26 June 2020
… on the basis of its legitimate interest (Article 6.1, f) GDPR), sent direct marketing messages to (former) donors for … subject to the data controller pursuant to Article 17.1 GDPR and its right to object pursuant to Article 21.2 GDPR. The Litigation Chamber decided that the data …
15 December 2020
… Commission (DPC) has today announced a conclusion to a GDPR investigation it conducted into Twitter International … found that Twitter infringed Article 33(1) and 33(5) of the GDPR in terms of a failure to notify the breach on time to … Concerned Supervisory Authorities under Article 60 of the GDPR in May of this year, was the first one to go through …
17 May 2023
… Findings The French SA has identified four breaches of the GDPR and a breach of the French Data Protection Act by … the purposes for which they are processed (Article 5.1(e) GDPR) Failure to obtain consent from individuals to collect their health data (Article 9 GDPR) Failure to provide a formal legal framework for the …
22 March 2022
… Legal Reference: Articles 5(1)(f), 5(2), 24(1) and 32(1) GDPR Decision: Administrative fine of €17m imposed Key … the requirements of Articles 5(1)(f), 5(2), 24(1) and 32(1) GDPR in relation to the processing of personal data relevant … found that Meta Platforms infringed Articles 5(2) and 24(1) GDPR. While the DPC found that the information and …
24 January 2023
… instructed the IE DPA to add an infringement of Art. 6(1) GDPR. Additionally, the EDPB instructed the IE DPA to … of the principle of fairness under Art. 5(1)(a) GDPR. The EDPB further decided that the IE DPA must carry … it processes special categories of personal data (Art. 9 GDPR); whether it processes data for the purposes of …
12 March 2024
… SA founded that the data controller infringed Article 12(3) GDPR because it failed to inform the Data Subject of the … of transparent data processing according to Article 5(1)(a) GDPR as the Data Subject could not see what additional data, … data. The Hungarian SA has also found that Article 5(2) GDPR cannot be regarded as a provision requiring mandatory …
4 May 2022
… the authority of the controller or processor (Article 29 GDPR), Security of processing (Article 32 GDPR), Processor (Article 28 GDPR) Decision: Administrative fine Key words: Health data …
26 July 2024
… the company to applicants (infringements of Article 5(1)(a) GDPR (principles of fairness and transparency, Article 12(1) and (4) GDPR); processing in the context of a company’s ‘shadow … (infringements of lawfulness principle, Article 5(1)(a) GDPR and Article 6(1) GDPR); improper implementation of the …
30 November 2022
… case: National case Legal references: Article 6 (1) GDPR (Lawfulness of processing), Article 5 (1) (a) GDPR (Principles relating to processing of personal data), Article 9 (1) and (2) GDPR (Processing of special categories of personal data), …
7 December 2023
… can therefore be lawful only if it has a legal basis under GDPR Article 6(1). Where the processing also involves … the controller must have a legal basis under Article 6(1) GDPR or the processing must also comply with one of the situations set out in Article 9(2) GDPR. The reply of the Company to the request of access …
23 January 2024
… Key Findings The French SA found several breaches of the GDPR regarding: Warehouse stock and order management: … with the principle of data minimisation (Article 5.1.c GDPR). Failure to ensure lawful processing (Article 6 GDPR) by using three indicators which are illegal: the "Stow …
16 June 2022
… on certification as a tool for transfers . Art. 46(2)(f) GDPR introduces approved certification mechanisms as a new … tool for transfers - a new transfer tool introduced by the GDPR. The guidelines provide guidance on how this tool can … a dispute resolution decision on the basis of Art. 65 GDPR . The binding decision seeks to address the lack of …
20 August 2020
… the e-Privacy Directive forms lex specialis vis-à-vis the GDPR (as lex generalis), as stated in article 95 GDPR, the provisions with regard to consent of the GDPR remain applicable as preconditions for lawful …
16 September 2022
… Reference: data retention periods (Article 5.1.e of the GDPR), security of personal data (Article 32 of the GDPR) Decision: infringement of the GDPR, Administrative fine Key words: website, data retention …
26 January 2023
… The principle of accountability (Article 5(2) of the GDPR), lawfulness of processing (Article 6(1) of the GDPR) Summary of the Decision Origin of the case The … of such measures must comply with the requirements of the GDPR. In the light of the principle of accountability …
18 September 2023
… Findings The French SA has found several breaches of the GDPR: Infringement of the data minimisation (Article 5(1)(c) of the GDPR) Infringement of the ban on processing sensitive data (Article 9 of the GDPR) A breach of the ban on processing personal data …
25 November 2020
… decision to specify certain viewpoints, the primacy of the GDPR as EU law resulted in the decision that a priori analysed potential breaches of the GDPR. Decision of the Litigation Chamber The litigation … were not processed in a lawful way under article 6.1.f. GDPR, as there were legitimate interests for the defendants …
23 September 2021
… National case Legal Reference: Information (Article 14 GDPR), Right of access by the data subject (Article 15 GDPR) Decision: Infringement of the GDPR, reprimand, and order to comply Summary of the Decision …
26 January 2021
… fine of NOK 100 000 000 for not complying with the GDPR rules on consent. - Our preliminary conclusion is that … to users. We consider that this was contrary to the GDPR requirements for valid consent. - Grindr is seen as a … magnitude as our findings suggest grave violations of the GDPR. Grindr has 13.7 million active users, of which …
7 December 2023
… adopted an order imposing a temporary ban under Art. 66 (1) GDPR on Meta IE and Facebook Norway AS (“Facebook Norway”) … EDPB concluded that there are ongoing infringements of the GDPR and there is an urgent need to act in light of the … found that there was an ongoing infringement of art. 6 (1) GDPR because of the inappropriate use of the legal bases of …