Background information Date of final decision: 26 November 2024 National case Legal Reference (s): Article 33 (Notification of a personal data breach to the supervisory authority), Article 34 (Communication of a personal data breach to the data subject) Decision: Administrative fine, Communication order personal data breach Key words: Administrative fine, Data subject rights, Personal data breach, Principles relating to processing of personal data, Data security, Responsibility of the controller Summary of the Decision Origin of the case The President of the Personal Data Protection Office

Background information Date of final decision: 18 October 2024 National case Legal Reference (s): Article 37 (Designation of the data protection officer) Decision: Administrative fine, Compliance order Key words: Administrative fine, Data protection officer, Legal obligation, Responsibility of the controller Summary of the Decision Origin of the case The obligation of designating a data protection officer (DPO) is incumbent on the controller under Articles 37(1)(a) and 37(7) of the GDPR. Under these provisions, public authorities or entities (with the exception of courts in their

Background information Date of final decision: 10 October 2024 National case Legal Reference(s): Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 32 (Security of processing), Article 5 (Principles relating to processing of personal data), Article 28 (Processor) Decision: Administrative fine, Compliance order Key words: administrative fine, Data subject rights, Personal data breach, Principles relating to processing of personal data, Data security, Responsibility of the controller Summary of the Decision Origin of the case In the

If someone asked you to answer 100 questions about your personal life to sell the answers, would you agree? Most likely not. It can be difficult to keep in control over your personal data and to keep it safe. From online shopping and browsing to social media, with every click, share and login-in you leave behind a digital trail. The GDPR ensures that your data can only be used in ways you agree to and that you can access any information about yourself. But do people actually know how to protect their data? We asked passers-by on the streets of Brussels. Happy Data Protection Day! Sorry, your

Background information Date of final decision: 26 November 2024 Cross-border case One-Stop-Shop Procedure: the decision was taken by national supervisory authorities following the One-Stop-Shop cooperation procedure (OSS). LSA: Netherlands and CSAs: Austria (two data subjects from Austria lodged a complaint with the Austrian SA) Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 13 (Information to be provided where personal data are

Background information Date of final decision: 5 December 2024 Cross-border case If cross-border, LSA: France and CSAs: all Legal Reference (s): Article 6 (Lawfulness of processing), Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 14 (Information to be provided where personal data have not been obtained from the data subject), Article 15 (Right to access by the data subject) Decision: Administrative fine Key words: Transparency, Lawfulness of processing

Background information Date of final decision: 14 November 2024 National case Controller: ORANGE Legal Reference: Obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code), Cookies read in spite of user consent withdrawal (Article 82 of the French Data Protection Act) Decision: Infringement of the French Post and Electronic Communications Code, Infringement of the French Data Protection Act, Administrative fine Key words: Commercial prospecting, cookies Summary of the Decision

Brussels, 20 January - The European Data Protection Board (EDPB) has adopted a report on the implementation of the right of access by controllers. The report summarises the outcome of a series of coordinated national actions carried out in 2024 under the Coordinated Enforcement Framework (CEF). It lists the issues that were observed for some controllers, along with a series of recommendations to help them implement the right of access. A central element is controllers’ awareness of the EDPB Guidelines 01/2022 on data subjects rights – Right of access and whether these guidelines were followed

Brussels, 17 January - During its January 2025 plenary meeting, the European Data Protection Board (EDPB) has adopted guidelines on pseudonymisation, as well as a statement on the interplay of competition law and data protection. EDPB clarifies the use of pseudonymisation for GDPR compliance The GDPR introduces the term ‘pseudonymisation’* and refers to it as a safeguard that may be appropriate and effective to meet data protection obligations. In its guidelines, the EDPB clarifies the definition and applicability of pseudonymisation and pseudonymised data, and the advantages of

Background information Date of final decision: 5 December 2024 Cross-border LSA: France and CSAs: all SAs Legal Reference(s): Article 6 (Lawfulness of processing), Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 14 (Information to be provided where personal data have not been obtained from the data subject), Article 15 (Right to access by the data subject), Decision: Administrative fine and order Add here your free text for the decision Key words