4 November 2024
… Article 5 (Principles relating to processing of personal data), Article 32 (Security of processing), Article 24 … Key words: Principles relating to processing of personal data, Data security, Public administration, Sensitive data … is not satisfactory to ensure compliance with the data protection regulations, and that securing confidentiality …
6 September 2020
… Type: Guidelines Topics: Controller Processor The European Data Protection Board welcomes comments on the Guidelines … 32). A processor must also designate a data protection officer under certain conditions (Article 37) and has a duty …
22 July 2020
… Type: Guidelines Topics: Financial matters The European Data Protection Board welcomes comments on the Guidelines … set out in the Regulation and in accordance with applicable data protection rules. All legal details can be found in our …
7 July 2022
… Cyber attack, Ransomware, Dark Web, Special Categories of Data Summary of the Decision Origin of the case The … most of the municipality’s IT systems, the municipality’s data was encrypted, and back-ups were erased. Ransom … flawed. These flaws include logs and log analytics, backup protection and lack of two-factor authentication or similar …
17 September 2024
… Article 5 (Principles relating to processing of personal data) Decision: Administrative fine Key words: Health … had processed, without authorisation, non-anonymous health data, transmitted to its customers in order to carry out … French SA to use them (Article 66.III of the French Data Protection Act). To assess whether or not the data processed …
20 January 2023
… Reference: Principles relating to processing of personal data (Article 5(1)(a)(e); Lawfulness of processing (Article … and modalities for the exercise of the rights of the data subject (Article 12); Information to be provided where … controllers not established in the Union (Article 27); Data protection impact assessment (Article 35) …
30 May 2018
… - version adopted after public consultation The European Data Protection Board welcomes comments on the Guidelines 1/2018 … circumstances (including the appointment of Data Protection Officers and carrying out data protection impact …
2 February 2024
… and modalities for the exercise of the rights of the data subject), Article 17 (Right to erasure (‘right to be forgotten’)), Article 25 (Data protection by design and by default) Decision: reprimand Key …
12 June 2023
… case: Cross-border case LSA: Swedish Authority for Privacy Protection (IMY) CSAs: All other SAs Controller: Spotify … Legal references: Article 15 (Right to access by the data subject), Article 12.1, Article 12.3, Article 58, … the complainants request for access Key words: Exercise of data subject rights, Transparency, Administrative fine …
16 May 2023
… Article 13 (Information to be provided where personal data are collected from the data subject), Article 28 (Processor) Decision: … provision of Article 13, paragraph 1 of the General Data Protection Regulation. This resulted in non-transparent …
4 September 2025
… STYLES SERVICES CO. LIMITED Legal Reference: The French Data Protection Act (Article 82): failure to obtain user consent … withdrawing consent Decision: Infringement of the French Data Protection Act, Administrative fine Key words: Cookies …
4 September 2025
… without free and informed consent (Article 82 of the French Data Protection Act) Decision: Infringement of the French Post … Electronic Communications Code, Infringement of the French Data Protection Act, Administrative fine and injunction Key …
7 December 2023
… and modalities for the exercise of the rights of the data subject), Article 17 (Right to erasure (‘right to be forgotten’)), Article 25 (Data protection by design and by default) Decision: Warning Key …
4 November 2024
… Decision: Compliance order, Definitive limitation data processing, Administrative fine Key words: CCTV, … people or property (violation of Article 78 of the national Data Protection Act). And second, these CCTV footages were …
21 June 2022
… (Art. 6) and principles relating to processing of personal data (Art. 5) Decision: Infringement of the GDPR and fine … process had no legal basis according to the General Data Protection Regulation. Publication of a CV has been a …
15 April 2024
… fine Keywords: own-initiative investigation, biometric data, Data Protection Impact Assessments Summary of the Decision …
18 July 2023
… Controller: UiPath SRL Legal references: Article 25 (Data protection by design and by default), Article 32 (Security … Decision: Administrative fine, Compliance order Key words: Data protection by design and by default, Personal data …
7 September 2020
… New Technology Automated decision & profiling The European Data Protection Board welcomes comments on the Guidelines 8/2020 … according to Article 35 GDPR, and whether a data protection officer must be appointed under Article 37 GDPR. In the …
4 March 2022
… (Art. 32) and Principles relating to processing of personal data (Art. 5) Decision: Infringement of the GDPR and fine … of the case The Norwegian parliament – the Storting – had a data breach in late 2020. In January 2022, the Norwegian … similar effective security measures to achieve satisfactory protection. Decision The Norwegian SA have issued a EUR …
12 February 2019
… Monitoring Bodies under Regulation 2016/679 The European Data Protection Board welcomes comments on the Guidelines 1/2019 … and monitoring body. Similar to a data protection officer, the monitoring body should be able to act free from …