holding_Rb. Amsterdam - C/13/693399 / HA RK 20-337

Was the case admissible?
First, the court commented on how repeated requests under Article 35(2) of the Act Implementing the GDPR (UAVG) should be treated. In this regard, the court clarified that it was not the intention of the law that the filing of repeated requests would allow for a new deadline under which a request can be filed with a court. At the same time, the court noted that Article 21 GDPR states that data subjects have the right to object and that this right can be exercised at any time, including more than once. Therefore, the court concluded that an interested party may file multiple applications under Article 35 of the GDPR Implementation Act (UAVG) as long as it does not lead to an abuse of procedural law.
As to the admissibility of the application, the court held that the application was admissible. The reason for this was that in its last decision Rabobank had taken into account the new facts and circumstances that the applicant had put forward regarding the interest in a leased vehicle when rejecting the application. Since Rabobank took the new circumstances into account and did not express in its reply of 13 October 2020 that it considered this to be a repeated request which it would not comply with, the applicant had six weeks after 13 October 2020 to file an appeal. The complaint was therefore admissible.

BKR Registration
Rabobank and other credit providers are required to participate in a credit reporting system pursuant to Article 4:32 of the Dutch Financial Supervision Act (Wft). In addition, under Article 4:34 of the Financial Supervision Act (Wft), the credit provider is required to assess the consumer's financial standing in order to determine whether it would be responsible to grant the credit to that person.
The court then looked at the legislative history of the law and found that its purpose was twofold. First, the regulation intended to protect consumers from over-indebtedness, and second, to protect lenders from borrowers who cannot repay. Further, the court considered the legal basis for credit scoring under the GDPR. The court found that under Article 3(4) of its General CKI Rules (Algemeen Reglement CKI) the BKR processes personal data for legitimate interest under Article 6(1)(f) GDPR. The court concluded that credit providers therefore also rely on legitimate interest. In this case, the court clarified that the legitimate interests are those of the consumer, BKR and its business customers.
Furthermore, the court clarified that the applicant has a right to object to the processing of his personal data under Article 6(1)(e) GDPR and Article 6(1)(f) GDPR. The court stated that if a data subject objects to data processing, Rabobank must comply with that request. Unless it can demonstrate compelling legitimate grounds which override the interests and rights of the data subject.
The court also concluded that Article 79 GDPR and Article 35 of the Dutch Act implementing the GDPR (UAVG) provide the data subject with access to effective remedies if the controller does not comply with the objection.
The court went on to state that if it has such a case before it. The court will assess whether the controller has made a prima facie case (made it probable) that the interest of protecting consumers from over-indebtedness and protecting credit providers outweighs the interests, rights and freedoms of the data subject in the specific case.
Furthermore, the court clarified that it would not be sufficient for Rabobank to refer in general terms to its legal obligation to participate in a credit registration system or the social importance of such a system. It would also not be sufficient for Rabobank to refer to the General Regulations of the CRI, as it is not a law. The court clarified that the General Regulations of the CRI are internal rules that only apply to the BKR and the banks. Nevertheless, the court considered the General Regulations as a good starting point and a document that gives legal certainty. However, it stated that it might be necessary to deviate from them when it comes to the objection of a data subject.
The court went on to state that Article 21 GDPR requires Rabobank to respond to the objection by assessing the circumstances in relation to the specific situation of the data subject. The court then assessed the applicant's situation in detail. The court indicated that the remaining debt was a result of the divorce and the foreclosure of the houses. Further, the court noted that the applicant had no irregularities in paying the mortgages and that he began paying off the remaining debt on his own initiative, even before the second house was sold and the total amount of the remaining debt was known.
Further, the court gave weight to the fact that the applicant and the bank had agreed to a special repayment arrangement. The applicant had fully complied with the repayment plan, after which he no longer owed any money to Rabobank.
Furthermore, the court considered that the applicant had shown that he was in a financially stable position, taking into account how much he earned through his business and how much his current partner earned.
Finally, the court also found it sufficiently plausible that Code 3 was an impediment to the applicant. It prevented the applicant from buying an apartment or renting an apartment more cheaply. The court also found it plausible that the code was a business obsticle that prevented the applicant from leasing a car.
The court held that there was no credit risk in this case. The court held that there was no need to protect the applicant from over-indebtedness, nor was there a need to protect credit providers from a customer who could not repay their loans. The court concluded that society's interest in responsible lending did not outweigh the interests of the applicant.
The court ruled that Rabobank must request the deletion of Code 3 and Code A from the applicant's file in the BKRs register within 48 hours of notification of the decision. If Rabobank failed to comply, it would be fined €1000 per day, counting three days from service of the decision. However, the maximum fine would be €30,000. The court also ordered Rabobank to pay the applicant's legal fees.


After examination of the facts of the case and after examination of 79 other data subjects data which were not successfully deleted from the company's data base, the authority decided that the company failed to implement the appropriate procedural and security measures to detect the error and to secure the deletion of the users' data. In the light of these violations the authority fined the company 5.000€.

HDPA (Greece) - 20/2021


The court did not decide on the subject matter. Instead, it repealed the contested decision and referred it back to the DSB in accordance with § 28(3) VwGVG. It concluded that the reasoning of the DSB's decision had been too superficial. According to the court, the decision showed a lack of investigation since the DSB had not even presented what type of personal data had been processed.

BVwG - W214 2242817-1


The AEPD found that the controller’s use of non-technical cookies without consent, the inability to reject consent in a granular manner and the impossibility of withdrawing consent violated Article 22(2) LSSI. These practices did not enable the data subject to give adequate consent and thus could not provide a legal basis for using cookies pursuant to the national law.
The AEPD considered this a slight infraction pursuant to Article 38(4) LSSI and imposed a €5,000 fine.

AEPD (Spain) - EXP202309359


holding_ANSPDCP (Romania) - Fine against Dante International SA (eMAG) - no 3

The Romanian Authority accepted the request, consulted with the Hungarian Authority according to the procedure under Article 60 GDPR, and held the following:
Firstly, for the account deletion request, the controller did not regularly train its employees with regard to data subject right requests. The training in place was deemed insufficient to satisfy the requirements of Article 24 GDPR.
Secondly, for the erasure request, the lack of a unified channel for receiving data subject requests lead to disproportionate restrictions of data subject rights. The DPA noted that the privacy notice of the controller did not include any information regarding processing performed by third parties and the transfer of the data to third countries, in breach of Articles 13(1) (c), (e), (f), and 14(1) (c), (e),( f) GDPR.
Thirdly, regarding the rectification request, the authority held that the controller did not have an appropriate legal basis (consent) to use the old email address of a data subject for electronic communications.
Considering the above mentioned reasons, the DPA held that the controller:
  * did not handle data subject rights requests in accordance with Articles 12(2) and 17(1) GDPR;
  * failed to inform data subjects about the third parties processing, and the international data transfers in breach of Articles 13(1) (c), (e), (f), and 14(1) (c), (e),( f) GDPR; and
  * did not rely on the appropriate legal basis for processing a data subject's old email address after a rectification request in breach of Article 6(1)(a) GDPR.
The DPA therefore issued a fine of a total amount of approx. €40,000 along with an order to apply coercive measures, including providing information to the data subjects on the website, anonymize some data and organize training for the employees about how to handle data subject rights requests.


holding_Datatilsynet (Denmark) - 2019-431-0048

The DPA held that the processor acted in breach of the GDPR, and expressed criticism for the security incident.

Datatilsynet (Denmark) - 2019-431-0048


The HDPA stated that with regards to the processing of personal data in the context of employment relations, this is permitted only for purposes directly related to the employment relationship, and insofar as it is necessary for the fulfilment of mutual obligations arising from that relationship, whether these obligations arise from the law or from a contract. Furthermore, the HDPA noted that in the case of employment relationships, the inherent power imbalance of the parties means that employees are rarely in a position to freely give valid consent for the processing of their personal data, and therefore employers should rely on a legal basis other than consent in these cases. Therefore, the HDPA held that, in this case, not only had the employee expressly objected to this processing, but that even if this consent had been given, this could not be relied on by the employer as a valid legal basis.
The HDPA also held that the employer had not satisfied the employee’s right to objection to the monitoring of the lessons. The HDPA explained that although the employer’s response to this objection was based on the grounds of legitimate interest in the exercise of its managerial right, the employer had not been able to establish that the actual attendance to the online courses was in fact an appropriate and necessary means for the exercise of this legitimate interest. Additionally, the HDPA found that the employment contracts analysed this case, did not mention the monitoring of lessons, nor the specific legal basis for this processing.
Therefore, the HDPA held that the employer’s failure to previously determine a valid legal basis for this processing violated of the principle of lawfulness, fairness and transparency under Article 5(1)(a) GDPR, and the principle of accountability under Article 5(2) GDPR. Additionally, the HDPA held that the employer’s failure to inform the employee of the processing and its corresponding legal basis was in breach of its legal obligations under Article 13 GDPR. As a result, the HDPA issued a fine of €2000 against the school.

HDPA (Greece) - 12/2022


The Federal Administrative Court (Bundesverwaltungsgericht – BVwG) decided in favour of the controller and set the administrative act aside. It found that there is no provision in national law or the GDPR that gave the DSB the power to declare the processing unlawful.
The court first established that § 24 DSG, which provides the DSB with such a power, only applies to complaint proceedings and not ex officio proceedings. The court also rejected an analogous application of § 24 DSG, because it found that the legislator purposefully regulated complaint and ex officio proceedings differently so that there is no room for an analogous application. Moreover, it reasoned that in a complaint proceeding there is a data subject who may have a legal interest in the declaration in order to pursue further individual claims against the controller like a claim for damages; in ex officio proceedings no such interest exists.
The court further found that there is no legal basis in the GDPR either, since Article 58(2) GDPR does not include a power to declare the processing unlawful, but only the power to issue a reprimand or to fine the controller.

