holding_Garante per la protezione dei dati personali (Italy) - 9771142

The DPA found violations related in particular to the inadequate privacy notice provided to data subjects (insofar as it lacks an indication of joint ownership of the processing) and 'formulated in a generic and approximate manner' with 'unclear and incomplete information' and 'not easy to understand'. Purposes of the processing were not well specified, the references to the rights of the data subjects were vague and incomplete, and it was not clear whether data subjects were obliged or not to provide their data, nor what the consequences of a possible refusal would be.
The DPA found the following violations:
1. Violation of article 13 Privacy Code, for failure to acquire the consent of the data subjects.
2. Violation of articles 37 and 163 Privacy Code, for failure to notify the DPA of the breach.
3. Violation of Article 164-bis (2) Privacy Code, because the violations committed relate to databases of particular relevance or size.
Consequently, the DPA fined Uber B.V. (Holland) and Uber Technologies Inc. (USA), €2,120,000 respectively (a total of €4,240,000), for violations relating to 1,5 million data subjects in Italy, including drivers and passengers.
In defining the amount of the sanctions, the DPA, in addition to the seriousness of the violations ascertained, also took into account the significant number of data subjects involved and the economic conditions of the company.


holding_Tietosuojavaltuutetun toimisto (Finland) - 7684/171/22

The DPA cited the “Schrems II” decision (C-311/18) and held that the controller had infringed Articles 44 and 46 GDPR because 1) the controller had not established a lawful basis for the transfers in accordance with Chapter V GDPR and 2) nor had the controller put in place appropriate safeguards for the transfers. Therefore, the controller had unlawfully transferred personal data of its website visitors to the United States by using Google Analytics and reCAPTCHA services.
As a result, the DPA 1) issued a reprimand to the controller and 2) ordered the controller to delete all personal data that were transferred to the United States without a lawful basis. Because the controller had already disabled the Google services from its website, the DPA did not deem necessary to order the controller to do the same and to bring the processing into compliance with the GDPR.
Finally, the DPA highlighted that controllers cannot transfer their responsibility to data subjects by instructing data subjects, for example, to install a Google add-on on their browser to block the use of Google's tracking technologies, such as Google Analytics. The DPA added that Google add-on does not completely prevent the transmission of the data subject's data to Google, as it does not prevent the downloading of Google Analytics scripts from Google's servers.


holding_ANSPDCP (Romania) - Natural Person

The DPA held that the publication of the personal data constituted a violation of the provisions of Article 5(1)(a) GDPR, Article 5(1)(f) GDPR, Article 6(1)(a) GDPR. As such, the DPA imposed a fined on the controller of €100 (for violating the provisions of Article 5(1)(a), 5(1)(f), and Article 6(1)(a) GDPR) and €50 (for violating Article 58(1)(a), 58(1)(e) and Article 83(5)(e) GDPR).
Thus, the DPA fined the controller €150 in total.

ANSPDCP (Romania) - Natural Person


Preliminarily, the DPA noted that the processing of personal data in the context of archiving, scientific, historical or statistical purposes is regulated under Austrian law by § 7 of the Data Protection Law (Datenschutzgesetz - DSG). Such a provision is an implementation of Article 89 GDPR, which enables Member States to adopt rules limiting data subjects’ rights in the context of the above mentioned processing activities, provided that safeguards are implemented.
According to § 7(2) DSG, processing of personal data that were not previously publicly available or were not subsequently anonymised could be based only on specific legal provisions, consent or authorisation by the supervisory authority. In the case at issue, the controller could rely exclusively on the latter legal basis.
The DPA considered several elements in the authorisation process:
1) The controller planned to erase or anonymise data as soon as they were no longer necessary for the purposes of the processing. These considerations also applied to data transferred to third parties, insofar as the disclosure was necessary to the research purposes. The controller guaranteed that when anonymisation was not a feasible measure, disclosure would have been possible only to the extent that legitimate interests of the controller outweighted data subject’s rights. The controller also planned to make use of processors that could guarantee compliance with the GDPR, pursuant to Article 28 GDPR.
2) The controller also stated that European data protection standards would have been respected in case data were transferred outside the EU.
3) The collection of consent from data subjects would have been impossible or a disproportionate effort for the controller.
4) The objective pursued by the controller – namely a higher level of safety in the development of automated vehicles - was in the public interest.
In light of the above, the DPA granted the authorisation to the processing. However, the DPA imposed two additional conditions: first, processing of data subjects’ faces should be limited as far as possible; second, the controller was not allowed to transfer data to third parties in lack of an additional administrative authorisation.

DSB (Austria) - 2022-0.930.971


The DPA held the following:
Lawfulness of the processing and transparency under Article 5(1)(a) GDPR in conjunction with Article 6, 12 and 13 GDPR
The DPA considers that the controller had a lawful legal basis for processing fingerprints in the context of creating ID cards under Article 6(1)(c) GDPR. The DPA goes as far as stating that there is an “unmistakably” legal obligation on the controller to process fingerprints for ID cards creation.
Violation of Articles 5(1)(a), 12 and 13 GDPR
The DPA starts its analysis by stating that no document can confirm that whether the data subject obtained the information when the fingerprints were provided, i.e. when the processing started.
Nevertheless, the DPA reiterated that the controller is under the obligation of provide a data subject with all information required when the fingerprints are first taken, as per Article 13 GDPR. The controller is under the further obligation to provide the information requested when the personal data are obtained from the data subject as per Article 13 GDPR and to ensure transparency in information and communication under Article 12 GDPR.
The DPA found that no violation of Articles 5(1)(a), 12 and 13 GDPR.
Violation of Article 5(1)(b) GDPR and Article 5(1)(c) GDPR
In relation to a possible violation of Article 5(1)(b) GDPR, the DPA considered first the fact that fingerprints are digitalized by ad hoc sensors at the initiative of the municipal authority. The digital image of these prints is then securely transmitted through the services for the National Registry to issue ID cards. This means that after fingerprints are registered and kept for up to three months to produce electronic ID cards. This is necessary so that the card producer can put the correct data on the chip, avoiding the need to re-register fingerprints in case of any technical malfunction. No later than three months from registration, the fingerprints are removed from the system and only one fingerprint per hand remains on the chip of the electronic ID.
Thus, the DPA concluded that there is no indication that the principle of purpose limitation, under Article 5(1)(b) GDPR, is violated.
In relation to a possible violation of Article 5(1)(c) GDPR, the fact that multiple fingerprints are processed per hand is motivated by the fact that it is prescribed by law that the best quality fingerprint should be integrated into the chip. This justifies the fact that several fingerprints per hand should be taken to select the best one.
Moreover, the storing of fingerprints for maximum three months indicates that the digital image of the fingerprints is only kept for the time necessary for the creation and issuance of the ID card. This ensures that fingerprints are not kept longer than necessary.
Thus, the DPA concluded that no violation of the principle of data minimization, as per Article 5(1)(c) GDPR.
To conclude, the DPA did not find any violation of Article 5(1)(b), 5(1)(c), 6(1)(a), 12 and 13 GDPR.

APD/GBA (Belgium) - 12/2025


The DPA held that the data controller was authorized to process the payment history data on the basis of legitimate interests which outweigh the fundamental rights and freedoms of the data subject. The court emphasized that the issue in question is subject of the implementation of the Data Protection Act and of resolved case. Further, applicable Icelandic law requires that a consumer's creditworthiness be assessed prior to the granting of a consumer loan and state, inter alia, that information from the financial information databases may be used for this purpose. According to the applicable law, the processing of personal data relating to four years from the date of its registration is permitted.

Persónuvernd - 2020010738


Governmental Bodies
The DPA clarifies its vision on why the defendant does not qualify for an exemption for administrative fines for public entities and/or government bodies. What falls under this definition is not defined in Article 83(7) and it is up to the member states to implement this in line with Union law.
In Belgium, Article 83(7) is not applicable to government bodies unless it is a legal entity under public law that offers goods or services on a market.
According the Article 5(2) of the Belgian Data Protection Law (Wet Gegevensbescherming), the defendant is classified as a government because it is an educational institution, in the form of a private not for profit. They were established for the specific purpose of meeting needs in the general interest that are not of an industrial or commercial nature (namely, to provide primary and secondary education), and its activities are primarily financed by the Flemish government and it is also under government supervision.
However, the exemption is not applicable when this 'government body' offers goods or services on a market. In Belgium, there is a market for private education as there is (non-)recognised private education available and thus competition.
The DPA holds that the term "public authorities and public bodies" in Article 83(7) cannot be interpreted so broadly as to include legal persons under private law that perform a task of general interest, such as free educational institutions.
The DPA holds that giving a broad interpretation to article 221(2) Wet Gegevensbescherming would contradict, on the one hand, the explicit will of the Belgian legislator not to exempt schools from administrative fines and, on the other hand, the restrictive interpretation that Article 83(7) should be given as an exception;
As such, Article 83(7) is not applicable which means article 221(2) Wet Gegevensbescherming is not applicable and thus free educational institutions are not exempt from administrative fines for violations of the GDPR.

Administrative fine
There are three factors which the DPA takes into consideration to determine a fine: gravity, duration and dissuasive effect.
The severity of the infraction on Article 6 GDPR and Article 8 GDPR is very high because it concerns fundamental principles of data protection and special protection of minors.
Regarding the duration, there was an earlier complaint against the defendant in 2016 concerning the same survey. In 2018, the survey was used again. The survey of 2016 is not taken into account since the GDPR was not yet into effect.
The DPA does take into account that the defendant anonymised the survey and that it is prepared to take additional measures. On top of that, it is also a not for profit organisation.
Lastly, a part of the infractions from Decision 31/2020 have been annulled.
Considering the above, the DPA lowers the fine to €1,000.

