Twitter International Company April 2022

Date27 April 2022
SectionDecisions made under data protection act 2018
DPCRef:IN
-
DPC Complaint Ref: C-
Date: 27 April 2022
Complainant:-
Data Controller: Twitter International Company
RE:
.v Twitter International Company
cPc
An
Coimisiun
um
Chosaint
Sonrai
Data Protection
Com
mission
This document is a decision
of
the Data Protection Commission
of
Ireland ("DPC")
in
relation to
DPC
complaint reference, C
--
hereinafter referred to
as
the
("Complaint"), submitted directly to the
DPC
by Mr. - ("Complainant") against
Twitter International Company (the "Twitter").
This decision is made pursuant to the powers conferred on the DPC by section
113(2)(a)
of
the Data Protection Act 2018 ("the Act") and Article 60
of
the General
Data Protection Regulation ("GDPR"
).
Communication
of
draft decision
to
"supervisory authorities concerned"
In accordance with Article 60(3)
of
the GDPR, the DPC was obliged to communicate
the relevant information and submit a draft decision, in relation to a complaint
regarding cross border processing, to the supervisory authorities concerned for their
opinion and to take due account
of
their views.
In accordance with its obligation, the DPC transmitted a draft decision in relation to the
matter to the "supervisory authorities concerned". As Twitter offers services across the
EU,
and therefore the processing is likely to substantially affect data subjects in every
EU
member state, the DPC in its role as LSA identified that each supervisory authority
is a supervisory authority concerned as defined in Article 4(22)
of
the GDPR. On this
basis, the draft decision
of
the DPC in relation to this complaint was transmitted to
each supervisory authority in the
EU
and EEA for their opinion.
1
cPc
Complaint HandlinQ
by
the DPC -Timeline and Summary
An
Coimisiun
um
C
hosaint
Sonrai
Da
ta
Pr
otect
ion
Commission
1.
The DPC received a complaint on 02 July 2019 via its online web form,
in
which
the complainant alleged that Twitter had failed to comply with an erasure
request submitted to it by him. The complainant also provided the DPC with
copies
of
correspondence exchanged between him and Twitter in relation to
his request. The complainant stated that on receipt
of
his erasure request,
Tw
itter had requested that he provide a copy
of
his photo ID before it would
remove his data. The complainant stated that he refused to provide a copy
of
his ID on the basis that a user can create a Twitter account using only an email
address and phone number to verify who you are and therefore the same data
should be enough to remove your data. The complainant stated that he had
been requesting the erasure of his personal data from Twitter since the middle
of
May
2019. In the documentation provided by the complainant it appears that
the complainant initially submitted an erasure request pursuant to Article 1 7
of
the GDPR to Twitter via email on 13 May 2019.
2. The DPC notified Twitter
of
receipt
of
the complaint via email on 10 September
2019. The DPC also provided Twitter with a copy
of
the complaint and the
supporting documentation provided by the complainant.
3.
Twitter responded to the DPC by way
of
letter dated 23 September 2019.
4.
The DPC relayed
Tw
itter's response to the complainant via email on 10
October 2019. The complainant responded via emails on 10 & 16 October
2019.
5.
The DPC reverted to Twitter via email on 30 October 2019, advising it
of
the
position
of
the complainant. Twitter responded to the DPC via email dated 13
November 2019.
6.
The DPC relayed the response
of
Twitter
to
the complainant via email on 04
December 2019.
7.
The complainant responded via emails dated 04 December 2019.
8.
The
DPC informed Twitter of the content
of
the complainant's reply via email
on
10 December 2019.
9.
Twitter responded via email dated
23
December 2019.
2
cPc
An
Co
imi
siun
um
Chosain
t
Sonrar
Data Protection
Commission
10.
The DPC reverted to Twitter via email dated 24 February 2020 and requested
further information.
11.
Twitter responded
via
correspondence dated 06 March 2020.
12 The DPC reverted to Twitter via email on 24 March 2020 requesting further
information.
13.
Twitter responded via email on 04 April 2020.
14
. The complainant contacted the DPC via email dated 07 April 2020.
15
. In an attempt to facilitate the amicable resolution
of
the complaint, the DPC
advised the complainant
of
Twitter's position via email dated 22 April 2020.
16.
The complainant responded via email dated 22 April 2020 and 23 April 2020.
17.
The DPC notified Twitter, via email dated 03 March 2021 , that the attempts to
facilitate the amicable resolution of the complaint were unsuccessful and that
the DPC was now required to comply with section 113(2)
of
the Data Protection
Act, 2018 which provides that the DPC shall "make a draft decision in respect
of
the complai
nt
(or
, as the case may be, part
of
the complaint) and, where
applicable,
as
to the envisaged action to be taken in relation to the controller
or
processor concerned,
and
, in accordance with Article 60
[of
the GDPRJ
and
,
where appropriate, Article 65, adopt its decision in respect
of
the complaint
or
,
as the case may
be
,
part
of
the complaint."
18.
In summary, therefore, the DPC was unable to arrange
or
facilitate within a
reasonable time an amicable resolution
of
the complaint through the
mechanism
of
its complaint handling process and the issues that remained
unresolved in relation to this complaint following the DPC's complaint handling
process are:
a) Whether Twitter had a lawful basis for requesting a copy
of
the data
subject's ID in order to verify his identity in circumstances where he had
submitted a request for erasure pursuant to Article 17; and
b) Whether Twitter's handling
of
the data subject's erasure request was
compliant with the GDPR and the Act.
3

To continue reading

Request your trial

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT