holding_UODO (Poland) - DKN.5130.2215.2020

The DPA imposed administratives fine of PLN 4,911,732 (roughly €1,000,000) on Fortum and of PLN 250,135 (roughly €53,000) on PIKA.
The DPA noted that under EN ISO/IEC 27002:2017-06, it is recommended to avoid using personal or other sensitive data as test data. If personal data are used during testing, it is recommended to protect all sensitive details and context by deleting or modifying them. The standard mentioned above accepts that actual data may be used for testing purposes, but such data should be subject to special protection. First of all, when real data is used for testing purposes, the same access control procedures should be applied in the tested applications as those used in production systems.
The DPA held that PIKA had acted contrary to the agreement on entrusting personal data processing, which required, among other things, to implement data pseudonymisation. In defining the security measures that it would apply to protect personal data, PIKA omitted, in particular, the obligation arising from the GDPR to take into account the state of technical knowledge when defining them. The DPA cited the legal doctrine indicating that the need to consider the state of the art may be understood as the need to apply measures that reflect current security standards. This requirement may be read as the need to apply solutions currently considered adequate while not applying outdated solutions commonly assessed as not ensuring security.
The DPA emphasised that using a processor did not exempt Fortum from these obligations. As a controller, the obligations in this regard remained primarily with Fortum itself. When analysing the actions, or rather the lack of actions by Fortum in this respect, the DPA concluded that it was more important for the controller to increase the capacity of the system as soon as possible than to ensure an adequate level of security of personal data processed using this system. It should be emphasised that Fortum indicated in the course of the proceedings that in the past practice of the Processor introducing changes to Fortum's systems, such changes were introduced according to a pre-agreed work plan, tested by Fortum on a test environment and only then implemented in production. Consequently, in the opinion of the DPA, both Fortum and PIKA failed to implement appropriate technical and organisational measures to ensure the security of the processing of personal data located in the IT system subject to modification, which constitutes a breach of Article 32(1) GDPR and Article 32(2) GDPR.
Both Fortum and PIKA failed to implement appropriate technical and organisational measures to ensure the security of the processing of personal data, which led to Fortum breaching their confidentiality in connection with the occurrence of a personal data breach, i.e. a breach of the principles of confidentiality and integrity referred to in Article 5(1)(f) GDPR.
According to Article 28(1) GDPR, where the processing is to be carried out on behalf of the controller, the controller shall only use the services of such processors that provide sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of the GDPR and protects the rights of the data subjects. In the case in question, Fortum indicated that it had not verified PIKA prior to entering the data processing outsourcing agreement. Fortum has been cooperating with PIKA for many years, and no security incidents have occurred so far. Additionally, as Fortum pointed out, PIKA is a market leader in terms of the services provided and represents a high standard of archiving and digitalisation. Given the above, Fortum considered it sufficient to sign an agreement on entrustment of personal data processing together with arrangements indicated in the appendix to the agreement.
Before initiating the administrative proceedings in question, Fortum also did not exercise the right of control referred to in Article 28(3)(h) GDPR concerning PIKA's provision of the measures required under Article 32 GDPR. Only after a personal data security breach had been identified and the administrative proceedings in question had been initiated, Fortum send a Processor Questionnaire to PIKA as the first element of the processor verification process.
The DPA pointed out that, since the processing was to be carried out on behalf of the controller, following the wording of Article 28(1) GDPR, the controller could only use the services of such processors that provide sufficient guarantees regarding the implementation of appropriate technical and organisational measures. Long-term cooperation of the parties, not supported by periodic, systematic audits or inspections, does not guarantee that the processor will adequately perform the tasks required by law and arising from the concluded entrustment agreement. A positively assessed cooperation in the past may only be a starting point when verifying whether the processor provides sufficient guarantees to implement appropriate technical and organisational measures so that the processing fulfils the requirements of GDPR and protects the rights of the data subjects. Indeed, the requirement set out in Article 28(1) GDPR applies to any data controller that, in the course of its business, uses the resources or services of a processor when processing personal data. The mere signing of a personal data processing outsourcing agreement without an appropriate assessment of the processor cannot be considered the fulfilment of the obligation to carry out a verification procedure of the processor concerning its compliance with the requirements of GDPR. Long-term cooperation and use of the services of a given processor before 25 May 2018, i.e. before the application of GDPR, also does not exempt from the obligation to carry out such an assessment.
According to the DPA, Fortum did not carry out such verification in the case at hand. It only contented itself with a positive assessment of the processor as a result of previous cooperation, during which, as it explained, there were no security incidents. However, the consequence of failing to carry out this assessment is that Fortum has breached the requirement set out in Article 28(1) GDPR. Given the above findings, the DPA concluded that in the case at hand, the conditions justified the imposition of administrative pecuniary penalties on both the controller and the processor.

UODO (Poland) - DKN.5130.2215.2020


The Romanian DPA found a violation of Articles 5,6, and 9 GDPR, Article 17 GDPR and Article 32(2)(b) GDPR.
Firstly, posting the videos and nickname was a violation of Articles 5, 6 and 9 GDPR, as the controller had no lawful basis to process the data under Article 6 GDPR, and violated the principles of processing under Article 5 GDPR (lawfulness, fairness, transparency). Moreover, there was a violation of Article 9 as the data revealed the data subject’s ethnic origin. Article 9 GDPR prohibits the processing of ‘special categories’ of personal data, unless certain exceptions apply. Data revealing ethnic origin falls within the scope of Article 9 GDPR, and in this case the exceptions did not apply, so the processing was unlawful.
Secondly, the controller did not comply with the complainant's request to delete the data, which constituted a breach of Article 17 GDPR.
Thirdly, the Romanian DPA found that the controller did not adopt sufficient appropriate technical and organisational measures to ensure the confidentiality of the personal data processed through the audio-video surveillance system, as required by Article 32 GDPR. The lack of appropriate internal measures led to an employee of the controller accessing and posting the data subject’s personal data on social media, which amounted to an infringement of Article 32(2)(b) GDPR.
As a result, the controller was fined a total of 49,322 RON, equivalent to €10,000.

ANSPDCP (Romania) - 23.08.2023


holding_Rb. Midden-Nederland - UTR 20/2315

The court does not agree with the restrictive interpretation of legitimate interest by the Dutch DPA. Any interest can be a legitimate interest as long as it is not against the law (negative test). The Dutch DPA should have performed a balancing test in order to balance the interests pursued by VoetbalTV against the interests or fundamental rights and freedoms of the data subjects. Because the DPA did not perform such a balancing test, the court annulled the decision and the imposed fine.
The court annulled the decision and decided to judge the case itself (Article 8:72a Dutch General Administrative Law Act). Then the court decided to not take a new decision in order to replace the annulled decision, noting that the fine is now completely off the table.

