Big Tech beloved one-stop shop mechanism to the test after recent Twitter decision

The specific case originated from a bug in the platform’s design which caused tweets from users up to January 2019 to become unprotected and accessible to a wider public without the user’s consent nor knowledge.

Investigations led by the Irish Commissioner - leading authority according to art. 56 GDPR - proved Twitter had failed to comply with its obligation to document the breach in a way to enable to verify the Company’s compliance to Art. 33 GDPR. As a result, the Irish Commissioner issued a draft of the Decision on 22 May 2020 to the other concerned supervisory authorities pursuant to Article 60 GDPR.

Based on this draft the authorities did raise concerns with their preliminary position, among others, calling for more consideration by the Irish Commissioner for Twitter's security measures rather than the late data breach notification itself and invoking a more thorough justification of the data protection role of Twitter, also in the context of the involved group companies.

As several objections remained unsolved, the Irish Authority was ultimately forced to invoke the GDPR’s dispute resolution process by bringing up the matter to the European Data Protection Board (EDPB).

The EDPB adopted its binding opinion on 9 November 2020 requiring the Irish Supervisory Authority to amend its decision by increasing the level of the fine to ensure it fulfils its purpose as a corrective measure and meets the requirements of effectiveness, dissuasiveness, and proportionality.

Finally, on 9 December, the Irish Data Protection Commissioner issued its final decision on the matter, imposing a fine of $ 500.000 equating to € 450.000 and admittedly considering the range set out in the first draft of the decision (amounting between $150,000 - $300,000).

The case marks the first decision against a major tech company under the GDPR. Like Twitter, several other multinational companies based their headquarters in Ireland, making the Irish Data Protection Commissioner the leading competent authority for complaints. The interest revealed by other supervisory authorities and the active objections provided, however, shows a widespread perception of need for a more uniform application of the law under the roof of GDPR.