Ireland's data watchdog fines Twitter €450k for GDPR breaches

It is the first admonishment of a tech multinational based in Ireland by the DPC, although the fine itself falls far short of the maximum amount allowable.

Twitter has received its first fine, of €450,000, from Ireland’s privacy regulator for breaches of GDPR which saw its mobile app making protected tweets public due to a glitch.

The Data Protection Commission said the fine had been handed down on foot of the social media giant failing to notify the regulator of the breach in adequate time, and for failing to adequately document the breach.

The commission said that the fine had been meted out to Twitter as “an effective, proportionate and dissuasive measure". It is the first admonishment of a tech multinational based in Ireland by the DPC, although the fine itself falls far short of the maximum amount allowable under the EU’s marquee General Data Protection Regulation.

The issue itself stemmed from a bug in the Android version of Twitter’s mobile app, which saw users who changed the email address associated with their account having their protected tweets, that is those that ordinarily would be visible to approved followers only, made public.

It was first discovered in December 2018 by an external contractor working for Twitter. During the company’s own internal investigation it discovered multiple other user actions which could lead to the same unintentional result.

Data Protection Commission announces decision in Twitter inquiry https://t.co/Ybeatszm9q pic.twitter.com/YQLkRBnsM9

— Data Protection Commission Ireland (@DPCIreland) December 15, 2020

The investigation, which began in January 2019, is the first cross-border probe undertaken by the regulator and began of the DPC’s own volition and stemmed from Twitter’s failure to notify the regulator “in a timely manner” about the breach.

A draft decision in the matter was produced by the DPC in May before being circulated to the other EU data protection authorities for their approval. That approval was received last month.