Rb. Midden-Nederland - UTR 20/2315


The Belgian DPA reiterated that in line with Article 17 GDPR and Article 12 GDPR, a controller is obliged to erase the personal data of a data subject upon request without delay. Furthermore, under Article 12(3) GDPR, the controller should inform the data subject as soon as possible, but at least within a month, about the action taken on his request.
The DPA established based on the facts of the case as provided by the data subject that he had exercised his deletion request several times but was still contacted afterwards. Moreover, even if the controller did respond after the data subject's second request confirming that the personal data had been deleted, the data subject still received messages from the controller.
Therefore, the DPA held that the controller infringed Article 12(3) GDPR, Article 12(4) GDPR and Article 17(1) GDPR and ordered the controller to deal with the data subject's request within 30 days after the decision.

APD/GBA (Belgium) - 03/2024


holding_Garante per la protezione dei dati personali (Italy) - 9856345

First, the DPA determined that the controller received lists of personal data from the company XX. This fact alone constituted a violation, since the controller should have obtained new consent for its promotional activities. Also, the fact that the controller asked for a single consent for 4 different purposes itself (marketing and profiling by both the controller and a potential third party) was in violation with the requirement for free and specific consent. Additionally, the DPA noted that the controller had taken insufficient steps to verify compliance with the GDPR, since it had not checked if the third party from which it received its calling list was acting in a GDPR complaint manner. Therefore, the controller violated Articles 5(2), 24, 6 and 7 GDPR, as well as Article 130 of the code.
Second, the DPA determined that the controller was liable for the fact that no sample checks were carried out with respect to the contact details on the lists provided by company XX, despite the fact that the controller had entrusted another third party to do this for the controller. Pursuant to Article 5(2) GDPR, it was the controller's responsibility to make sure that measures were adopted to ensure GDPR compliance, which was not the case here, since people who had objected to marketing were still contacted. This resulted in a violation of Articles 5(2), 24(1), 24(2) and 25(1) GDPR.
Third, the DPA determined that the controller did not provide an easy way to object to the marketing campaign. The DPA confirmed that the data subject would have to contact both the controller, and Company XX to be excluded from the processing. The data subject would have to object to the controller against the processing for the marketing campaign, which would last for around 3 months. However, to prevent from being targeted again, the data subject would also have to object to the transfer of data between the controller and company XX. This resulted in a violation of Articles 12(2), 12(3) and 21(2) GDPR.
Fourth, the DPA held that there was a discrepancy between the processing being conducted by the controller and the information provided on its website and in its mobile application. The controller admitted that it was not sharing data with third parties and was not individually profiling data subjects. This resulted in a mismatch between the information provided by the controller and reality. It was likely to result in reasonable doubts as to what processing was actually carried out by the controller. This resulted in a violation of of Articles 12 and 5(1)(a) GDPR.
Lastly, the DPA held that the controller failed to obtain free and specific consent for various processing activities, but in particular failed to obtain consent for marketing and profiling purposes. This resulted in violations of Articles 6, 7 and 12(1) GDPR, as well as Article 130 of the code.
After considering several aggravating and mitigating circumstances, the Italian DPA fined the controller €4,900,000 pursuant to Article 58(2)(i) GDPR. The controller was also ordered to make its several processing operations GDPR-compliant.


holding_ANSPDCP (Romania) - Sanction against Tensa Art Design SA

The DPA held that the controller's conduct was a violation of the GDPR. Pursuant to Article 21 GDPR - the right to object - data subjects have the right to object to processing which is done based either the legal basis of Article 6(1)(e) GDPR - public interest - or the legal basis of Article 6(1)(f) GDPR - legitimate interest. Moreover, Article 21(3) GDPR specifically grants data subjects the right to object to processing for direct marketing purposes.
Considering the facts above, the DPA decided that the controller violated Article 21(3) GDPR by not respecting the data subject's objection. Based on its powers pursuant to Article 58(2)(i) GDPR, the DPA fined the controller €1,000 (RON 4,927.3). Moreover, based on Article 58(2)(d) GDPR, the DPA ordered the controller to take corrective measures to ensure that its processing of personal data respected the rights of data subject vested in them by the GDPR.


holding_ICO (UK) - Tuckers Solicitors LLP

The ICO held that “primary culpability for this incident rests with the attacker”. However, Tuckers violated Article 5(1)(f) GDPR as its “technical and organisational measures areas were, over the relevant period, inadequate”. The same was based on the reading of Article 32 GDPR which mandates “a controller when implementing appropriate security measures to consider "the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons". The failure to comply with the same was evident from the following:
Although Tucker’s GDPR and Data Protection Policy required two-factor authentication where available, it was not using the same for remote access. The ICO held that multi-factor authentication was a low-cost measure that “could have substantially supported Tuckers in preventing access to its network”. Accordingly, Tuckers failed to meet the requirements of Article 32(1)(b) GDPR.
Tuckers installed the patch after months of its release, during which the attacker could have exploited the vulnerability.
Considering the “highly sensitive nature of the personal data”, Tuckers “should not have been processing personal data on an infrastructure containing known critical vulnerabilities without appropriately addressing the risk”.
Tuckers did not encrypt the personal data, and accordingly “did not ensure appropriate security, including protection against unauthorised and unlawful processing of its personal data, as required by Article 5(1)(f) GDPR”. Although the encryption would not have prevented the ransomware attack, it could have mitigated the damage.
For determining the penalty amount, the ICO took note of the fact that “personal data included within the bundles included special category data, and related to individuals that were particularly vulnerable, including children and individuals involved in significant crimes”. As per the ICO, “this type of personal data required particularly high levels of security to be applied to it”; and its breach made the infringement more severe. It also determined that Tuckers’ security practices were negligent. The fact that Tuckers informed the data subjects as per Article 34 GDPR and commissioned a third-party investigator was also considered by the ICO.
Tuckers' failure to follow the mandated security standards was considered to be an aggravating factor. Its subsequent actions of taking remedial steps including changes in the way it handles personal data were considered as mitigating factors.
The ICO used the Five-Step Process mandated in the Regulatory Action Policy (RAP) and fined Tuckers a total of €116,784.27 (GBP 98,000).