APD/GBA (Belgium) - 36/2021


holding_ICO (UK) - Advanced Computer Software Group Limited

The DPA found that the processor did not have in place a system to perform regular vulnerability scanning in relation to the breached systems. The DPA noted that this practice was in stark contrast to the advice issued by the National Cyber Security Centre (NCSC). The DPA found that the processor had infringed the obligation to adopt appropriate technical and organisational safety measures in Article 32(1)(b) UK GDPR in failing to implement comprehensive and regular vulnerability scanning in their systems.
The investigation also revealed that the attainment of administrator privileges was explicable due to the exploitation of the “ZeroLogon” vulnerability, a vulnerability which had been discovered and widely publicised about two years prior to the incident. Although some work had been performed to address this vulnerability, the DPA found this to be “ad hoc”, with no record of the patch having been implemented and the processor unable to confirm if it had been implemented at the time of the breach. The DPA found that the failure of the processor to fully implement this patch constituted an infringement of Article 32(1)(b) UK GDPR.
The investigation also revealed that the breached server did not have Multi-Factor Authentication (MFA) enabled. The implementation of MFA, the investigation revealed, would have prevented the data breach. The DPA noted the high turnover of the processor, and the scope of personal data they process on their systems (between 25-30 million data subjects). The DPA found that the failure to implement MFA on the breached system constituted an infringement of Article 32(1)(b) UK GDPR.
The DPA, in light of the nature and scope of the breach, categorized the infringement as having a high degree of seriousness. The DPA issued a provisional fine of £6.09 million (€7.28 million) in August 2022, but following acknowledgment by the processor of the fine and agreement to a voluntary settlement, the fine was reduced to £3.07 million (€3.68 million).


holding_Datatilsynet (Norway) - 21/03530

Temporary ban on processing (order)
Pursuant to Article 66(1) GDPR and 58(2)(f) GDPR the Norwegian DPA consequently issued a temporary ban on Meta and Facebook Norway AS regarding the processing of personal data for behavioural advertising on Facebook and Instagram based on Article 6(1)(b) or 6(1)(f) GDPR. The order applies in Norway and remains valid provisionally for three (3) months from 4 August 2023 until 3 November 2023. However, the ban will be lifted if Meta would impelement remedial measures before that date. In this context, the authority welcomes a dialogue with Meta on elements such as limiting the scope of processing of personal data for behavioural advertising and introducing new user settings for behavioural advertising. Additionally, if the order is not complied with, the authority may impose a coercive fine of up to NOK 1,000,000 (approx. € 90,000) per day.
Urgent binding decision by the EDPB
Furthermore, subsequent to the issuance of the order, the Norwegian supervisory authority stated the intention to request an urgent binding decision by the EDPB correspondingly, pursuant to Article 66(2) GDPR, so that that final measures may urgently be adopted.

Datatilsynet (Norway) - 21/03530


holding_Tietosuojavaltuutetun toimisto (Finland) - 4300/182/2019

Concerning the first question, the DPA held that under Article 2(2)(d) GDPR, the Regulation does not apply to the processing of personal data by competent authorities, including courts, for criminal prosecution. Furthermore, according to the CJEU's case C-245/20 - Autoriteit Persoonsgegevens, the procedure whereby a court temporarily makes available to journalists procedural documents containing personal data to enable them to understand better the course of the proceedings falls within the scope of that court's "judicial functions". Therefore, under Article 55(3) GDPR, the DPA is not competent to supervise such processing.
Regarding the second question, the DPA held that courts charge a fee under § 34 of the Public Access to Information Act for providing access to documents. Further, the payment in the present case is charged ex post facto, and according to § 29(2) of the Finnish Data Protection Act, a personal identity number may be processed for debt collection. Consequently, the processing is justified under Article 6(1)(c) GDPR as it is necessary for compliance with a legal obligation to which the controller is subject.
Finally, the DPA also requested the Supreme Court to reassess the likelihood and severity of the risk of discovering the data subject's identity by accessing information from the billing system where it is stored. The Supreme Court must announce the reassessment and possible measures to reduce or eliminate the risks by 15 September 2022.


The DPA held that under its current practice, it is not possible under Article 15 GDPR to obtain information about specific individuals who have processed personal data within the controller. This applies irrespective of the fact:
- that the person is employed by a controller,
- which systems and collections the employee has accessed, and - whether the access was lawful or unlawful.

IP - 07120-1/2021/168


The Icelandic DPA outlined the importance of media and freedom of expression in a democratic society. It went on to say that the media must also guarantee democratic principles, including the respect for rights such as the right to privacy.
The DPA outlined that freedom of expression, as well as the right to privacy, were enshrined in the Icelandic Constitution. The right to freedom of expression can be found under Article 73, whilst the right to privacy falls within Article 71 of the Constitution. Elaboration on the latter Article can be found in the national Act 90/2018 and the GDPR.
The Icelandic DPA outlined that Article 6 Act 90/2018 provides for the harmonization of the right to privacy and freedom of expression. The Article is based on Article 85 GDPR which obliges member states to reconcile data protection law and freedom of expression in national law. Article 6 Act 90/2018 establishes that only Article 5(1)(a) and (d), Articles 24, 26, 28, 29, 32, 40-43 and 82 GDPR will apply in the context processing for journalistic purposes.
The Icelandic DPA then went on to describe its tasks pursuant to Article 39 Act 90/2018. This includes deciding whether there is a breach of the Act or the GDPR on the basis of complaints made. However, the DPA does not consider itself to be competent to assess the boundaries between the constitutional rights to privacy and freedom of expression where a media entity is concerned. It deems that a court is better place to make such decisions. Therefore, the DPA does not have jurisdiction to determine whether an individual has gone beyond it constitutional right to freedom of expression and thereby breached another’s right to data protection. The DPA mentioned that depending on the fact, it could rule on the legitimacy of processing where the data controller is a non-media entity (individual or private company).
In any case, parties processing personal data for journalistic purposes must comply with Article 5(1)(a) and (d), Articles 24, 26, 28, 29, 32, 40-43 and 82 GDPR. The Iceland DPA then went on to outline what certain of these provisions entailed (such as Article 5(1)(a) and (d)) for journalists. It notably highlighted that under Article 26 Media Act 38/2011, journalists have a duty to respect human rights including the right to privacy.
The Icelandic DPA also provided some suggestions as each case is to be determined on a case by case basis. The sensitivity of the personal data is significant. Additionally, the status of the person in question (whether they are a public figure, for example) should be considered. This is particularly important as Article 73 of the Constitution on freedom of expression has been interpreted broadly by Icelandic courts where it concerns public figures. The context of the publication must be considered before publishing personal information.

Persónuvernd - 2020082249


holding_ANSPDCP (Romania) - Vodafone România S.A. 3

The ANSPDCP held that the controller failed to meet its obligations, as it could not prove that it had replied to or complied with the requests from data subject. The DPA therefore fined Vodafone €4000 for breaching Articles 12, 15, and 17 GDPR.
Furthermore, the DPA imposed the corrective measure of ordering the controller to adequately respond to the data subject who submitted the requests.


The appeal board held that access to an employee's mailbox constitutes processing of personal data, thus the GDPR applies. The appeal board also held that in order for the inspection to be lawful, the employer must also follow the procedures set out in the national E-Mail Regulations The appeal board agreed with the DPA and the Court of Appeal that the controller had not proceeded in line with national law and the requirements of the GDPR when carrying out the inspection.
The Board also agreed with the DPA’s and Court of Appeal’s assessment that the inspection of the data subject’s mailbox was sufficiently justified under Article 6(1)(f) GDPR and §2(b) of the Norwegian E-mail Regulations. The appeal board agreed with the district court and appeal court that the data subject had shared insider information, as well as other confidential information, which constituted a breach of the duty of loyalty.
The disclosure of personal data to a third party requires a legal basis under Article 6(1) GDPR. The appeal board agreed with the DPA that the controller had no legal basis for the disclosure of personal data to the third party under Article 6(1)(f) GDPR. The DPA rightly issued a reprimand against the controller under Article 58(2)(b) GDPR. The appeal board rejected the data subject’s argument that the third party was a data processor.
Under Article 30 GDPR, the controller is obliged to keep a record of processing activities. It also follows from Article 30(3) GDPR and Article 30(4) GDPR that these records must be in writing and must make them available to the DPA on request.
Although the data subject had the right to lodge a complaint with a DPA under Article 77 GDPR, this right does not extend to separate complaints about possible non-compliance with the controller's general obligations under Chapter IV of the GDPR, including the obligation to keep records under Article 30 GDPR. It is up to the DPA to assess whether or not this is a matter to be pursued against a controller. Therefore, the appeal board rejected the data subject's argument.
The appeal board held that the fact that the DPA chose to impose a reprimand, but did not find it necessary to impose a fine, is not a decision directed at the data subject and does not affect their rights and obligations. The appeal board refers to their cases PVN-2019-12 and PVN-2020-07, in which the appeal board took a similar legal view.
The appeal board therefore dismissed the data subject’s appeal about the DPA’s choice of measures taken against the controller.

