The Coordinated Supervision Committee (CSC) has elected Matej Sironic from the Slovenian Data Protection Authority (DPA) as its Deputy Coordinator for a term of two years. Sironic will be the second Deputy Coordinator, and will work along with Sebastian Hümmeler from the Federal German DPA. A second Deputy was elected in order to keep up with the CSC’s expanding mandate. Together with CSC Coordinator, Clara Guerra, they will lead the work of the Committee. The CSC ensures the coordinated supervision of the large EU Information Systems and of EU bodies, offices and agencies in accordance with

Background information Date of final decision: 18 October 2023 National case Legal Reference(s): Article 35 (Data protection impact assessment), Article 83 (General conditions for imposing administrative fines) Decision: Administrative fine Key words: Administrative fine, Insurance, Data subject rights, Responsibility of the controller, Personal data breach Summary of the Decision Origin of the case The Polish Supervisory Authority (SA) was informed that unauthorised recipient had received a document confirming the award of compensation in an email attachment. The e-mail from the insurance

Background information Date of final decision: 19 December 2023 National case Legal Reference(s): Article 33 (Notification of a personal data breach to the supervisory authority), Article 34 (Communication of a personal data breach to the data subject) Decision: Administrative fine Key words: Administrative fine, Data security, Data subject rights, Lawfulness of processing, Personal data breach, Responsibility of the controller or Sensitive data Summary of the Decision Origin of the case The Polish Supervisory Authority (SA) received a personal data breach notification from the Minister of

Background information Date of final decision: 22/12/2023 Cross-border case LSA: Hungarian SA and CSAs: Polish SA Controller: an airline company Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 17 (Right to erasure (‘right to be forgotten’)) Decision: Erasure order, Administrative fine Key words: Exercise of data subject rights, Lawfulness of processing, Right to erasure, Transparency