In the matter of the General Data Protection Regulation
DPC Complaint Reference:
IMI Complaint Reference Number:
In the matter of a complaint, lodged by with Der Hamburgische Beauftragte für
Datenschutz und Informationsfreiheit pursuant to Article 77 of the General Data Protection
Regulation, concerning Twitter International Company
Record of Amicable Resolution of the complaint and its consequent withdrawal pursuant to
Section 109(3) of the Data Protection Act, 2018
Further to the requirements of EDPB Guidelines 06/2022 on the practical implementation of
amicable settlements Version 2.0 (adopted on 12 May 2022)
RECORD OF AMICABLE RESOLUTION FOR THE
PURPOSE OF EDPB GUIDELINES 06/2022 ON THE
PRACTICAL IMPLEMENTATION OF AMICABLE
SETTLEMENTS VERSION 2.0, ADOPTED 12 MAY 2022
Dated the 22nd day of May 2023
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, Ireland
1
Background
1. On 3 September 2019, (“the Data Subject”) lodged a complaint pursuant to
Article 77 GDPR with Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
(“the Recipient SA”) concerning Twitter International Company (“the Respondent”).
2. In circumstances where the Data Protection Commission (“the DPC”) was deemed to be the
competent authority for the purpose of Article 56(1) GDPR, the Recipient SA transferred the
complaint to the DPC on 3 September 2019.
The Complaint
3. The details of the complaint were as follows:
a. On 18 July 2019, the Data Subject submitted an access request pursuant to Article 15
GDPR for all personal data stored and processed by the Respondent.
b. The Data Subject received his data via a time-limited URL that they could access.
However, the Data Subject considered the information that they received to be
incomplete and not clear to understand.
Action taken by the DPC
4. The DPC, pursuant to Section 109(4) of the Data Protection Act, 2018 (“the 2018 Act”), is
required, as a preliminary matter, to assess the likelihood of the parties to the complaint
reaching, within a reasonable time, an amicable resolution of the subject-matter of the
complaint. Where the DPC considers that there is a reasonable likelihood of such an amicable
resolution being concluded between the parties, it is empowered, by Section 109(2) of the
2018 Act, to take such steps as it considers appropriate to arrange or facilitate such an amicable
resolution.
5. Following a preliminary examination of the material referred to it by the Recipient SA, the DPC
considered that there was a reasonable likelihood of the parties concerned reaching, within a
reasonable time, an amicable resolution of the subject matter of the complaint. The DPC’s
experience is that complaints of this nature are particularly suitable for amicable resolution in
circumstances where there is an obvious solution to the dispute, if the respondent is willing to
engage in the process. In this regard, the DPC had regard to:
a. The relationship between the Data Subject and Respondent (being, in this case, an
individual consumer and a service provider); and
b. The nature of the complaint (in this case, an unsuccessful attempt by the Data Subject
to exercise their data subject rights).
6. While not relevant to the assessment that the DPC is required to carry out pursuant to Section
109(4) of the 2018 Act, the DPC also had regard to EDPB Guidelines 06/2022 on the practical
2
implementation of amicable settlements Version 2.0, adopted on 12 May 2022 (“Document
06/2022”), and considered that:
a. the possible conclusion of the complaint by way of amicable resolution would not
hamper the ability of the supervisory authorities to maintain the high level of
protection that the GDPR seeks to create; and that
b. such a conclusion, in this case, would likely carry advantages for the Data Subject,
whose rights under the GDPR would be vindicated swiftly, as well as for the controller,
who would be provided the opportunity to bring its behaviour into compliance with
the GDPR.
Amicable Resolution
7. The DPC engaged with both the Data Subject (via the Recipient SA) and Respondent in relation
to the subject-matter of the complaint. On 12 September 2019, the DPC wrote to the
Respondent and outlined the Data Subject’s complaint, requesting a response. On 24
September 2019, the Respondent replied to the DPC and stated that it provided the Data
Subject with a copy of their data in its raw form along with an explanatory file to explain the
contents of the file. The Respondent indicated that the purpose of processing, and its retention
policy, are outlined in its Privacy Policy along with additional explanatory guidance in its help
centre regarding its legal bases for processing.
8. On 25 September 2019, the DPC provided the Data Subject with the Respondent’s response
via the Recipient SA. On 23 October 2019, the DPC received a response from the Data Subject
stating that they believed that the Respondent had not complied with their request for
information. On 5 February 2020, the Data Subject outlined certain data they believed was not
contained in the information provided and stated that his data had not been provided in an
accurate, transparent, clear and easily accessible form, and in plain and simple terms.
9. On 5 March 2020, following further engagement from the DPC, the Respondent provided the
DPC with a copy of the access request in the same form as it was provided to the Data Subject,
and identified the relevant areas of its privacy policy and help centre where the additional
information sought by the Data Subject could be found. However, the Data Subject remained
unsatisfied that their complaint had been adequately resolved. The Data Subject also took issue
with the fact that the Respondent appeared to only provide them with what it believed was
the “most relevant and useful” information to the Data Subject when utilizing the URL.
10. Following a period of further engagement between the DPC and both the Data Subject and the
Respondent, the DPC wrote to the Respondent on 14 September 2022 with further queries. In
its response of 22 September 2022, the Respondent explained that, in response to an access
request, it “makes available all relevant personal data to data subjects by sending them a link
which they can use to download their personal data” and that this tool “automatically fulfills
data subject rights for all users in a way that protects the security and confidentiality of their
personal data.” As such, the Respondent explained that no decision was made to omit
individual categories of personal data belonging to the Data Subject. The Respondent further
3
advised that it had since enhanced and developed the tools it uses to respond to access
requests as part of its processes for continuing improvement, and that they could now provide
access to other categories of data (such as deleted tweets and messages).
11. The DPC proposed that the Data Subject use the updated tool, and the Respondent provided a
new link directly to the Data Subject for them to download their data. In the circumstances, on
1 December 2022, the DPC wrote to the Data Subject (via the Recipient SA) asking them to
confirm whether the new link provided resolved their complaint. The DPC further requested
that the Data Subject notify it, within three weeks of the letter, if they were not satisfied with
the outcome, so that the DPC could take further action.
12. This correspondence was issued to the Data Subject by the Recipient SA on 9 January 2023. On
31 January 2023, the Recipient SA wrote to the DPC stating that the Data Subject was satisfied
with the outcome and accepted amicable resolution.
13. On 19 April 2023, and in light of the foregoing, the DPC wrote to the Recipient SA noting that
the DPC considered the complaint to have been amicably resolved and withdrawn in
accordance with section 109(3) of the Act and that it would conclude the case and inform the
Respondent.
14. In circumstances where the subject-matter of the complaint has been amicably resolved, in
full, the complaint, by virtue of Section 109(3) of the 2018 Act, is deemed to have been
withdrawn by the Data Subject.
Confirmation of Outcome
15. For the purpose of Document 06/2022, the DPC confirms that:
a. The complaint, in its entirety, has been amicably resolved between the parties
concerned;
b. The agreed resolution is such that the object of the complaint no longer exists; and
a. Having consulted with the supervisory authorities concerned on the information set
out above, as required by Document 06/2022 the DPC has now closed off its file in
this matter.
16. If dissatisfied with the outcome recorded herein, the parties have the right to an effective
remedy by way of an application for judicial review, by the Irish High Court, of the process
applied by the DPC in the context of the within complaint.
Signed for and on behalf of the DPC:
4
_____________________________
Deputy Commissioner
Data Protection Commission
5