Personvernnemnda - PVN-2024-01


holding_Helsingin hallinto-oikeus (Finland) - 3620/2023

The Court noted that, despite the opportunity reserved for it, the controller had not sufficiently demonstrated that some other entity had acted as a controller of the personal data generated in connection with the treatment that took place on its premises. In its appeal, the controller had not denied that the data subject had received treatment from the controller. Thus, the Court stated that the controller had to be considered as a controller within the meaning of the GDPR.
In light of this, the Court agreed with the DPA that the controller had violated Article 5(1)(a) GDPR, Article 12 GDPR, Article 13 GDPR, Article 15 GDPR and Article 25(1) GDPR by not implementing the data subject's access request and failing to inform data subjects about the processing of personal data. The Court also considered that the administrative fine issued by the DPA had been effective, proportionate and dissuasive in accordance with Article 83(1) GDPR.


The court ordered the controller to pay €1200 as non-material damages to the data subject. The court found that the controller violated Article 32(1) and Article 5(1)(f) GDPR because it had not implemented technical and organisational measures to ensure an appropriate level of security, especially in regards to “integrity and confidentiality”. The controller contributed to the data breach and potential identity theft by not deactivating or changing CodeShip’s credentials for several years.
Although it could not be verified by the court that the data subject’s identity was fraudulently used by a third person, the court found that the risk alone establishes an immaterial damage pursuant to Article 82(1) GDPR.
When assessing the amount of damages pursuant to Article 82(2) GDPR, the court considered as mitigating factors that the data was not used for any fraudulent behaviour until the time of the decision and that the controller paid for the identity protection service.[1] Therefore, the court considered the amount of €1,200 appropriate.

LG Köln - 28 O 328/21


The HDPA found that the politician acts as data controller for this communication and that he did not obtain the recipient's consent. Moreover, he initially collected the complainant's contact details for different purposes. However, the politician provided and satisfied the complainant's right to objection.
The HDPA upheld the complaint and imposed the proportionate fine of EUR 2000.

HDPA (Greece) - 38/2020


The Icelandic DPA decided that the processing of the Complainant's personal data by Creditinfo Lánstraust hf. in connection with the preparation of their credit report, was in compliance with Act no. 90/2018 on Data Protection and the Processing of Personal Data.
The DPA pointed out that it had previously taken a position on the issue in question with a ruling, cf. January 26, 2017, in case no. 2016/950; on December 6, 2016, in case no. 2016/580; on September 28, 2017, in case no. 2016/1138; and on May 31, 2018, in case no. 2017/537. In all of the foregoing rulings, the DPA considered that Creditinfo could use information on the entry of the company's defaults list for four years from the registration of such information.

Persónuvernd - 2020010613


The AEPD found that the controller infringed Articles 6(1) and 17 GDPR because it processed the data subject’s account number without a legal basis and failed to comply with the data subject’s deletion request.
Since 2022, the controller has been erroneously processing the data subject’s bank account information in its debt contract with the third party debtor, in its databases, and in its transmission to a future debt buyer in June 2023. At no point during this period did the controller correct the issue. As a result, the controller was processing the data subject’s data without a legal basis in violation of Article 6(1) GDPR. The AEPD considered the processing in 2022 and 2023 (between which the data subject had made a deletion request) separately – thus, it found that two Article 6(1) GDPR violations occurred on the separate processing occasions.
The AEPD also found that the controller violated Article 17(1)(d) GDPR when it failed to delete the data subject’s data pursuant to an erasure request. After it received the data subject’s deletion request and even though it alleged to have erased the data in 2022, the controller continued making charges on the data subject’s account in 2023.
The AEPD recommended a sanction of €250,000. Pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the AEPD informed the controller that it may acknowledge its responsibility for the alleged violations and/or pay the proposed fine. Each of these actions reduces the imposed fine by 20%. The controller opted to reduce the fine by 40%, both acknowledging its responsibility for the violations and paying the reduced sanction amount of €150,000.

AEPD (Spain) - EXP202317282


holding_Datatilsynet - Datatilsynet - Arp-Hansen Hotel Group A/S indstilles til bøde

The Danish DPA held that Arp-Hansen was indeed in violation of Article 5(1)(e), noting in particular Arp-Hansen's lack of an objective reason for the extensive storage of information. Therefore, the DPA fined the hotel chain DKK 1,100,000.


Although Vodaphone insisted on the fact that a mistake has been made by an employee, the AEPD held that personal data was processed in a manner which does no ensure appropriate security. As a consequence, Vodaphone violated Article 5(1)(f) GDPR, as interpreted in the light of the last sentence of the recital 39 GDPR.

AEPD (Spain) - PS/00093/2019


The DPA stated that the controller cannot exercise a right to access, which is a personal right that belongs to the data subject, and that the controller can only compel the processor to comply with its legal obligations.
The DPA also remarked that the controller may leave a certain degree of discretion as to how best to serve the interests of the controller, allowing the processor to choose the most appropriate technical and organisational means.
Ultimately, the DPA concluded that there had been a violation of Article 28(3)(g) GDPR, that obliges the processor, at the choice of the controller, to delete or return all the personal data, as well as existing copies, to the controller after the end of the provision of services relating to processing. For not complying with this obligation, the DPA fined the processor €100,000.

AEPD (Spain) - PS/00315/2020


The Spanish DPA admitted the claim and urged the controller to send the claimant a certificate stating that his/her request to exercise the right of access has been satisfied or to refuse it, indicating the reasons why his/her request should not be satisfied.
If the company complained of fails to comply with this resolution, this could lead to the commission of a very serious infringement, which will be sanctioned in accordance with art. 58 (2) of the GDPR.

AEPD (Spain) - TD/00085/2020


holding_ANSPDCP (Romania) - Fine against S.C. Delivery Solutions S.A. (Sameday)

The DPA noted that a processor is obliged to take all necessary measures to protect systematically the processing of personal data of natural persons, as required by Article 28(3)(c) GDPR, including against disclosure and/or unauthorised access to data.
During its investigation, the DPA found that the database for sale on website contained data relating to 26.566 individuals. The data included: AWB number and date (the transport document which must accompany the dispatch of any parcel), courier details, sender's name, consignee's name and surname, telephone number, address, delivery status, type of service, parcel weight, amount to be collected and delivery interval.
The DPA held that the processor did not implement adequate technical and organisational measures to ensure a level of security appropriate to the risk of the processing for the rights and freedoms of natural persons, which led to the disclosure and/or unauthorised access to personal data of 26,566 natural persons. As result, the DPA held that the controller violated Article 29, Article 32(1)(b), and Article 32(2) GDPR.
The DPA fined the processor €3,000 (RON 14,825.70).


holding_ANSPDCP (Romania) - Fine against Asociația de Proprietari Aviației Park

The Romanian DPA fined the controller €7000 for violating Article 5(1)(a), (c), (e), (2) GDPR and Article 6 GDPR by processing the personal data without a legal basis, by violating the principles of data minimisation and storage limitation. €2,000 (RON 9,885.80) of the fine was for the violation of Article 5(1)(a), (c) (2) GDPR and Article 6 GDPR by keeping the access register and €5,000 (RON 24,714.50) for the violation of Article 5(1)(e), (2) GDPR by storing the video footage longer than necessary for the purpose of monitoring the access to the complex.
Additionally, the DPA ordered the controller under Article 58(2)(d) GDPR to bring is processing into compliance with the GDPR by:
 1. reviewing and updating the technical and organisational measures on the basis of a risk assessement, especially establishing a deadline after which collected data is anonymised and which is in accordance with the storage limitation principle.
 2. evaluating the processing carried out to implement the necessary measures to comply with the principles of Article 5 GDPR.


No legal basis
The court found that the controller could not rely on any legal basis under Article 6(1) GDPR for the data transfer. The court rejected the argument that the processing could be based on the legitimate interest of fraud prevention.
The court explained that prevention of fraud committed by the data subject cannot be a legitimate interest in this case as the contract has already been concluded. The controller therefore doesn’t directly benefit from transferring the data subject’s contract information but instead can benefit from an informed and detailed credit rating system in order to assess future customers to prevent fraud.
The court highlighted that telecommunication providers, including the controller, have ceased the transfer of data to SCHUFA without this having any impact on their business. The court concludes that this shows the practice was not of significant importance never mind a necessity. Instead, the court determined that the true interest of the controller is to participate in the credit rating system by supplying information so that others can draw on these scores.
The court held that whether or not the registration of the contract information is based on a legitimate interest is not the key question as the interests of the data subject nevertheless outweigh. The court declared that an outweighing interest is worthy of protection especially when the purpose of the data transfer is the creation of a profile, the scope of the collected data is particularly large and if the collection of data can substantially impact the data subject.
Informational
In relation to the supplied informational, the court declared that the document amounted to a mere formality, as it didn’t provide the data subject with any options. The controller supplied this document knowing that the only option for the data subject in response to the information was not to continue with the contract. The court concluded that to follow that logic would render the protections of the GDPR useless.
Regardless, the court further highlighted that the informational didn’t clearly communicate that every formation of contract would be disclosed as it stated that this would occur if the information was sufficiently relevant.
Damage
The court rejected the data subject’s claims of loss of control and worry truly impact his life as in the oral hearing he did not focus on this. However, the court declared that the violation of the right to informational self-determination itself classifies as damage under Article 82 GDPR. To illustrate this, the court referred to a lead decision by the German Federal Court of Justice (Bundesgerichtshof – BGH) which showed that the mere loss of control and the resulting violation of the right to informational self-determination can constitute damage.
The court stated that the registration of the contract information itself violated the data subject’s right to informational self-determination, which encompasses the ability to freely determine who can access your data.
The controller was ordered to pay the data subject €400 in damages and based this number off the European General Court judgment T-354/22, in which the unlawful disclosure of an IP-address warranted the same amount of damages.
The court ordered the data subject to pay 89% of the procedural fees while the controller had to pay 11%, additionally the controller was ordered to pay €368.70 in pre-litigation lawyer fees.