BVwG - W258 2247028-1


The Supreme Court rejected the appeal.
First, it considered the data subject’s argument that their request should have been assessed on the basis of Article 10 GDPR. The Supreme Court found that it was irrelevant to discuss whether the Court of Appeal should have done this. According to the Supreme Court, the Court of Appeal already assessed whether it was strictly necessary to process the sensitive data pursuant to Article 10 GDPR. Now, the Court of Appeal decided that this was the case, to protect the right to information and freedom of expression. Hence, the Supreme Court considered that the Court of Appeal already considered the applicable standard (that would follow from Article 10 GDPR), and nevertheless decided that the data subject’s rights and interests did not outweigh Google and third parties’ interests.
Second, the Supreme Court considered whether it follows from Article 47 of the Charter of Fundamental Rights and Article 79 GDPR, that they should not be ordered to pay the costs of both proceedings, because this would limit their right to effective remedy. The Supreme Court noted that the assessment of such costs is left to national procedural law (Article 289 Rv. in the Netherlands). However, because the data subject did not argue why this national provision prevents them from effective legal remedy, the Supreme Court did not discuss this matter further.

Hoge Raad - 20/02950


The DPA rejected the argument of transaction-based customer communication and held that the mail had marketing purposes because the Controller publicizes its services, although the data subject had expressly indicated his refusal to receive advertising content.
As a result, the DPA considered that the financial entity violated Article 21(1) LSSI.
Furthermore, the commercial communication did not inform the recipient about his right to object to the processing of its data for marketing purposes.
As a consequence, the Spanish DPA imposed a fine of €5,000.

AEPD (Spain) - PS/00421/2020


The court dismissed ING's plea for inadmissibility under national provisions.
The court then clarified that under national law, credit providers are mandated to process personal data and participate in the Central Credit Information System. The aim of the provision is twofold: firstly, it seeks to protect consumers from over-indebtedness and secondly, shield creditors from non-paying borrowers.
The court added that the rejection of a request for data deletion under Article 21 GDPR needs to be justified by a compelling legitimate interest, subject to the principles of proportionality and subsidiarity. Legitimate interest must be assessed on the basis of currently known facts and circumstances of the case, including those after the CKI registration.
The court pointed out that the data subject had inconsistent debt repayment patterns but fully cleared his debt in 2023 (i.e. after the CKI registration). In the balance of interest, the court considered that the controller's interest in maintaining the registration outweighed the data subject's interest in their removal. Consequently, the court dismissed the appeal.

Rb. Amsterdam - KG ZA 23-440


holding_Datatilsynet (Norway) - 20/01627

Personal data
The DPA agreed with the controller's claim that it was unlikely that number plates or faces of people would be recognisable due to the distance and the quality of the recording. The DPA highlighted, however, that it would be possible to recognise the type of car someone was driving, what type of clothes people were wearing, the colour of their hair and rough hair style. The DPA highlighted that prior knowledge about someones schedule, shopping patterns, their car or their look could identify the person being recorded, for example by friends, significant others, family or colleagues. This view was supported by the police requesting access to the recordings on several occasions concerning events in the city centre.
As such, the DPA held that the recordings captured personal data pursuant to Article 4(1) GDPR.

Legal basis
Since the controller did not use the recordings, they had not assessed whether there was a legal basis for the processing as per Article 6. The DPA therefore assumed that the legal basis would have been legitimate interest as per Article 6(1)(f).
The DPA identified two processing operations with different purposes. The first one was the live feed of the city centre, where the purpose was to provide a service to customers and local residents. The second processing operation was saving the recording and keeping it for 14 days, for the purpose of providing security to the local residents by sharing the recordings with the police if needed.

Balancing of interests
For the first purpose, the DPA also questioned whether the recording pursued a legitimate interest, finding that it did not need to conclude as the balancing of interest was in the data subjects favour. The DPA also noted that the placement of the camera could be positioned at an angle that would not be as invasive to the privacy of the data subjects.
For the second purpose, the DPA held that it could not be established for certain that there was a legitimate interest for storing the recordings. The DPA referenced EDPB guidelines which state that purposes connected to protection against theft, vandalism and criminal acts may be a legitimate interest, noting however that such a purpose must be connected to a specific event and not based entirely on speculation. The DPA questioned whether a real danger for criminal acts was established, finding however that it did not need to conclude as the rights and freedoms of the data subject clearly outweighed the controller's interest.
Consequently, the DPA held that the camera surveillance and livestreaming violated Article 6(1) and Article 5(1)(a) and fined the controller €15,000.

Datatilsynet (Norway) - 20/01627


The Court decided to uphold the judgment of the Stuttgart Regional Court, dismissing the data subject's appeal.
They concluded that the advertising mail sent by Dansk Retursystem was lawful under Article 6(1)(f) GDPR and there was no need for an existing customer relationship for direct advertising to be considered a legitimate interest.
Also, they highlighted that the data subject's claim for damages under Article 82 GDPR was unfounded, since he failed to demonstrate that he suffered any actual harm or distress beyond mere displeasure from receiving the advertisement.
The Court reaffirmed that the use of personal data for direct advertising in this context complied with the GDPR, as the processing was aligned with recognized legitimate interests and did not disproportionately impact the data subject's rights or freedoms.

OLG Stuttgart - 2 U 63/22


holding_Persónuvernd (Island) - 2020122992

The DPA held that the processing of financial data is considered personal data and falls under the authority of the DPA. The DPA is responsible for monitoring the implementation of Act No. 90/2018, on Data Protection and the Processing of Personal Data, Regulation (EU) 2016/679 (General Data Protection Regulation) and Act No. 75/2019, on the Processing of Personal Data for Law Enforcement Purposes.
The controller is responsible for ensuring that the processing of personal data complies with Act No. 90/2018 and Regulation (EU) 2016/679 (GDPR).
In the present case there are three controllers. Firstly, Creditinfo is the controller of the processing that involved the use of information registered with the company for the preparation of reports on the complainant's credit status. Secondly, the ÍL Fund is the controller of the processing involved in the transmission of information about the complainant in the Creditinfo debt ranking system. Thirdly, Netgíró is the controller of the processing that the undertaking itself carried out in assessing the applicant's creditworthiness when requesting financial assistance from the complainant.
Eventually, the DPA found that the processing of personal data about the complainant's debt status and credit assessment took place in accordance with the Icelandic national data protection law Act no. 90/2018 and Articles 5 and 6 GDPR.

Persónuvernd (Island) - 2020122992


The court held that the controller's request was admissible and justified. The court pointed out that the CJEU case law allows the application of national law enabling judges to check the existence of abuses of EU rights by the parties (see C-373/97).
In the present case, such parameter is the standard of "good faith" under § 242 of the German Civil Code (Bürgerliches Gesetzbuch - BGB) which, according to the court, the data subject had violated in the present case. This results from the fact that, contrary to the data subject's submissions, their primary interest when accessing the websites was the generation of claims for damages against the controller. The court rejected the data subject's statement that their main concern was to denounce data protection violations. Besides, the court held that the risk that inexperienced users came to the webpages was very low. A violation in the form of unlawful data transfers materialised only because the data subject intentionally looked for it with an aim of asking for non-material damages.
As a further argument to substantiate the data subject's bad faith, the court claimed that, by visiting the controller's website, the data subject implicitly consented to the data processing in accordance with Article 6(1)(a) GDPR.
In conclusion, the court identified an abuse of the right, as the data subject based their requests on irrelevant interests and goals that were not worthy of protection in themselves.

LG Baden-Baden - 3 O 277/22


Referencing a decision of the Court of Justice of the European Union (ECJ) (ECLI:EU:C:2014:2081), the Austrian Federal Administrative Court stated that personal data legally assessed by the competent state agency in an administrative matter is not considered as information about the data subject. Consequently, the court held that a correction of personal data in a legal notice cannot be based on Article 16 GDPR.

BVwG - W256 2226003-1/5E


holding_Garante per la protezione dei dati personali (Italy) - 9867661

The Italian DPA held that the controllers violated Article 17 GDPR. In particular, a controller shall facilitate the exercise of data subject's rights in accordance with the procedural rules set forth in Article 12 GDPR. The fact that the controllers updated the content of the original publication was not considered sufficient by the supervisory authority.
Therefore, pursuant to Article 58(2)(c) and (g) GDPR, the Italian DPA ordered the controllers to take action in order to ensure the delisting of the publications from external search engines, insofar as the data subject's name was used as a keyword for the online search.
In addition, the Italian DPA issued a warning against the controller pursuant to Article 58(2)(a) GDPR.


holding_Datatilsynet (Denmark) - Decision of 2 December 2022

First, the Danish DPA stated that a detailed description of the criminal offence by the controller in the sent email meant that the recipient of the information had to consider it to be true. According to Section 8 Subsection 3 of the Danish Data Protection Act, such information may only be shared if the controller had the authority to do so. This might be the case, if the disclosure is made to further personal interests that clearly exceed the reasons for maintaining confidentiality.
Second, the DPA assessed that the controller had a legitimate interest in passing on information about the dismissal of the data subject to its customers and in informing them that the data subject could, therefore, not enter into agreements on behalf of the company anymore.
Third, the DPA made a concrete assessment of the seriousness of the offence pursuant to Article 83(1) GDPR when assessing which sanction should be adopted. In assessing that a fine should be imposed, the DPA emphasised that criminal offences were at stake as sensitive information. Besides that, the description of the criminal offence, which was the reason for the dismissal, was not necessary for the company to safeguard its legitimate interests. Moreover, the controller has not proven that it only informed customers with whom the data subject had been in contact.
In Denmark, fines according to the GDPR must be decided by the courts. The Danish DPA can recommend to impose fines on both private actors and public authorities. In connection with the notification of the case to the police, the DPA assesses the amount of the fine, and it is then up to the police and the prosecution to bring charges and conduct the criminal case court. In this case, the DPA proposed a fine of DKK 150,000 on the controller for unlawfully passing on information about criminal offences to third parties.


