uploaded to Facebook but chose not to post. For example, if someone uploads a photo to Facebook but doesn't finish posting it - maybe because they've lost reception or walked into a meeting - we store a copy of that photo so the person has it when they come back to the app to complete their post."
Facebook said it believes the bug affected up to 1,500 apps built by 876 developers.
"We're sorry this happened. Early next week we will be rolling out tools for app developers that will allow them to determine which people using their app might be impacted by this bug," Mr Bar said.
"We will be working with those developers to delete the photos from impacted users.
"We will also notify the people potentially impacted by this bug via an alert on Facebook. The notification will direct them to a Help Center link where they'll be able to see if they've used any apps that were affected by the bug."
Privacy expert Katherine O'Keefe has said the move by the Data Protection Commission to begin a statutory inquiry into Facebook's compliance with data protection regulations is "very significant".
Ms O'Keefe, a senior consultant with Castlebridge, an information management firm said: "The DPC may well be losing its patience with Facebook. We've seen a consistent line of apology tours from Mark Zuckerberg, but we haven't seen clear steps to comply with GDPR, we haven't seen clear improvement in action and we haven't seen changes in culture."
She added that the data breach announced by Facebook today is "another sign that Facebook is not as trustworthy as they say they are when it comes to keeping your data safe and making sure it is held and processed in a manner compliant with GDPR and your protection rights."
The social network recommended that users log into any apps, which they have previously given access to their photos, to check which images the app has access to.
Following a statutory inquiry, GDPR rules provide that if an organisation is found to be in breach of the regulations, it could be subject to corrective sanctions or fines of up to €20m or 4% of global turnover.
The incident is the latest in a series of data breaches to hit the social network this year, following the Cambridge Analytica scandal and another leak in September, which affected around 29 million users.