A potential fine against Twitter for violating EU privacy law has been delayed, due to disagreement among national regulators in the EU. Ireland's Data Protection Commissioner proposed a settlement of the case in May, but has since had to launch an arbitration procedure, after the consultation with other EU national regulators led to differing opinions, the Wall Street Journal reports.
Ireland is the lead regulator for all Twitter's EU operations. However, the General Data Protection Regulation requires national regulators to consult with their counterparts in other countries when a decision has an impact on multiple countries.
The case concerns a security hole that Twitter said it fixed in January 2019. Over a period of more than four years, the breach exposed the private tweets of some users. Ireland’s data commission said in its 2019 annual report that the focus of the case is on whether Twitter fulfilled its obligation for a timely notification of the breach. This can result in fines of up to 2 percent of annual turnover under the GDPR.
A draft decision on the case was sent to EU data protection regulators in May. Further discussions could not resolve their disagreement, so the Irish watchdog has launched a dispute-resolution process with the European Data Protection Board, the umbrella organisation for the regulators. It's not known what the objections to the draft decision were.
The EDPB now has one month to reach a two-thirds majority among member states and if that fails, a further month to seek an absolute majority. If it still can’t find agreement, the chair of the board will cast the deciding vote.