The Division noted that not only the wording, but also the context and purpose should be considered when interpreting EU legislation (HvJ Tarola). This required a comparison of the different language versions (HvJ Consorzio).
The Division found that the English, German and French version of Article 17(3)(e) all had a much broader scope than the Dutch text. They contained some translation of the word 'defense,' (defence; Verteidigung; défense) while the Dutch version merely used the word 'substantiation' (onderbouwing).
The Division further noted that in case of these differences in translations, it must consider the objective and purpose of the legislation for a uniform interpretation (CJEU Kraaijveld). The objective is the protection of natural persons when processing personal data (Recital 1&2), however this must be balanced with other fundamental rights recognized in the Charter (Recital 4). In particular, the Division followed, Article 47 of the Charter, which included the right of defense (CJEU Otis). Thus, the German, English and French versions of Article 17(3)(e) were more consistent with the purpose of the AVG.
The Division held that, contrarily to what the data subject argued, Article 17(3)(e) AVG does include the defense against a legal claim. Therefore, the appeal was unfounded.

RvS - 202100165/1/A3


The DPA held that the company failed to comply with Article 5(1) GDPR as they processed the data subject's personal data illegally, due to the use of his vehicule tracking outside of working hours and for the purpose of locating the data subject for the lack of legal basis.
The DPA also found a breach of Article 12 and 13 GDPR as the controller gave incomplete information regarding the function of the system installed in the vehicule, as well as the fact that he was not entitled to use it outside of working hours.
The HDPA therefore imposed a €2,000 fine on the controller.

HDPA (Greece) - 6/2024


The DPA found several violations and imposed a fine of total amount €10,000.
First, the DPA held that the controller violated Article 5, Article 12 and Article 15 GDPR for refusing to satisfy the data subject’s access request to the CCTV footage without demonstrating adverse negative effects on the rights or freedoms of the employees involved. It also found that it stored the footage for way longer than 48 hours. For this violation the DPA imposed a €3,000 fine.
Second, it found that the controller infringed Article 5, Article 13 and Article 24 GDPR by transmitting the personal data of the minor child to the third party without prior notification, and imposed a €3,000 fine.
Third, it found that the controller disclosed the interim measures order of the court which contained personal data of the child to a large number of third parties, in violation of Article 5 and Article 13 GDPR, and imposed a €3,000 fine.
Lastly, it imposed a €1,000 fine for failure to cooperate with the DPA, in breach of Article 31 GDPR.

HDPA (Greece) - 31/2025


holding_ANSPDCP (Romania) - Fine against Condor SA

The ANSPDCP found that someone had gained unauthorised access to a document containing the personal data of current and former employees, which included, inter alia, name and surname, role, salary, bank account and personal identification number.
The ANSPDCP held that the controller had not implemented the necessary technical and organisational measures to ensure the confidentiality of its current and former employees' personal data, and did not prove to have adequately trained its personnel regarding the protection of personal data. As a result, the ANSPDCP held that the controller had violated Articles 32(1), (2) and (4) GDPR, and issued a fine of approximately €2000 (RON 9.897,4).
Additionally, the as corrective measures, the ANSPDCP ordered the controller to implement appropriate technical and organisational measures to ensure compliance with GDPR, including the adequate training its personnel, and also to contact the individual who was granted unauthorised access to the personal data to make sure they delete it.


The court found that the DPA could refrain from conducting further investigation. According to Article 57(1)(f) GDPR, the DPA must deal with complaints to the extent appropriate. The court therefore held that the DPA has discretion to determine case by case whether to take corrective measures.
The court found that based on the available information, the DPA could not yet determine whether there was a violation as for example it was not clear what personal data was shared during the phone call. The fact that the controller should have informed the former bankruptcy trustee that they were no longer appointed and that information should not be shared with them anymore, does not mean that there was a GDPR violation. Therefore, further investigation was required.
However, the court stated it could follow the DPA’s reasoning for not further investigating the complaint based on the DPA's criteria. Therefore, the court held that the DPA could refrain from further investigating and thus dismissed the appeal.

Rb. Den Haag - SGR 23/6174


The Spanish DPA considered that even though the Community is authorized to display personal data in some cases for the management of the community, the notice board must not be placed in a public area of transit easily accessible by any person.
The AEPD highlighted that the data subject had a previous complaint against the Community under proceeding A/00001/2018, concluded with a warning to the Community and an order to remove the (other) document displayed.
AEPD concluded that, based on the evidence, it occurred a personal data security breach, categorized as a breach of confidentiality as the data subject’s personal data was improperly exposed by the Community to third parties, as they appeared in an Decree of Execution of Judicial Titles. Specifically, the information was displayed on a bulletin board in plain view of any person who accesses the building and not only the neighbors.
For this reason, the Community was fined €1,500 for unduly exposure of personal data to third parties on a public bulletin board, in violation of Article 5(1)(f) and Article 32 GDPR.

AEPD (Spain) - EXP202100764


In its decision, the Belgian DPA first stated that the withdrawal of a complaint does not as such put an end to any potential violation of the GDPR, and therefore does not deprive the DPA from its competences to assess whether the reported facts constitute an infringement. The Belgian DPA noted in this respect that the control it exercises does not aim so much at settling disputes between parties, but rather at ensuring compliance with the data protection rules.
In the present case, however, the Belgian DPA noted that the potential infringements of Article 17 GDPR by the search engine provider were inextricably linked to the willingness of the Complainant to exercise his right to erasure. Because the Complainant had informed the Belgian DPA of the fact that he longer wanted to exercise his right to erasure, the Belgian DPA thus concluded that the case had become moot. The Belgian DPA therefore closed the case without taking any further action.

APD/GBA (Belgium) - 103/2021


holding_UODO (Poland) - ZSZZS.440.768.2018

Following an ex officio administrative proceedings, the President of the UODO has established that the school is using a biometric reader at the entrance to the school canteen that identifies the children in order to verify the payment of the meal fee. The UODO highlighted that it is special categories of personal data and that extra protection has been set out for children.
In this case the UODO found that the consent given by the parents was not valid in particular because of the imbalance of the parties, hence the processing of biometric data did not have a valid legal basis. It also stressed that there it promotes unequal treatment among the students. The identification of the students could have been achieved through less intrusive means.
For the mentioned reasons, the UODO ordered the primary school to delete the biometric data concerned, to cease the collection of this data in the first place and it imposed the fine of PLN 20,000.

UODO (Poland) - ZSZZS.440.768.2018


holding_ANSPDCP (Romania) - Fine against Kaufland Romania SCS

The Romanian DPA decided that a controller should take all the necessary technical and organisational measures when answering an access request to make sure the personal data and rights of others are not affected. The DPA suggested that, in cases like these, in order to provide the claimant with the personal data in their access request, this could be solved by blurring the image of other individuals appearing in the footage.
Therefore, the Romanian DPA held that Kaufland did not fulfill their obligation to grant the data in the claimant's access request in breach of Article 15(3) GDPR, and imposed a fine of approximately €3000 in local currency on the supermarket chain.


First, the AEPD recalled that, in accordance with Article 5(1)(c) GDPR, private surveillance cameras should be oriented towards private space, and not intimidate adjacent neighbours nor control the local transit without justification. Unless permitted by specific legal provisions, private individuals are not allowed to capture images of public space. In the case at hand, the AEPD found that the cameras used by the controller aimed at recording the controller’s property, within the limits of the legal data protection provisions. In its analysis, the AEPD held that the first camera used by the controller also captured the surroundings, which was done in proportionate manner and thus was not illegal. The second and third cameras captured a very small portion of the community yard. Finally, the fourth camera located on the controller’s rooftop did not capture direct images of the data subject’s property. The AEPD concluded that the images captured by the surveillance system were not disproportionate or excessive, and did not constitute of a breach of Article 5(1)(c) GDPR.
Second, the AEPD recalled that, compliant with Article 13(1) and (2) GDPR, and Article 22(4) of the Law on the Protection of Personal Data and Guarantee of Digital Rights (Ley Orgánica 3/2018 de Protección de Datos Personales y Garantía de los Derechos Digitales - LOPDGDD), the data controller should display a sufficient visible sign informing data subjects about the video surveillance of the area. In the case at hand, the AEPD held that the controller did not install a sign informing about the video surveillance system. Instead of a fine, the AEPD issued a reprimand on the controller.

