Brussels, 14 April - During its April 2025 plenary, the European Data Protection Board (EDPB) has adopted guidelines on processing of personal data through blockchain technologies. A blockchain is a distributed digital ledger system that can confirm transactions and establish who owned a digital asset (such as cryptocurrency) at a given time. Blockchains can also support the secure handling and transfer of data, ensuring its integrity and traceability. As the use of blockchain technologies is expanding, the Board considers it important to help organisations using these technologies to comply

Brussels, 14 March - During its March 2025 plenary meeting, the European Data Protection Board (EDPB) adopted a statement on the implementation of the Passenger Name Record Directive (PNR) in light of the Court of Justice of the EU (CJEU) judgment C-817/19*. In its second statement on the implementation of the PNR Directive, which follows the one of 15 December 2022, the Board gives further guidance to the Passenger Information Units (PIUs)** on the necessary adaptions and limitations to the processing of PNR data, following the PNR judgment. PNR data is personal information provided by

Background information Date of final decision: 17 December 2024 National case Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 25 (Data protection by design and by default), Article 32 (Security of processing) Decision: Administrative fine, Communication order personal data breach, Reprimand Key words: Data security, Personal data breach, Third party access to personal data Summary of the Decision Origin of the case The Finnish SA launched an investigation based on a complaint filed by a customer. A technical investigation revealed serious data

Background information Date of final decision: 11 February 2025 National case Controller: the Primary Health Care of the Capital area Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing). Decision: violation identified, administrative fine Key words: lawfulness of processing, administrative fine, sensitive data Summary of the Decision Origin of the case The Icelandic Supervisory Authority (SA) initiated an investigation into the integration of medical record systems by the Primary Health Care of the Capital area (Primary

Brussels, 05 March - The European Data Protection Board (EDPB) has launched its Coordinated Enforcement Framework (CEF) action for 2025. Following a year-long coordinated action on the right of access in 2024, the CEF's focus this year will shift to the implementation of another data protection right, namely the right to erasure or the “right to be forgotten” (Art.17 GDPR). The Board selected this topic during its October 2024 plenary as it is one of the most frequently exercised GDPR rights and one about which DPAs frequently receive complaints from individuals. Next steps During 2025, 30

Brussels, 13 February - The EDPB published the Coordinated Supervision Committee's (CSC) biannual activity report (July 2022 - December 2024). Over the last two years, the CSC worked on the integration of the large-scale EU information technology (IT) systems within its scope. During the reporting period, it took over the supervision of the upgraded Schengen Information System (SIS) and the Visa Information System (VIS). In addition, the Committee prepared for the arrival of new systems and for the implementation of interoperability regulations. The Committee has also published a set of

Brussels, 12 February - During its February 2025 plenary meeting, the European Data Protection Board (EDPB) adopted a statement on age assurance and decided to create a taskforce on AI enforcement. In addition, the Board also adopted recommendations on the 2027 World Anti-Doping Agency (WADA) World Anti-Doping Code. In a statement on age assurance, the EDPB lists ten principles for the compliant processing of personal data when determining the age or age range of an individual. The statement aims to ensure a consistent European approach to age assurance, to protect minors while complying with

Background information Date of final decision: 12 November 2024 National case Legal Reference (s): Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 32 (Security of processing), Article 5 (Principles relating to processing of personal data), Article 28 (Processor), Article 34 (Communication of a personal data breach to the data subject), Article 33 (Notification of a personal data breach to the supervisory authority) Decision: Administrative fine, Compliance order Key words: Administrative fine, Data subject rights, Personal data

Background information Date of final decision: 26 November 2024 National case Legal Reference (s): Article 33 (Notification of a personal data breach to the supervisory authority), Article 34 (Communication of a personal data breach to the data subject) Decision: Administrative fine, Communication order personal data breach Key words: Administrative fine, Data subject rights, Personal data breach, Principles relating to processing of personal data, Data security, Responsibility of the controller Summary of the Decision Origin of the case The President of the Personal Data Protection Office

Background information Date of final decision: 18 October 2024 National case Legal Reference (s): Article 37 (Designation of the data protection officer) Decision: Administrative fine, Compliance order Key words: Administrative fine, Data protection officer, Legal obligation, Responsibility of the controller Summary of the Decision Origin of the case The obligation of designating a data protection officer (DPO) is incumbent on the controller under Articles 37(1)(a) and 37(7) of the GDPR. Under these provisions, public authorities or entities (with the exception of courts in their