Background information Date of final decision: 27 May 2024 National case Legal Reference (s): GDPR: Article 5.1.a: Principle of lawfulness, fairness and transparency; GDPR: Article 6.1.f: Processing based on legitimate interest; GDPR: Article 14: Information to be provided where personal data have not been obtained from the data subject; GDPR: Article 25.1: Data protection by design; GDPR: Article 30: Records of processing activities; GDPR: Article 32: Security of processing; GDPR: Article 33: Notification of a personal data breach Controllers: Hellenic Ministry of the Interior, and a second

Update on 17/09/24: The call is now closed. Thank you to all those who expressed an interest in taking part in the EDPB stakeholder event on upcoming guidelines on ‘Consent or Pay’. We will carefully review all applications and communicate the results of the process to those who applied in the coming weeks. The European Data Protection Board (EDPB) organises a remote stakeholder event, taking place on 18 November 2024 from 10.00 to 16.00 CET (exact time to be confirmed), in order to collect stakeholders’ input in the context of upcoming guidelines on the application of data protection

The Commission services in charge of the enforcement of the Digital Markets Act (DMA) and the European Data Protection Board (EDPB) have agreed to work together to clarify and give guidance on the interplay between DMA and GDPR. This enhanced dialogue between Commission’s services and the EDPB will focus on the applicable obligations to digital gatekeepers under the DMA which present a strong interplay with the GDPR, as there is a need to ensure the coherent application to digital gatekeepers of the applicable regulatory frameworks. Developing a coherent interpretation of the DMA and GDPR

The European Data Protection Board (EDPB) is organising a remote stakeholder event aimed at collecting stakeholders’ input in the context of upcoming guidelines on the application of data protection legislation in the context of ‘Consent or Pay’ models. The event will take place on 18 November 2024 from 10.00 to 16.00 CET (exact time to be confirmed). The aim of the event is to collect relevant insights from organisations that have expertise in ‘Consent or Pay’ models, which require data subjects to choose between consenting to processing of personal data for a specified purpose or paying a

Background information Date of final decision: 16 May 2024 National case Legal Reference (s): Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 14 (Information to be provided where personal data have not been obtained from the data subject), Reference, Article 15 (Right to access by the data subject), Article 27 (Representatives of controllers not established in the Union), Article 84 (Penalties) Decision

Background information Date of final decision: 24 June 2024 national case Controller: Avanza Bank AB Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 32 (Security of processing), Article 83 (General conditions for imposing administrative fines) Decision: Administrative fine Key words: Finance, Personal data breach, Administrative fine Summary of the Decision Origin of the case A Swedish bank has reported a personal data breach to the Swedish Supervisory Authority (SA). The notification states that the bank has used the Facebook pixel (now the Meta

Background information Date of final decision: 23 August 2024 (the legal 30-day appeal period has not yet expired) National case Legal Reference (s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 15 (Right to access by the data subject) Decision: Administrative fine Key words: telecommunications, right to access Summary of the Decision Origin of the case The plaintiff was a customer of the defendant (a telecom operator). Successive to a contractual incident, the complainant followed a mediation procedure with the

Background information Date of final decision: 12 August 2024 national case Controller: UNIQLO EUROPE, LTD. (BRANCH IN SPAIN) Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 32 (Security of processing). Decision: Administrative fine. Key words: Integrity and confidentiality’ and Security of processing. Summary of the Decision Origin of the case The complainant in the case, whose employment contract had been terminated, requested access to their payroll information for July 2022. In responding to the request, the controller sent an e-mail to the

Background information Date of final decision: 26 June 2024 Cross-border case The decision was taken by national supervisory authorities following the One-Stop-Shop cooperation procedure (OSS) LSA: BE SA and CSAs: HU SA Controller: KAPITOL S.A. (new name: INFOBEL S.A.), controller name anonymised in the decision sent to the EDPB Legal Reference (s): Article 4 (Definitions), Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 7 (Conditions for consent), Article 30 (Records of processing activities Decision: No violation, Choose one item

Background information Date of final decision: 22 July 2024 Cross-border case One-Stop-Shop Procedure: the decision was taken by national supervisory authorities following the One-Stop-Shop cooperation procedure (OSS). Netherlands and CSAs: All SAs, except for Bulgaria, Cyprus, Iceland, Latvia, Liechtenstein, Luxembourg and Slovenia. Legal Reference(s): Article 44 (General principle for transfers), Article 46 (Transfers by way of appropriate safeguards), Article 49 (Derogations for specific situations) Decision: Administrative fine Key words: Administrative fine, International transfer, Third