Background information Date of final decision: 21 May 2025 National case Controller: Autostrade per l’Italia spa Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 88 Decision: Administrative fine Key words: Administrative fine, Consent, Lawfulness of processing, Unsolicited communication Summary of the Decision Origin of the case The Italian Supervisory Authority (SA) - Garante action followed the complaint of an employee who had reported the company's use of content extracted from her Facebook profile and private

Background information Date of final decision: 23 April 2025 National case Controller: the Equality Ombudsman (DO) Legal Reference (s): Article 32 (Security of processing), Article 83 (General conditions for imposing administrative fines) Decision: administrative fine Key words: administrative fine, data security, restriction of processing, personal data breach, public administration, sensitive data Summary of the Decision Origin of the case The Equality Ombudsman (DO), the Swedish agency to promote equal rights and opportunities and to combat discrimination, has reported a personal data

Brussels, 9 July 2025 - The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) issued today a Joint Opinion on the European Commission’s Proposal for a Regulation amending certain regulations, including the GDPR. The Proposal, part of the fourth simplification Omnibus, aims to simplify EU rules and reduce administrative burden, extending certain mitigating measures available for small and medium sized enterprises (SMEs) to small mid-cap enterprises (SMCs), and includes further simplification measures. The Proposal aims to modify Art.30 (5) GDPR, providing a

Background information Date of final decision: 2 May 2025 Cross-border LSA: Ireland CSAs: all SAs Controller: TikTok Technology Limited Legal Reference (s): Article 13 (Information to be provided where personal data are collected from the data subject), Article 46 (Transfers by way of appropriate safeguards) Decision: Administrative fine, Compliance order Key words: Administrative fine, Social media, Transparency Summary of the Decision Origin of the case The Irish Supervisory Authority (SA) announced its final decision following an Inquiry into TikTok Technology Limited (“TikTok”). The

A fundamental rights approach to innovation and competitiveness Helsinki, 3 July 2025 – At a high-level meeting in Helsinki on 1–2 July 2025, the European Data Protection Board (EDPB) adopted a landmark Statement on enhanced clarity, support and engagement. The Statement outlines new initiatives to make GDPR compliance easier, in particular for micro, small and medium organisations, strengthen consistency and boost cross-regulatory cooperation. EDPB Chair Anu Talus said: “The EDPB aims to ensure that compliance with the GDPR can be more easily achieved. By placing fundamental rights into the

Background information Date of final decision: 12 June 2025 National case Controller: Department of Social Protection’s (DSP) Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data), Article 13 (Information to be provided where personal data are collected from the data subject), Article 35 (Data protection impact assessment) Decision: Administrative fine, Compliance order and Reprimand Key words: Lawfulness of processing, Sensitive data, Biometrics Summary of the

Background information Date of final decision: 23 June 2025 National case Controller: City of Dublin Education and Training Board (CDETB) Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority), Article 34 (Communication of a personal data breach to the data subject) Decision: Administrative fine, Reprimand Key words: Personal data breach, Sensitive data, Biometrics Summary of the Decision Origin of the case The Irish Supervisory Authority (SA)

Background information Date of final decision: 10 June 2025 National case Controllers: 116111.no (Municipality of Kristiansand), apotekfordeg.no (Apotekfordeg AS), bibel.no (Det norske bibelselskap), drdropin.no (Dr.Dropin AS), ifengsel.no (Kirkens Bymisjon), nhi.no (Norsk Helseinformatikk AS) Legal Reference(s): Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 13 (Information to be provided where personal data are collected from the data subject), Article 9 (Processing of

Background information Date of final decision: 27 May 2025 National case Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 25 (Data protection by design and by default), Article 32 (Security of processing) Decision: Administrative fine, Reprimand Key words: Third party access to personal data, Administrative fine, E-Commerce, Cookies, Sensitive data Summary of the Decision Origin of the case The Finnish Supervisory Authority (SA) started investigating the practices of the pharmacy company Yliopiston Apteekki after a doctoral researcher from the

Background information Date of final decision: 10 March 2025 National case Controller: Vodafone GmbH Legal Reference(s): Article 58(2)(i) GDPR, Article 83(4)(a) GDPR, Article 28(1) GDPR, Article 32(1) GDPR Decision: Administrative fine Key words: Administrative fine, Consumer protection, Data processing agreement, Data security, Password, Fraud User Account Summary of the Decision Origin of the case The German Federal Supervisory Authority (SA) launched investigations regarding Vodafone GmbH’s partner agencies and its online service portal after having received external information outside of