Decision 01/2020 on the dispute arisen on the draft decision of the Irish Supervisory Authority regarding Twitter International Company under Article 65(1)(a) GDPR | European Data Protection Board
DECISION UNDER S.111 OF THE DATA PROTECTION ACT 2018 AND FOR THE PURPOSES OF ARTICLE 60 OF THE
GENERAL DATA PROTECTION REGULATION (EU) 2016/679 (GDPR)
TO: TWITTER INTERNATIONAL COMPANY, ONE CUMBERLAND PLACE, FENIAN STREET, DUBLIN 2,
IRELAND
1. INTRODUCTION
Purpose of this document
1.1 This is a decision (‘the Decision’) made by the Data Protection Commission (‘the Commission’) in
accordance with Section 111 of the Data Protection Act 2018 (‘the 2018 Act’), and the General Data
Protection Regulation (EU) 2016/679 of the European Parliament and of the Council) (‘the GDPR’)
arising from an inquiry conducted of the Commission’s own volition, pursuant to Section 110 of the
2018 Act (‘the Inquiry’). For the avoidance of doubt, the within constitutes the notice in writing of
the decision made under Section 111 of the 2018 Act that I am required to give to Twitter
International Company, as the controller concerned, for the purpose of Section 116(1) of the 2018
Act.
1.2 The Inquiry, which commenced on 22 January 2019, examined whether Twitter International
Company (‘TIC’) complied with its obligations under the GDPR in respect of its notification of a
personal data breach to the Commission on 8 January 2019.
1.3 On 14 March 2020, a preliminary draft of this Decision (‘the Preliminary Draft’) was issued to TIC by
the Commission. The Preliminary Draft set out my provisional findings, as the decision-maker in the
Commission in this matter, in relation to (i) whether or not an infringement of the GDPR has occurred
/ is occurring; and (ii) the envisaged action to be taken by the Commission in respect of same.
1.4 The Preliminary Draft was provided to TIC for the purpose of allowing TIC to make any submissions
in relation to my provisional findings. TIC furnished its submissions in respect of the Preliminary Draft
on 27 April 2020. I carefully considered and took account of TIC’s submissions for the purpose of
preparing a draft of this Decision (‘the Draft Decision’), which was submitted by the Commission, on
22 May 2020, to other concerned supervisory authorities (within the meaning of Article 4(22) of the
GDPR) pursuant to Article 60.
1.5 Following this, and during the four-week timeframe provided for under Article 60(4), a number of
concerned supervisory authorities raised objections in respect of aspects of the Draft Decision. In
circumstances where the Commission was unable to follow the objections raised and / or was of the
opinion that the objections were not relevant and reasoned, the Commission submitted the matter
to the consistency mechanism referred to in Article 63, as is required by Article 60(4). Pursuant to
that mechanism, the European Data Protection Board (‘the EDPB’) is required to adopt a binding
GENERAL DATA PROTECTION REGULATION (EU) 2016/679 (GDPR)
TO: TWITTER INTERNATIONAL COMPANY, ONE CUMBERLAND PLACE, FENIAN STREET, DUBLIN 2,
IRELAND
1. INTRODUCTION
Purpose of this document
1.1 This is a decision (‘the Decision’) made by the Data Protection Commission (‘the Commission’) in
accordance with Section 111 of the Data Protection Act 2018 (‘the 2018 Act’), and the General Data
Protection Regulation (EU) 2016/679 of the European Parliament and of the Council) (‘the GDPR’)
arising from an inquiry conducted of the Commission’s own volition, pursuant to Section 110 of the
2018 Act (‘the Inquiry’). For the avoidance of doubt, the within constitutes the notice in writing of
the decision made under Section 111 of the 2018 Act that I am required to give to Twitter
International Company, as the controller concerned, for the purpose of Section 116(1) of the 2018
Act.
1.2 The Inquiry, which commenced on 22 January 2019, examined whether Twitter International
Company (‘TIC’) complied with its obligations under the GDPR in respect of its notification of a
personal data breach to the Commission on 8 January 2019.
1.3 On 14 March 2020, a preliminary draft of this Decision (‘the Preliminary Draft’) was issued to TIC by
the Commission. The Preliminary Draft set out my provisional findings, as the decision-maker in the
Commission in this matter, in relation to (i) whether or not an infringement of the GDPR has occurred
/ is occurring; and (ii) the envisaged action to be taken by the Commission in respect of same.
1.4 The Preliminary Draft was provided to TIC for the purpose of allowing TIC to make any submissions
in relation to my provisional findings. TIC furnished its submissions in respect of the Preliminary Draft
on 27 April 2020. I carefully considered and took account of TIC’s submissions for the purpose of
preparing a draft of this Decision (‘the Draft Decision’), which was submitted by the Commission, on
22 May 2020, to other concerned supervisory authorities (within the meaning of Article 4(22) of the
GDPR) pursuant to Article 60.
1.5 Following this, and during the four-week timeframe provided for under Article 60(4), a number of
concerned supervisory authorities raised objections in respect of aspects of the Draft Decision. In
circumstances where the Commission was unable to follow the objections raised and / or was of the
opinion that the objections were not relevant and reasoned, the Commission submitted the matter
to the consistency mechanism referred to in Article 63, as is required by Article 60(4). Pursuant to
that mechanism, the European Data Protection Board (‘the EDPB’) is required to adopt a binding
