Thanks for sharing. We also got this at our company. We've reached out to their support for more details. Support have been unhelpful so far, providing extremely generic answers.
Will appreciate a comment if someone has or gets more information.
Will appreciate a comment if someone has or gets more information.
1) Which countries it applies to. 2) What is their current and past policy for carriers storing message data.
* The exposed data included mobile number, message content, SMS timestamp.
* Only France, Italy, Burkina Faso, Ivory Coast, and Gambia were impacted.
Twilio support also provided a CSV file listing the message SIDs for my account that were exposed. Unfortunately they say they cannot associate the message SIDs with recipient numbers. And I cannot either, as I have configured short log retention period (out of privacy concerns, ironically) :-/
"To answer your questions:
1. Only France, Italy, Burkina Faso, Ivory Coast, and Gambia were impacted by this incident, only the traffic sent to these countries.
2. To provide you more context, Twilio’s carrier partners are not considered to be Twilio's processors (or Twilio's customers' subprocessors) under the GDPR because carriers transmitting communications content (i.e., Customer Content) are not considered to be processing the personal data contained in the communication. There are a number of reasons behind this positioning: • “Disclosure by transmission” is called out in the GDPR definition for 'processing' rather than transmission without disclosure. • A processor role does not fit the nature of telecoms services and the telecoms value chain; Confidentially (and security) of communications is safeguarded by the ePrivacy framework. • Guidance from the EDPB specifically covers “telecom operators” and does not specify a role for the carrier with respect to the content of the communication. • Communications content merely transits a communications network or service, without significant processing being involved as confidentiality of communications prohibits the carrier from gaining access. • Any other position would be impossible to implement given the complexity of the telecommunications value chain, with many parties involved in the origination, transit, and termination of communications content."