Brussels, 10 October - During its October 2024 plenary, the European Data Protection Board (EDPB) selected the topic for its fourth Coordinated Enforcement Action (CEF), which will concern the implementation of the right to erasure (‘right to be forgotten’) by controllers. Data Protection Authorities (DPAs) will join this action on a voluntary basis in the coming weeks and the action itself will be launched during the first semester of 2025. The right to erasure (Art.17 GDPR) is one of the most frequently exercised data protection rights and one about which DPAs frequently receive complaints

Brussels, 09 October - During its latest plenary, the European Data Protection Board (EDPB) adopted an Opinion on certain obligations following from the reliance on processor(s) and sub-processor(s), Guidelines on legitimate interest, a Statement on laying down additional procedural rules for GDPR enforcement and the EDPB work programme 2024-2025. First, the EDPB adopted an Opinion on certain obligations following from the reliance on processor(s) and sub-processor(s) following an Art. 64(2) GDPR request to the Board by the Danish Data Protection Authority (DPA). Art. 64(2) GDPR provides that

Background information Date of final decision: 5 September 2024 National case Legal Reference (s): Article 5 (Principles relating to processing of personal data) Decision: Administrative fine Key words: Health records, Anonymisation, Lawfulness of processing Summary of the Decision Origin of the case The French Supervisory Authority (SA) carried out investigations in 2021 which revealed, in connection with the use of one of its software products, that the company CEGEDIM SANTÉ had processed, without authorisation, non-anonymous health data, transmitted to its customers in order to carry out

Background information Date of final decision: 27 May 2024 National case Legal Reference (s): GDPR: Article 5.1.a: Principle of lawfulness, fairness and transparency; GDPR: Article 6.1.f: Processing based on legitimate interest; GDPR: Article 14: Information to be provided where personal data have not been obtained from the data subject; GDPR: Article 25.1: Data protection by design; GDPR: Article 30: Records of processing activities; GDPR: Article 32: Security of processing; GDPR: Article 33: Notification of a personal data breach Controllers: Hellenic Ministry of the Interior, and a second

Update on 17/09/24: The call is now closed. Thank you to all those who expressed an interest in taking part in the EDPB stakeholder event on upcoming guidelines on ‘Consent or Pay’. We will carefully review all applications and communicate the results of the process to those who applied in the coming weeks. The European Data Protection Board (EDPB) organises a remote stakeholder event, taking place on 18 November 2024 from 10.00 to 16.00 CET (exact time to be confirmed), in order to collect stakeholders’ input in the context of upcoming guidelines on the application of data protection

The Commission services in charge of the enforcement of the Digital Markets Act (DMA) and the European Data Protection Board (EDPB) have agreed to work together to clarify and give guidance on the interplay between DMA and GDPR. This enhanced dialogue between Commission’s services and the EDPB will focus on the applicable obligations to digital gatekeepers under the DMA which present a strong interplay with the GDPR, as there is a need to ensure the coherent application to digital gatekeepers of the applicable regulatory frameworks. Developing a coherent interpretation of the DMA and GDPR

The European Data Protection Board (EDPB) is organising a remote stakeholder event aimed at collecting stakeholders’ input in the context of upcoming guidelines on the application of data protection legislation in the context of ‘Consent or Pay’ models. The event will take place on 18 November 2024 from 10.00 to 16.00 CET (exact time to be confirmed). The aim of the event is to collect relevant insights from organisations that have expertise in ‘Consent or Pay’ models, which require data subjects to choose between consenting to processing of personal data for a specified purpose or paying a

Background information Date of final decision: 16 May 2024 National case Legal Reference (s): Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 14 (Information to be provided where personal data have not been obtained from the data subject), Reference, Article 15 (Right to access by the data subject), Article 27 (Representatives of controllers not established in the Union), Article 84 (Penalties) Decision

Background information Date of final decision: 24 June 2024 national case Controller: Avanza Bank AB Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 32 (Security of processing), Article 83 (General conditions for imposing administrative fines) Decision: Administrative fine Key words: Finance, Personal data breach, Administrative fine Summary of the Decision Origin of the case A Swedish bank has reported a personal data breach to the Swedish Supervisory Authority (SA). The notification states that the bank has used the Facebook pixel (now the Meta