ICO (UK) - Tuckers Solicitors LLP


holding_ICO (UK) - Brazier Consulting Services Ltd

The ICO found that BCS violated Regulation 21A of the Privacy and Electronic Communications Regulations, implementing the e-Privacy Directive in the UK, which requires organisations to obtain consent from individuals in order to make calls related to claims management services.
Between 1 February 2019 and 31 July 2019, BCS used a public electronic communications service for the purpose of making 11,489,873 unsolicited calls for direct marketing purposes to individuals in relation to claims management services. These calls were made to who had not given their prior consent to BCS to receive such calls.
The ICO issued a fine of £200,000 for this violation.
The ICO considered that the conditions for the imposition of a monetary penalty section 55A of the UK Data Protection Act are met, namely: the convention was sufficiently serious (since there were because multiple breaches over a six month period) as well as negligent (since BCS knew or ought reasonably to have known that there was a risk that these contraventions would occur)
With regards to the amount of the fine, the ICO stated that the fact that BCS did not fully cooperate during the investigation, and was not completely open and transparent regarding information provided, was an aggravating feature. It did not identify any mitigating features.
The ICO also issued BCS with an Enforcement Notice compelling them to stop their illegal marketing activity and informing them that failure to do is a criminal offence.


holding_Rb. Overijssel - 9965129 \ CV EXPL 22-2279

The District Court of Overijssel (Rechtbank Overijssel - Rb. Overijssel) concluded that both claims were partly justified.
The controller’s claim was not fully justified, as the controller did not dispute that the laptop contained personal data of the data subject. The fact that the data subject was not allowed to put these data on the laptop was irrelevant. It was still personal data within the meaning of the GDPR and therefore protected by this Regulation.
The data subject’s counterclaim was not fully justified, as granting her access to the laptop would give her access to the controller’s digital work-environment. This contained personal data for which the controller was responsible (other employees, clients).
The Court held that the solution must be found in the middle. The Court proposed that laptop would be taken to the controller. Someone other than the data subject or the controller could then erase the data subject's personal data from the laptop. The data subject may be present during this process.


The Persónuvernd held that the publishing of the complainant's information constituted an unlawful processing of personal data in breach of Article 6(1)(f) GDPR.
In its reasoning, the DPA first examined whether the publishing of the complainant's address constituted processing of personal data. Despite the DPA not having explicitly mentioned Recital 18 GPDR, it did state that the processing did not only cover personal information intended for personal use. A main reason for the household exemption not applying was that the Facebook page was not closed, but open to be accessible to anyone who had the URL of the post in question.
The DPA then examined the defendant's potential exercise of his freedom of expression based on Article 10 ECHR and its relation to Article 8 ECHR. The Persónuvernd first noted that expressing one's views and beliefs, as well as value judgements based on facts, do not constitute personal data and the DPA would not be competent to assess whether an individual has violated the Icelandic Constitution which protects the aforementioned ECHR rights and freedoms. However, the Persónuvernd then noted that the photos and screenshots posted on Facebook constituted information which can be objectively verifiable, for example by consulting the national registry. The DPA reasoned that this information went beyond merely expressing one's views and value judgements, and constituted personal data processing which the DPA was competent to examine.
As there was no valid legal basis for the personal data processing, the Persónuvernd held that the publishing of the complainant's information in the form of Facebook posts occurred in breach of Article 6 GDPR. More specifically, the DPA stated that the only potential legal ground for processing would have been Article 6(1)(f), but that the interests of the complainant outweighed the interests of the defendant. The DPA therefore ordered that the electronic summary of payments be removed from the Facebook page.

Persónuvernd - 2020010610


holding_FG Berlin-Brandenburg - 16 K 2059/21

The Finance Court Berlin-Brandenburg fully rejected the data subject's claim.
First, regarding the data subject's right to access pursuant to Article 15(1) GDPR, the court held that the data subject was not entitled to the requested unlimited and unspecified data disclosure. It stated that this right against controllers who process large amounts of data only exists if the request is sufficiently specified. The court rejected the data subject's view which mainly referred to the wording of the provision. Instead, it made a systematic argument. The court used Recital 63(7) GDPR and a comparison with Article 14(5)(b) GDPR according to which the fulfilment of information obligations vis-à-vis a person affected by a data collection from third parties can be omitted if the provision of this information proves to be impossible or would require a disproportionate effort. Here, the court emphasised that some scholars even apply Article 14(5)(b) GDPR analogously to Article 15(1) GDPR even though it did not create an analogy itself. In particular, the court argued that, if Article 15(1) GDPR had to be interpreted widely, the exercise of comprehensive rights by a comparatively small group of data subjects (taxpayers) may have the consequence that the level of data protection for a larger group of data subjects (also taxpayers) falls short of the intended level of the Union legislator due to the inevitably limited resources of the tax authorities.
Further, the court held that the request was excessive pursuant to Article 12(5) GDPR, regardless whether Article 15(1) GDPR was to be interpreted narrowly or widely. It found the excessiveness both in the temporal sense because it concerned data aggregation over 50 years, and in the substantive-material sense. The court interpreted the granting of specific information as something qualitatively different (aliud) in relation to the unspecified and unlimited request for the provision of a copy of the data. Therefore, it rejected the entire claim instead of granting it with regard to specific information.
Second, regarding the data subject's right to a copy pursuant to Article 15(3) GDPR, the court held that he was not entitled to be provided with copies of personal data in the form of (electronic) duplicates of entire files. It argued that Article 15(1) and 15(3) GDPR do not contain two independent rights but a single right. Therefore, according to the court, Article 15(3) GDPR only contains a right to the catalogue information pursuant to Article 15(1)(a)-(h) GDPR. The court confirmed that the request was also excessive in this regard.
Third, the court rejected the data subject's right to deletion and to object (Articles 17(1)(d) and 21(1) GDPR). It held that there had been no unlawful processing of personal data because it was based on Article 6(1)(e) GDPR, § 29b(1) German Tax Code (Abgabenordnung - AO). Moreover, the right to deletion was precluded by § 29b(1) AO.

