Enforcement · Data Protection Authority of Ireland EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Twitter International Company: Insufficient fulfilment of data breach notification obligations

€450,000 Fine
Twitter International Company
IRELAND
Art. 33 GDPR
Notification Obligation Data Breaches Social Media Article 19 GDPR - Notification of Rectification, Erasure or Restriction Notified Body Reporting and Notification Obligations Telecommunications Processing Agreement Law Enforcement
Dec 15, 2020 Source

How it connects

Related across sources

Guidance EDPB Annual Report 2021 EDPB News Data Protection Officer or Chief Privacy Officer?The rise of the Data Protection Officer White Label Consultancy Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Literature GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection European Data Protection Law Review Literature GDPR Implementation Series ∙ Netherlands: The GDPR Implementation Act European Data Protection Law Review Literature GDPR Implementation Series ∙ Romania: Overview of the GDPR Implementation European Data Protection Law Review

Full text

The Irish DPA (DPC) fined Twitter International Company EUR 450,000 for violating Art. 33 (1) GDPR and Art. 33 (5) GDPR for failing to notify the DPA in a timely manner of a data breach and not adequately documenting that breach. The data breach concerned the privacy settings of user posts on the social media platform Twitter. There, users have the option to set the visibility of their posts to private or public. Private posts can only be seen by subscribers of the respective user profile, while public posts are visible to the public. A programming bug in Twitter's Android app resulted in some private posts being visible to the public. The DPA found that Twitter had not properly fulfilled its reporting and documentation obligations. Twitter's legal team became aware of the error on January 2nd, 2019, and it was not until January 8th that the company informed the DPC. Consequently, the company failed to inform the DPC within the 72-hour period required by Art. 33 (1) GDPR. Furthermore, it had failed to adequately document the incident in accordance with Art. 33 (5) GDPR.

Industry: Media, Telecoms and Broadcasting

Original document at the source edpb.europa.eu

Similar Content