AEPD (Spain) - PS/00446/2021


The CNIL found that the controller had violated Articles 5(1)(e), 13, 17 and 32 GDPR by failing to comply with the obligation to determine and implement data retention periods, failing to inform web visitors about processing activities, failing to comply with the request for erasure of data, and failing to ensure appropriate security measures regarding authentication on the website and on the customer relationship management software used by the company's employees.
The CNIL also found that the controller had violated national provisions concerning cookies and unsolicited commercial communications.
With regards to Article 5(1)(e), the DPA found that the company did not have a retention policy in place for the deletion of data. The company had data from accounts as old as five years without any activity.
With regards to Article 13, the controller did not offer on their website information such as the contact details of the data protection officer, the retention periods, the legal bases for processing, and certain rights from which individuals benefit under the GDPR.
With regards to Article 17, the company did not delete the data when there were requests from users to delete their account, but only deactivated the accounts, preventing the person from connecting to the account and ending unsolicited commercial communications.
With regards to Article 32, the DPA found that there was not a sufficient level of data security to meet requirements concerning the robustness of passwords, both for users and employees.
With regards to cookies, the DPA found that several cookies that did not fall within the scope of the exceptions (necessary cookies) were placed on the user's terminal as soon as they arrived on the home page of the site, and before any action on their part.
Additionally, the company was sending unsolicited commercial communications to users who created an account for commercial purposes and without obtaining their consent.
Therefore, the CNIL fined Brico Privé €300,000 for violating Articles 5(1)(e), 13, 17 and 32 GDPR and €200,000 for violating Article 82 of the loi n° 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés and Article 34(5) of the Code des postes et des communications électroniques (CPCE) – the national provisions concerning cookies and unsolicited commercial communications.
The CNIL also ordered the controller to bring its processing operations into compliance with the obligations resulting from Article 5(1)(e) GDPR and Article 34(5) of the CPCE, and in particular:
  * to cease to retain the personal data of former customers at the end of a set period of inactivity and proceed with the purging of such data retained by the company,
  * to provide evidence of an intermediate archive procedure for customers personal data, established after sorting out the relevant data to be stored and deleting irrelevant data, as well as the starting point of such storage (e.g. for invoices stored for accounting purposes),
  * to cease unsolicited commercial communications to users who have not given their consent.

CNIL (France) - SAN-2021-008


holding_Garante per la protezione dei dati personali (Italy) - 9746047

The Italian DPA noted that the use of video surveillance systems may result in the processing of personal data depending on the positioning of the cameras and the quality of the images captured. Furthermore, the Italian DPA stated that processing of personal data by video surveillance cameras must be carried out in compliance with the general principles contained in Article 5 GDPR, in particular with the principle of transparency. In the case of video surveillance cameras, this presupposes that "the interested parties must always be informed that they are about to enter a video surveillance area", and therefore the data controller must place appropriate information signs which convey this information to data subjects.
The Italian DPA held that the processing of personal data carried out by the club in this case was unlawful since it was not carried out in accordance with the principles of "lawfulness, fairness and transparency" and "data minimisation", in violation of Articles 5(1)(a) and (c) GDPR, as well as in breach of the adequate information requirements under Article 13 GDPR. Based on these infringements, the Italian DPA imposed a €2000 fine on Ruian club.


The DPA noted that pursuant to the entry into force of the GDPR, public bodies were obliged to designate a DPO no later than 25 May 2018. Meanwhile, on the date the investigation was opened, and after consulting the register of DPOs, no DPO had been identified for the controller. The controller appointed a DPO only on 10 March 2023, namely after the opening of the investigation. Thus, the controller violated Article 37(1)(a) GDPR. Moreover, the DPA acknowledged that when the investigation began, the controller had not communicated to the DPA the contact details of the DPO, breaching Article 37(7) GDPR.
Observing Article 48 of the National Data Protection Law, the DPA may impose administrative fines as provided in Article 83 GDPR, except against the State or municipalities. Hence, the DPA found it appropriate to issue a reprimand to the controller under Article 58(2)(b) GDPR. In light of this, the DPA recognised that during the proceedings, the controller took steps to remedy the shortcomings identified by the head of the investigation.

CNPD (Luxembourg) - 10FR/2023


holding_ANSPDCP (Romania) - Valoris Center S.R.L.

The DPA held that Valoris did not fulfill its obligations laid down in Article 29, Article 32(1)(b), and Article 32(4) GDPR. Even if the employee of Valoris was not allowed to share the personal data with the customer, this data breach could only occur because of Valoris negligence. In particular, the processor had not taken adequate measures to ensure that any natural person acting under its authority could have limited access to the personal data. Hence, the security of processing was not guaranteed, ultimately leading to a personal data breach.
The DPA considered the different aspects of the case, such as the amount of data subjects involved, the categories of personal data, and decided to impose a fine of 9898 Leu (the equivalent of €2,000) on Valoris.


Without prejudice to the results of the final investigations corresponding to the sanction procedure, the AEPD understood that the defendant could have breached the lawfulness of processing principle as per article 6(1) GDPR: on the basis of the available evidences, and although the defendant admitted its mistake and declared that new measures in order to avoid such situations have been taken, it did not prove the lawfulness of the data processing. Consequently, after considering some aggravating circumstances [(i) there is a negligence by the defendant, (ii) basic personal data have been affected, (iii) there has been a continuous breach, and (iv) there is a clear connection between the busines activity of the defendant and the processing of personal data related to clients and third parties], the AEPD understood that, in case the sanction procedure resulted in a successful decision, this infringement would be fined with 75,000 € to the defendant. In this sense, the AEPD offered the defendant the possibility to settle the issue before the decision takes place by agreeing to a voluntary payment of part of the fine with two possible discounts: (i) acknowledging of its liability (60,000 €) and early voluntary payment (45,000 €). The defendant agreed to both concepts, so it paid 45,000 € and the sanction procedure was closed by the AEPD.

AEPD (Spain) - PS/00198/2020


Recital 64 of the GDPR states that the data controller should take all reasonable steps to verify the identity of a data subject requesting access. If there is reason to doubt the identity, additional information may be requested, as follows from Article 12(6) of the GDPR.
In this case, the Council of State as of the opinion that there were other possibilities for establishing identity, which raised a lower threshold. The presentation of a copy of a passport, for example, is in principle considered a reasonable measure to verify identity.
The fact that it is possible to falsify the copy of a passport and that it is impossible to check whether the document that has been scanned is authentic, as argued by the Council, does not make this any different. The Council itself indicated that it did not suspect that the copy had been falsified or that there might be another person behind the request. Therefore there was no reason to ask for additional information or to impose additional requirements.

RvS - 202000948/1/A3


With regard to the application of the "one-stop shop" mechanism and the CNIL's jurisdiction:
The Conseil ruled that the application and enforcement of the ePrivacy directive was the responsibility of national DPAs according to Article 15a of the directive. The "one-stop shop" mechanism did not apply in this case, even when there was a form of a cross-border processing. The Conseil also stated that the absence of a 'one-stop shop' mechanism did not imply any infringement of Article 50 of the Charter of Fundamental Rights, because the DPA only ruled on breaches of national law transposing EU law in the contested decision, and not on GDPR related violations.
The Conseil also assessed the compatibility of Article 3 of the French Data protection Act with the ePrivacy Directive. The Conseil determined that Directive 2002/58/EC did not prevent the French DPA to apply the French data protection Act (including Article 82). The Directive would therefore also not prevent the French DPA from penalising the controller for supposed violations of Article 82 of the French data protection Act. Therefore, the Conseil established that the French DPA could enforce the French data protection act against any person or legal entity responsible for the processing of data who had an establishment in France, irrespective of the location of the principal establishment of the responsible entity. This enforcement by the DPA would also not constitute violations of articles 49 (Freedom of establishment) or 56 (Freedom to provide services) of the TFEU.
With regard to the sanction imposed by the CNIL:
The Conseil deemed that the applicant was sufficiently informed regarding the scope of the DPA's investigations, the facts and the legal grounds on which the sanction was based. Moreover, the Conseil considered that the applicant was given sufficient time to present its defence. The Conseil also ruled that the involvement of the French DPA, while the Luxembourg DPA was the lead supervisory authority, was not enough to constitute a breach of the equality of arms principle. Amazon had argued that the involvement of the French DPA in the procedure had enabled the French DPA to gain access to privileged and confidential information and had used this information as a basis for its own decision. The Conseil determined that Amazon did not provide enough proof for this argument and stated that Amazon was not able to prove that was the procedure contrary to Article 15a(4) of Directive 2002/58/EC.
On a possible violation of Article 50 of the Charter of Fundamental Rights:
The Conseil explained, based on the CJEU's case law (Aklagaren v Akerberg Fransson C-617/10, Powszechny Zaklad Ubezpieczen na Zycie SA of C-617/17 and bpost SA v Belgian Competition Authority C-117/20), that the principle invoked by the applicant, that the same person may not be the subject of several proceeding in respect of the same facts, was not violated by the French DPA. The Conseil stated that the principle could only be enforced when criminal proceedings had been definitively terminated. This was in particular the case when a criminal penalty had become final. The Conseil held that Amazon was not found to be the subject of a final sanction issued by the Luxembourg DPA for the facts that had resulted in the €35,000,000 fine in the contested decision. The Conseil rejected the applicant's claim for a reference for a preliminary ruling on the matter.
Regarding the application of French Data Protection Act by the French DPA, Amazon had argued that the legal framework regarding cookies was not stable and unclear at the time when proceedings against Amazon were started. The Conseil concluded that it had published guidelines detailing obligations for entities under the applicable law, and considered that the fact that other national supervisory authorities had taken divergent positions in interpreting the conditions and procedures applicable to the collection of user consent had no bearing on the application of the French Data Protection Act by the French DPA.
On the proportionality of the sanction imposed:
Taking into account the elements assessed by the French DPA to calculate the imposed fine, the Conseil ruled that the DPA had not imposed a disproportionate penalty on the controller.
Consequently, the Conseil rejected the entirety of controller's claims.

