Ireland’s data protection authority has fined Twitter €450,000 ($546,943) over its late reporting of a 2018 data breach in the first-ever sanction of a U.S. firm under the General Data Protection Regulation adopted the same year.

The Data Protection Commission of Ireland, where Twitter and most other big U.S. tech companies are headquartered, announced Tuesday that it had imposed a €450,000 fine on the social media company over its failure to notify the Irish watchdog of a 2019 breach on time, as well as its failure to adequately document that breach. It described the fine as an “an effective, proportionate and dissuasive measure” in a statement posted to its website.