LG Lübeck - 15 O 262/23


holding_Tietosuojavaltuutetun toimisto (Finland) - TSV/35/2022

On the basis of the information provided by the controller, the DPA considered that the email sent from the controller's information system was promoting services offered by another organisation and that such use of the personal data was comparable to disclosure.
The DPA emphasised that in accordance with Article 32(4) GDPR, the controller must ensure that its employees have sufficient understanding and competence regarding the processing of personal data and data protection.
The DPA stated that the controller must also comply with Section 16(3) of the Finnish Act on the Openness of Government Activities, according to which the disclosure of personal data for direct marketing requires the data subject's consent. Since there was no legal basis to disclose the students' personal data, the controller processed the personal data in violation of the lawfulness principle.
On the basis of the information gathered, the DPA held that the controller had violated Article 5(1)(a) GDPR, as the processing of personal data was not related to the activities of the controller and there were no legal grounds for the processing. The controller's purpose in collecting the personal data was for processing related to college operations. As the advertisement for another organisation did not relate to college operations, the DPA also found a violation of Article 5(1)(b) GDPR.
As a result, the DPA issued a reprimand to the controller in accordance with Article 58(2)(b) GDPR.


holding_Tietosuojavaltuutetun toimisto (Finland) - 6097/161/21

The DPA held that requiring the printing, filling and signing of a separate form to identify the data subject does not conform with Articles 12(2), 12(6), 5(1)(c) and 25(2) GDPR as it complicates the exercise of data subject rights and processes more personal data than necessary for the data subject's identification. The DPA stressed that the unnecessary collection of data subjects' signature data may actually increase, rather than decrease, the potential risks of misuse while making it more difficult for data subjects to exercise their rights. The controller should have also considered the nature of the personal data concerned, the nature of the request, and the context in which the request is made in determining the means of identification. Whilst controllers may offer different options for the exercise of data subjects' rights, digital identification, such as using the same identifiers when logging in online services provided by the controller, should be one of them.
Furthermore, the DPA held that the controller neglected the data protection by design principle of Article 25(1) GDPR by not testing its email system, which was used as a main electronic channel for data subjects to exercise their rights. In conclusion, the DPA ordered Otavamedia Oy to pay an €85,000 fine and bring its subject requests processing system in conformity with the GDPR.


holding_ANSPDCP (Romania) - PPC Energie Muntenia S.A.

The DPA found that the controller illegally processed the personal data, i.e. the phone number, of the data subject by making them available to a partner. This making available of the phone number happened solely for marketing and advertising reasons. However, the controller did so without any legal basis. This entailed a violation of Article 5(1)(a) and (b) GDPR, as well as Article 6 GDPR.
Moreover, the DPA considered that the controller did not properly manage the access request advanced by the data subject and thus violated Article 12(3) and (4) GDPR, as well as Article 15 GDPR.
Therefore, the DPA deemed it appropriate to impose a twofold fine:
- First, a fine of RON 9,950 (€2,000) for the violation of Article 5(1)(a), (b) GDPR and Article 6 GDPR;
- Second, a fine of RON 4,975 (€1,000) for the violation of Article 12(3) and (4) GDPR and Article 15 GDPR.
Additionally, the DPA recommended the controller to take the following actions:
- To ensure that the data collected is processed in compliance with the GDPR; and
- To submit a complete and applicable legal provision to access requests.


According to the DPA, the controller duplicated the data subject’s SIM card without a valid legal basis under Article 6(1) GDPR, despite the protocols set in place by the controller. The protocol to verify an individual’s identity was based solely on matching specific data with its database, and did not ensure that the data subject was involved or aware. The DPA stated that the coincidence of the data provided by an individual and the database is not enough to process the data under consent (Article 6(1)(a) GDPR) or any other legal basis. The issue in this case was not that the controller did not follow its internal protocol or lacked security measures, but rather that it was processing the personal data without a valid legal basis.
The DPA dismissed the mitigating circumstances presented by the controller. The DPA argued that the controller had not taken the initiative in resolving the situation or detected the fraud. Therefore, applying the mitigating circumstance under Article 82(2)(c) GDPR would “artificially” decrease the fine and its deterrent effect. Furthermore, while the processing did not involve special categories of data, the DPA considered that the data (full name and ID) had a sensitive nature. The unauthorised access was particularly serious because it was accessed with the intent of committing identity theft, and it involved a loss of control of the data subject over their data.
Finally, the DPA highlighted three previous fines it had given the controller for duplicating a SIM card without a legal basis, each resulting in a €70,000 fine. As a very important telecommunications company in Spain, the DPA considered that the controller had the responsibility to more rigorously guarantee the protection of personal data principles according to national case law[1].
The DPA maintained the €200,000 fine imposed on the controller in its previous decision on the grounds that the controller had not presented new legal facts.

AEPD (Spain) - EXP202311911


The AEPD concludes that VOX España has infringed the lawfulness principle as per Article 6(1)(a) GDPR.
The controller has processed the personal data of its former representative without her consent and despite the fact that she had requested the full erasure of her data. Consequently, after considering some circumstances including, (1) the local scope of the processing activity made by the defendant, (2) only one person has been affected by the processing activity, (3) there is no evidence that the defendant has adopted any measures in order to prevent such issues to happen again in the future, (4) there is no evidence of wilful misconduct by the defendant, even being this issue a very serious breach of the law, (5) the link between the activity of the defendant and the processing of personal data, and (6) the defendant is a national political party, the AEPD decided to impose a fine of 1,500 € to the defendant.

AEPD (Spain) - PS/00051/2020


The DPA held that the data subject properly submitted his access - and erasure requests (Articles 15 and 17 GDPR). The DPA held that the controller breached Articles 12(3) GDPR, Article 15(1) GDPR and Article 17(1) GDPR by not responding to any request made by the data subject. The DPA ordered the controller to fulfil the data subject requests within 30 days. This order was based on Article 95, § 1, 5° WOG (law establishing the Belgian DPA) and Article 58(2)(c) GDPR. This order was not a final decision in light of article 100 WOG but a decision in a procedure prior to the decision on the merits.

APD/GBA (Belgium) - 160/2022


holding_ANSPDCP (Romania) - Fine against Telekom Romania Communications SA 3

The DPA warned Telekom for the processing performed without legal ground, breaching Article 6 GDPR, and fined it approximately €2,000 (RON 9,851.40) for contacting a data subject subsequent to his/her opposition request, breaching Article 21 GDPR.


First, the court assessed the claim against the controller. The court determined that it did not have the authority to assess the decision of the controller regarding the access request. Therefore, the court also did not have the authority to order the controller to provide financial compensation for the data subject.
Second, the court assessed the data subject's claim against the DPA for immaterial damages. The court rejected this claim for several reasons. Among other reasons, the data subject had not explained what the claimed immaterial damage exactly entailed. Also, since the data subjec alrerady received financial compensation, additional compensation was deemed unnecessary by the court.
Third, regarding the claim against the DPA about the reasonable time (Article 6 ECHR), the court determined that a term of 2 years was reasonable in this case, where two public institutions were involved in the procedure. In this case, the court determined that the two-year period had started on 2 November 2021, the date of the first appeal (bezwaar).
To determine if a reasonable term had been violated, the court took into account the following circumstances: the complexity of the case, the manner in which the complaint was handled by the administrative body and the court, the procedural conduct of the data subject throughout the proceedings and the nature of the measure and the interest of the data subject. However, the court merely determined that the procedure had not exceeded two years, which seems to be the only circumstance which was assessed by the court to reject the data subject's claim.
Fourth, regarding the information provided by the controller to the DPA about any procedures between the controller and the data subject, the court determined that the GDPR had not been infringed. The DPA was allowed to ask questions to the controller. The court did not provide an explanation/ motivation for this conclusion that the GDPR had not been breached.
In conclusion, the court refused all the claims of the data subject.

Rb. Den Haag - AWB - 22 5012


The President of the Bundesnetzagentur Jochen Homann held that it is not acceptable that consumers are concerned that way by impermissible telephone advertising and supposed conclusions of a contract.

BfDI (Germany) - 11.02.2021


holding_Datatilsynet (Denmark) - 2024-442-4149

The DPA held that there had been unauthorised access to personal data, and thus found there was a personal data breach under Article 4(12) GDPR.
The DPA stated that it follows from Article 32(1) GDPR that the controller must take appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the controller's processing of personal data. The DPA held that the controller did not ensure that only employees with a work-related need had access to the drive and that there was a set-up where a single employee's error could result in a breach involving 3.7 million people. The DPA also criticised the controller that it did not test immediately after the transfer of the data whether the correct employees had access to the drive. This would have immediately revealed the error. Therefore, the DPA found that the controller’s processing of personal data had not been carried out in accordance with Article 32(1) GDPR.
The DPA held that when developing new applications or swapping file drives, it must first be assessed whether it is necessary to move and store the data in personally identifiable form in the future. The DPA stated that if it is necessary for the purpose of the processing, a possible security measure could be that the controller ensures that the data is encrypted so that only an authorised person can read and unlock the data. The DPA held that a proprietary data format cannot be equated with encryption, as there are often viewers or plugins that make it relatively easy to read these file formats. Moreover, the DPA held that the controller is also required to check that the intended access management, control and logging are working before the change is released for operation.
The DPA took into account that the controller is implementing a number of measures to prevent a similar situation from occurring again. Thus, the DPA issued a reprimand against the controller for violating Article 32(1) GDPR.

