Brussels, 18 April - During its latest plenary, the EDPB adopted its strategy for 2024-2027. The strategy sets out the EDPB’s priorities, grouped around four pillars, as well as key actions per pillar to help achieve these objectives. These four pillars are: Pillar 1 – Enhancing harmonisation and promoting compliance Pillar 2 – Reinforcing a common enforcement culture and effective cooperation Pillar 3 – Safeguarding data protection in the developing digital and cross-regulatory landscape Pillar 4 – Contributing to the global dialogue on data protection EDPB Chair Anu Talus said: “The new

Brussels, 17 April - During its latest plenary, the EDPB adopted an Opinion following an Art. 64(2) GDPR request by the Dutch, Norwegian & Hamburg Data Protection Authorities (DPA). The Opinion addresses the validity of consent to process personal data for the purposes of behavioural advertising in the context of ‘consent or pay’ models deployed by large online platforms. EDPB Chair Anu Talus said: “Online platforms should give users a real choice when employing ‘consent or pay’ models. The models we have today usually require individuals to either give away all their data or to pay. As a

Background information Date of final decision: 4 April 2024 Cross-border case LSA: France and CSAs: Belgium, Italy, Portugal, Spain Legal References: Article 6 (Lawfulness of processing), Article 14 (Information to be provided where personal data have not been obtained from the data subject) Decision: Administrative fine Key words: Transparency, Consent Summary of the Decision Origin of the case The French Supervisory Authority (SA) has decided to initiate control proceedings against HUBSIDE.STORE, which carries out phone and SMS prospecting campaigns to promote products it sells in its store

Background information Date of final decision: 2 April 2024 National case Legal Reference(s): Articles 4, 5, 6, 7, 12-14, 22, 24, 25, 28, 30, 31, 35, 37-39, 51, 55, 58, 83 of GDPR, Article 39 of Law 4624/2019 Controller: Ministry of Migration and Asylum Decision: Infringement of the GDPR, Administrative fine Keywords: own-initiative investigation, biometric data, Data Protection Impact Assessments Summary of the Decision Origin of the case At the end of 2021, the Greek Supervisory Authority (SA) became aware of a decision of the Greek Government regarding the development and implementation of

The Coordinated Supervision Committee (CSC) has elected Matej Sironic from the Slovenian Data Protection Authority (DPA) as its Deputy Coordinator for a term of two years. Sironic will be the second Deputy Coordinator, and will work along with Sebastian Hümmeler from the Federal German DPA. A second Deputy was elected in order to keep up with the CSC’s expanding mandate. Together with CSC Coordinator, Clara Guerra, they will lead the work of the Committee. The CSC ensures the coordinated supervision of the large EU Information Systems and of EU bodies, offices and agencies in accordance with

Background information Date of final decision: 18 October 2023 National case Legal Reference(s): Article 35 (Data protection impact assessment), Article 83 (General conditions for imposing administrative fines) Decision: Administrative fine Key words: Administrative fine, Insurance, Data subject rights, Responsibility of the controller, Personal data breach Summary of the Decision Origin of the case The Polish Supervisory Authority (SA) was informed that unauthorised recipient had received a document confirming the award of compensation in an email attachment. The e-mail from the insurance

Background information Date of final decision: 19 December 2023 National case Legal Reference(s): Article 33 (Notification of a personal data breach to the supervisory authority), Article 34 (Communication of a personal data breach to the data subject) Decision: Administrative fine Key words: Administrative fine, Data security, Data subject rights, Lawfulness of processing, Personal data breach, Responsibility of the controller or Sensitive data Summary of the Decision Origin of the case The Polish Supervisory Authority (SA) received a personal data breach notification from the Minister of

Background information Date of final decision: 22/12/2023 Cross-border case LSA: Hungarian SA and CSAs: Polish SA Controller: an airline company Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 17 (Right to erasure (‘right to be forgotten’)) Decision: Erasure order, Administrative fine Key words: Exercise of data subject rights, Lawfulness of processing, Right to erasure, Transparency