FG Berlin-Brandenburg - 16 K 2059/21


holding_ICO (UK) - Royal Mail Group Limited

The ICO determined as follows:
Royal Mail contravened Regulation 22 PECR as 213,191 unsolicited marketing emails were received by subscribers.
Royal Mail accepted that it did not have the consent for sending the unsolicited marketing emails as it did not have the consent of those persons, or those persons had used services of Royal Mail as a guest, and were never given an opportunity to provide their consent.
For 123,466 persons who had used Royal Mail’s services as a guest, Royal Mail cannot rely on “the soft opt-in as it cannot be said that individuals were given “a simple means of refusing […] the use of [their] contact details for the purposes of such direct marketing, at the time that the details were initially collected”.”
The contravention was considered to be serious as the emails “contained direct marketing material for which subscribers had not provided valid consent”.
Royal Mail did not deliberately contravene PECR. However, its actions were considered to be negligent as “storing all consented and non-consented email addresses on the same system from which direct marketing emails were sent, and given the risk of human error which could (and indeed did) occur, it is reasonable to think that Royal Mail ought to have been aware of the risk that direct marketing emails could be sent to customers who had opted out of marketing communications.”
Since the incident, Royal Mail took steps to remove the risk of human error. However, Royal Mail ought to have taken have these steps before in order to prevent the incident. Accordingly, “Royal Mail failed to take reasonable steps to prevent the contraventions.”
The ICO considered the following aggravating factors:
Six responses/complaints from persons who had received unsolicited marketing emails demonstrate a level of annoyance.
The ICO in 2018 had taken action against Royal Mail for contravening Regulation 22 PECR, and Royal Mail had got clear advice for compliance with PECR.
The ICO considered the following mitigating factors:
Royal Mail undertook to conduct a full internal Data Protection audit of its direct marketing practices.
This was an isolated accident resulting due to human error.
Royal Mail itself reported the incident, despite there being no legal requirement for the same.
The ICO said, “The sending of unsolicited direct marketing messages is a matter of significant public concern. A monetary penalty in this case should act as a general encouragement towards compliance with the law, or at least as a deterrent against non-compliance, on the part of all persons running businesses currently engaging in these practices. The issuing of a monetary penalty will reinforce the need for businesses to ensure that they are only messaging those who specifically consent to receive direct marketing.” Thus, the ICO issued a €23,850 (GBP 20,000) fine against Royal Mail for sending unsolicited direct marketing emails in violation of provision 22 of the UK Privacy and Electronic Communications (EC Directive) Regulations 2003.

ICO (UK) - Royal Mail Group Limited


According to the AEPD, the controller did not provide all the information required by Article 13 GDPR, since information about the right to portability and to restrict the processing was missing, as well as information about the right to lodge a complaint with the supervisory authority. In this regard, AEPD issued a reprimand to the controller and ordered them to include such information.
The AEPD found no evidence whatsoever of a violation of Article 6 GDPR, nor of Article 8 GDPR. There was also no violation of Article 9 GDPR, since the exception for explicit consent from Article 9(2)(a) GDPR applied.
With regard to international transfers of data, the AEPD concluded that there was no evidence of a violation, since the complainant did not point to any specific risks, and the controller manifested that they were working on new Standard Contractual Clauses (SCCs).
The AEPD also disregarded all the other allegations, finding no violations whatsoever, except in relation to cookies. Regarding cookies, the AEPD found that the website placed unnecessary own and third-party cookies before asking for consent. Additionally, the information offered in the banner was insufficient, and the cookies policy did not identify the cookies the web used. According to the AEPD, such facts constituted a violation of Article 22(2) LSSI, (the Spanish law implementing the e-Privacy Directive), and fined the controller €20,000, that were reduced to €16,000 because of an early payment.

AEPD (Spain) - PS/00475/2021


holding_ICO (UK) - Colour Car Sales Limited

The UK DPA first outlined the definition of consent as defined by Article 4(11) of the GDPR. It also outlined the rules under Regulation 22 PECR which address consent.
Analysing the application form, the ICO considered that there was no specific reference to direct marketing nor purposes of contact from third parties. Additionally, the UK DPA found that there was no method for the individual to send an application without consenting to being contacted, nor any option for them to select who may contact them.
The ICO therefore found CCSL in contravention of Regulation 22 of PECR for instigating unsolicited direct marketing messages. Individuals did not have the option other than agreeing to receiving direct marketing. Consent was therefore not freely given. Similarly, it was not specific as individuals could not select which party they agreed to receive marketing from. Finally, it was not informed (the information provided was too vague).
The ICO found that the "soft opt-in", where organisations can send marketing messages by text and e-mail to individuals whose details had been obtained in the course or negotiation of a sale and in respect of similar products and services, was also not available to CCSL. This is because individuals were not given the opportunity to refuse or opt-out in the first place.
The ICO took into account the seriousness and the deliberate or negligent nature of the infraction, as well as the lack of cooperation by CCSL. It therefore imposed a fine of approximately €198,000 on CCSL.

ICO (UK) - Colour Car Sales Limited


The Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG) rejected the complaint and upheld the DPA’s decision entirely.
The court held that the controller was processing personal data according to Article 4(1) GDPR because, at least, in (small) private homes measuring the water consumption can give insights into the beaviour of the residents. The court also corrected the view of the DSB which was of the opinion that the controller is not obliged to erase data of its own accord but only if the data subject requested it to do so. It clarified that according to the explicit wording of Article 17(1) GDPR erasing the data of its own accord is an obligation of the controller and a request by the data subject is not necessary. However, it found that Articles 17(1)(c),(d) GDPR and 21(1) GDPR were not violated because the processing was lawful under Article 6(1)(f) GDPR since measuring the water consumption was necessary to fairly distribute the costs among all users, to check whether the data subject exceeds the water supply needed for a single-family home, to ensure daily reliability of the distribution system and to detect damages to it. The court further held that the controller did not violate Article 18 GDPR because the data subject did not show that the data was inaccurate (Article 18(1)(a) GDPR) and the data subject did not oppose the erasure of the data but rather tried to achieve it with its complaint (Article 18(1)(b) GDPR). Moreover, since the controller did not violate Article 21 GDPR, the court found that the requirements of Article 18(1)(d) were also not met, and a violation of Article 18(1)(c) GDPR was not indicated by the data subject's submissions. Lastly, the court did not find a violation of Article 22(1) GDPR. It clarified that Article 22(1) GDPR does not require a request of the data subject – contrary to the DPA’s opinion – because it constitutes a prohibition, although it is systematically listed in Chapter 3 of the GDPR. However, the court found that there was no decision solely based on automated processing as required by Article 21(1) GDPR because the decision to cut off the supply if the data subject exceeds the daily limit was taken by the controller as a kind of "fundamental decision" before the respective system was installed and was not taken again each time when the supply was actually cut off by the automatic system or the employee (the automatic system or the employee just being the means to enforce the "fundamental decision" of the controller). Furthermore, the court reasoned that there was no automated decision making because, even if the decision was taken each time again, the controller switched from an automated system to a system where the accuracy of the counter is checked by an employee, who is also responsible for shutting off the water supply manually, and therefore the decision was not solely based on automated processing.

BVwG - W214 2224204-1


This incident was deemed a personal data breach under Article 5(1)(f) GDPR, as defined by Article 4(12) GDPR. Consequently, the Spanish DPA imposed a fine of €2,000, calculated based on Blu Management Spain's annual turnover. On February 29, 2024, the controller acknowledged responsibility and opted to take advantage of a 20% reduction by voluntarily paying the fine within the established timeframe and admitting responsibility, resulting in a reduced penalty of €1,200.

