Specifically, you'd look to Article 83[1]. It being an unintentional act (83(2)(b)), otherwise following best practices (83(2)(d)), taking steps to mitigate the

Specifically, you'd look to Article 83[1]. It being an unintentional act (83(2)(b)), otherwise following best practices (83(2)(d)), taking steps to mitigate the damage (83(2)(c)), and that Twitter announced the breach (83(2)(h)) weigh heavily in favour of the fine being minimal, or there being no fine at all. Article 83(1) also notes that fines must be "proportionate and dissuasive" -- there is nothing proportionate about imposing the maximum fine for a simple error, nor dissuasive about fining a company that is otherwise compliant and following best practices. [1] https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/