EDPB adopts its first dispute resolution decision under Article 65 of the GDPR - Twitter likely to face a big fine within days

During its 41st plenary session, the European Data Protection Board (“EDPB”) adopted by a 2/3 majority its first dispute resolution decisions on the basis of Article 65 of the General Data Protection Regulation (“GDPR”).


The Article 65 dispute resolution is meant to ensure the correct and consistent application of the GDPR for the 'cross-border processing’ situations where the processing of personal data takes place in more than one of the Member States and where it involves multiple supervisory authorities.


The EDPB shall adopt binding decisions in a scenario where a supervisory authority of one Member State (supervisory authority concerned) raises a ‘relevant and reasoned’ objection to a draft decision by the lead supervisory authority or when the lead supervisory authority rejects such objections as being not relevant or reasoned.


The EDPB’s first binding decision seeks to address a dispute arisen following a draft decision by the Irish Data Protection Commission (“DPC”) as a lead supervisory authority regarding Twitter International Company and the subsequent relevant and reasoned objections expressed by a number of concerned supervisory authorities.


The DPC issued a draft decision based on its own investigations into Twitter after it notified the DPC of a personal data breach on 8 January 2019. In May 2019, the DPC shared its draft decision with the supervisory authorities concerned. The supervisory authorities concerned raised their relevant and reasoned objections on the infringements of the GDPR identified by the DPC, the role of Twitter as a sole controller and the quantification of the proposed fine. The Irish DPC rejected the objections stating they were not “relevant and reasoned” and referred the matter to the EDPB.


The Irish DPC shall adopt its final decision on the basis of the EDPB’s dispute resolution decision without undue delay and at the latest one month after the EDPB has notified it. Twitter could face its first GDPR fines within days.


See the EDPB’s press release on its first dispute resolution decision here.