Background information Date of final decision: 23 August 2024 (the legal 30-day appeal period has not yet expired) National case Legal Reference (s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 15 (Right to access by the data subject) Decision: Administrative fine Key words: telecommunications, right to access Summary of the Decision Origin of the case The plaintiff was a customer of the defendant (a telecom operator). Successive to a contractual incident, the complainant followed a mediation procedure with the

Background information Date of final decision: 12 August 2024 national case Controller: UNIQLO EUROPE, LTD. (BRANCH IN SPAIN) Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 32 (Security of processing). Decision: Administrative fine. Key words: Integrity and confidentiality’ and Security of processing. Summary of the Decision Origin of the case The complainant in the case, whose employment contract had been terminated, requested access to their payroll information for July 2022. In responding to the request, the controller sent an e-mail to the

Background information Date of final decision: 26 June 2024 Cross-border case The decision was taken by national supervisory authorities following the One-Stop-Shop cooperation procedure (OSS) LSA: BE SA and CSAs: HU SA Controller: KAPITOL S.A. (new name: INFOBEL S.A.), controller name anonymised in the decision sent to the EDPB Legal Reference (s): Article 4 (Definitions), Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 7 (Conditions for consent), Article 30 (Records of processing activities Decision: No violation, Choose one item

Background information Date of final decision: 22 July 2024 Cross-border case One-Stop-Shop Procedure: the decision was taken by national supervisory authorities following the One-Stop-Shop cooperation procedure (OSS). Netherlands and CSAs: All SAs, except for Bulgaria, Cyprus, Iceland, Latvia, Liechtenstein, Luxembourg and Slovenia. Legal Reference(s): Article 44 (General principle for transfers), Article 46 (Transfers by way of appropriate safeguards), Article 49 (Derogations for specific situations) Decision: Administrative fine Key words: Administrative fine, International transfer, Third

Background information Date of final decision: 2 July 2024 Cross-border case or national case: cross-border case One-Stop-Shop Procedure: the decision was taken by national supervisory authorities following the One-Stop-Shop cooperation procedure (OSS) LSA: LT and CSAs: FR, DE, PL, NL, ES Controller: Vinted, UAB Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 83 (General conditions for imposing

Brussels, 17 July - During its latest plenary, the European Data Protection Board (EDPB) adopted a statement on the Data Protection Authorities’ (DPAs) role in the Artificial Intelligence Act (AI Act) framework. According to the EDPB, DPAs already have experience and expertise when dealing with the impact of AI on fundamental rights, in particular the right to protection of personal data, and should therefore be designated as Market Surveillance Authorities (MSAs) in a number of cases. This would ensure better coordination among different regulatory authorities, enhance legal certainty for all

The Coordinated Supervision Committee (CSC) elected Fanny Coudert from the European Data Protection Supervisor (EDPS) as its new coordinator for a term of two years. Ms. Coudert succeeds former coordinator Clara Guerra from the Portuguese Data Protection Authority (DPA). Fanny Coudert will lead the work of the Committee with the support of Deputy Coordinators Sebastian Hümmeler from the Federal German DPA and Matej Sironic from the Slovenian DPA. EDPB Chair Anu Talus said: “I would like to thank outgoing CSC coordinator Clara Guerra for her valuable work in the past years, which helped the CSC

Brussels, 19 June - During its latest plenary, the Members of the European Data Protection Board (EDPB) elected Zdravko Vukić, Director of the Croatian Personal Data Protection Agency, as Deputy Chair. Vukić replaces Aleid Wolfsen (Chair of the Dutch Data Protection Authority), who has reached the end of his five-year mandate as EDPB Deputy Chair. Over the coming years, Zdravko Vukić, together with fellow Deputy Chair Irene Loizidou Nikolaidou, will work closely together with EDPB Chair Anu Talus to ensure the consistent application of EU data protection rules and to promote effective

Brussels, 24 May - During its latest plenary, the EDPB adopted an Opinion on the use of facial recognition technologies by airport operators and airline companies to streamline the passenger flow at airports*. This Article 64(2) Opinion, following a request from the French Data Protection Authority, addresses a matter of general application and produces effects in more than one Member State. EDPB Chair Anu Talus said: “More and more airport operators and airline companies around the world are piloting facial recognition systems allowing passengers to go more easily through the various

The EDPB Data Protection Guide for small business is now available in French and German The Guide provides practical information to SMEs about GDPR compliance and benefits in an accessible and easily understandable language. The development of tools providing practical, easily understandable and accessible data protection guidance is key to reaching a non-expert audience and a strategic objective for the EDPB. The EDPB Data Protection Guide for small business covers various aspects of the GDPR, from data protection basics, to data subject rights and measures to secure personal data. It