Background information Date of final decision: 28 June 2024 National case Legal references: Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data) Decision: Administrative fine Key words: Lawfulness of processing Summary of the Decision Origin of the case The Norwegian Supervisory Authority (SA) decided to impose an infringement penalty of NOK 250,000 to Eidskog Municipality for breach of the requirements for a legal basis in the General Data Protection Regulation. Key findings The Norwegian SA’s conclusion is based on the Eidskog Municipality’s

Background information Date of final decision: 18 March 2024 National case Legal references: Article 5 (Principles relating to processing of personal data), Article 32 (Security of processing), Article 24 (Responsibility of the controller) Decision: Administrative fine, Compliance order Key words: Principles relating to processing of personal data, Data security, Public administration, Sensitive data Summary of the Decision Origin of the case The Norwegian Supervisory Authority (SA) carried out an inspection of Norwegian Labour and Welfare Administration (NAV) in September 2023, and announced

Background information Date of final decision: 5 October 2024 National case Legal reference: Article 6 (Lawfulness of processing) Decision: Compliance order, Definitive limitation data processing, Administrative fine Key words: CCTV, Lawfulness of processing, Legitimate interest, Employment Summary of the Decision Origin of the case The Slovenian Supervisory Authority (SA) carried out an investigation in 2023 against the company FOVELLA d.o.o., acting as the owner of DODO PIZZA franchise in Slovenia. The investigation revealed unlawful monitoring of employees in the restaurant’s kitchen via

On 8 October 2024, the European Data Protection Board met with Commissioners and representatives of Data Protection Authorities (DPAs) from the fifteen countries having been subject to an EU adequacy decision. The meeting took place in the margins of the EDPB October’s plenary and reflects the EDPB’s commitment to international engagement. The European Commission has so far recognised the following adequate countries: Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, United Kingdom, Uruguay and United States

Update on 15/10/24: The call is now closed. Thank you to all those who expressed an interest in taking part in the EDPB stakeholder event on ‘AI models’. We will carefully review all applications and communicate the results of the process to those who applied in the coming weeks. Brussels, 15 October - The European Data Protection Board (EDPB) organises a remote stakeholder event, taking place on 5 November 2024 (time to be confirmed), aimed at collecting input from stakeholders in the context of a request for an Art. 64(2) GDPR opinion relating to artificial intelligence models (‘AI models’)

Brussels, 11 October -The EDPB will organise a stakeholder event on ‘AI models’ on 5 November 2024 (exact time to be confirmed). During its latest plenary, the European Data Protection Board (EDPB) exceptionally agreed to organise a remote public event aimed at collecting input from stakeholders on issues relating to the request for an Art. 64(2) GDPR opinion on artificial intelligence ("AI") submitted to the EDPB by the Irish Data Protection Authority (DPA). Individuals representing European sector associations, organisations or NGOs and individual companies, law firms or academics are

Brussels, 10 October - During its October 2024 plenary, the European Data Protection Board (EDPB) selected the topic for its fourth Coordinated Enforcement Action (CEF), which will concern the implementation of the right to erasure (‘right to be forgotten’) by controllers. Data Protection Authorities (DPAs) will join this action on a voluntary basis in the coming weeks and the action itself will be launched during the first semester of 2025. The right to erasure (Art.17 GDPR) is one of the most frequently exercised data protection rights and one about which DPAs frequently receive complaints

Brussels, 09 October - During its latest plenary, the European Data Protection Board (EDPB) adopted an Opinion on certain obligations following from the reliance on processor(s) and sub-processor(s), Guidelines on legitimate interest, a Statement on laying down additional procedural rules for GDPR enforcement and the EDPB work programme 2024-2025. First, the EDPB adopted an Opinion on certain obligations following from the reliance on processor(s) and sub-processor(s) following an Art. 64(2) GDPR request to the Board by the Danish Data Protection Authority (DPA). Art. 64(2) GDPR provides that

Background information Date of final decision: 5 September 2024 National case Legal Reference (s): Article 5 (Principles relating to processing of personal data) Decision: Administrative fine Key words: Health records, Anonymisation, Lawfulness of processing Summary of the Decision Origin of the case The French Supervisory Authority (SA) carried out investigations in 2021 which revealed, in connection with the use of one of its software products, that the company CEGEDIM SANTÉ had processed, without authorisation, non-anonymous health data, transmitted to its customers in order to carry out