CE - 451423


holding_Rb. Zeeland-West-Brabant - 10072897 AZ VERZ 22-61

The Court held that the summary of the dismissal was not legally valid, following the requirements under article 7:677(1) of the Dutch Civil Code (BW). The provision states that there must be an ‘urgent reason’, the dismissal must be without delay, and the reason must be communicated to the employee in a timely and sufficiently clear manner. The e-mail sent to the data subject listed “refusal to work” and "insubordination” as the ‘urgent reasons’.
The Court found that the reason was not sufficiently clear, as the email had no explanation on the nature and seriousness of the behaviour which underlay the ‘urgent reasons’ stated in the e-mail. The e-mail correspondence also did not sufficiently prove that the data subject refused to perform his assigned activities. Hence, the alleged refusal to work did not constitute an urgent reason for the dismissal granted.
The Court also found that there was no unruly or disobedient behaviour, as there was no reasonable instruction that the data subject had to comply pursuant to the definition of reasonable orders under article 7:678(2)(j) BW. It held that Art. 8 ECHR is applicable for the underlying employer-employee relationship, where the state did not sufficiently protect the fundamental right.
The court held that since the data subject was only observed during working hours, and there were no recordings that were stored or used, there was an absence of processing of data within the meaning of Article 4(2) GDPR, hence the lawfulness of the observation was tested directly against Article 8 ECHR. The requirement by the controller to leave the data subject’s camera on is contrary to his right to respectful private life without any justification under Article 8 ECHR. Hence, there was no refusal to comply with a reasonable order/instruction by the data subject, therefore no urgent reason for instant dismissal either.
The Court awarded the data subject an approximation of €75,000 in compensation for reasons including wages, vacation allowance and transit compensation.


holding_DPC (Ireland) - WhatsApp Ireland Limited - IN-18-12-2

First, it found WhatsApp denied non-users their right to exercise control over their personal data by failing to provide them with the information prescribed by Article 14 GDPR.
Second, it held WhatsApp failed to provide users with sufficiently meaningful information regarding nearly every category of information to be provided under Article 13 GDPR, making it impossible for them to adequately consider and exercise their data rights.
Third, it included an infringement of the key principle of transparency under Article 5(1)(a) GDPR in its final decision following an objection to its original decision by the Italian SA and a decision by the EDPB.

WhatsApp’s transparency obligations in the context of non-users under Articles 14 and 12(1) GDPR
In its assessment of WhatsApp’s processing of non-user personal data, the DPC first analysed how the ‘Contact Feature’ operates in practice. It found that the data it generates, a table of lossy hashes together with the associated users’ mobile phone numbers, is personal data because non-users are identifiable. It held WhatsApp processed this personal data as a controller due to the degree of control it has over the purposes and means of that processing.
Having concluded WhatsApp processes non-user personal data as a controller, the DPC evaluated its compliance with the transparency obligations set out in Articles 14 and 12(1) GDPR.
WhatsApp argued that it took “appropriate measures” to inform non-users of the “very limited ways” in which it processed their personal data. This was supposedly done by stating users provide the company with all their contacts’ phone numbers in their Privacy Policy.
The DPC rejected this argument, pointing out the lack of a discoverable and accessible “public notice” that would provide non-users of WhatsApp services with the information they are entitled to under Article 14. For example, they should be provided with details about the “circumstances in which any non-user personal data is shared with any of the Facebook Companies”. It emphasised that the burden of preparing such information is outweighed by “the role and utility of the right to be informed”.
€75,000,000 of the total fine are attributable to the infringement of Article 14 GDPR.

WhatsApp’s transparency obligations in the context of users under Articles 13 and 12(1) GDPR
The DPC first considered WhatsApp’s submissions of a general nature, and divided them into four categories. Then, it in turn considered how WhatsApp conveyed to users the information required by the sub-clauses of Articles 13(1) and 13(2) GDPR, asking two questions as part of every assessment:
-“What information has been provided?”
-“How has the information been provided?

Submissions of a general nature

Submissions concerning WhatsApp’s willingness to amend its Privacy Policy and related material.
The company contended any changes it made to its policies in response to the Preliminary Draft it was provided should be taken into consideration when the DPC determined whether a breach of the GDPR occurred. The DPC rejected this.

Submissions concerning Legal Certainty
WhatsApp argued official guidance about transparency requirements was lacking and that its policies aligned with those of industry peers. It qualified the standard to which the DPC held them in the preliminary draft as “alternative and even higher” than what is required by the GDPR. The DPC rejected both these points, citing the Article 29 Working Party’s Transparency Guidelines to support their original assessment.

Submissions concerning Inconsistency
WhatsApp suggested there were inconsistencies in the DPC’s interpretation of the Transparency Guidelines, notably about the requirement of a “concise approach” to providing information about the company’s reliance on legitimate interests. The DPC rejected this, explaining its view that there was an “over-supply of very high level, generalised information at the expense of a more concise and meaningful delivery of the essential information” in the Privacy Policies.

Submissions concerning WhatsApp’s pre-GDPR engagement with the Commission
WhatsApp defended its position “in a limited number of respects” by pointing out that the DPC did not take issue with its policies at the time of its pre-GDPR engagement. The DPC rejected this, maintaining that its function is not to approve or review policy documents for individual data controllers

Articles 13(1) and 13(2) GDPR

Article 13(1)(a) - the identity and contact details of the controller
The DPC held this information was provided in a clear and predictable way.

Article 13(1)(b) – the contact details of the data protection officer
The DPC held this information was provided in a clear and predictable way.

Article 13(1)(c) – the purposes of the processing for which the personal data are intended as well as the legal basis for processing
The DPC stated that data subjects must be provided with meaningful information such that they know (i) which of his/her personal data are being processed, (ii) for what processing operation(s), (iii) for what purpose(s), and (iv) in reliance on which legal basis. Such information should be presented in a way that clearly links each of these elements. This “Proposed Approach” represents the minimum information required to adequately give effect to the rights of the data subject.
It analysed whether WhatsApp achieved this in regard to the individual legal bases it identified in its Privacy Policy and found the company did not.

Article 13(1)(d) – where applicable, the Legitimate Interests being pursued
The DPC originally held this information was provided in a clear and meaningful way, but amended its finding to comply with the EDPB’s binding decision.

Article 13(1)(e) – the Recipients or Categories of Recipients
The DPC held “the information provided does not enable the user to understand what categories of personal data will be sent to which category of recipient, [nor] why such transfers are being carried out and, therefore, [their] consequences”.
It criticised the excessive links between different WhatsApp documents and “scattered” manner relevant information is spread throughout them, and stated it should be presented in a clear and concise format instead.

Article 13(1)(f) - Transfers of personal data to a third country
The DPC held controllers are required to provide information such that data subjects are informed either (i) that transfers are subject to an adequacy decision; or (ii) that transfers are not subject to an adequacy decision. The link to “a generic European Commission webpage” WhatsApp provided did not meet this standard. Instead, the DPC stated the “specific set of standard contractual clauses or specific adequacy decision” should be directly accessible.

Article 13(2)(a) – Retention Criteria/Retention Periods
The DPC held WhatsApp failed to provide meaningful information (i) in relation to the criteria that will be used to determine if, and for how long, a user’s personal data will be retained following the deletion of their account; (ii) concerning the fact that certain information will be retained, even after deletion; and (iii) to explain how such retained records are “disassociated from personal identifiers”.

Article 13(2)(b) - the existence of the data subject rights
The DPC held this information was provided in a clear and concise way.

Article 13(2)(c) – the existence of the right to withdraw consent
The DPC held whilst WhatsApp’s Legal Basis Notice referenced the right to withdraw consent, the required extent of information was not included. Further, users were not informed about how to exercise this right.
It again criticised the “piecemeal approach to the provision of the required information”, which made any effort to provide information about this right pointless.

Article 13(2)(d) – the right to lodge a complaint with a supervisory authority
The DPC held this information was provided in a clear and concise way, albeit in a confusing place.

Article 13(2)(e) - whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data
The DPC originally proposed no finding under this heading, but amended its finding to comply with the EDPB’s binding decision.

Article 13(2)(f) – the existence of automated decision-making, including profiling
The DPC proposed no finding under this heading because WhatsApp does not engage in such activities.

WhatsApp’s transparency obligations in the context of its relationship with other Facebook Companies and any sharing of user data in the context of that relationship
The DPC specifically assessed the extent to which WhatsApp explained its relationship with the Facebook Companies and any consequent sharing of data.
It again criticised the manner in which the information is spread out "across a wide range of texts", and how a significant amount of it is so high level as to be meaningless. It pointed out how the Facebook FAQ is only linked to WhatsApp's Privacy Policy in one place. The information being provided is characterised as "unnecessarily confusing and ill-defined".
As such, the DPC held that WhatsApp failed to comply with its transparency obligations per Articles 13(1)(c), 13(1)(e) and 12(1) in relation to how the company works with other Facebook Companies. It notably added that "unless WhatsApp has a concrete plan in place, that includes a definitive and imminent commencement date, to commence the sharing of personal data on a controller-to-controller basis with the Facebook Companies for safety and security purposes, the misleading elements of the Legal Basis Notice and Facebook FAQ should be deleted to reflect the true position".
Whilst the DPC originally found WhatsApp complied with Article 13(1)(d), it changed this assessment following the EDPB's binding decision.

WhatsApp's compliance with the Principle of Transparency per Article 5(1)(a)
The DPC did not include an assessment on this issue in its original draft, but found a violation of Article 5(1)(a) following the EDPB's binding decision.

