The Data Protection Commission (the
"DPC") announced on 15 December 2020
that it has imposed an administrative fine of €450,000 on
Twitter International Company
("Twitter") as a result of that
company's handling of, and response to, a data breach. The data
breach in question, which occurred in December 2018, involved a
technical issue which resulted in some Twitter users' protected
tweets becoming publicly available to other viewers. The DPC found
that Twitter infringed Articles 33(1) and 33(5) of the General Data
Protection Regulation (the "GDPR") as a
result of its failure to notify the DPC of the breach within the
statutory 72-hour notification period and its failure to adequately
document the breach.
