Background information Date of final decision: 23 June 2025 National case Legal Reference(s): Article 31 (Co-operation with the supervisory authority) Decision: administrative fine Key words: administrative fine, Cooperation with the supervisory authority Summary of the Decision Origin of the case The case concerns a complaint to the President of the Personal Data Protection Office lodged by an individual in 2021 about irregularities in the processing of his or her personal data by an entrepreneur from Silesia voivodeship. That was the processing of the complainant’s biometric data by the

Background information Date of final decision: 17 June 2025 National case Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 32 (Security of processing) Decision: Administrative fine, Compliance order Key words: Administrative fine, Data protection by design and by default, Data security, Lawfulness of processing, Data subject rights Summary of the Decision Origin of the case The decision was issued in connection with a security incident which

Background information Date of final decision: 23 July 2025 National case Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing) Decision: Administrative fine Key words: Administrative fine, Anti-Money Laundering, Data security, Lawfulness of processing, Data subject rights, Data protection by design and by default Summary of the Decision Origin of the case From 1 April 2019 to 23 September 2020, ING Bank Śląski (the Bank) scanned identity documents of customers and potential customers. It was not checked whether such actions

Background information Date of final decision: 23 June 2025 National case Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 28 (Processor), Article 32 (Security of processing), Article 34 (Communication of a personal data breach to the data subject), Article 38 (Position of the data protection officer) Decision: Administrative fine Key words: Administrative fine, Data processing agreement, Data security, Lawfulness of processing, Data subject rights

Background information Date of final decision: 03 June 2025 National case Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 28 (Processor), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority) Decision: Administrative fine Key words: Administrative fine, Accountability, Data security, Lawfulness of processing, Data subject rights, Data protection by design and by default Summary of the

Background information Date of final decision: 10 April 2025 Cross-border case or national case: national case Controller: Acea Energia spa Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 7 (Conditions for consent), Article 13 (Information to be provided where personal data are collected from the data subject), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 28 (Processor), Article 29 (Processing under the authority of the controller and processor)

Background information Date of final decision: 10 July 2025 National case Controller: Magna PT S.p.A. Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data), Article 13 (Information to be provided where personal data are collected from the data subject) Decision: Administrative fine, Definitive ban on data processing Key words: Administrative fine, Principles relating to processing of personal data, Transparency, Retention time, Lawfulness of processing, Employment

Background information Date of final decision: 04 July 2025 National case Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 32 (Security of processing) Decision: Administrative fine Key words: Administrative fine, Data protection by design and by default, Data security, Lawfulness of processing, Data subject rights Summary of the Decision Origin of the case A doctor’s car was stolen while the doctor was seeing a patient during a home visit

Brussels, 12 September - During its September plenary meeting, the European Data Protection Board (EDPB) has adopted guidelines on the interplay between the Digital Services Act (DSA) and the General Data Protection Regulation (GDPR). These are the first set of EDPB guidelines on the interplay between the GDPR and the EU’s recently adopted digital laws. The DSA aims to complement the rules of the GDPR to ensure the highest level of protection of fundamental rights in the digital space. Its main goal is to create a safer online environment in which the fundamental rights of all users, including

Background information Date of decision: 25/06/2025 National case Controller: Vodafone S.A Legal References: GDPR: Article 5.1.d Principle of accuracy GDPR: Article 28: Processor GDPR: Article 29: Processing under the authority of the controller or processor GDPR: Article 32: Security of processing, Law 3471/2006 (National Law incorporating ePrivacy Directive 2002/58/EC) Decision: Infringement of the GDPR, fines imposed Key words: Data breach, Security of processing, Processor Summary of the Decision Origin of the case Α complaint was submitted to the Greek Supervisory Authority (SA) against