Background information Date of final decision: 6 March 2024 National case Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 25 (Data protection by design and by default) Decision: Administrative fine, Compliance order, Reprimand Key words: Administrative fine, Retention time, Data retention, E-Commerce Summary of the Decision Origin of the case The Finnish Supervisory Authority (SA) investigated the activities of the online retailer Verkkokauppa.com due to a complaint filed by a customer. The controller had required the person to register themselves as

Background information Date of final decision: 28 February 2024 National case Legal Reference (s): Article 5(1)(f)(Principle of integrity and confidentiality), Article 32 (Security of processing) Controller: HELLENIC POST SERVICES S.A. Decision: Infringement of the GDPR, administrative fine Key words: non-compliance with technical and organisational measures, network vulnerabilities, unauthorised access, dark web, data breach, data breach notification, network intrusion, ransomware, security policy implementation, remote desktop, incident investigation, security review, privileged access

Background information Date of final decision: 10 April 2024 Cross-border case LSA: Czech SA and CSAs: all SAs Legal Reference (s): Article 6 (Lawfulness of processing), Article 13 (Information to be provided where personal data are collected from the data subject) Decision: Violation identified, Administrative fine Key words: Lawfulness of processing, Anonymisation, Clients, Definition of personal data, Big Data, Administrative fine, internet browsing history as personal data Summary of the Decision Origin of the case The case concerns the transfer by the controller of the personal data

Europe Day commemorates the signing of the Schuman Declaration, to celebrate peace and solidarity in Europe. Every year, the EDPB takes part in Europe Day, with an interactive stand manned by volunteers from the EDPB Secretariat and national DPAs, to raise awareness of data protection and to provide information about the EDPB’s activities This year, the EU institutions open their doors to the public in Brussels, Luxembourg and Strasbourg on Saturday 4 May. In Brussels, Europe Day will take place at the European Commission’s headquarters - the Berlaymont building - from 10:00 to 18:00. EDPB and

Background information Date of final decision: 28/11/2023 National case Controller: the municipality of Hafnarfjörður Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 28 (Processor), Article 35 (Data protection impact assessment), Article 44 (General principle for transfers), Article 46 (Transfers by way of appropriate safeguards) Decision: Compliance order, Administrative fine Key words: accountability, purpose

Background information Date of final decision: 28/11/2023 National case Controller: The municipality of Garðabær Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 28 (Processor), Article 35 (Data protection impact assessment), Article 44 (General principle for transfers), Article 46 (Transfers by way of appropriate safeguards) Decision: Compliance order, Administrative fine Key words: accountability, purpose

Background information Date of final decision: 28/11/2023 National case Controller: the municipality of Kópavogur Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 28 (Processor), Article 35 (Data protection impact assessment), Article 44 (General principle for transfers), Article 46 (Transfers by way of appropriate safeguards) Decision: Compliance order, Administrative fine Key words: accountability, purpose

Background information Date of final decision: 28/11/2023 National case Controller: the municipality of Reykjanesbær Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 28 (Processor), Article 35 (Data protection impact assessment), Article 44 (General principle for transfers), Article 46 (Transfers by way of appropriate safeguards) Decision: Compliance order, Administrative fine Key words: accountability, purpose

Background information Date of final decision: 28/11/202 National case Controller: the municipality of Reykjavík Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 28 (Processor), Article 35 (Data protection impact assessment), Article 44 (General principle for transfers), Article 46 (Transfers by way of appropriate safeguards) Decision: Compliance order, Administrative fine Key words: accountability, purpose

The EDPB has launched its 2023 Annual Report. The report provides an overview of the work carried out by the EDPB in the previous year and reflects on important milestones, such as the election of Anu Talus as EDPB Chair; the adoption of two binding decisions and one urgent binding decision providing important common interpretations of data protection law and key legal principles that will shape the digital landscape; and the launch of the EDPB’s first outreach project for a general audience: the EDPB Data Protection Guide for small business. In addition, it includes examples of enforcement by