Twitter International Company (‘TIC’)

Introduction 4 - 6 Purpose of this document Background in brief 2. Legal Framework for the Inquiry 6 - 12 Outline of Inquiry process TIC as controller Competence of the Commission Legal basis for Inquiry Conduct of Inquiry 3. Legal Framework for the Decision 12 - 15 Decision-making process – materials considered TIC’s submissions in relation to the Preliminary Draft 4. The Facts as Established 15 - 21 5. Issues for Determination 21 6. Issue I – Article 33(1) 21 - 29 Requirements of Article 33(1) Controller responsibility Accountability Controller obligations under the GDPR 7. Issue I – TIC’s Compliance with Article 33(1) 29 - 89 Analysis of facts relating to TIC’s notification of the Breach TIC’s Submissions in relation to the Preliminary Draft TIC’s Submissions in respect of factual matters concerning its notification of the Breach to the Commission TIC’s Submissions in relation to the provisional finding that it did not comply with Article 33(1) Finding – Article 33(1) 8. Issue II – Article 33(5) 90 - 108 Requirements of Article 33(5) TIC’s submissions regarding the interpretation and application of Article 33(5) Documentation requirements to enable verification of compliance with Article 33, in accordance with Article 33(5) 9. Issue II –TIC’s Documentation in relation to the Breach 109 - 113 Summary of documentation furnished by TIC 3 10.