Datatilsynet (Denmark) - 2024-442-4149


holding_DSB (Austria) - DPA 2021-0.415.529

The DPA held that the controller is required to not only justify the lawfulness of its data processing under Article 6 GDPR, but also to comply with the principles of processing under Article 5 GDPR. Under Article 5(2) GDPR, the controller is not only obligated to comply with these principles, but must also be able to prove compliance. The DPA stated that the controller failed to provide such proof.
According to Article 5(1)(a) GDPR, personal data must be processed lawfully, fairly and in a transparent manner. The DPA explained that from this transparency principle follows Article 14 GDPR, which states that the controller has an information obligation if the data was not collected from the data subject themselves. The DPA stated that the controller took the data subject’s data from a job advertisement created by the data subject themselves in the e-Job-Room of the AMS without the data subject’s participation and thus without the knowledge of the data collection. The exception of the information obligation under Article 14(5)(a) GDPR thus did not apply here. The controller should therefore have provided the data subject with the information under Article 14 GDPR at the latest at the time of the first text message to the data subject. The DPA stated that the controller failed to do so and thus violated the principle of transparency under Article 5(1)(a) GDPR and thus processed the data subject’s data unlawfully.
Regarding the request for erasure, the DPA stated that under Article 17(1)(d) GDPR, the data subject has a right to erasure without undue delay and that the controller shall have the obligation to erase personal data without undue delay where the personal data have been unlawfully processed. The DPA found it unnecessary to go into further detail on other possible grounds for erasure, such as the data subject objecting to the processing under Article 17(1)(c) GDPR.
The DPA therefore held that the controller was obliged to erase the data subject's data immediately after receiving their request for erasure, but at the latest within the one-month period pursuant to Article 12(3) GDPR. By failing to do so, it violated the data subject's right to erasure under Article 17 GDPR.
The DPA thus ordered the controller to comply with the data subject’s request to erasure.

DSB (Austria) - DPA 2021-0.415.529


holding_Rb. Den Haag - C/09/662309 / HA RK 24-104

First, the court assessed if there has been an automated decision-making by the controller.
The court upheld the controller’s argument, ruling that there was no ADM since the subsequent investigation and the final decision was carried out by employees of the controller.
Secondly, the court noted that providing more information about how the transaction monitoring system works could have the effect of providing insight into how the controller's process, designed to prevent criminal offences, operates. According to the court, disclosing this information could result in malicious persons gaining knowledge that could undermine the operation of the system.
Thus, the court found that the controller rightfully relied on Article 41(1)(d) UAVG in order to partially restrict the data subject’s right of access.
On these grounds, the court rejected the data subject’s claims.


holding_Datatilsynet (Norway) - 20/02376

First, the DPA held that the bank did not comply with the GDPR requirements for conducting risk assessments. Both Article 24 and Article 32 GDPR impose such an obligation.
Considering the individual case a thorough assessment would have been necessary. This is due to the following facts: Although financial data do not constitute special categories of personal data within the meaning of Article 9 GDPR, they are nevertheless to be considered sensitive data. Personal data in a large number were processed.
However, the controller could not present documentation or in any other way demonstrate that they have made the necessary assessments.
Second, the DPA found that the controller failed to take appropriate technical measures (testing) when launching the new online portal.
The DPA repeated that the controller did not assess the risk correctly.
With regard to measures under Article 32 of the GDPR, the DPA has ruled the following. Despite of the facts that the controller tested the portal in its own test environment and only launched it for a selection of customers, those measures were not sufficient. The testing was not specifically described and documented. Further, the error occurred during frequent navigation of the page. The DPA considered that the breach could have been avoided if the bank had tested sufficiently.
Consequently, the DPA fined the controller NOK 400,000 (€ 39,700) for failing to assess risks and conduct testing when launching a new customer portal.

Datatilsynet (Norway) - 20/02376


The AEPD imposes a warning sanction and explains that imposing a sanction under Article 83(5)(b) of the GDPR against the respondent would be a disproportionate burden on it. In addition, the AEPD takes into account two factors: 1) that the main activity of the respondent is not directly linked to the processing of personal data and 2) that there is no record of previous data protection infringements.

AEPD (Spain) - PS/00357/2020


With regard to the information obligation from Article 13 GDPR, the AEPD considered different issues. First, that the RFEF could not prove that the participants had been informed that the second meeting was being recorded, since it was only at the beginning of the first meeting where RFEF's representative warned the participants that the meeting was being recorded. However, the AEPD noted that no more information was given, and the fact that future meetings would also be recorded was not mentioned. Additionally, the AEPD observed that this communication would have been insufficient since some participants in the second meeting had not attended the first one. Therefore, the AEPD held that the RFEF could not prove that the participants in the meeting had been informed about the processing of personal data as required by Article 13 GDPR. Furthermore, the AEPD, highlighted that the RFEF did not provide the information required by Article 13(3) GDPR about further processing of the data, which in this case was related to sharing the recording with two radio broadcasters. Therefore, the AEPD held that the RFEF had breached Article 13 GDPR.
On the other hand, the AEPD established that the RFEF did have a valid legal basis for the processing of personal data in this case, since Article 18 of the Spanish Act for the Regulation of the Public Sector (Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público - LRJSP) allows public bodies to record their meetings and to store them in order to keep a literal transcript of the minutes. However, the AEPD noted that having a valid legal basis does not excuse the controller from properly informing the data subjects with the requirements included under Article 13 GDPR. According to the AEPD, stating that the recording would take place in order to keep a transcript of the meeting, did not amount to providing adequate information under this provision, including basic information regarding the legal basis and the purposes of the processing.
In relation to public bodies' transparency obligations related to keeping a record of their meetings' minutes and disclosing them, the AEPD observed that this obligation only includes a written record of certain aspects, not a recording of the meeting itself. Therefore, although these obligations would allow RFEF to record the meeting, as well as to provide access to the written minutes, it would not allow it to share the actual recording. The AEPD highlighted Recital 50 GDPR, which states that "the processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected." For the subsequent processing which occurred when sharing the video with the broadcasters, the RFEF relied on freedom of information and expression, considering that it had the legitimacy to refute a press released by the AFE which was not factual, and to substantiate this refutation by providing a recording of what was exactly said during the meeting. However, the AEPD held these rights could have been exercised by sharing the written record of the meeting, and not the actual recording. The AEPD also noted that the recording contained comments of a personal and private nature, and that therefore the RFEF should have only shared the minimum amount of data necessary to achieve that purpose, according to the data minimization principle. Consequently, the AEPD held that the RFEF had violated Article 6(1) GDPR, processing personal data without a valid legal basis by sharing the recording instead of a transcript limited to the relevant details.
Based on these considerations, the AEPD fined the RFEF a total of €200,000 ( €100,000 for the violating Article 13 GDPR, and €100,000 for the violating Article 6(1) GDPR).

AEPD (Spain) - PS/00368/2021


holding_ANSPDCP (Romania) - Compania Națională Poșta Română SA

In October 2022, the Romanian DPA completed an investigation at the processor Compania Nationala Poșta Română SA and found a violation of the provisions of Article 32(1)(b) GDPR and Article 32(2) GDPR.
The DPA fined the processor €2,000 for this data breach.
Under the Article 58(2)(d) GDPR  it was decided against the Compania Națională Poșta Română SA  the corrective measure to review and update the technical and organizational measures implemented as a result of the risk assessment for the rights and freedoms of individuals, including the work procedures related to the protection of personal data, in order to ensure the protection of data processed both on workstations (PCs), and for the provision of postal services in physical format (receiving or delivering postal items), as well as ensuring physical protection of the work spaces where they are processed mailings and measures regarding the training of persons acting under the authority of the company.


holding_EDPB - Binding Decision 2/2022 - 'Instagram'

