Background information Date of final decision: 10 April 2025 Cross-border case or national case: national case Controller: Acea Energia spa Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 7 (Conditions for consent), Article 13 (Information to be provided where personal data are collected from the data subject), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 28 (Processor), Article 29 (Processing under the authority of the controller and processor)

Background information Date of final decision: 10 July 2025 National case Controller: Magna PT S.p.A. Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data), Article 13 (Information to be provided where personal data are collected from the data subject) Decision: Administrative fine, Definitive ban on data processing Key words: Administrative fine, Principles relating to processing of personal data, Transparency, Retention time, Lawfulness of processing, Employment

Background information Date of final decision: 04 July 2025 National case Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 32 (Security of processing) Decision: Administrative fine Key words: Administrative fine, Data protection by design and by default, Data security, Lawfulness of processing, Data subject rights Summary of the Decision Origin of the case A doctor’s car was stolen while the doctor was seeing a patient during a home visit

Brussels, 12 September - During its September plenary meeting, the European Data Protection Board (EDPB) has adopted guidelines on the interplay between the Digital Services Act (DSA) and the General Data Protection Regulation (GDPR). These are the first set of EDPB guidelines on the interplay between the GDPR and the EU’s recently adopted digital laws. The DSA aims to complement the rules of the GDPR to ensure the highest level of protection of fundamental rights in the digital space. Its main goal is to create a safer online environment in which the fundamental rights of all users, including

Background information Date of decision: 25/06/2025 National case Controller: Vodafone S.A Legal References: GDPR: Article 5.1.d Principle of accuracy GDPR: Article 28: Processor GDPR: Article 29: Processing under the authority of the controller or processor GDPR: Article 32: Security of processing, Law 3471/2006 (National Law incorporating ePrivacy Directive 2002/58/EC) Decision: Infringement of the GDPR, fines imposed Key words: Data breach, Security of processing, Processor Summary of the Decision Origin of the case Α complaint was submitted to the Greek Supervisory Authority (SA) against

Background information Date of decision: September 1st, 2025 National case Controller: GOOGLE IRELAND LIMITED and GOOGLE LLC Legal Reference: Obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code); Use of cookies without free and informed consent (Article 82 of the French Data Protection Act) Decision: Infringement of the French Post and Electronic Communications Code, Infringement of the French Data Protection Act, Administrative fine and injunction Key words: Commercial

Background information Date of final decision: September 1st, 2025 National case Controller: INFINITE STYLES SERVICES CO. LIMITED Legal Reference: The French Data Protection Act (Article 82): failure to obtain user consent before placing cookies; incomplete information banners, insufficient second-level information, inadequate mechanisms for refusing and withdrawing consent Decision: Infringement of the French Data Protection Act, Administrative fine Key words: Cookies Summary of the Decision Origin of the case In August 2023, the French supervisory authority (CNIL) carried out an inspection

Background information Date of final decision: 24 June 2025 National case Controller: Association “Shield of David” Legal Reference(s): GDPR: Article 5. Principles relating to processing of personal data GDPR: Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject GDPR: Article 13: Information to be provided where personal data is collected from the data subject GDPR: Article 15: Right of access by the data subject GDPR: Article 24: Responsibility of the controller GDPR: Article 31 Cooperation with the Supervisory Authority Decision

Background information Date of final decision: 18 June 2025 National case Controller: the SL Group Legal Reference (s): Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data), Article 83 (General conditions for imposing administrative fines) Decision: Administrative fine Key words: Personal data breach, Sensitive data, Administrative fine, Data retention, Retention time Summary of the Decision Origin of the case The Swedish Supervisory Authority (SA), IMY has reviewed two complaints from employees that had been subject to sobriety tests during their

Background information Date of final decision: 27 March 2025 National case Controller: Istituto di Istruzione Superiore “P. Galluppi” Tropea Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data) Decision: Administrative fine Key words: Administrative fine, Consent, Lawfulness of processing, Biometrics, Public administration Summary of the Decision Origin of the case Following a complaint, the Italian Supervisory Authority (SA) - Garante found out that a high school