European Data Protection Board

EDPB adopts first Art. 65 decision

Tuesday, 10 November, 2020

Brussels, 10 November - During its 41st plenary session, the EDPB adopted by a 2/3 majority of its members its first dispute resolution decision on the basis of Art. 65 GDPR. The binding decision seeks to address the dispute arisen following a draft decision issued by the Irish SA as lead supervisory authority (LSA) regarding Twitter International Company and the subsequent relevant and reasoned objections (RROs) expressed by a number of concerned supervisory authorities (CSAs). 

The Irish SA issued the draft decision following an own-volition inquiry and investigations into Twitter International Company, after the company notified the Irish SA of a personal data breach on 8 January 2019. In May 2020, the Irish SA shared its draft decision with the CSAs in accordance with Art. 60 (3) GDPR. The CSAs then had four weeks to submit their RROs. Among others, the CSAs issued RROs on the infringements of the GDPR identified by the LSA, the role of Twitter International Company as the (sole) data controller, and the quantification of the proposed fine. 

As the LSA rejected the objections and/or considered they were not “relevant and reasoned”, it referred the matter to the EDPB in accordance with Art 60 (4) GDPR, thereby initiating the dispute resolution procedure. 

Following the submission by the LSA, the completeness of the file was assessed, resulting in the formal launch of the Art. 65 procedure on 8 September 2020. In compliance with Article 65 (3) GDPR and in conjunction with Article 11.4 of the EDPB Rules of Procedure, the default adoption timeline of one month was extended by a further month because of the complexity of the subject matter. 

On 9 November 2020, the EDPB adopted its binding decision and will shortly notify it formally to the Irish SA. 

The Irish SA shall adopt its final decision on the basis of the EDPB decision, which will be addressed to the controller, without undue delay and at the latest one month after the EDPB has notified its decision. The LSA and CSAs shall notify the EDPB of the date the final decision was notified to the controller. Following this notification, the EDPB will publish its decision on its website.

For further information see: Art. 65 FAQ

Note to editors:
Please note that all documents adopted during the EDPB Plenary are subject to the necessary legal, linguistic and formatting checks and will be made available on the EDPB website once these have been completed.

EDPB_Press Release_2020_17