Twitter fined ~$550k over a data breach in Ireland’s first major GDPR decision – TechCrunch

Summary (IA Generated)

Ireland’s Data Protection Commission (DPC) has issued Twitter with a fine of €450,000 (~$547k) for failing to promptly declare and properly document a data breach under Europe’s General Data Protection Regulation (GDPR).

The decision is noteworthy as it’s the first such cross-border GDPR decision by the Irish watchdog, which is the lead EU privacy supervisor for a number of tech giants — having a backlog of some 20+ ongoing cases at this point, including active probes of Facebook, WhatsApp, Google, Apple and LinkedIn, to name a few.

The DPC’s decision relates to a breach that Twitter publicly disclosed in January 2019 — when it said a bug in its ‘Protect your tweets’ feature could have meant some Android users who’d applied the setting to make their tweets non-public may have had their data exposed to the public Internet since as far back as 2014.

Ireland’s DPC, meanwhile, continues to face criticism for the length of time it’s taking to reach decisions on major cross-border GDPR cases where impacts on individual rights can scale to hundreds of millions of European Internet users.

In the event the first cross-border decision has crossed the line days before the end of the year — underlining the challenges for the bloc in effectively enforcing its digital rulebook against tech giants.

In this specific case, some half a year extra was added to the decision timeline after a draft outcome Ireland submitted to other EU DPAs for review, back in May, was not accepted by all of them — triggering a majority vote mechanism in the GDPR for settling disagreement between the bloc’s data supervisors.

The (now) final outcome on the Twitter case comes at a key time — with EU lawmakers due to set out their next major pieces of digital policy later today, as part of an ambitious push to accelerate regional digitization by rolling out a reassuring promise of European guardrails wrapping around all this tech.

Yet with GDPR enforcement proving such a tedious, friction-filled process that threatens to take the shine off the nascent Digital Services Act and Digital Markets Act many months (or even years) before they can become EU law — raising questions about how the whole strategy can be expected to function in the absence of effective (i.

Simple put: You can’t allow your regulators to move so slowly and expect your rulebook to touch tech giants whose playbook is to move fast in order to disrupt the rule of law in their own business’ interests.

The DPC’s decision in the Twitter case is thus a measure of how sizeable a gap sits between the rhetoric EU policymakers ply around the bloc’s ‘powerful’ digital rules — and the messier and more faltering reality: Nearly two years since Twitter disclosed the breach and waiting for a hammer to drop in what should be a relatively straightforward case.

A data breach is not an investigation into the lawfulness of Facebook’s business model vs GDPR, after all, nor does it delve into the intricacies of Google’s adtech — both of which are still open case files on the DPC’s desk.

The problem now is the black marks against the bloc’s record on digital enforcement look stubbornly set in — just as the Commission is laying out a plan to go all in on platform regulation.