Exercise of Corrective Powers
The DPC exercised the following corrective powers:
  * A reprimand pursuant to Article 58(2)(b).
  * An order to bring processing operations into compliance, pursuant to Article 58(2)(d) within 3 months.
  * An administrative fine, pursuant to Articles 58(2)(i) and 83, addressed to WhatsApp, in the amount of €225,000,000.
The total fine reflected these individual infringements.
i. In respect of the infringement of Article 5(1)(a) of the GDPR, a fine of €90,000,000
ii. In respect of the infringement of Article 12 of the GDPR, a fine of €30,000,000
iii. In respect of the infringement of Article 13 of the GDPR, a fine of €30,000,000
iv. In respect of the infringement of Article 14 of the GDPR, a fine of €75,000,000
It arrived to these figures after first taking a number of submissions by WhatsApp into consideration, then assessing the Article 83(2) criteria, and finally adopting the EDPB’s binding decision.

Submissions

'New and Subjective Views' Submissions
WhatsApp argued the DPC’s assessment turned on “new and subjective interpretations” of relevant GDPR articles, and that “unprecedented fines” should not be imposed where it was not aware of such a higher standard. The DPC rejected expecting this much, and gave a concrete example of how the company did not meet the standard it claimed to by citing the Transparency Guidelines’ advice on the use of “language qualifiers such as ‘may’, ‘might’, [etc]”.

'Nuanced Nature of Assessment' Submissions
WhatsApp argued that the “nature” of assessing transparency requirements is “subjective and nuanced” and that this made the DPC approach to this investigation inappropriate, pointing to the “material differences” between the views of the original Investigator and Commissioner as evidence. The DPC rejected this, arguing they were the mere “result of a divergence in approach to the inquiry itself”.

'Binary Approach' Submissions
WhatsApp argued that the DPC should not have found “either full compliance or complete non-compliance with each provision”. In response, the DPC repeated much of its earlier justifications for the findings it made to illustrate that it only assessed whether “all” the required information under every article had been provided.

'Careful and Good Faith Efforts' Submissions
WhatsApp, amongst other things, argued it considered that it met the required transparency standard because “its approach [to transparency] is aligned with the approach adopted by many industry peers”. The DPC rejected this, stating that “while an industry-wide failure (if this is, in fact, the case) to achieve compliance with the transparency requirements is a poor reflection on that industry, it is not, however, evidence of a position whereby data controllers in this particular sector are unable to identify what is required of them, in terms of transparency”.

'Willingness to Change' Submissions
WhatsApp argued that because it actively ‘volunteered’ to change the information it provides in response to the preliminary draft decisions it received, the use of corrective powers is inappropriate. The DPC rejected this, highlighting that the company’s express disagreement with the DPC’s points at previous points during the investigation “creates certain limitations, in terms of the weight [it] might attribute to WhatsApp’s willingness to change”.

'Theoretical Risk' Submissions
WhatsApp argued the DPC could not demonstrate that its approach to transparency “has in fact had any negative impact on data subject rights”. The DPC reminded the company it has no duty to demonstrate “evidence” of damage to data subjects.

Article 83(2) criteria
The DPC considered each of the Article 83(2) criteria (subsection a-k) to assess the nature, gravity and duration of the infringements as well as the duration of the infringements. The purpose of this assessment was to determine the sums to be fined in order for them to be “effective, proportionate and dissuasive” as required by Article 83(1) GDPR.
It held a fine is warranted where:
  * All four infringements are very serious in nature and severe in gravity. This was the case as WhatsApp only provided "41% of the prescribed information to users and none to non-users"
  * The number of affected users was very large. The exact figure of users was redacted in the report, but this was the case. The number of affected non-users was described as "unquantifiable" but likely to be extremely high.
  * Users are not able to meaningfully consider and exercise their data subject rights. The DPC held there was a very serious information deficit that led to this.
Further, it took consideration of the limited nature and scope of the processing in question, but stated it could not give it significant weight as a mitigating factor because of the seriousness of the infringements. It characterised all of them as negligent and the Article 14 GDPR one demonstrating "a high degree of negligence", which was taken into account as an aggravating factor.
The only mitigating factors it recognised as valid were the limited categories of personal data processed by WhatsApp and the company's willingness to amend its Privacy Policy and related material.

EDPB’s binding decision
See decision here for commentary.

Appeal
The decision by the EDPB underlying this case has since been appealed by WhatsApp, which brought an action to the CJEU on 1 November 2021.


The BVwG held, that KSV 1870 Information GmbH is allowed to store the data on the data subject's insolvency, even though that data is no longer available in the official insolvency register. Both the amount of a debt and the time that has passed since its incurrence and its payment are relevant to assess an indivuidual's creditworthiness.
Neither EU law nor the national Austrian law contain provisions on the allowed storage period of creditworthiness data (such as information on insolvencies). The storage period can therefore be established by assessing existing legal provisions that deal with creditor protection or requirements for an appropriate credit assessment.
Under REGULATION (EU) No 575/2013 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012 banking institutions have to estimate the probability of default of payment by using long-term averages of the annual default rate, based on a historical observation period of at least five years. In light of these obligations and the fact that banking institutions are among KSV 1870 Information GmbH's customers, the BVwG rejected the data subject's erasure request. The debts have only been fulfilled some two years ago (in 2018) - i.e. nowhere near the five-year period taken into account by the BVwG.

BVwG - W211 2225136-1


Overturned and upheld decisions
Concerning the appeal against decisions 1, 3, 4 and 5 (see above: "Decisions by the Austrian Data Protection Authority"), the BVwG had already issued its decsion on 20.08.2020 (GZ 2217446-1/15E):
  * decisions 1, 4 and 5 were upheld and
  * decision 3 was overturned.
On 23.10.2020, the Austrian Postal Service informed the BVwG that it had deleted any data on "marketing information and classifications", including those on the "affinity for a political party" from its database.
On 26.11.2020, the BVwG issued its decision on the appeal against decisions 2 and 6:
  * decision 2 was partially overturned and partially upheld: The order to erase the data on the "affinity for a political party" was overturned, because the Austrian Postal Service had already deleted this data. The ban of further processing of such data was upheld.
  * decision 6 was overturned.

Data on the "affinity for a political party" as personal data?
The BVwG held that data on the "affinity for a political party" qualify as personal data under Article 4(1) GDPR. This affinity is a calculated probability of a person's interest fo advertisement by a certain political party for the purpose of limiting the sending of advertisement of political parties that the recipient is not interested in. It is i.a. based on regional election results, socio-demographic information and opinion polls. As it is assigned to a specific identifiable natural person, it qualifies as personal data under Article 4(1) GDPR.
The argument, that these data could not be rectified under Article 16 GDPR was waived as incorrect (and could not change the qualification as personal data anyhow). Assessments of a presumed affinity can indeed be rectified - e.g. in cases of incorrect socio-demographic information by using correct socio-demographic information.
Given the primacy of the GDPR as EU law, the differentiations between "marketing information and classifications" and other data in the national law (§ 151 GewO) could also not change the qualification of data on the "affinity for a political party" as personal data

Data on the "affinity for a political party" as special categories of personal data?
Data on the "affinity for a political party" also qualify as special categories of personal data, namely data on political opinions. The purpose of Article 9 GDPR is to protect data subject from discrimination based on their (presumed) political opinions. Even though the "affinity for a political party" only expresses a probability, it allows for discrimination based on the fact that they are considered to be especially interested in one or more particular political parties.

Lawfulness of processing
The BVwG held that the processing of data on the "affinity for a political party" could not be based on Article 9(2)(g) GDPR in connection with § 151(6) GewO in lack of a substantial public interest. The processing of personal data by address publishers under Article 151 GewO might facilitate the business of address publishers but it is not of vital interest for the economy. The general public would not be seriously affected without such a regulation. Processing of data under Article 151 GewO is therefore not in the substantial public interest.
Other legal bases under Article 9(2) GDPR could also not justify the processing of of data on the "affinity for a political party". Hence it needs to be based on the data subject's explicit consent under Article 9(2)(a) GDPR. As the Austrian Postal Service did not collect such consent, the processing was unlawful.

Ban of processing
The BVwG upheld the DSB's ban of processing but corrected it so that it only concerned the processing of data on the "affinity for a political party".

BVwG - W258 2217446-1


holding_Garante per la protezione dei dati personali (Italy) - 9938413

The DPA held that the processing of personal data by the data controller fell under Article 10 GDPR, which states that processing of data relating to criminal convictions and offences must take place only under the control of public authority or if the processing is authorised by Union or Member State law providing appropriate safeguards for the rights and freedoms of the data subjects. However, it found that the disclosure on the controller’s website of the data was carried out in the absence of a legitimate legal basis, in accordance with the combined provisions of Article 10 GDPR and Article 2-octies of the Italian Privacy Code. Because there is no law authorising the processing of judicial data as done in the present case.
Additionally, the DPA held that the processing did not comply with the principles set out in Article 5(1)(a) GDPR, Article 5(1)(c) GDPR and Article 5(1)(f) GDPR either. According to the Articles, personal data needs to be processed in accordance with the principles of lawfulness, fairness and transparency, the principle of data minimisation and the principle of integrity and confidentiality.
Thus, the DPA found that the disclosure, in the absence of lawfulness requirements, of such data by the Italian Bar Association in question, in its capacity as data controller, constituted an administrative offence under Article 166(2) of the Italian Privacy Code, read in conjunction with Article 83(5) GDPR.
The DPA fined the data controller €20,000 pursuant to Article 58(2)(i) GDPR and Article 83 GDPR.