The EDPB declared most of the objections of the other DPA’s both relevant and reasoned in the context of Article 4(24) GDPR. After this assessment, the EDPB looked into the reasoning of the DPC regarding the legal ground for processing of child user’s data by Meta in the context of business accounts.
Processing of contact information on child user’s business accounts
Article 6(1)(b) GDPR
The EDPB held that the DPC could not have concluded that the contact information processing may be regarded as necessary for the performance of a contract between Meta and child users. As a consequence, the EDPB held that Meta IE could not have relied on Article 6(1)(b) GDPR as a legal basis for processing of contact information. The EDPB focused on the assessment by the DPC regarding the ‘necessity’ for the performance of the contract form Meta. The EDPB formulated several reasons why the processing was not necessary.
The EDPB held that it was important to determine the exact rationale of the contract, regarding substance and objective, to determine whether or not the processing is necessary. Factors to consider are the particular aim, purpose, or objective of the service. The processing should be objectively necessary for a purpose and must be integral to the delivery of the service to the data subject. The controller should also be able to justify the necessity in the context of the mutually understood purpose. This depends both on the controller’s perspective as the perspective of the data subject (an ordinary user). Children merit special protection in this consideration.
The EDPB started by considering that the publication of the contact details on children’s profiles could have not been reasonably expected by these children, considering the high-level information in the Terms of Use and the fact that no specific information about business accounts was provided. Also, the EDPB did not agree that the contact information processing (publishing of phone number or e-mail), could be considered as “integral” or “central” to Instagram. The EPDB referred to a remark by the DPC in its original draft, that it was now possible to operate a professional profile without also publishing contact information.
The EDPB also considered that if there are realistic, less intrusive alternatives, the processing cannot be considered ‘necessary’. The principle of proportionality should be taken into account here. The DPC had even stated in its original draft that there was a possibility on Instagram to contact users directly through direct messaging within the platform. This was even the preferred method for communication for some business account users. This contact method should have been taken into consideration by the DPC as a less intrusive alternative judging the ‘necessity’ of the processing, according to the EDPB.
The EDPB observed that Meta had claimed that the publication of the contact details was intended for traditional businesses. The EDPB held that it was technically possible to distinguish these traditional businesses from child users during the Instagram registration process based on age information. It would have therefore also been possible to avoid publishing child users’ contact information.
The EDPB also held that the publication of the contact information in the HTML source code on the Instagram website was not considered necessary by Facebook’s security team and was therefore discontinued by Facebook. The EDPB also considered here that the principle of data minimization (Article 5(1)(c) GDPR) is relevant for the ‘necessity’ assessment. Considering these facts, the EDPB held that the contact information in the HTML should therefore not have been regarded as ‘necessary’ by the DPC.
The EDPB also held that the publication of contact information meant massive risks to the rights and freedoms of children. This should also have been taken into consideration by the DPC whether or not this processing was ‘necessary’.
Article 6(1)(f) GDPR
The EDPB held that the publication of Children’s contact information did not meet the requirements under Article 6(1)(f) GDPR, because the interests of the data subjects overrode the respective legitimate interests. Therefore, the EDPB held that Meta couldn’t use this legal ground for the processing. The EDPB formulated an opinion on all of the three cumulative arguments, which were necessary for the controller to fulfill in order to use this processing ground.
1) Legitimate Interest(s): The EDPB held that the interests were not specific enough because the controller mentioned them in vague fashion. The EDPB mentioned that the evaluation of the existence of the legitimate interest(s) pursued should have been conducted by the DPC in a better way. Despite the fact that the EDPB could have stopped here, it decided to also assess the other assessments of the DPC on the cumulative criteria.
2) Necessity: The EDPB didn’t agree with the assessment of the DPC regarding the necessity of the processing. For assessing necessity, the EDPB stated that the existence of less intrusive means that would contribute effectively to achieving the interests pursued should be analyzed. The principle of proportionality should also be taken into account. The DPC held that Meta had violated the data minimization principle (Article 5(1)(c) GDPR) because of the mandatory display of contact information for business users in the HTML code of the Instagram website. The problem according to the EDPB was the fact that the DPC didn’t follow this up with a conclusion that the processing was not necessary. The EDPB held that the recognition of the HTML-processing should have concluded the assessment of the DPC that the processing was not necessary. The EDPB also noted that the DPC should have considered direct messaging on Instagram as a less intrusive way of communication for the assessment of necessity, which the DPC hadn’t done in its draft decision. The EDPB continued by calling the DPC approach to determine the ‘necessity’ requirement ‘substantially erroneous’. This was because of the fact that the DPC had named the interests of business users as legitimate interest. The business users are the data subjects, whose interests cannot be seen as legitimate interest. Only interests of the controller or a third party can be regarded as a legitimate interest. The DPC had therefore failed to justify why it considered the publication of the contact details necessary, also considering other communication means, such as direct messaging on Instagram.
3) Balancing exercise: The EDPB held that the risk assessment made the DPC was accurate. The EDPB agreed with the DPC with regard to the lack of adequate safeguards and transparency by Meta. The EDPB did however not agree with the statement of the DPC that it was possible that the legitimate interests of Meta or third parties would not be overridden by the interests or fundamental rights and freedoms of the child users in some circumstances. The EDPB held that the DPC did not properly assess the impact of the processing when performing this balancing exercise, stating it had only taken into account the positive aspects of the processing, despite the risks the DPC had identified itself.
Public-by-default Instagram accounts
The EDPB dismissed the objection from the Norwegian DPA against the DPC’s original draft regarding public-by-default Instagram accounts, because the Norwegian DPA failed to establish a direct connection with the specific legal and factual content of the decision of the DPC. The compliance of 'public by default' processing with Article 6 GDPR was not part of the original DPC decision and the objection of the DPA was not 'reasoned' (Article 4(24) GDPR).
Other grounds
The decision of the EDPB contained other supposed violations of the GDPR. Most of these objections which were brought forward by other DPA’s. These were mostly not analyzed by the EDPB because they were deemed to be neither “relevant”, nor “reasoned” (Article 4(24) GDPR).
Objections to fine:
After the EDPB considered several objections from other DPA’s regarding the fine, the EDPB formulated this binding decision, after which the DPC adapted its original decision and fined Meta €405,000,000.


The DPA of Bremen (LfDI Bremen) held that processing this data was not necessary for the conclusion of rental agreements and that this kind of data is particularly protected under the GDPR. Furthermore, it found that BREBAU GmbH also deliberately thwarted requests from data subjects for transparency about the processing of their data.
Regarding the amount of the fine, the DPA concluded that, because of the extraordinary gravity of the violation, a significantly higher fine would actually have been appropriate. However, the DPA reasoned that the amount of the fine could be reduced considerably because BREBAU GmbH cooperated extensively in the supervisory procedure, endeavoured to minimise the damage, to clarify the facts on its own and to ensure that such violations would not be repeated.

LfDI (Bremen) - 03/2022


holding_Personvernnemnda (Norway) - 2021-13 (20/01874)

The PVN agreed with the DPA that the the Company had infringed Article 6(1)(f) GDPR because of the absence of a valid legal basis for the processing of personal data through the installation of surveillance cameras. However, the PVN considered that the breach of Article 6 GDPR as not as serious as the DPA had found. In the opinion of the PVN, the breaches of Article 13 and 24 GDPR were more serious.
After an overall assessment, the PVN concluded that the amount of the administrative fine for such violations should be limited to €10,127 (NOK 100,000). After considering the length of the procedure, however, the PVN decided to annul the fine altogether due to the DPA's long case processing time (i.e. in total, almost three years).


The DPA held that Article 6 of the GDPR had been violated because AAA could not show that using the data subject's photograph to create a false profile on Instagram was with the consent of the data subject, or that any other legal ground for processing could be relied on.
The DPA also referred to a Spanish Supreme Court, second chamber, case STS 363/2017 of 15 February 2017, where it was noted that in opening a social network account, while 'the owner of the profile has“uploaded” a photograph of himself that is accessible to the general public, it does not authorize a third party to reproduce it in a media without the owner's consent. Such an action cannot be considered a natural consequence of the accessible nature of the data and images of a public profile.'
AAA was held to be responsible for the actions of his minor child, since Article 1903 of the Spanish Civil Code states that 'parents are responsible for damages caused by children under their care.…' and therefore 'whoever holds parental authority has the obligation to monitor what his minor children do.' No evidence indicated that AAA had complied with his duty of care when his child posted the photograph of another minor.
In imposing a fine of €10,000, the DPA took into consideration seriousness of the facts, since the image was used in a profile with images of sexual content, the type of data processed, since it affected a minor, and the intentionality of the action.

AEPD (Spain) - EXP202206302


holding_First-tier Tribunal - Vestani v Information Commissioner

The First-tier Tribunal decided that it can only review the actions of the ICO carrying out its obligations under section 165 of the UK Data Protection Act 2018, as empowered to do so by section 166 of the UK Data Protection Act 2018.
The Commissioner has wide discretion as the expert regulator in complaint investigations. The Tribunal held its role was limited under the law to assessing the “appropriateness” of steps taken by the Commissioner, not re-examining the actual merits or substance of Mr. Vestani’s complaint itself. Accordingly, the Tribunal struck out the application.


The CNIL held that it was unlawful to process information on the number of days an agent had been on strike in the context of career advancement procedures because such information was unnecessary for the purpose of the processing. In particular, the RATP should have limited such information to the number of days of absence of each agent, regardless of the reason behind such absence(s). As a consequence, the CNL found that the RATP had been processing these data in breach of the principle of data minimization (Article 5(1)(c) GDPR).
The investigation also revealed other breaches with respect to the principle of storage limitation (Article 5(1)(e) GDPR). Indeed, the app used to monitor the work of RATP's agents was storing personal data for an excessive period of time. Moreover, agents' files were kept for more than three years after the commission on careers advancement had taken a decision. In the opinion of the CNIL, the RATP should have kept such files for 18 months maximum.
Finally, the investigation also revealed severe security flaws. In particular, it was found that authorized agents could access an excessive amount of data (including human resources files) regardless of their role, from all bus transport units, and could also extract all the data from the app, without any restriction. Because of this, the CNIL considered that the RATP had violated Article 32 GDPR.
Taking into account the scope and severity of these violations, the CNIL decided to impose a fine of 400,000 EUR on the RATP.

