Background information Date of final decision: 28/11/2023 National case Controller: the municipality of Hafnarfjörður Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 28 (Processor), Article 35 (Data protection impact assessment), Article 44 (General principle for transfers), Article 46 (Transfers by way of appropriate safeguards) Decision: Compliance order, Administrative fine Key words: accountability, purpose

Background information Date of final decision: 28/11/2023 National case Controller: The municipality of Garðabær Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 28 (Processor), Article 35 (Data protection impact assessment), Article 44 (General principle for transfers), Article 46 (Transfers by way of appropriate safeguards) Decision: Compliance order, Administrative fine Key words: accountability, purpose

Background information Date of final decision: 28/11/2023 National case Controller: the municipality of Kópavogur Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 28 (Processor), Article 35 (Data protection impact assessment), Article 44 (General principle for transfers), Article 46 (Transfers by way of appropriate safeguards) Decision: Compliance order, Administrative fine Key words: accountability, purpose

Background information Date of final decision: 28/11/2023 National case Controller: the municipality of Reykjanesbær Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 28 (Processor), Article 35 (Data protection impact assessment), Article 44 (General principle for transfers), Article 46 (Transfers by way of appropriate safeguards) Decision: Compliance order, Administrative fine Key words: accountability, purpose

Background information Date of final decision: 28/11/202 National case Controller: the municipality of Reykjavík Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 28 (Processor), Article 35 (Data protection impact assessment), Article 44 (General principle for transfers), Article 46 (Transfers by way of appropriate safeguards) Decision: Compliance order, Administrative fine Key words: accountability, purpose

The EDPB has launched its 2023 Annual Report. The report provides an overview of the work carried out by the EDPB in the previous year and reflects on important milestones, such as the election of Anu Talus as EDPB Chair; the adoption of two binding decisions and one urgent binding decision providing important common interpretations of data protection law and key legal principles that will shape the digital landscape; and the launch of the EDPB’s first outreach project for a general audience: the EDPB Data Protection Guide for small business. In addition, it includes examples of enforcement by

Brussels, 18 April - During its latest plenary, the EDPB adopted its strategy for 2024-2027. The strategy sets out the EDPB’s priorities, grouped around four pillars, as well as key actions per pillar to help achieve these objectives. These four pillars are: Pillar 1 – Enhancing harmonisation and promoting compliance Pillar 2 – Reinforcing a common enforcement culture and effective cooperation Pillar 3 – Safeguarding data protection in the developing digital and cross-regulatory landscape Pillar 4 – Contributing to the global dialogue on data protection EDPB Chair Anu Talus said: “The new

Brussels, 17 April - During its latest plenary, the EDPB adopted an Opinion following an Art. 64(2) GDPR request by the Dutch, Norwegian & Hamburg Data Protection Authorities (DPA). The Opinion addresses the validity of consent to process personal data for the purposes of behavioural advertising in the context of ‘consent or pay’ models deployed by large online platforms. EDPB Chair Anu Talus said: “Online platforms should give users a real choice when employing ‘consent or pay’ models. The models we have today usually require individuals to either give away all their data or to pay. As a

Background information Date of final decision: 4 April 2024 Cross-border case LSA: France and CSAs: Belgium, Italy, Portugal, Spain Legal References: Article 6 (Lawfulness of processing), Article 14 (Information to be provided where personal data have not been obtained from the data subject) Decision: Administrative fine Key words: Transparency, Consent Summary of the Decision Origin of the case The French Supervisory Authority (SA) has decided to initiate control proceedings against HUBSIDE.STORE, which carries out phone and SMS prospecting campaigns to promote products it sells in its store

Background information Date of final decision: 2 April 2024 National case Legal Reference(s): Articles 4, 5, 6, 7, 12-14, 22, 24, 25, 28, 30, 31, 35, 37-39, 51, 55, 58, 83 of GDPR, Article 39 of Law 4624/2019 Controller: Ministry of Migration and Asylum Decision: Infringement of the GDPR, Administrative fine Keywords: own-initiative investigation, biometric data, Data Protection Impact Assessments Summary of the Decision Origin of the case At the end of 2021, the Greek Supervisory Authority (SA) became aware of a decision of the Greek Government regarding the development and implementation of