Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Compliance

EU Regulators Wrangle Over Twitter Data Privacy Penalty

European Union privacy regulators are wrangling over the penalty Ireland’s data privacy watchdog was set to issue Twitter for a data breach, pushing back the case’s long awaited conclusion under the bloc’s tough new data privacy rules.

European Union privacy regulators are wrangling over the penalty Ireland’s data privacy watchdog was set to issue Twitter for a data breach, pushing back the case’s long awaited conclusion under the bloc’s tough new data privacy rules.

The Irish Data Privacy Commission was expected to issue its decision in the Twitter case, which would be its first involving a U.S. technology company since the new privacy law, known as GDPR, took effect in 2018, allowing for hefty fines.

But it said Thursday that its counterparts in other countries – so-called concerned supervisory authorities – challenged a draft decision it circulated in May.

“A number of objections were raised,” the Irish regulator said in a brief statement. “However, following consultation a number of objections were maintained and the (Irish Data Privacy Commission) has now referred the matter to the European Data Protection Board,” the independent body representing the bloc’s privacy regulators. It provided no other details. The board has up to two and a half months to come up with a decision.

Under the EU’s General Data Protection Regulation, a single regulator takes the lead role in cross-border data privacy cases as part of a “one-stop shop” system.

Twitter and other U.S. tech companies like Apple, Facebook and Google have their European headquarters in Dublin, making the Irish watchdog their lead privacy regulator in the EU.

But in this system, the main regulator has to share its draft decision with regulators in other EU member states and take their feedback into consideration. The Twitter case could foreshadow more disagreements and delays that Irish authorities may face as they wrap up about two dozen other investigations involving the Silicon Valley giants.

The Twitter case stems from a security breach that affected its Android app users and let anyone view protected tweets over more than four years. The Irish regulator said in a June report it was investigating the company for failure to report the breach within 72 hours.

Under GDPR, companies that don’t make such timely disclosures can be fined up to 10 million euros ($12 million) or 2% of a company’s annual revenue, whichever is higher. In 2019 Twitter’s revenue reached $3.46 billion, making a potential fine worth up to $69 million.

Related: Irish Regulator Probes Google, Tinder Over Data Processing

Related: Ireland’s Data Protection Commission Reports Multiple GDPR Investigations on Tech Giants

Written By

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.

Management & Strategy

SecurityWeek examines how a layoff-induced influx of experienced professionals into the job seeker market is affecting or might affect, the skills gap and recruitment...

Management & Strategy

Tens of cybersecurity companies have announced cutting staff over the past year, in some cases significant portions of their global workforce.

Funding/M&A

Twenty-one cybersecurity-related M&A deals were announced in December 2022.

CISO Conversations

In this edition of CISO Conversations, SecurityWeek speaks to two city CISOs, from the City of Tampa, and from Tallahassee. 

Audits

Out of the 335 public recommendations on a comprehensive cybersecurity strategy made since 2010, 190 were not implemented by federal agencies as of December...