In the first place, the DPA stated that the publication of data subjects' first and last names on a website was considered processing of personal data. These data allowed the identification of the data subjects since the list contained names of persons who fulfil the requirements to enroll in a specific category, and more elements allowing the identification by a broader audience.
Regarding the claim of the public character of the data, since it had been published on the SERGAS website, the DPA considered that a website is not a publicly accessible source. In addition, in case that the data was made available by a public entity for a specific purpose, the list made by the controller must rely on its own legal basis. When it comes to the concept of publicly accessible sources, the GDPR regulates it in the context of the right to information when the data was not collected from the data subject. In any case, data contained in a publicly accessible source must have a legal basis for further processing.
On the legitimate interest, the DPA noted that Article 29 Working Party Opinion 6/2014states that is necessary to take into account not only the data subject’s fundamental rights and freedoms but also their interests and that “legitimate” involves the need for processing and the use of the least invasive method to achieve the same end. For instance, the controller could have informed only the participants about the results but opted to inform the public in general.
In the context of data impact assessments, the DPA highlighted which elements to include, such as the bargaining position of the parties (especially the controller’s), if there is a reasonable expectation of further processing, the way that the controller processes the data (including if there is profiling or not) and the need for a balancing exercise between the data subject’s rights and interests and the controller’s legitimate interest whose results must show a prevalence of the latter, being the only case to rely on Article 6(1)(f) GDPR.
In the present case, the Spanish DPA did not observe a prevalence of the controller’s interest over the data subject’s rights for the following reasons. The processing was not necessary for the initial collection purposes, the data subjects were not informed about the publication of results on the website, sensitive data was included in the list, the storage limitation principle was violated (the publication lasted for more than three months), there was an incomplete impact assessment, there was no inclusion of information regarding the right to object which is mandatory when relying on legitimate interest as legal basis for the processing (Article 21(1) GDPR).
Finally, the DPA fined the controller €12,000 for a violation of Article 6(1) GDPR due to the lack of a valid legal basis for processing.

AEPD (Spain) - EXP202100897


holding_NAIH (Hungary) - NAIH/2020/2729/15

The DPA concluded that the video surveillance system introduced by the company was unreasonable and that it failed to provide sufficient information about collection of personal data from its employees. The company was fined 700.000 HUF and instructed to change the angle of view of the camera so that it doesn't monitor workers' activities.

NAIH (Hungary) - NAIH/2020/2729/15


The ICO found that Energy Suite had contravened Regulation 21 of Privacy and Electronic Communications (EC Directive) Regulations 2003 by calling numbers that were registered on the TPS. On the balance of probabilities, it found out that at least 1246 calls made by Energy Suite got connected. The ICO referred to another complaint made outside the investigation period to conclude that Energy Suite's compliance with Privacy and Electronic Communications (EC Directive) Regulations 2003 has been lax.
The ICO concluded that "unsolicited direct marketing calls were made to subscribers who had registered with the TPS at least 28 days prior to receiving the calls, and who for the purposes of regulation 21(4) had not notified Energy Suite that they did not object to receiving such calls." This contravention was considered to be serious due to multiple violations as Energy Suite made some 15,000 calls in total, many of which did not connect. Consequently, the ICO concluded that Energy Suite had been negligent and the "condition (b) from section 55A (1) DPA is met".
The ICO considered the aggravating factors of Energy Suite's action being for financial gain, claiming ignorance of the law, inadequacy in record keeping, continued non-compliance etc. At the same time, the ICO also considered the mitigating factors of Energy Suite being a small company, its cooperation with the investigation, and the number of calls being comparatively low.
Thus, the ICO issued a monetary penalty of £2000 (two thousand pounds) against Energy Suite,

ICO (UK) - Energy Suite Limited


The Conseil d’État rejected the request made by Google and ruled that the French DPA was territorially competent on this matter even though it is not the lead supervisory authority.
The court stated that Article 82 of the Law Informatique et Libertés was a transposition of article 5(3) of the Directive 2002/58/CE into French Law when dealing with cookies and that the CNIL is charged with enforcing this Directive. As such, the one-stop shop mechanism provided for in Article 56 GDPR does not apply in the present case.

CE - 449212


Issuing its decision, the DPA acknowledged the two arguments put forward by the controller. In response to both of these claims, the authority held that “the controller is not released from its obligation to inform the data subject merely because the data in question does not exist in a file kept by [them]”. Therefore, as the company did not respond to the data subject’s request in any way, they had violated Article 12 and 15 GDPR. The decision also found that the investigation, and the controller’s comments, demonstrated that the company does not appear to have any methods in place to deal with these sorts of requests.
Regarding the exercise of corrective powers, the DPA observed that the effects of the infringement were de minimis, that the company did not derive any benefit from it, and that there are have been no prior infringements by the controller. Therefore, in accordance with Article 58 GDPR, the DPA issued a reprimand to the controller, and imposed an order instructing the company to establish, within two months from the receipt of this notice, procedures to ensure that the rights of data subjects are duly satisfied and to inform the Authority accordingly.

HDPA (Greece) - 65/2022


holding_Datatilsynet (Denmark) - 2019-431-0031

First, the DPA assessed whether the controller had legal basis for the processing of personal data. The DPA held that the Party had a legitimate interest in using the personal data for campaigning purposes, and that the use of such publicly available information was not particularly invasive to the data subjects' privacy. The controller, therefore, had legal basis for the processing, namely Article 6(1)(f) GDPR.
The DPA then assessed whether the Party had acted in accordance with the information obligations in Article 14 GDPR. First, the DPA stated that, contrary to the opinion of the controller, the exception laid down in Article 14(5)(c) GDPR was not applicable "since the processing of information in connection with the sending of letters on the party's main issues is not expressly provided for by law". Second the DPA held that the information could not be considered "given to the data subject" when the data subject would have to find the information on the website by themself.
Hence, the DPA reprimanded the controller for violating Article 14 GDPR.

Datatilsynet (Denmark) - 2019-431-0031


holding_CPDP (Bulgaria) - PSPN-01-243.2021

The CPDP issued warnings to both controllers. It found that controller 1 violated Article 5(1)(a), (b) and (d) as well as 5(2) GDPR. Controller 2 violated Article 5(1)(a) GDPR.
The CPDP considered both the journalist and the doctor from the data subject’s same clinic controllers. The journalist, Controller 1, was a controller by nature of publishing the data on their profile. The doctor, Controller 2, was a controller because they distributed the data to Controller 1 with knowledge that they were a journalist intending to investigate and broadcast information about the data subject.
Given that the infringement was brought to an end and the unlawful data was only briefly posted online, the CPDP thought it proportionate to issue a formal nonmonetary warning to both controllers.

Controller 1
The CPDP found that Controller 1’s post violated Article 5(1)(a), (c) and (d) GDPR.
Controller 1 infringed the accuracy principle pursuant to Article 5(1)(d) GDPR. Regardless of whether or not the processing occurred for ‘journalistic purposes,’ the CPDP noted that accuracy obligations still applied. This reasoning related to the data subject’s diploma: While the CPDP considered that the diploma did not contain personal data because it only had an outdated photograph of the data subject from 1996, it determined that the image not being up to date implicated the accuracy principle.
The CPDP also considered that the post violated data minimisation obligations pursuant to Article 5(1)(c) GDPR. Information about the data subject’s previous convictions had already been deleted due to rehabilitation purposes. Thus, for the purposes of his medical practice, the CPDP said that the data subject should be considered unconvicted. As a result, Article 10 GDPR was also implicated. The inclusion of the data subject’s date and place of birth, PIN, address and kin connection data were also excessive. On the other hand, the processing of the data subject’s name and complete educational degree is not unlawful because it can be found in the register of the Bulgarian Medical Association.

Controller 2
The CPDP concluded that Controller 2 violated Article 5(1)(a) GDPR's transparency and fairness principles. The CDPD considered it clear that Controller 2 had processed information related to the data subject’s convictions within the meaning of Article 10 GDPR. It then transmitted this information to Controller 1 knowing that they were a journalist investigating this issue. The CPDP also noted that Controller 2 had misled the DPA through their written submissions, which incorrectly claimed no part in transmitting the data to Controller 1.

CPDP (Bulgaria) - PSPN-01-243.2021


holding_Garante per la protezione dei dati personali (Italy) - 9949453

On the basis of the information provided, the DPA found a systematic lack of compliance with GDPR provisions by the controller.
The DPA began by explaining that pursuant to Article 4 GDPR a phone number randomly dialled and called for telemarketing purposes can be considered personal data. Hence, the GDPR and the Italian Privacy Code apply. In light of this, the controller's acquisition of the personal data by word-of-mouth could not be considered valid since the person who provided the data was not entitled to give any valid consent on behalf of the data subject to whom the promotional communication was addressed. Thus, DPA assessed that the controller violated Article 5(1)(a) GDPR, Article 6 GDPR, Article 7 GDPR, Article 13 GDPR and Article 130 of the Italian Privacy Code also for not providing any information concerning the data processing to the data subjects.
In relation to this, the DPA stated that the controller violated Article 5(1) GDPR, Article 5(2) GDPR, Article 6(1)(a) GDPR and Article 7 GDPR for having utilised personal data acquired from third parties without having verified the existence of the requirements for lawful processing, so the acquisition of the free, specific, documented and informed consent of the persons concerned.
The DPA also found a breach of Article 5(1)(a) GDPR, Article 6(1)(a) GDPR, as well as Article 7 GDPR and Article 12(1) GDPR for not having published on its website a transparent information notice regarding the data processing operations conducted, as telemarketing activities were not clearly indicated.
It further established a violation of Article 12 GDPR, Article 15 GDPR and Article 21 GDPR as the controller failed to comply with the access requests made by certain data subjects. In some cases, the controller did not provide a full reply to the requests since it limited its answer to explain that the numbers were dialled randomly and that it would remedy the mistake by creating a 'no-go list' of numbers, although such list was never provided to the DPA. In addition, the controller failed to consider the objection requests made by some data subjects.
Moreover, the DPA also stated that the controller breached Article 130(3) of the Italian Privacy Code for having conducted telemarketing activities without having consulted the RPO.
Lastly, the DPA found a violation of Article 5(2) GDPR, Article 24(1) GDPR, Article 24(2) GDPR and Article 25 GDPR for failing to take adequate measures against any third parties that would unlawfully use the Scionti name, although the DPA also alleged that the promotional activity of third parties, allegedly external to the controller, could have been advantageous for the latter.
Consequently, the controller was ordered to stop processing personal data for marketing activities without proper consent, was instructed to promptly delete unlawfully obtained personal data, and was mandated to adopt stringent procedures and measures to ensure GDPR compliance in future promotional activities. Additionally, an administrative fine of €70,000 was imposed on the controller, taking into account the seriousness of the violations, inadequate cooperation, and the need for an effective deterrent.


holding_ANSPDCP (Romania) - S.C. Marsorom S.R.L.