AEPD (Spain) - EXP202209596


holding_ANSPDCP (Romania) - fine against AG-BROKER ASIGURARE S.R.L

The DPA found that the controller had not implemented security measures on secure access to network storage equipment. This increased the risk of access to the personal data of its customers. The DPA then fined the controller for not implementing appropriate technical and organisational measures in line with the risk of processing, as stated in Article 32(1)(b) and 32(2) GDPR.


holding_Rb. Midden-Nederland - C/16/531572 / KG ZA 21-672

The interim relief judge rejected Brein's request because Ziggo does not (yet) have a permit as listed in Article 33(4)(c) Implementation Act, to process the IP addresses.
First, the Court noted that the IP-addresses are personal data for both Ziggo and Brein, referring to CJEU-cases Breyer and Mircom, since Brein has the legal means to force Ziggo to hand over name and address details related to a specific IP-address. Secondly, the Court considered that the IP addresses are personal relating to criminal offences, Article 10 GDPR, because copyright infringement is a criminal offence according to Article 31-33 Dutch Copyright Act. Even though there is barely any prosecution on the basis of these offences, the Dutch DPA has previously held that processing of personal data of persons against whom there is a more or less well-founded suspicion of acts that infringe a copyright, must be regarded as the processing of personal data regarding criminal offences.
Third, the Court marginally assessed the DPIA that Brein had to conduct pursuant to Article 35(3)(b) GDPR, and acknowledged Brein's conclusion that the processing of the IP addresses was not likely to result in a high risk to the rights and freedoms to the affected data subjects. The Court considered that there were some risks, but that the risks were not high enough. Hence, the Court found that the DPA did not have to be consulted before processing, pursuant to Article 36 GDPR.
Fourth, the Court noted that, pursuant to Article 10 GDPR and Article 31 Implementation Act, the IP addresses could only be processed if one of the exceptions listed in Articles 32 and 33 Implementation Act. Although Brein can rely on the exception laid down in Article 33(2)(b) Implementation Act, since the offences have been committed against their interests as a foundation, Ziggo can only process the personal data if they have a permit as listed in Article 33(4)(c) Implementation Act. The Court noted that, since Ziggo did not have such a permit, they did not have a legal basis to rely on. Moreover, the Court stated that Brein also needs a legal basis pursuant to Article 6 GDPR, and considered that Brein can rely on Article 6(1)(f) because their legitimate interests overrule the interests of the alleged copyright infringers. Referring to previous case law, the Court also concluded that Ziggo had a legitimate interest.
Fifth, the Court stated that the processing of the IP addresses does not violate the principle of purpose limitation, as laid down in Article 5(1)(b) GDPR. Processing the name and address details for Brein's legitimate interest, is further processing, since it was initially only collected for providing internet access. The Court, however, considered that the requirements set out in Article 6(4) GDPR were met because the processing was based on a provision of Dutch law, which constitutes a necessary and proportionate measure in a democratic society to safeguard one of the objectives of Article 23(1) GDPR.
Finally, the Court assessed whether Ziggo would have to send the warning letters, if it were to have a permit as previously mentioned. It concluded, after a long assessment, that Ziggo would act unlawfully if it were not to forward the letters, after having such a permit.


Upon reviewing the data subject's complaint, the AEPD confirmed the following:
1. The purposes of the processing for which the personal data are intended and the legal basis for the processing have ambiguous wording, or lack of required clarity.
2. The legitimate interests of third parties to whom the controller is referred to in the information banner on the main page are unclear and it is necessary to access the information individually different privacy policies of each of the more than 1,000 companies that appear in the providers list.
3. No reference is made to the controller's intention to transfer personal data to a third country or international organization outside the European Union, all this despite the fact that some of the companies that appear in the providers list are located outside the EU.
4. In terms of dark patterns, the AEPD confirmed that the dark pattern of overloading and skipping is observed when accessing the providers list. Once there, the users find a list of about 130 companies, of which, more than half have the default marked “Accept data processing for legitimate interest” box, which requires, in the case of objection to the processing marking one by one throughout the entire list, without the option of being able to object by indicating it only once or a number of times that is reasonable and does not generate fatigue in the affected person.
5. In regards to cookies, those that are not technical or necessary are deployed before obtaining consent from users.
6. The cookie management panel shows that the groups of Cookies are divided into two options, accept the cookies by “Consent” that are pre-marked in the “not accepted” option and accept the cookies by “Legitimate Interest” which pre-marked in the “accepted” option. However, if all the options marked “accepted” are unchecked, the website still continues to use the same cookies detected when entering on the web without having given consent.
7. There is no information about cookies in the second layer or link that enable the user to be redirected to the “Cookie Policy” of the website. The information about cookies appears dispersed in each of the options of the cookie management panel.
The DPA resolved to impose a fine of 2000 euro for infringement of Article 13 GDPR and required compliance with this article within one month. This infringement was considered as medium. It also Imposed a fine of 5000 euro for infringement of Article 5 (1)(a) as well as one month to bring its processing into compliance. This infringement was considered very gave

AEPD (Spain) - EXP202211953


Regarding the first controller:
The DPA considered that the first controller did not demonstrate that its legitimate interest in carrying out direct marketing prevails over the rights and interests of data subjects. For this reason, the processing could not be based on the controller's interest and lacked a legal basis under the GDPR.
The DPA specified that their balancing depends on the circumstances of the concrete case, and recital 47 of the GDPR provides that the reasonable expectations of the persons concerned must be taken into account. These expectations relate in particular to processing operations, data, purposes and the persons responsible for further processing. They are influenced by the relationship between the controller and the data subjects.
The DPA then pointed out that it is not sufficient for the controller to rely on the declarations of the data seller and the existence of a contractual clause to consider that the data has been lawfully collected and can be reused (as the first controller did in this case). The data controller must instead ensure how they were collected, by whom, on what legal basis, and for what purpose.
Furthermore, the DPA points out that consent given at the time of collection would in no way have implied an authorization to reuse the data: such consent must be free, specific, informed and unambiguous.
The second controller
The second controller claimed that it was not a controller of the subject's personal data. In this regard, it pointed out that it merely acted as an intermediary and did not open or modify the file containing the data.
The DPA rejected the argument. In this regard, the DPA pointed out that by purchasing and re-selling personal data, the second controller determined the means and purposes of the processing (respectively, by deciding to provide its customers with personal data, and by deciding how to transmit them).
For this reason, the second controller needed to demonstrate the existence of a legal basis for the processing.
The DPA held that it failed to do so. In the DPA's view, the rights and interests of the data subject prevailed over the interest of its customers in receiving the data. In this regard, the DPA stressed that the second controller (like the first) failed to ensure that the circumstances of the initial collection of the data, permitted its re-use. So, the second controller processed personal data unlawfully.
Finally, the DPA held that as a data controller, the second controller was under an obligation to reply to the data subject's access request. By failing to do so, the second controller breached Article 15 GDPR.

