I think the difference it Facebook got caught and called out, whereas it appears here like Twitter identified this as an issue and Twitter decided to publicly d

I think the difference it Facebook got caught and called out, whereas it appears here like Twitter identified this as an issue and Twitter decided to publicly disclose the privacy violation rather than sweeping it under the rug. Is disclosure of this sort of breach mandated by GDPR?