The Data Protection Commission (“DPC”) launched an inquiry against Twitter International Unlimited Company (“TIUC”) under section 110 of Ireland’s Data Protection Act, 2018. The inquiry has been initiated when multiple media reports pointed out that one or more collated datasets of twitter user personal data has been made available on the internet. The datasets contained personal data of approximately 5.4 million Twitter Users worldwide. The data was obtained through the exploitation of an API vulnerability that Twitter had fixed in January.
DPC wants to investigate if the twitter has fulfilled its obligations as data controller regarding the processing of personal data of user. It believes that Twitter has violated one or more provisions of GDPR and Ireland’s Data Protection Act, 2018.