CNIL (France) - SAN-2021-019


holding_AZOP (Croatia) - Decision 21-07-2022 (car dealership)

The Croatian DPA held that the controller violated Article 27(1) of the Croatian GDPR Implementing Act which provides for an obligation to clearly mark premises that are under video surveillance. This notice must be visible at the latest when entering the area in question. The DPA found that the controller did not put up a notice that its premises were under video surveillance and hence violated the Act.


The investigation carried out by the CNIL revealed that the controller had received several letters from people complaining that they were still being solicited despite their opposition. It also appeared that the company's files contained several excessive comments related to customers or their health conditions. In addition, people were not properly informed about the processing of their personal data, or about the recording of the conversations they had with the company.
In total, following its investigations the CNIL found five breaches of the GDPR:
- Violation of the right to object, Article 21(2) GDPR: no procedure was implemented to ensure effectively that persons who opposed telephone solicitation were no longer called);
- Violation of the principle of data minimization, Article 5(1)(c) GDPR: inadequate and offensive comments or irrelevant comments related to people's health were found in the company's customer file;
- Violation of Articles 12 and 13 GDPR: insufficient information on the processing of data subject’s personal data and their rights;
- Violation of Articles 46 and 49 GDPR: the controller did not provide appropriate safeguards for data subjects;
- Failure to cooperate with the CNIL, Article 31 GDPR.
As a consequence, the CNIL imposed a fine of EUR 500.000.

CNIL (France) - SAN-2019-010


holding_Garante per la protezione dei dati personali (Italy) - 9435753

The main violations of the GDPR and of the Italian Privacy Code observed by the Garante were due to the following behaviours: • The lack of transparency towards data subjects, concerning the information provided to them, including information regarding the company’s communications channels; • Consent collection contrary to data protection regulation, as well as various issues related to the exercise of data subjects’ rights; • Serious shortcomings in the management and control of Wind Tre supply chain, including the absence of compliance audits.
More specifically, the Garante held that Wind Tre had violated the following articles of the GDPR: Articles 5(1), 5(2), 6(1)(a), 7, 12(1), 12(2), 24 and 25. It subsequently fined Wind Tre 16,729,600 EUR, prohibited any further processing and ordered the company to bring their processing practices in line with the GDPR.
The Italian DPA found that Wind Tre operating methods incentivised sellers to collect ‘as much consent as possible’ from data subjects, while impairing their ability to object to processing of data for promotional purposes. According to the Garante, the numerous complaints received suggest that, behind the lack of clarity, there was an intention to force the will of the users towards consenting to the processing of personal data for commercial purposes. A conduct that was “not only negligent, but deliberately designed to circumvent the rules set out to protect the freedom of expression of the will of data subjects.” As a result, the Authority found a lack of appropriate technical and organisational measures to enable interested parties to exercise their rights, with the consequence that the revocation of consent or the objection to data processing was unjustifiably hindered. As regards the management of consents by sellers in physical shops, the indications given to staff to gather as many consents as possible, the presence of a single button in the management system to facilitate the tick of all consent boxes, the small prints used to inform about consent collection and, in some cases, the bundling of consents, were considered further negative elements by the DPA.
Concerning the control of the supply chain, the Garante held that the fact itself that subcontractors were conducting promotional campaigns in the interest of Wind Tre, while the company disowned such activities, was a sign that marketing communications were carried out without the necessary control of the supply chain – which is necessary, according to the Italian DPA, also when subcontractors are considered as independent data controller. Moreover, discrepancies in the communications from contractors concerning the source of contact data, should have made the company aware of the illicit practices. Such conduct showed a lack of adequate technical and organisational measures, in this case “with particular regard to the inability to effectively control the chain of partners who carry out promotional activities for the benefit of the Company.” Controls across the procurement network should have been stricter, and the relationship among Wind Tre, its contractors and sub-contractors should have been framed in the context of the processing of personal data, as per Article 28 and 29 GDPR.
Taking into account all these elements, Wind Tre’s conduct was, according to the Italian DPA, generally elusive of the principles of accountability and privacy by design. In fact, "taking into account the state of the art and the costs of implementation, as well as the nature, scope, context and purpose of the processing, as well as the risks having different probability and seriousness for the rights and freedoms of individuals", the company had sufficient tools and knowledge to assess the risks associated with the data processing, and to prepare, consequently, adequate technical and organizational procedures. This was particularly due to well-established decisions of the Garante, some of which even directly addressed to Wind Tre.
Regarding the size of the fine, the Garante found it was proportionate on the basis of the duration of the infringements, both the wilful and negligent violations of the GDPR committed by Wind Tre, and the number of people affected by the breach. To quantify the former, the Garante based its assessment not on the number of complainants, but on the number of people in Wind Tre's client base. The Garante also noted that previous sanctions against the telemarketing sector had not been sufficiently dissuasive.
Key excerpts from the Garante's decision include the following:
"... [T]he Company's responses revealed an uncertain and contradictory picture in the description of the technical and organizational measures taken to identify the parties concerned in a reasonable manner, representative of an insufficient assessment of the different interests at stake."
"pursuant to art. 58, paragraph 2, letter d), to adopt, without prejudice to the corrective measures already introduced, suitable procedures to verify the correctness of the procedures for the acquisition of consent by its sales network and that persons who have already expressed opposition to the treatment against Wind Tre are not contacted by third parties who operate as independent owners."
"The preliminary findings showed an overall picture unsuitable for satisfying this requirement of adequacy, since the lack of suitable technical and organisational measures was noted several times, in some cases adding the aggravating circumstance of pre-ordering the conduct (in cases relating to the collection of consent through apps and by signing the contract with dealers) and also having to note that, on several occasions, the Company has not been able to demonstrate compliance with the rules of the treatments put in place and the effectiveness of the measures taken, as required by Article 5, paragraph 2 of the Regulation."
"In fact, it cannot but be strongly noted that the lack of control of the supply chain involves the Company in a "market of personal data", already the subject of specific information from the Guarantor to the Public Prosecutor's Office at the Court of Rome, in which, in addition to the violation of the provisions concerning the processing of personal information, serious profiles of violation of labour law, tax law and probably criminal law emerge, fuelling an "undergrowth" which in some cases could also be the object of attention by criminals."


The AEPD maintains that the defendant infringed the LSSI by sending commercial communications without consent. Likewise, the AEPD points out that the contact form did not meet the requirements of the GDPR regarding consent. The data subject simply wanted to communicate with the company about a data protection issue. To do so, he was forced to accept that his personal data would be processed (also) for advertising purposes. Therefore, the consent was neither free nor specific (Article 4(11)).
The AEPD decided to impose on the defendant €4000 for each of the infringements, that is, €8000 in total. Finally, the company used the system of reductions for voluntary payment provided for in the Spanish administrative law and paid a fine of €4800.

AEPD (Spain) - PS/00332/2020


holding_Tietosuojavaltuutetun toimisto (Finland) - 8493/161/21

On the basis of the information provided by the controller, the DPA considered that the controller had not provided sufficient explanation of which entity acted as the controller with regard to patient data that was generated during the treatment of the data subject at the controller's premises. Thus, the controller had not implemented the data subject’s right to access their personal data in accordance with Article 15(1) GDPR and Article 15(3) GDPR or informed the data subject of the reason for not taking action in accordance with Article 12(4) GDPR.
The DPA stated that the controller's practice of not sending personal data by email was unreasonable, considering that the controller shall facilitate the exercise of data subject rights pursuant to Article 12(2) GDPR. The controller had also not provided the information to the data subject within the deadline defined in Article 12(3) GDPR.
The DPA also noted that the controller's website did not contain information about the processing of personal data, such as which entity acted as the controller of patient data. The DPA considered that the controller had not fulfilled its obligation to provide data subjects with the information required by Article 12(1) GDPR, Article 13(1) GDPR and Article 13(2) GDPR regarding the processing of personal data. Therefore, the controller had not taken into account data protection by design and by default in its operations as required by Article 25(1) GDPR and had processed the personal data in violation of the transparency principle.
On the basis of the information gathered, the DPA held that the controller had violated Article 5(1)(a) GDPR, Article 12 GDPR, Article 13 GDPR, Article 15 GDPR and Article 25(1) GDPR. As a result, the DPA issued a reprimand to the controller in accordance with Article 58(2)(b) GDPR. Pursuant to Article 58(2)(c) GDPR, the DPA also ordered the controller to comply with the data subject's access request insofar as it concerned the personal data processed by the controller.
In addition to the reprimand and the order, the Sanctions Board of the DPA imposed an administrative fine of €5,000 on the controller pursuant to Article 83 GDPR. The Board considered the controller’s practice to be systematic, and in addition, the violation had been long-term and concerned a large number of data subjects.


The court held that the controller was entitled to terminate the employment relationship after the data subject had presented a forged vaccination card. It rejected the data subject's argument and found that it was procedurally allowed to consider the missing vaccination of the data subject. The court reasoned that a procedural prohibition to consider evidence or submissions of a party only exists if two requirements are met, which it found not to be met in the present case. The first requirement is that the controller must have obtained the information in violation of the GDPR. The second requirement is that the violation of the data subject's right to informational self-determination must outweigh the interest of the controller in using the information and its right to be heard as well as the public interest in a functioning administration of justice and any other interests at stake.
The court held that already the first requirement was missing since the processing of the data was lawful under Article 6(1)(c) GDPR in conjunction with the third and first sentence of § 28b(3) IfSG (German Infection Protection Act). According to the first sentence of § 28b(3) IfSG the controller was legally obliged to check whether its employees were vaccinated, recovered or tested negative. According the third sentence of § 28b(3) IfSG the controller was allowed to process personal data and data relating to the vaccination, recovery or test status insofar as it was necessary for the fulfillment of its obligations. The court concluded that - in the absence of a QR code - making a copy of the vaccination card and performing a batch query was the only way for the controller to ensure that the data subject was truly vaccinated.
The court further assessed that, even if performing the batch query was not covered by the GDPR and consequently unlawful, it would still not lead to a procedural prohibition because the public's interest in accurate vaccination certificates overrides the data subject’s right to informational self-determination.

