A formal investigation will aim to establish whether Facebook’s handling of the leak constitutes a breach of the GDPR.