The ANSPDCP held that the controller failed to take appropriate measures and breached the storage limitation principle enshrined in Article 5(1)(e) GDPR, and also failed to fulfill its obligation under Articles 25 and 32 GDPR.
Consequently, the DPA issued a €3000 fine and recommended the website operator to establish a shorter storage period for the personal data associated with the accounts of its customers.


holding_Rb. Rotterdam - C/10/583910/KG ZA 19-1062

The Court went through this balancing exercise and first invoked Recital 1 GDPR and Recital 4 GDPR and the definition of processing under Article 4(2) GDPR.
Then, it noted that according to Article 9 GDPR and Recital 35 GDPR genetic data must be protected as sensitive data. The man’s consent to processing was only referred to the purposes of the research he participated in. Further, none of the requirements in Article 9(2) GDPR is fulfilled.
The Court concluded that in this case the interest of the EUMCR must outweigh the plaintiff’s interest and the EUMCR must not provide her the DNA material.
The Court rejected the plaintiff's claim.


The AEPD concluded that Iberia had infringed Article 22(2) of the Spanish law on cookies (LSSI), as transposed from the e-Privacy Directive. The DPA considered that the airline should have allowed users to reject cookies in the second layer at once, instead of granularly, and that it should not had installed cookies without allowing users to exercise their choice.
The airline should have also informed users about third party cookies and the storage period, as well as more clear information about the purpose of cookies.
For this, the Spanish DPA fined Iberia €30,000.

AEPD (Spain) - PS/00032/2020


The DPA conducted a step-by-step analysis of the alleged GDPR violation.
1. Biometric Data Processing
The DPA considers that in the case at hand, automated technical instruments are used which allow the permanent and univocal identification, stemming from the biological identity of each employee.
The DPA held that each singular scan of an employee's face is compared to the database containing all scans of employee´s faces and not just the individual´s registered biometric data. This entails that a processing operation takes place.
In relation to whether or not the data was biometric data and whether or not there has been processing of such data, the DPA held that the data processed is linked to the identification of the data subject in each access log and thus is biometric data.
2. Obligations under Article 25 GDPR
The DPA determined that the purpose of processing is the registration of employees for the working day, access and exit throughout the workday. Against this background, the DPA considered that the controller is obliged to respect the principles of privacy by design and privacy by default as per Article 25 GDPR.
3. Processing of Biometric data: legitimization
As per Article 9 GDPR, the processing of biometric data is in principle prohibited. The DPA considered that the “labour exception” to this general prohibition under Article 9(2)(b) GDPR, may apply to the case at hand. The ground for processing under Article 9(2)(b) GDPR can only be successful if there is a provision of national law that requires the data processing. However, the DPA concluded that no such provision existed in Spanish law, rendering the ground for processing under Article 9(2)(b) GDPR inapplicable to the case at hand.
The DPA considered that, even if that was not the case, the “necessity” element was not fulfilled. In fact, the intended purposes could have been achieved through other means. This was further confirmed by the fact that the system had since been discontinued by the controller, in favor of an ID-card system.
Thus, the DPA found that no lawful ground for the processing of biometric data under Article 9(2) GDPR was applicable.
4. DPIA and Violation of Article 35 GDPR
As biometric data is sensitive data, it shall be processed only when no risks to the rights and freedoms of individuals are present. Therefore, as put forward in Article 35 GDPR, any processing considered high risk to the rights and freedoms of natural persons, must be legitimised through a data protection impact assessment, describing the processing in detail.
The DPA acknowledged that the processing of biometric data for labor control began in 2016. It has been acknowledge by the controller that they were not aware of whether a DPIA was ever carried out or not.
Considering that the controller did not provide a DPIA of the processing of biometric data, the DPA found that the controller violated Article 35 GDPR.
5. Violation of Article 15 GDPR
As the controller did not effectively reply to the email of the data subject requesting access to their personal data, the DPA found a violation of Article 12 and 15 GDPR.
6. Fine
In light of the aforementioned violations, the DPA deemed it appropriate to impose a twofold fine to the controller:
  * €200,000 for the violation of Article 35 GDPR;
  * €20,000 for the violation of Article 15 GDPR.
Thus, the overall amount of the fine was €220,000.

AEPD (Spain) - EXP202212247


The AEPD ruled that the form used to allow underage children travelling did not provide the mandatory information, as required by Article 13 GDPR.
As a consequence, the AEPD issued a reprimand to the Directorate-General of the Spanish Civil Guard for the violation of Article 13 GDPR.

AEPD (Spain) - PS/00098/2019


holding_ANSPDCP (Romania) - fine to Enel Energie Muntenia SA

The ANSPDCP found that Enel Energie Muntenia SA transmitted a client's personal data to the e-mail address of another client. The DPA decided that the controller did not have adequate technical and organizational measures in place to ensure a level of security that corresponds to the risk of the processing.
Thus, the controller violated the security of processing as required by Article 32 GDPR and the DPA imposed the fine of 14,423.7 lei (approx. EUR. 3,000) and ordered the controller to take the necessary measures within 30 days.


The Polish DPA imposed an administrative fine of approximately € 35,387 EUR (PLN 160,000) on the insurer, Sopockie Towarzystwo Ubezpieczeń ERGO Hestia S.A, for failure to report the breach of personal data protection. In addition, the insurer was fined for not notifying data subjects about the breach, which was also required by the supervisory authority.
The DPA explained that a breach of data confidentiality in connection with a breach of personal data protection - through the sharing of documents with unauthorized recipient which contained: the calculation of an insurance premium, PESEL number, information about the proposed period of insurance, the subject of insurance (house), the sum insured, as well as the name, town and postal code of the data subject - amounts to a high risk of infringement of the rights or freedoms of natural persons.
High risk of harm to the rights or freedoms of natural persons exists where the breach is likely to lead to physical harm or damage to the property or non-property of the individuals whose data has been breached. Examples of such damage includes discrimination, identity theft or falsification, financial loss and damage to reputation. According to the DPA, there is no doubt that the cited examples of damage, given the scope of the data covered by this data protection breach, may occur in the present case. Such a data breach must consequently be reported.

UODO (Poland) - DKN.5131.3.2021


Firstly, the controller based its processing on consent under Article 6(1)(a) GDPR. The DPA reiterated that it is necessary to ensure that data subjects have given their unambiguous, specific, free and informed consent.
Regarding the one-button form, the CNIL considered that the form did not allow data subjects to make a valid choice reflecting their preferences regarding the transmission of data for commercial purposes. The CNIL emphasized on the fact that the “I VALIDATE” button had a size and colour that made it stand out from the other information provided, whereas the hyperlink which enabled the data subject to take part in the game without agreeing to the transmission of their data was presented in the body of the text and in much smaller characters.
Regarding the two-button form, the CNIL noted that there was no mention of the consequences of clicking on the “I REFUSE” button and that as designed, the form did not make it possible to obtain unambiguous and free consent from the user under Article 4(11) GDPR.
Regarding the new form, the CNIL considered that although the two buttons were identical in size, font and colour, the “NEXT STEP” button suggested that there was a sequence between these two buttons. Therefore, the choices in design did not compensate for the risk that the data subject may consent without measuring the consequences.
Thus, the CNIL considered that the forms did not sufficiently inform the data subjects that they were consenting to the transmission of their data for commercial prospecting purposes and that the controller did not have valid consent within the meaning of Article 6(1)(a) GDPR and Article 4(11) GDPR.
Secondly, the CNIL discovered that the phone number and postal address of data subjects who refused to have their data transmitted to the controller’s partners were nonetheless transmitted for another purpose (the performance of technical and qualification operations) and on another legal basis (legitimate interest). The CNIL considered that in order to transmit this data to its partners, and insofar as it had chosen the legal basis of consent for this processing, the controller should have obtained the consent of the data subjects, therefore breaching Article 6 GDPR, as well as Article 5(1)(b) GDPR.
Thirdly, Article 30 GDPR stipulates that the controller must keep a register of processing activities. The CNIL noted that the controller shared a register of processing activities with another company but did not specify which one of the companies was acting as the controller for each processing. The DPA concluded that given the amount of data processed in its activity, the controller should have ensured that its register was exhaustive, accurate and up to date. Therefore, the controller failed to comply with Article 30 GDPR but did update its register during the sanctioning procedure.
Fourthly, Article 32(1) GDPR provides that the controller shall implement appropriate technical and organisational measures in order to guarantee a level of security appropriate to the risk. The CNIL considered that despite the use of a single administration account to access the database, the controller required a connection to a VPN using individual authentication keys which allowed access and actions carried out within the database to be attributed, given the small number of people accessing the administration account. Therefore, the DPA established that there was no infringement of Article 32 GDPR.
The CNIL imposed a €75,000 fine for the infringements to Article 6 GDPR and Article 30 GDPR.

CNIL (France) - SAN-2023-025