Twitter is being investigated by the Irish Data Protection Commission (DPC) after a complaint by researcher Michael Veale from University College London in August that his request for information about link tracking was denied, Fortune reported.
According to the EU General Data Protection Regulation (GDPR), users of electronic services have the right to request details on how the data collected during their activity on the website is used, as well as for a full copy of all data collected.
Twitter refused to comply with Veale's lawful request, saying it would require disproportionate effort, which is one of the exemptions allowed by the GDPR.
However, the researcher disagrees, accusing the social network of misinterpreting the text of the EU regulations. According to Veale, Twitter collects more data than it should when users click on links shortened with its internal t.co URL shortener, far beyond the declared scope of recording the number of clicks on each link and stopping the spread of malware on the platform.
Twitter could face a €20 million fine if DPC investigation concludes it is not complying with EU data protection regulation
The researcher stated that in his opinion Twitter could collect information about the user's device type as well as their inappropriate location, seeing as the social platform's privacy policy mentions the fact that advertisers are able to collect IP in affiliate links.
“The DPC has commenced a formal legal investigation into your complaint,” the Irish data protection authority told Veale. “The investigation will examine whether Twitter has fulfilled its obligations in relation to the subject matter of your complaint and to determine whether or not Twitter has breached the relevant sections of the GDPR or Irish data protection law.”.
Under the EU's non-compliance penalties for GDPR, companies found to be in breach of the regulations can be fined up to €20 million or up to 4% of their total annual revenue, whichever is higher.
Seeing as Twitter's 2017 revenue was around $2.4 billion, a potential GDPR fine could reach €20 million.