APD/GBA (Belgium) - 76/2025


First, the DPA confirmed that the personal data of the data subject had been unlawfully disclosed to a third party from the database of the controller. Therefore, the controller violated Article 5(1)(f) GDPR. The DPA considered several aggravating factors, such as the fact that in some cases the leaked data concerned minor children.
Second, the DPA held that the controller failed to implement appropriate technical and organisational measures to ensure an adequate level of security, breaching Article 32 GDPR. The risk analysis that the controller provided was the output of the ‘GESTIONA EIDP’ tool of the DPA itself. With this tool, data subjects, controllers and DPOs are informed about basic aspects that must be taken into account for adequate data protection, prior to carrying out adequate risk management. The DPA held that this tool only provided guidance for basic elements about risk analysis for processing operations and impact assessments. In this case, there was no link between the measures that were implemented by the controller and the risk analysis. Therefore, it could not be held the measures were deployed to mitigate a certain level of risk. The DPA considered again, among other factors, the fact that part of the leaked data was of minor children and considered this an aggravating factor.
Finally, the DPA found that a violation of Article 33 GDPR. The DPA stated that the controller knew it had suffered a data breach on 28 October 2021 and only informed the DPA on 11 November 2021. The controller had therefore notified the DPA almost two weeks after the data breach. Again, the DPA considered, among other factors, the fact that the leaked data was of minor children and considered this an aggravating factor.
The DPA fined the controller €52,000 for all the violations combined. This was reduced to €31,200 because the controller had already paid part of the fine voluntarily.

AEPD (Spain) - EXP202200399


holding_Datatilsynet (Norway) - 20/01893

First, the DPA stated that, although the SPK could rely on both Article 6(1)(c) and Article 6(1)(e) GDPR, the processing must have been necessary. The same necessity requirement follows from Article 9(2)(b) GDPR, since SPK processed health data. Because SPK processed unnecessary income information that was obtained from the Tax Authority, the necessity requirement was not met, in violation of Article 6(1) and Article 9(2) GDPR. In addition, the DPA found that the Public Service Pension Fund (SPK) had obtained excess personal data not needed for the purpose of calculating correct disability pension disbursements, in breach of Article 5(1)(c) GDPR. Lastly, SPK lacked sufficient routines for assessing what personal data was needed and for deleting superfluous data, in breach of Article 5(1)(e) GDPR.
Although the DPA found that the violations were not found intentional, but negligent, and SPK took measures to limit the damage, SPK violated basic principles of the GDPR, special categories of personal data were involved, and a large number of persons was affected. Hence, the DPA concluded that SPK needed to be fined, and considered the fine of € 99,940 (NOK 1 million) to be sufficient.

Datatilsynet (Norway) - 20/01893


The Hungarian DPA noted that both recording the conversation for purely personal use or sharing information about the meeting with other interested parents could have fallen under the household exemption of the GDPR under Article 2(2)(c). However, NAIH held that the sharing of such recording excluded the exemption and was also contrary to the principles of purpose limitation and data minimisation under Articles 5(1)(b) and 5(1)(c) GDPR. Moreover, the DPA held that the defendant had no legal ground for the processing of the data, including special categories of data, under Article 6(1) and Article 9 GDPR.Subsequently, NAIH decided to reprimand the controller under Article 58(2)(b) and impose a ban on any further processing under Article 58(2)(f). The DPA also ordered the controller to inform those with whom the data was shared to erase it without undue delay under Article 58(2)(g). However, NAIH did not find it necessary to impose an administrative fine under Article 83(2), taking into account that the controller is a natural person who had accepted that their conduct had been unlawful.

NAIH (Hungary) - NAIH-1743/2021


holding_EWHC (QB) - Damavand Media Ltd v DMA Media Ltd

The High Court dismissed the argument of the complainant alleging that he was not subject to the editorial guidelines. It found that the contract was to be read holistically, and by doing so it became clear that the contract indeed created an obligation for Mr. Farhadbahman to adhere to the editorial guidelines through other obligations which were expressly agreed upon in the terms of the contract, such as an undertaking to promote the interests of IITV.
In considering the arguments of both parties relating to the reasonable expectation of privacy in relation to the employment contract, the court noted that in order to uphold the claimant’s argument, it has to be satisfied that the claimant expected his employment contract with the defendant to be confidential and that such expectation is reasonable. The court further noted that employment contracts are not routinely or intrinsically a private matter and therefore this case is to be considered on its own merits.
The court went ahead to look at various factors such as the contractual terms and the correspondence between the claimant and the defendant reflecting the claimant’s reaction or attitude toward the leaking of his particulars at the time. Noting that the onus is on the claimant “to discharge the burden of showing on the facts and evidence that he had a reasonable expectation of privacy as to the existence of his contract” the court found that “[t]he difficulty he faces in making out a claim for misuse of private information is the lack of contemporaneous evidence that he actively made clear to IITV he expected his contract to be kept private, or that IITV ought in all the circumstances to have inferred as much.” The court dismissed the claimant’s argument as he was not able to discharge his burden of proof. It is therefore clear that an expectation of privacy arising from contract (more specifically an employment contract) has to be expressly agreed upon between the contracting parties and if not, it should at the very least be made clear at some stage thereafter through written correspondence between the parties reflecting an unequivocal understanding of such privacy expectation by either or both parties.


The AEPD dismissed the appeal by the data subject. It found that the data controller had responded to the erasure request and was not able to fully address the request due to technical problems with Meta.
The AEPD considered that the controller had put forth considerable effort to comply with the erasure request, as evidenced by the partial deletion achieved.

AEPD (Spain) - EXP202315744


holding_Garante per la protezione dei dati personali (Italy) - 9751137

Regarding the alleged failure to delete the data subject’s company email account, the Garante noted, first of all, that the company did not have access to the communications contained in its mailbox following the termination of the employment relationship, since they had been deleted by the complainant upon his dismissal. The Garante also took into consideration the fact that the email account only remained partially active with an automated redirection message for a month and a half, before it was permanently deactivated. Therefore, the Garante did not find any GDPR violations regarding this element of the claim.
With regards to the processing of data contained in the complainant’s company laptop, the Garante once again highlighted the absence of regulations or information provided to employees regarding the company’s handling, possible controls and interventions on these computers, as well as on other tools provided to its workers as part of their employment relationship. The Garante established that it was of no relevance that the task of drafting these regulations was the responsibility of the complainant during his tenure, because any liability deriving from non-compliance with data protection legal obligations by the employee ultimately falls on the company, since the role of data controller is attributed to the company itself and not the employee (without prejudice to the possible civil liability that the employee might have towards the company in this sense).
Moreover, the Garante held that the obligation to provide the information regarding the collection of personal data referred to in Article 13 GDPR, falls on the data controller, who once again, in the context of a work relationship, is the employer. Additionally, the Garante noted the protection of privacy also extends to the workplace, since the boundary between the working/professional sphere, and the strictly private sphere, cannot always be clearly drawn. On this point, the Garante cited European Court of Human Rights case law which considers that Article 8 of the European Convention on Human Rights protects private life without making a distinction between the private and professional spheres.
Based on these considerations, the Garante held that processing of personal data contained in the company computer assigned to the complainant in the absence of internal regulations and information on the handling of employee IT tools, violated the principle of lawfulness, fairness and transparency under Article 5(1)(a) GDPR, as well as the data subject’s right to information under Articles 12 and 13 GDPR, and issued a fine of €10,000 against the company.


