Twitter is being investigated for a potential General Data Protection Regulation (GDPR) breach after refusing to provide an academic with information about how he is tracked on the platform.
The social media network uses shortened t.co links as a way to track a handful of data points, including how many clicks longer links receive. They also help to curb the spread of malware and phishing attacks, the platform says.
Michael Veale, a researcher based at University College London (UCL), lodged a subject access request (SAR) to find out whether these links track more data on users than Twitter lets on.
But according to Fortune, the social media company denied his request on the grounds that providing this information would take "disproportionate effort".
Veale then escalated the issue with a complaint to the Irish Data Protection Commission (DPC), which confirmed in a letter last week that it would investigate whether Twitter's refusal to fulfill the request constitutes a GDPR breach.
The DPC also said it would consider engaging the European Data Protection Board, an independent advisory body that works to apply the consistent application of GDPR across the continent.
"The DPC has initiated a formal statutory inquiry in respect of your complaint," the regulator wrote.
"The inquiry will examine whether or not Twitter has discharged its obligations in connection with the subject matter of your complaint and determine whether or not any provisions of the GDPR or the [Irish Data Protection] Act have been contravened by Twitter in this respect."
Ireland's data watchdog is handling the case under GDPR's One Stop Shop principle, in which a lead investigator is nominated to investigate cross-border breaches.
The rights of data subjects have considerably strengthened since GDPR came into force on 25 May. Under the new regulations, organisations are required to provide any data held on their users or customers within 30 days, subject to exceptions in the law.
These subject access requests (SARs) also operate in tandem with the right to be forgotten, which gives data subject the right to request that data held on them by any organisation is deleted, under reasonable circumstances.
Research published last month showed just 35% of EU-based companies are fulfilling SARs within the legal 30-day timeframe, which is true for 50% of firms based outside of Europe.
This case is being handled under GDPR since the request was made after the new regulations came into force.
IT Pro approached Twitter for comment, but did not get a response at the time of writing. A spokesperson for the DPC said a statement would follow.
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
IBM: Data governance for data-driven organizationswhitepaper Master your data management
-
Google claims US government is too reliant on unsecure Microsoft productsNews The tech giant suggested it might be time for the government to rethink its approach to procurement
-
Over half of London councils lack cyber insuranceNews One council representative called the cyber insurance market “very challenging”
-
EU might force tech giants to share data with smaller rivalsNews The Digital Services Act draft also suggests that firms may be banned from giving their own services preferential treatment
-
Master O365 governance, enforce security policies, and achieve regulatory complianceWhitepaper Identify — and solve — security compliance pain points
-
German housing giant fined £12.5m for GDPR violationsNews The firm’s archive system held onto highly sensitive data from bank statements to health insurance records
-
Heathrow Airport and NHS Digital join ICO sandbox projectsNews The UK regulator will oversee the development of data-reliant services to ensure GDPR compliance
-
Liberty defeated in ‘snooper’s charter’ legal challengeNews High court rules the government’s Investigatory Powers Act doesn’t breach human rights
