The Data Protection Commission of Ireland (DPC) fined Twitter €450,000 (approximately $546,000) for a data breach discovered back in January 2019, the regulator reported today.
For over four years, the security bug revealed some apparently private tweets from the Android users of the app. The Wall Street Journal notes that Twitter was found to have breached the General Data Protection Regulation (GDPR) of the EU because it failed to alert the regulator within 72 hours of finding the violation.
The fine is remarkable because it is the first time in a cross-border case that a US technology giant has been hit with a GDPR fine, meaning one in which the Irish regulator consulted its EU counterparts as part of the decision.
Ireland’s DPC led the investigation because Ireland is where the international headquarters of Twitter are located.
This cross-border procedure is part of why it has taken so long for this fine to be released. As part of the GDPR’s commentary process, Ireland’s DPC posted its draft decision back in May.
However, in its decision, several other regulators raised objections to several issues, which inevitably led to the dispute-resolution process.
The WSJ notes, one of the main objections raised was the amount the DPC wanted to fine Twitter. A fine of EUR 450,000 is just short of the 2 percent of the global annual sales of Twitter that can be imposed under GDPR for failing to report a data breach properly.
Originally, the Irish regulator decided to fine Twitter even less than this, but it was advised to increase the amount through the dispute-resolution process. The DPC had called for a lower fine because it felt that the failure of Twitter was due to incompetence, rather than being deliberate or systemic.
The fact that the resolution of this conflict took too long has contributed to criticism of the efficacy of GDPR. Helen Dixon, president of the Irish Data Protection Commission, has previously acknowledged that the process did not work particularly well but noted that it was the first time the process was used and expressed hope that it would get better in the future, reports the WSJ.
Twitter said it supports the regulator’s decision in response to the fine in a statement given to TechCrunch. “An unforeseen result of staffing between Christmas Day 2018 and New Years’ Day resulted in Twitter notifying the IDPC outside the statutory notice period of 72 hours,” the company said We have made changes so that all incidents following this have been reported to the DPC in a timely manner.”
“We take responsibility for this error and remain fully committed to the protection of our customers’ privacy and data,” the company added.
The Twitter case is described by the WSJ as “the first in a long pipeline” of cases involving US tech giants. Other open cases include more than a dozen open cases, such as WhatsApp, that have been made available to Facebook and its subsidiaries.