About 530 million people had some personal information leaked, including, in some cases, phone numbers.
A digital privacy group is preparing to take a case to the Irish courts on behalf of EU citizens affected.
Facebook denies wrongdoing, saying the data was "scraped" from publicly available information on the site.
Antoin Ó Lachtnain, director of Digital Rights Ireland (DRI), warned other tech giants its move could be the beginning of a domino effect.
"This will be the first mass action of its kind but we're sure it won't be the last," he said.
"The scale of this breach, and the depth of personal information compromised, is gob-smacking."
He added: "The laws are there to protect consumers and their personal data and it's time these technology giants wake up to the reality that protection of personal data must be taken seriously."
DRI claims Facebook failed to protect user data and notify those who had been affected.
The data leak was first discovered and fixed in 2019, but was recently made easily available online for free.
DRI said individual users who take part in the legal action could be offered compensation of up to €12,000 (£10,445) if it is successful - based on what it says are similar cases in other countries.