Twitter Faces Complaints Regarding Data Retention

Several complaints have been made against Twitter in Europe, leading to investigations being carried out by the UK’s Information Commissioner’s Office (ICO) and Ireland’s Data Protection Commission (DPC) regarding Twitter’s data retention. The ICO and DPC are working with Twitter to investigate complaints that the social media company is not fulfilling requests to delete users’ direct messages.

TechCrunch found that when users request the deletion of their direct messages, they are prompted to delete their accounts, with instructions on how to do so. However, there is no confirmation that doing this will delete any data. Moreover, its Help Center confirms that when a user deletes a message, it is only deleted from that user’s view — it still exists on Twitter’s servers and remains viewable by the recipient.

Privacy advocates have also expressed concern over the fact that direct messages sent between users on the platform aren’t end-to-end encrypted. This means Twitter employees could freely access the potentially sensitive content within these messages without oversight.

The EU’s GDPR, which is retained in the UK as domestic law, gives citizens the right to request that their information is deleted. This is also known as “the right to be forgotten” and it is the right that users have been exercising. If Twitter keeps failing to fulfill these requests and skirting EU law, regulators may have to intervene, and it could face a penalty of up to 4% of the company’s annual revenue.

These complaints come amid wider concerns regarding Twitter’s ability to delete user data. This includes the allegations made by a whistleblower last year.

The whistleblower, Peiter “Mudge” Zatko, alleged that Twitter fails to delete user data when their accounts are closed and, in some cases, loses track of this data completely. His account depicts a disorderly and careless workplace at a poorly managed business.

Concerns over Twitter’s general privacy and security standards have been growing since Elon Musk took over as CEO in October 2022, firing top executives and making huge layoffs. His actions led to a surge of key security and privacy staff leaving, which may have left critical security systems and privacy protocols unmaintained.