Twitter International Company

the DPC found that Twitter’s requirement that the complainant verify his identity by way of submission of a copy of his photographic ID constituted an infringement of the principle of data minimisation, pursuant to Article 5(1)(c) of the GDPR. Article 6(1) of the GDPR as the DPC found that Twitter had not identified a valid lawful basis under Article 6(1) of the GDPR for seeking a copy of the complainant’s photographic ID in order to process his erasure request. Article 17(1) of the GDPR as the DPC found that Twitter infringed Article 17(1) of the GDPR, as there was an undue delay in handling the complainant’s request for erasure. Article 12(3) of the GDPR as the DPC found that Twitter infringed Article 12(3) of the GDPR by failing to inform the data subject within one month of the action taken on his erasure request pursuant to Article 17 of the GDPR. In light of the extent of the infringements, the DPC issued a reprimand to Twitter, pursuant to Article 58(2)(b) of the GDPR. Further the DPC ordered Twitter, pursuant to Article 58(2)(d), to revise its internal policies and procedures for handling erasure requests to ensure that data subjects are no longer required to provide a copy of photographic ID when making data erasure requests, unless it can demonstrate a legal basis for doing so. For more information, you can download a copy of the full decision at this link: Twitter International Company April 2022 (PDF, 9.0 MB) .