Background information Date of final decision: 23 June 2025 National case Controller: City of Dublin Education and Training Board (CDETB) Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority), Article 34 (Communication of a personal data breach to the data subject) Decision: Administrative fine, Reprimand Key words: Personal data breach, Sensitive data, Biometrics Summary of the Decision Origin of the case The Irish Supervisory Authority (SA)

Background information Date of final decision: 10 June 2025 National case Controllers: 116111.no (Municipality of Kristiansand), apotekfordeg.no (Apotekfordeg AS), bibel.no (Det norske bibelselskap), drdropin.no (Dr.Dropin AS), ifengsel.no (Kirkens Bymisjon), nhi.no (Norsk Helseinformatikk AS) Legal Reference(s): Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 13 (Information to be provided where personal data are collected from the data subject), Article 9 (Processing of

Background information Date of final decision: 27 May 2025 National case Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 25 (Data protection by design and by default), Article 32 (Security of processing) Decision: Administrative fine, Reprimand Key words: Third party access to personal data, Administrative fine, E-Commerce, Cookies, Sensitive data Summary of the Decision Origin of the case The Finnish Supervisory Authority (SA) started investigating the practices of the pharmacy company Yliopiston Apteekki after a doctoral researcher from the

Background information Date of final decision: 10 March 2025 National case Controller: Vodafone GmbH Legal Reference(s): Article 58(2)(i) GDPR, Article 83(4)(a) GDPR, Article 28(1) GDPR, Article 32(1) GDPR Decision: Administrative fine Key words: Administrative fine, Consumer protection, Data processing agreement, Data security, Password, Fraud User Account Summary of the Decision Origin of the case The German Federal Supervisory Authority (SA) launched investigations regarding Vodafone GmbH’s partner agencies and its online service portal after having received external information outside of

Brussels, 05 June - During its latest plenary, the European Data Protection Board (EDPB) adopted the final version of its guidelines on Art.48 GDPR about data transfers to third country authorities, after public consultation. In addition, the Board presented two new Support Pool of Experts (SPE) projects providing training material on artificial intelligence and data protection. Finally, the Board discussed the European Commission’s request for a joint EDPB-EDPS opinion on the draft proposal on the simplification of record-keeping obligation under the GDPR. Data transfers to third country

Background information Date of final decision: 15 May 2025 National case Controller: CALOGA Legal Reference (s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing), Article 5 (Principles relating to processing of personal data) Decision: administrative fine Key words: administrative fine, consent, unsolicited communication Summary of the Decision Origin of the case As the CNIL made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in this ecosystem, in particular intermediaries who resell data, known as data

Background information Date of final decision: 10 April 2025 National case Controller: Luka Inc. Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 13 (Information to be provided where personal data are collected from the data subject), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default) Decision: administrative fine, Compliance order Key words

Background information Date of final decision: 15 May 2025 National case Controller: SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months Key words: administrative fine, consent, unsolicited communication Summary of the Decision Origin of the case As the French Supervisory Authority (SA) made commercial prospecting a priority topic

Background information Date of final decision: 27 February 2025 National case Controller: High school Legal Reference(s): Article 25 (Data protection by design and by default) Decision: reprimand Key words: education, data protection by design and by default Summary of the Decision Origin of the case The Slovenian Supervisory Authority (SI SA) initiated an ex officio inspection after receiving an official data breach notification. A school reported an unauthorized access to student data by its external meal service provider, contracted for school meals. The provider had been granted access to

Brussels, 08 May - The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have adopted a letter, addressed to the European Commission, on the upcoming proposal on the simplification of record-keeping obligation under the GDPR, amounting to a targeted amendment of Art. 30(5) GDPR. The joint letter replies to the letter sent by the European Commission to the EDPB and the EDPS on 6 May 2025 where the Commission explained how it intends to introduce specific modifications to the GDPR. The EDPB and EDPS understand that a formal consultation will take place