The AEPD considered that there was an infringement of Article 5(1)(f), as there was a leak of personal data without the consent of the data subject. Additionally, they considered that there was an infringement of Article 32(1), as they concluded that the audit company did not have the appropriate technical and organisational measures in place to ensure an adequate level of protection.
For this, the AEPD fined Asesoria Alpi Clua:
  * for the infringement of Article 5(1)(f), €2,000.
  * for the infringement of Article 32(1), €1,000.

AEPD (Spain) - PS/00483/2020


Without prejudice to the results of the final investigations corresponding to the sanction procedure, the AEPD understood that the defendant could have breached its information duties in relation to cookies as per Article 22(2) of the LSSI (digital services providers may use data storage and retrieval devices on computers terminals of the recipients, provided that such recipients have given their consent after they have been provided with clear and complete information on their use and, in particular, on the purposes of data processing according to the data protection laws): on the basis of the available evidences, the three websites still load not necessary cookies (even Facebook ones) without informing nor obtaining any consent from the user, and the basic layer is too much vague ("…in order to improve your browsing experience…") and does not follow the recommendations by the AEPD; besides, the second layer of the three websites provide generic information on the concept of cookies, but not specific information on which cookies and how long will they be installed at the user's device (in one of them, it even specify that the way to reject cookies "will change depending on your browser", but it does not include any link nor explanation on how), and they do not offer any way to reject all the cookies. Consequently, after considering some aggravating circumstances [(i) there is a negligence/intentionality by the defendant, (ii) the period of time in which the breach has been happening, and (iii) the acceptance by the defendant of the cookies guide of the AEPD], the AEPD understood that, in case the sanction procedure resulted in a successful decision, this infringement would be fined with 10,000 € to the defendant. In this sense, the AEPD offered the defendant the possibility to settle the issue before the decision takes place by agreeing to a voluntary payment of part of the fine with two possible discounts: (i) acknowledging of its liability (8,000 €) and early voluntary payment (6,000 €). The defendant agreed to both concepts, so it paid 6,000 € and the sanction procedure was closed by the AEPD.

AEPD (Spain) - PS/00057/2020


holding_AP (The Netherlands) - 10.12.2020 (Booking.com)

The AP concluded that Booking violated the breach reporting obligation under Article 33(1) of the GDPR. According to the Fine Policy of the AP, the basis fine for this violation is €525,000. The AP took into account the measures taken by Booking to minimize the consequences of the breach and reduced the fine to €475,000.


holding_ICO - Enforcement Notice against Experian

The ICO found three main categories of failures on Experian's approach to data protection compliance:
1. Transparency and fairness
The privacy notice and the Consumer information portal ('CIP') drafted by Experian were insufficiently clear in explaining how data is collected, processed and sold, in particular in relation to the credit data used in connection with the direct marketing purposes.
Also, the CIP did not specify all the rights available to the data subjects (in particular rectification and restriction under art.16 of the GDPR) and did not set up a proper retention period for the data used.
The Commissioner acknowledged the CIP still fails to set out clearly in one place and at the forefront:
- the attributes that may be processed about an individual;
- the 'invisible' tracing activity undertook for marketing;
- the explanation of the drawbacks or outcomes that individuals may find undesirable.

With reference to the credit reference data, The Authority highlighted that was not appropriate to use them for direct marketing purposes without the active engagement of the individuals concerned. Such consent needs to be either obtained by Experian directly from the individual, or by the lender on the Experian’s behalf, clearly and separately from the collection of data to be shared for credit referring purposes.
2. Art. 14 of GDPR
The ICO found that, where Experian acquires the personal data of a data subject from a third party, Experian does not provide Art. 14 privacy information to the data subject directly, relying on the privacy policy of the third parties, which in many cases provides links to the policies of Experian.
Experian suggested that any direct notification exercise will be extremely costly and disproportionate. However, the Commissioner’s views are that the question for the proportionality must be considered in the light of the extensive processing carried out by Experian. Moreover, the ICO pointed out that the processing activities are a matter of choice of Experian, and it follows from Experian's business model. The fact that there are large numbers of data subjects cannot in itself be a determinative factor against the proportionality of the notification.
The cost could be seen as high because it is the cost of an accumulation of many years during which there has been a failure to give notifications.
3. Lawful processing
The Commissioner considered that it is unlikely that Experian would be able to apply its legitimate interests for intrusive profiling for direct marketing purposes. The Legitimate Interest Assessment put in place could not be considered to be properly balanced.
Also, the Commissioner was not satisfied that the privacy information and data capture mechanism of Experian’s suppliers with regards to the transparency and lawful obligations of the GDPR. It seemed that an individual could be confused about which marketing activities they had, or had not, consented to, and how much control they had over the onwards processing of their data.
Therefore, the Commissioner is requiring Experian to take specified steps to comply with the GDPR. In particular, within 3 months:
- revise the CIP to set out a clear summary of the direct marketing activities that Experian undertakes; place information that is likely to surprise the individuals, in a clearer and more concise language; - cease using credit reference data for any direct marketing activities other than those requested by the individuals. - delete any data supplied by third parties on the basis of the consent which is now being processed on the basis of the Experian's legitimate interests.
Also, within 9 months, Experian must:
- directly provide all data subjects with an 'Art. 14 privacy notice', potentially sent by mail or other similar means; - review the compliance with the GDPR of the privacy notice of its suppliers to provide the same standard of transparency as the CIP; and their data capture mechanisms in order to have a valid 'consent' to the disclosure and further processing of the data carried out by Experian.


