Background information Date of final decision: 26 September 2024 Cross-border case LSA: France CSAs: For TELEMAQUE: Germany, Austria, Belgium, Cyprus, Spain, Greece, Hungary, Italy, Latvia, Luxembourg, Netherlands, Portugal, Czech Republic, Sweden. For COSMOSPACE: Germany, Austria, Belgium, Croatia, Denmark, Spain, Greece, Italy, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovenia, Sweden. Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 9 (Processing of special categories of personal data) Decision: Administrative fine Key words

Brussels, 05 November - During its latest plenary, the European Data Protection Board (EDPB) adopted a report on the first review 1 of EU-U.S. Data Privacy Framework (DPF), as well as a statement on the recommendations of the high-level group (HLG) 2 on access to data for effective law enforcement. The EDPB welcomes the efforts by the U.S. authorities and the European Commission to implement the DPF, and takes note of several developments that took place since the adoption of the adequacy decision in July 2023. Regarding commercial aspects, i.e. the application and enforcement of requirements

Background information Date of final decision: 4 September 2024 National case Legal references: Article 32 (Security of processing), Article 24 (Responsibility of the controller) Decision: Administrative fine Key words: Responsibility of the controller, Publicly available data, Data security, Employment Summary of the Decision Origin of the case In February 2024, an employee at the University of Agder discovered that documents containing personal data had been stored in open Teams folders, that employees without a need to know had access to. The data breach has been ongoing since the

The EDPB is holding a stakeholder event on “AI models” with participants representing European sector associations, organisations, NGOs, individual companies, law firms and academics. During today’s event, the EDPB will collect input for of the preparation of a consistency opinion on AI models, requested by the Irish Data Protection Authority under Art. 64 (2) GDPR. EDPB Chair Anu Talus said: “During the stakeholder event we will tackle a number of targeted questions, which will feed our reflection in the context of the preparation of our Opinion on AI models. Stakeholder input is especially

Background information Date of final decision: 28 June 2024 National case Legal references: Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data) Decision: Administrative fine Key words: Lawfulness of processing Summary of the Decision Origin of the case The Norwegian Supervisory Authority (SA) decided to impose an infringement penalty of NOK 250,000 to Eidskog Municipality for breach of the requirements for a legal basis in the General Data Protection Regulation. Key findings The Norwegian SA’s conclusion is based on the Eidskog Municipality’s

Background information Date of final decision: 18 March 2024 National case Legal references: Article 5 (Principles relating to processing of personal data), Article 32 (Security of processing), Article 24 (Responsibility of the controller) Decision: Administrative fine, Compliance order Key words: Principles relating to processing of personal data, Data security, Public administration, Sensitive data Summary of the Decision Origin of the case The Norwegian Supervisory Authority (SA) carried out an inspection of Norwegian Labour and Welfare Administration (NAV) in September 2023, and announced

Background information Date of final decision: 5 October 2024 National case Legal reference: Article 6 (Lawfulness of processing) Decision: Compliance order, Definitive limitation data processing, Administrative fine Key words: CCTV, Lawfulness of processing, Legitimate interest, Employment Summary of the Decision Origin of the case The Slovenian Supervisory Authority (SA) carried out an investigation in 2023 against the company FOVELLA d.o.o., acting as the owner of DODO PIZZA franchise in Slovenia. The investigation revealed unlawful monitoring of employees in the restaurant’s kitchen via

On 8 October 2024, the European Data Protection Board met with Commissioners and representatives of Data Protection Authorities (DPAs) from the fifteen countries having been subject to an EU adequacy decision. The meeting took place in the margins of the EDPB October’s plenary and reflects the EDPB’s commitment to international engagement. The European Commission has so far recognised the following adequate countries: Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, United Kingdom, Uruguay and United States

Update on 15/10/24: The call is now closed. Thank you to all those who expressed an interest in taking part in the EDPB stakeholder event on ‘AI models’. We will carefully review all applications and communicate the results of the process to those who applied in the coming weeks. Brussels, 15 October - The European Data Protection Board (EDPB) organises a remote stakeholder event, taking place on 5 November 2024 (time to be confirmed), aimed at collecting input from stakeholders in the context of a request for an Art. 64(2) GDPR opinion relating to artificial intelligence models (‘AI models’)

Brussels, 11 October -The EDPB will organise a stakeholder event on ‘AI models’ on 5 November 2024 (exact time to be confirmed). During its latest plenary, the European Data Protection Board (EDPB) exceptionally agreed to organise a remote public event aimed at collecting input from stakeholders on issues relating to the request for an Art. 64(2) GDPR opinion on artificial intelligence ("AI") submitted to the EDPB by the Irish Data Protection Authority (DPA). Individuals representing European sector associations, organisations or NGOs and individual companies, law firms or academics are