Background information Date of final decision: September 1st, 2025 National case Controller: INFINITE STYLES SERVICES CO. LIMITED Legal Reference: The French Data Protection Act (Article 82): failure to obtain user consent before placing cookies; incomplete information banners, insufficient second-level information, inadequate mechanisms for refusing and withdrawing consent Decision: Infringement of the French Data Protection Act, Administrative fine Key words: Cookies Summary of the Decision Origin of the case In August 2023, the French supervisory authority (CNIL) carried out an inspection

Background information Date of final decision: 24 June 2025 National case Controller: Association “Shield of David” Legal Reference(s): GDPR: Article 5. Principles relating to processing of personal data GDPR: Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject GDPR: Article 13: Information to be provided where personal data is collected from the data subject GDPR: Article 15: Right of access by the data subject GDPR: Article 24: Responsibility of the controller GDPR: Article 31 Cooperation with the Supervisory Authority Decision

Background information Date of final decision: 18 June 2025 National case Controller: the SL Group Legal Reference (s): Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data), Article 83 (General conditions for imposing administrative fines) Decision: Administrative fine Key words: Personal data breach, Sensitive data, Administrative fine, Data retention, Retention time Summary of the Decision Origin of the case The Swedish Supervisory Authority (SA), IMY has reviewed two complaints from employees that had been subject to sobriety tests during their

Background information Date of final decision: 27 March 2025 National case Controller: Istituto di Istruzione Superiore “P. Galluppi” Tropea Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data) Decision: Administrative fine Key words: Administrative fine, Consent, Lawfulness of processing, Biometrics, Public administration Summary of the Decision Origin of the case Following a complaint, the Italian Supervisory Authority (SA) - Garante found out that a high school

Background information Date of final decision: 21 May 2025 National case Controller: Autostrade per l’Italia spa Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 88 Decision: Administrative fine Key words: Administrative fine, Consent, Lawfulness of processing, Unsolicited communication Summary of the Decision Origin of the case The Italian Supervisory Authority (SA) - Garante action followed the complaint of an employee who had reported the company's use of content extracted from her Facebook profile and private

Background information Date of final decision: 23 April 2025 National case Controller: the Equality Ombudsman (DO) Legal Reference (s): Article 32 (Security of processing), Article 83 (General conditions for imposing administrative fines) Decision: administrative fine Key words: administrative fine, data security, restriction of processing, personal data breach, public administration, sensitive data Summary of the Decision Origin of the case The Equality Ombudsman (DO), the Swedish agency to promote equal rights and opportunities and to combat discrimination, has reported a personal data

Brussels, 9 July 2025 - The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) issued today a Joint Opinion on the European Commission’s Proposal for a Regulation amending certain regulations, including the GDPR. The Proposal, part of the fourth simplification Omnibus, aims to simplify EU rules and reduce administrative burden, extending certain mitigating measures available for small and medium sized enterprises (SMEs) to small mid-cap enterprises (SMCs), and includes further simplification measures. The Proposal aims to modify Art.30 (5) GDPR, providing a

Background information Date of final decision: 2 May 2025 Cross-border LSA: Ireland CSAs: all SAs Controller: TikTok Technology Limited Legal Reference (s): Article 13 (Information to be provided where personal data are collected from the data subject), Article 46 (Transfers by way of appropriate safeguards) Decision: Administrative fine, Compliance order Key words: Administrative fine, Social media, Transparency Summary of the Decision Origin of the case The Irish Supervisory Authority (SA) announced its final decision following an Inquiry into TikTok Technology Limited (“TikTok”). The

A fundamental rights approach to innovation and competitiveness Helsinki, 3 July 2025 – At a high-level meeting in Helsinki on 1–2 July 2025, the European Data Protection Board (EDPB) adopted a landmark Statement on enhanced clarity, support and engagement. The Statement outlines new initiatives to make GDPR compliance easier, in particular for micro, small and medium organisations, strengthen consistency and boost cross-regulatory cooperation. EDPB Chair Anu Talus said: “The EDPB aims to ensure that compliance with the GDPR can be more easily achieved. By placing fundamental rights into the

Background information Date of final decision: 12 June 2025 National case Controller: Department of Social Protection’s (DSP) Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data), Article 13 (Information to be provided where personal data are collected from the data subject), Article 35 (Data protection impact assessment) Decision: Administrative fine, Compliance order and Reprimand Key words: Lawfulness of processing, Sensitive data, Biometrics Summary of the