Brussels, 3 December - As part of its December’s plenary meeting, the European Data Protection Board (EDPB) held yesterday an online meeting with Commissioners and representatives of Data Protection Authorities (DPAs) from the countries and the organisation with an EU adequacy decision. This meeting marked the second of its kind, following the first gathering in October 2024. An adequacy decision is a key-mechanism in EU data protection legislation which allows free flow of personal data from Europe to third countries or an international organisation offering an adequate level of data

Brussels, 28 November - The EDPB launched a call for expression of interest to establish a new reserve list for the Support Pool of Experts (SPE) programme. The objective is set up a reserve list of legal and technical experts. The legal expertise sought includes a wide range of fields, such as data protection, policy monitoring, technology, cybersecurity, competition, healthcare, online intermediary services and content moderation. As for the technical expertise, the relevant areas include IT auditing, website security, mobile OS and apps, Internet of Things, cloud-computing, behavioural

Background information Date of final decision: 18 Semptember 2025 National case Controller: SAMARITAINE SAS Legal Reference: obligation to process data lawfully and breach of the principle of liability (articles 5-1-a) and 5-2 of the GDPR); Failure to collect adequate, relevant and necessary data (article 5-1-c) of the GDPR); Failure to involve the Data Protection Officer in matters relating to the protection of personal data (article 38-1 of the GDPR) Decision: administrative fine Key words: CCTV cameras, hidden cameras Summary of the Decision Origin of the case In August 2023, due to the

Background information Date of final decision: 10/07/2025 National case Controller: la Combricola Dei Birichini Di Betty Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 7 (Conditions for consent), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 13 (Information to be provided where personal data are collected from the data subject), Article 35 (Data protection impact assessment), Article 37 (Designation of the data protection officer)

Background information Date of final decision: 10 July 2025 National case Controller: Banco Bilbao Vizcaya Argentaria SA Legal Reference (s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 15 (Right to access by the data subject) Decision: Administrative fine Key words: Administrative fine, Data subject rights, Transparency Summary of the Decision Origin of the case A customer, who was the victim of fraud, contacted the bank to obtain recordings of calls made to customer service, which would be useful in contesting

Background information Date of final decision: 23 October 2025 National case Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 25 (Data protection by design and by default), Article 32 (Security of processing) Decision: Administrative fine, Reprimand Key words: Administrative fine, Data protection by design and by default, Data security, Personal data breach, Third party access to personal data Summary of the Decision Origin of the case Aktia Bank's strong electronic authentication service experienced a disruption due to a technical change In January

Background information Date of final decision: 8 September 2025 National case Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 25 (Data protection by design and by default), Article 32 (Security of processing) Decision: Administrative fine, Reprimand Key words: Data security, Data protection by design and by default, Administrative fine, Personal data breach Summary of the Decision Origin of the case The Finnish Supervisory Authority (SA) investigated the personal data breach following a notification by S-Bank in August 2022. In April 2022, the bank

Brussels, 17 November - The EDPB organises a remote event to collect stakeholders’ input on anonymisation and pseudonymisation on implications of the judgement of the Court of Justice of the European Union (CJEU) in EDPS v Single Resolution Board (SRB). The event will take place on 12 December 2025 (time to be confirmed). This will be an opportunity to inform and support the EDPB’s ongoing work on these topics as per its work programme 2024-2025 and it reflects the EDPB’s commitment to stakeholder engagement, as outlined in the recent Helsinki statement. Who can participate? Individuals

Brussels, 5 November - The European Data Protection Board (EDPB) is taking an important step towards facilitating GDPR compliance for organisations by developing a series of ready-to-use templates. This initiative, announced following the Helsinki Statement on enhanced clarity, support, and engagement, aims to provide practical tools that organisations can readily implement to meet their data protection obligations. To ensure these templates address the needs of organisations, the EDPB has launched a public consultation inviting stakeholders to share their suggestions. The consultation

Brussels, 5 November - During its latest plenary, the EDPB adopted an opinion on the European Commission’s draft decision on the adequate level of protection of personal data in Brazil.* Once adopted, the decision will ensure that personal data can flow freely from Europe to Brazil and that individuals can retain control over their data. In its opinion, requested by the Commission, the EDPB assesses whether the Brazilian data protection framework and the rules on government access to personal data transferred from Europe provide safeguards essentially equivalent to the ones in EU legislation