Irish Twitter and Facebook privacy probe reaches next phase

European Union regulators have submitted preliminary decisions, but they remain secret.

Twitter Facebook stock image - reuters
Twitter and Facebook have faced investigations in Ireland into alleged lapses in user privacy [Dado Ruvic/File Photo/Reuters]

Twitter may be the first big technology firm to face a fine over tougher data protection rules after the European Union’s lead regulator submitted a preliminary decision in a probe into the social media firm to other member states.

Ireland’s Data Protection Commission (DPC) also said on Friday that it had sent a preliminary decision to Facebook-owned WhatsApp for their submissions and made further progress in three other investigations related to Facebook.

Ireland hosts the European headquarters of a number of US technology firms, making the DPC the EU’s lead regulator under the bloc’s General Data Protection Regulation’s (GDPR) “one-stop shop” regime introduced in 2018.

The new rules give regulators the power to impose fines of up to four percent of a company’s global revenue, or 20 million euros ($22m), whichever is higher.

GDPR: European tech firms struggle with new data protection law [2:31]

Under GDPR, the DPC must share its preliminary decision with all concerned EU supervisory authorities and consider their views in its final verdict. Each of the bloc’s regulators may be called on for a majority decision if agreement cannot be reached.

The DPC is not commenting on the substance of the preliminary Twitter decision at this point, Deputy Commissioner Graham Doyle told Reuters.

The Twitter ruling relates to a 2019 probe into a bug in its Android app, where some users’ protected tweets were made public. Twitter is the subject of two of the 20 other inquiries the DPC had open into big tech firms at the end of 2019.

A spokeswoman for Twitter declined to comment.

Facebook has come under the most scrutiny, with eight individual probes, plus two into WhatsApp and one into Facebook-owned Instagram.

The DPC said it had moved to the decision-making phase of a complaint-based inquiry that focuses on Facebook Ireland’s obligations to establish a lawful basis for personal data processing.

It said it had also sent draft inquiry reports to the complainants and companies concerned in two further inquiries concerning Instagram and WhatsApp. 

Source: Reuters