Brussels, 08 May - The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have adopted a letter, addressed to the European Commission, on the upcoming proposal on the simplification of record-keeping obligation under the GDPR, amounting to a targeted amendment of Art. 30(5) GDPR. The joint letter replies to the letter sent by the European Commission to the EDPB and the EDPS on 6 May 2025 where the Commission explained how it intends to introduce specific modifications to the GDPR. The EDPB and EDPS understand that a formal consultation will take place

Background information Date of final decision: 6 March 2025 National case Legal Reference (s): Article 24 (Responsibility of the controller), Article 32 (Security of processing) Decision: Administrative fine, Compliance order Key words: Administrative fine, Data security, Encryption, Personal data breach, Data subject rights Summary of the Decision Origin of the case In 2022, Polskie Radio Szczecin (Polish Radio Szczecin) released a press article in which a conviction for sexual harassment was described. The journalist revealed that a parliament member’s son was the victim and did it in such a

Background information Date of final decision: 18 December 2024 National case Legal Reference (s): Article 30 (Records of processing activities), Article 35 (Data protection impact assessment), Article 38 (Position of the data protection officer) Decision: Administrative fine Key words: Administrative fine, Data protection officer, Profiling, Data protection impact assessment, Data subject rights, Record of processing activities Summary of the Decision Origin of the case During the inspection, it turned out that Toyota Bank Polska S.A., as data controller, had led to the situation that the

Brussels, 06 May - During its latest plenary, the European Data Protection Board (EDPB) adopted an opinion on the European Commission’s draft adequacy decision under the GDPR concerning the European Patent Organisation (EPO). In addition, the Board adopted an opinion on the European Commission’s proposal to extend the validity of the UK adequacy decisions under the GDPR and the Law Enforcement Directive (LED). Finally, the EDPB agreed to grant the status of observer to the Personal Data Protection Agency of Bosnia and Herzegovina. Adequate protection of personal data by the EPO At the European

Every year, on 9 May, people across Europe celebrate the anniversary of the Schuman Declaration, which was a milestone to bring peace and solidarity in Europe. This year is particularly special as it marks the 75th anniversary of this historic moment. Let’s celebrate together To celebrate this occasion, the EDPB takes part in the EU Open Day, with an interactive stand hosted by volunteers from the EDPB Secretariat and national Data Protection Authorities (DPAs). Come and visit us to learn more about data protection and the EDPB’s activities. You will find the EDPB and EDPS stands at the

Background information Date of final decision: 17 January 2025 National case Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data), Article 13 (Information to be provided where personal data are collected from the data subject), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 32 (Security of processing) Decision: administrative fine Key words: administrative fine, sensitive data, data security

Background information Date of final decision: 17 March 2025 National case Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 83 (General conditions for imposing administrative fines) Decision: administrative fine Key words: administrative fine, data subject rights, Principles relating to processing of personal data Summary of the Decision Origin of the case The case concerns an attempt to organise the election of the President of the Republic of Poland only by way of postal voting in spring 2020. At that time, the

Background information Date of final decision: 19 March 2025 National case Legal Reference (s): Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data), Article 24 (Responsibility of the controller) Decision: administrative fine Key words: administrative fine, sensitive data, data security, lawfulness of processing, data subject rights Summary of the Decision Origin of the case The case concerns an incident from 2023. Media revealed at that time that a woman who had been in contact with the 112 emergency telephone number and reported that she had

Background information Date of final decision: 10 January 2025 National case Controller: National Bank of Greece S.A Legal Reference: Article 5.1(d) (Principle of accuracy), Article 5.1(f) (Principle of Integrity and Confidentiality), Article 15 (Right of access by the data subject), Article 25.1 (Data protection by design and by default), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority), Article 34 (Communication of a personal data breach to the data subject) Decision: infringement of the GDPR, administrative fines imposed

Brussels, 23 April - The European Data Protection Board (EDPB) has published its 2024 Annual Report. The report provides an overview of the EDPB work carried out in 2024 and reflects on important milestones, such as the adoption of the 2024-2027 strategy, the increase in Art. 64(2) consistency opinions and the continued efforts to provide guidance and legal advice. EDPB Chair Anu Talus said: “As I look back on the work carried out over the past year, I am proud to present our achievements. In 2024, we reaffirmed our commitment to safeguarding individuals’ fundamental rights to privacy and data