Twitter International Company April 2022

• Year: 2022
• Date: 27 April 2022
• Section: Decisions made under data protection act 2018

DPCRef:IN

-

DPC Complaint Ref: C-

Date: 27 April 2022

Complainant:-

Data Controller: Twitter International Company

RE:

.v Twitter International Company

cPc

An

Coimisiun

um

Chosaint

Sonrai

Data Protection

Com

mission

This document is a decision

of

the Data Protection Commission

of

Ireland ("DPC")

in

relation to

DPC

complaint reference, C

--

hereinafter referred to

as

the

("Complaint"), submitted directly to the

DPC

by Mr. - ("Complainant") against

Twitter International Company (the "Twitter").

This decision is made pursuant to the powers conferred on the DPC by section

113(2)(a)

of

the Data Protection Act 2018 ("the Act") and Article 60

of

the General

Data Protection Regulation ("GDPR"

).

Communication

of

draft decision

to

"supervisory authorities concerned"

In accordance with Article 60(3)

of

the GDPR, the DPC was obliged to communicate

the relevant information and submit a draft decision, in relation to a complaint

regarding cross border processing, to the supervisory authorities concerned for their

opinion and to take due account

of

their views.

In accordance with its obligation, the DPC transmitted a draft decision in relation to the

matter to the "supervisory authorities concerned". As Twitter offers services across the

EU,

and therefore the processing is likely to substantially affect data subjects in every

EU

member state, the DPC in its role as LSA identified that each supervisory authority

is a supervisory authority concerned as defined in Article 4(22)

of

the GDPR. On this

basis, the draft decision

of

the DPC in relation to this complaint was transmitted to

each supervisory authority in the

EU

and EEA for their opinion.

1

cPc

Complaint HandlinQ

by

the DPC -Timeline and Summary

An

Coimisiun

um

C

hosaint

Sonrai

Da

ta

Pr

otect

ion

Commission

1.

The DPC received a complaint on 02 July 2019 via its online web form,

in

which

the complainant alleged that Twitter had failed to comply with an erasure

request submitted to it by him. The complainant also provided the DPC with

copies

of

correspondence exchanged between him and Twitter in relation to

his request. The complainant stated that on receipt

of

his erasure request,

Tw

itter had requested that he provide a copy

of

his photo ID before it would

remove his data. The complainant stated that he refused to provide a copy

of

his ID on the basis that a user can create a Twitter account using only an email

address and phone number to verify who you are and therefore the same data

should be enough to remove your data. The complainant stated that he had

been requesting the erasure of his personal data from Twitter since the middle

of

May

2019. In the documentation provided by the complainant it appears that

the complainant initially submitted an erasure request pursuant to Article 1 7

of

the GDPR to Twitter via email on 13 May 2019.

2. The DPC notified Twitter

of

receipt

of

the complaint via email on 10 September

2019. The DPC also provided Twitter with a copy

of

the complaint and the

supporting documentation provided by the complainant.

3.

Twitter responded to the DPC by way

of

letter dated 23 September 2019.

4.

The DPC relayed

Tw

itter's response to the complainant via email on 10

October 2019. The complainant responded via emails on 10 & 16 October

2019.

5.

The DPC reverted to Twitter via email on 30 October 2019, advising it

of

the

position

of

the complainant. Twitter responded to the DPC via email dated 13

November 2019.

6.

The DPC relayed the response

of

Twitter

to

the complainant via email on 04

December 2019.

7.

The complainant responded via emails dated 04 December 2019.

8.

The

DPC informed Twitter of the content

of

the complainant's reply via email

on

10 December 2019.

9.

Twitter responded via email dated

23

December 2019.

2

cPc

An

Co

imi

siun

um

Chosain

t

Sonrar

Data Protection

Commission

10.

The DPC reverted to Twitter via email dated 24 February 2020 and requested

further information.

11.

Twitter responded

via

correspondence dated 06 March 2020.

12 The DPC reverted to Twitter via email on 24 March 2020 requesting further

information.

13.

Twitter responded via email on 04 April 2020.

14

. The complainant contacted the DPC via email dated 07 April 2020.

15

. In an attempt to facilitate the amicable resolution

of

the complaint, the DPC

advised the complainant

of

Twitter's position via email dated 22 April 2020.

16.

The complainant responded via email dated 22 April 2020 and 23 April 2020.

17.

The DPC notified Twitter, via email dated 03 March 2021 , that the attempts to

facilitate the amicable resolution of the complaint were unsuccessful and that

the DPC was now required to comply with section 113(2)

of

the Data Protection

Act, 2018 which provides that the DPC shall "make a draft decision in respect

of

the complai

nt

(or

, as the case may be, part

of

the complaint) and, where

applicable,

as

to the envisaged action to be taken in relation to the controller

or

processor concerned,

and

, in accordance with Article 60

[of

the GDPRJ

and

,

where appropriate, Article 65, adopt its decision in respect

of

the complaint

or

,

as the case may

be

,

part

of

the complaint."

18.

In summary, therefore, the DPC was unable to arrange

or

facilitate within a

reasonable time an amicable resolution

of

the complaint through the

mechanism

of

its complaint handling process and the issues that remained

unresolved in relation to this complaint following the DPC's complaint handling

process are:

a) Whether Twitter had a lawful basis for requesting a copy

of

the data

subject's ID in order to verify his identity in circumstances where he had

submitted a request for erasure pursuant to Article 17; and

b) Whether Twitter's handling

of

the data subject's erasure request was

compliant with the GDPR and the Act.

3