ArbG Köln - 18 Ca 6830/21


The Court reversed the first instance ruling: it held that the storage of the data was unlawful and awarded non-material damages.
On the lawfulness of the data storage
The Court held that the controller stored the claims unlawfully. This finding was based on both national law and the case law of the Court of Justice.
First, the Court referred to the SCHUFA Holding[1] ruling of the EU Court of Justice and held that the controller could not store information about the data subject’s debts for any longer than the law allowed for this information to be stored in public databases. Then, the Court observed that under the Civil Procedure Code[2], debts must be erased from the public insolvency registry as there is proof that they have been paid.
On these bases, the Court held that the storage of paid debts fails to balance the interest of the controller with that of the data subject. Therefore, the Court held that the processing could not be based on the controller’s legitimate and was ultimately unlawful.
With regards to lawfulness, the Court also held that the code of conduct invoked by the controller, could not be taken into account for the purpose of assessing the balancing of legitimate interest.
On damages
The Court partly upheld the data subject’s claim for damage. In this regard, the Court held that the controller damaged the data subject’s reputation by providing third parties with credit scores based on the data. The Court valued this damage €500. The Court clarified that this damage was a direct consequence of the disclosure of the data to third parties, regardless of any further consequences of such disclosures.
The Court explicitly left two questions open: whether the unlawful storage of the data constituted a loss of control for the data subject over their data, and whether the storage itself harmed the data subject’s reputation. The Court held that the questions were irrelevant because, in the case at hand, the data were disclosed and the disclosure caused reputational damage.
The Court rejected the data subject’s damages claim with regards to the further adverse consequences they suffered from the storage and disclosure of the data. The Court held that such consequences (i.e.: the refusal of certain third parties to conclude a contract with the data subject) occurred at a time when the controller was still entitled to store the data.

OLG Köln - 15 U 249/24


The AEPD concluded that the facts constitute a personal data breach and that the controller had not adopted the necessary technical and organizational measures to prevent it. The AEPD reminds that the GDPR does not require the adoption of specific measures, but that controller must assess in each case what measures are necessary according to a risk assessment.
The AEPD found that there was therefore a violation of Article 32(1) GDPR.

AEPD (Spain) - PS/00464/2020


The AEPD upheld the complaint.
First, the recording of personal conversations is an invasion of privacy. This is therefore strictly forbidden and can lead to a violation of Article 5(1)(c) GDPR.
Second, the cameras must be limited to the purpose for which they are intended. Also, the way of capturing and processing this data must be proportionate in relation to this purpose (surveillance/security).
Third, the AEPD recalls that, in order to comply with Article 12 GDPR, a clear sign must be placed in a visible area (e.g. access door) indicating that it is a video-surveilled area, and it must indicate:
  * the existence of the processing.
  * the identity of the data controller.
  * the possibility of exercising the rights provided for in Articles 15 to 22 GDPR.
If there is not a clear sign informing employees of the video-surveillance area, which provides this information, this leads to a violation of Article 13 GDPR. Respondent had failed to install and show a clear sign that provided this information. Moreover, the purpose of security had not been known to the legal representatives of all the public employees of the aforementioned entity, although they must be aware of the purpose(s) of the images obtained. Hence, this constituted an infringement, attributable to the respondent, for violation of Articles 5(1)(c) and 13 GDPR.
Therefore, the AEPD (1) imposed a warning on the Municipality and (2) ordered respondent to:
  * Place information signs duly approved to the current GDPR at the main entrances to the Town Hall within one month of the decision.
  * Inform all public employees of the measures adopted, in particular those related to the purpose(s) of the processing.
  * To place the entrance camera so that it is used for the security function of the Town Hall, but avoids capturing the work area of the employees exclusively, disabling the audio option if necessary.

AEPD (Spain) - PS/00377/2021


The HDPA assessed the above facts and the late submission of the questionnaire, but also the failure to inform the authority about the technical problem faced by the Ministry, as claimed.
Based on the above, the Authority found that the Ministry of Rural Development and Food violated Article 31 GDPR with regard to the cooperation of the controller with the Authority and Article 37 GDPR with regard to non-designation of DPO for the period from 04.08.2022 to 20.06.2023.
Taking into account the above and the fact that no material damage occurred to the data subjects in the interim period when no DPO was appointed, but also the late submission of the questionnaire, the HDPA imposed an administrative fine on the Ministry of Rural Development and Food for a total amount of 5. 000 euros, for violation of Article 31 GDPR, and an administrative fine for a total of 20,000 euros, for violation of Article 37 GDPR.

HDPA (Greece) - 2/2024


holding_Datatilsynet (Denmark) - 2022-432-0099

The DPA concluded that the controller violated the data minimisation principle of Article 5(1)(c) GDPR. The principle should have been complied with despite the system being the only possible solution according to the current technical structure of the driving licence register. It further stated that the accessibility needs described by the controller and the mere fact that it is convenient for citizens to have the Driving Licence app, as they can leave their physical driving licence at home, cannot justify the processing in question. Thus, the DPA concluded that data processing of all holders of a valid Danish driving licence is not justifiable, as the controller was processing data of a very large number of people - approximately 2.26 million people - who had not actively joined the Driving Licence app.
Hence, the DPA issued serious criticism to the controller under Article 58(2)(b) GDPR. In addition, per Article 58(2)(f) GDPR, it banned the storing and processing of personal data about persons who have not actively joined the Driving Licence app.
The controller has four weeks from when the decision was issued to comply with the prohibition.

Datatilsynet (Denmark) - 2022-432-0099


holding_NAIH (Hungary) - NAIH-2501-10/2022

The DPA found that, on the form sent out by the controller, the information was provided in very small print, so barely legible. When requesting consent for direct marketing, only the identity of the controller was indicated, with a very general purpose to send “further favourable offers.” The information also stated that the processing was unlimited in time and scope, until consent would be withdrawn. The DPA noted that a more specific purpose limitation and other information as required under Article 13 GDPR, as well as the fact of data transfer abroad, were completely missing. The DPA stated that Article 13 GDPR only provides the bare minimum content. Additional, case-specific information would be necessary for transparency and informed choice. On the forms of the controller, the mandatory data were distinguished from the non-mandatory data with a tiny asterisk. Thus, the DPA found that the average data subject was not given clear and easily accessible information. It was not possible to indicate that you only wanted to provide your data to receive updates on an order, and not for direct marketing. Individual purposes and individual contact methods were not separated on the postal form.
Over the phone – if the data subjects shared that they did not have an internet connection – a list of data processors was read out to them. In this case, it was not possible either to choose whether the data subject wished to consent to be contacted only by certain means, e.g. by post only, by phone only, by e-mail only, or by any combination of these. As in the case of postal communications, no information was provided about other forms of processing, such as Google and Facebook targeted advertising.
For online orders, the data subject could easily access the privacy notice, which contained information on data processing related to direct marketing. However, the DPA found that it was not possible to give specific, separate consent for receiving emails and targeted advertising through Google and Facebook. The DPA noted that the absence of any meaningful information on the use of these complex services in itself raised a serious validity issue in relation to consent.
With regard to the legal basis for consent, the DPA stressed that consent was not intended to be a general authorization for the controller to process any personal data without restriction, at any time and for any reason, irrespective of other legal conditions. It was only valid when requested for specific, separately identifiable purposes, and preceded by appropriate information that puts the data subject in a position to make an informed decision. Article 12(1) GDPR explicitly requires the controller to be result-oriented, i.e. to provide the data subject with the assistance necessary to enable him or her to exercise all his or her data subject rights in an informed manner. The DPA deemed it not the responsibility of the data subject to obtain the information from another source. It should be readily and reasonably available to them at the time of the request for consent. The DPA concluded a data subject would most likely not look online for information on data processing before placing an order by post or phone. This is also not expected by GDPR. The DPA held that the controller had an active obligation to provide the information to the data subject, appropriate for the communication channel used.
The DPA further stated that there was currently no DPO under the name of the controller in the designated database operated by the DPA (accessible for everyone). The controller also did not prove otherwise that it had in fact appointed a DPO. DPA noted that, if there was a technical reason beyond the control of the controller for which the entry was not made, it could have been detected and corrected by the controller in the last 4 years since the introduction of the GDPR, if it really considers data protection to be of high importance.
In short, the DPA found that the processing was explicitly for profit, using small print and without easily accessible information, implementing a poor business practice that was, and is problematic, even before the GDPR. The lack of adequate information put the data subjects in a position where they were not aware of their rights and how to exercise them. Therefore, the DPA fined the controller €73,500. The DPA further instructed the controller to modify its data processing practices in relation to direct marketing in order to properly separate specific purposes, obtaining the consent of data subjects, and providing them with adequate prior information appropriately. Also, to delete contact personal data where there was no valid consent.

NAIH (Hungary) - NAIH-2501-10/2022