Firstly, regarding the retention periods, the CNIL considered that a retention period of ten years from the date of acceptance of the order was justified by its legal obligations resulting from French law, in particular Articles L.213-1, D.213-1 and D.213-2 Consumer Code, for contracts worth more than €120. Therefore, the CNIL considered that for contracts that were less than €120, the 10 year retention period was excessive and therefore breaches Article 5(1)(e) GDPR.
Additionally, while the CNIL agreed that a 5 year retention period commencing from the date of last connection to the user account was justified for legal proceedings and anti-fraud purposes, more than 2 million user accounts of between 5 and 10 years old had been retained, as well as more than 700,000 accounts more than 10 years old. The retention of data beyond what was necessary for the announced purpose constituted a breach of Article 5(1)(e) GDPR.
Secondly, the CNIL indicated that the controller breached Article 13 GDPR by failing to include the right to lodge a complaint to the CNIL, together with inaccurate data retention period information, in the privacy policy. The CNIL noted that this information helps users to control the processing of their data, and thereby ensures fair and transparent processing.
Thirdly, the CNIL found that the controller had breached Article 28(3) GDPR where it had tried to retroactively amend one of its data processor agreements to include all requirements of this Article. The CNIL held that the retroactive nature of the amendment cannot cover the breach for the past.
Finally, the CNIL considered that the controller breached Article 32 GDPR in several ways. Firstly, users were not required to provide strong passwords when creating an account, accounts were not locked after a certain number of failed access attempts, and part of a reference code used instead of an account (if the user did not wish to create one) was made publicly available by forming part of the ad reference number. The CNIL found that the above measures, given the current state of the art, were not sufficient to guarantee the security and confidentiality of the data being processed. Secondly, the controller failed to intermediately archive inactive customer data (kept for 10 years) and inactive user account data (kept for 5 years). The CNIL found that the mixing of inactive data in an active database, which the controller explained was for daily anti-fraud checks, did not ensure adequate data security. A large number of employees could access the data, and some of the retained data was not needed for anti-fraud checks (such as advertising details and billing addresses).
For breaching Articles 5(1)(e), 13, 28 and 32 GDPR the CNIL imposed a €100,000 to the controller.

CNIL (France) - SAN-2024-002


The Austrian DPA assessed the documents the respondent provided, and held that the processing of the complainant's address data was lawful because (i) the respondent had a valid trade licence "for the exercise of the trade of address publishers and direct marketing companies", (ii) only obtained the relevant data for advertising purposes, (iii) processed the data in line with the principle of proportionality per §151(3) Trade Regulation Act 1994.

DSB (Austria) - 2021-0.568.642


holding_Garante per la protezione dei dati personali (Italy) - 9870832

The Italian DPA held that the controller did not comply with its obligation to provide data subjects with a privacy policy pursuant to Article 13 GDPR.
Moreover, the collection of personal data and their use in the training of ChatGPT algorithms were undertaken in lack of a proper legal basis,in violation of Article 5 and 6 GDPR.
Concerning specifically data of people other than the users, namely those data subjects whose data were collected on the internet, the DPA found that the algorithms behind the functioning of ChatGPT did not guarantee the principle of accuracy as enshrined in Article 5(1)(d).
Finally, the DPA also considered that the lack of any mechanism to check the age of the users entailed a violation of Article 8 GDPR.
In light of the above and in the context of an urgency procedure, the DPA imposed on OpenAI a temporary limitation of processing pursuant to Article 58(2)(f) GDPR. Such limitation concerns all processing operations involving data subjects on the Italian territory.


The AEPD pointed out that the fact that the claimant’s sister knew her brother’s name, surname, ID number, telephone number and address could not lead to the presumption that she was authorised to represent him in order to make changes to the contract with the electricity company. The AEPD noted that in this case, the family relationship between the brother and sister allows her to easily know this data, and that this data could also be accessible to other third parties without the data subject’s knowledge. The AEPD stated that the mere fact that someone might have knowledge of this data should not imply that they can act on behalf of the data subject to modify the contract with the electrical company.
Based on these considerations, the AEPD held that the electrical company had violated Article 32 GDPR by failing to having an adequate security protocol in place to verify if someone was actually authorised to act on the data subject’s behalf. The AEPD also held that by not having an adequate security protocol in place, the company had modified the power supply contract without the data subject’s consent, in violation of Article 6 GDPR.
In light of the aforementioned violations, the AEPD imposed a fine of €150,000 against the electrical company (€50,000 for the violation of Article 32 GDPR and €100,000 for the violation of Article 6 GDPR).

AEPD (Spain) - PS/00476/2021


The DPA firstly determined that LaLiga was the data controller, rejecting the contention by the controller that each club should be considered controllers in their own respect. In doing so, the DPA focused on the provision by the controller of the access system which complied with their regulation, and the speed with which it was made available to clubs who requested it.
The DPA found that the controller infringed Article 35 by not conducting a DPIA prior to the commencement of the processing. The DPA stressed both the high-risk nature of the processing in question, i.e. biometric processing, as well as the large scale.
The DPA imposed a fine of €1,000,000 for the infringement of Article 35(1). The also ordered the suspension of the biometric processing until a DPIA had been appropriately carried out, assessing the necessity and proportionality of the processing.

AEPD (Spain) - EXP202315637


The DPA held that the controller's conduct was a violation of the GDPR. Pursuant to Article 21 GDPR data subjects have the right to object to processing which is done based either on the legal basis of Article 6(1)(e) GDPR (public interest) or Article 6(1)(f) GDPR (legitimate interest). Moreover, Article 21(2) GDPR specifically grants data subjects the right to object to processing for direct marketing purposes.
During the investigation, the DPA found that the controller did not present evidence from which it could be concluded that it reacted to the request of the data subject in accordance with Article 12(3) GDPR and Article 21 GDPR and did not provide the data subject with an answer, within the month of the request, regarding the measures adopted following the exercise of the right to objection.
The DPA decided that the controller violated Article 12(3) and Article 21 GDPR by not respecting the data subject's objection. Based on its powers pursuant to Article 58(2)(i) GDPR, the DPA fined the controller €1,000 (RON 4,947.9). Moreover, based on Article 58(2)(d) GDPR, the DPA ordered the controller to take the necessary measures to modify the existing procedures at the company level and communicate them to the employees, in order to ensure that its processing of personal data respect the rights of data subjects under the GDPR.

ANSPDCP (Romania) - 24.04.2023


The DPA first dismissed the arguments on competence and sanctioning procedure. In terms of competence, the DPA affirmed that the case fell under its competence despite the national data retention law. Under this law, the Secretariat of State for Telecommunications and Digital Infrastructure (SETID) is competent for the failure to maintain a prepaid phone line logbook. However, Article 8 specifies that the quality of data falls under the scope of Spanish data protection law, and that the DPA is the authority responsible for ensuring compliance with data protection requirements. According to the DPA, data accuracy (Article 5(1)(d) GDPR) is directly related to the quality of data.
The DPA cited Supreme Court case law[3] to support the broadening of the case; here, the Court acknowledges the possibility of setting fines for violations found during the DPA’s investigations. This means that the DPA is not strictly bound by the facts of the complaint. By limiting the procedure to the facts of the case, the DPA would fail to fulfill its duty.
The DPA later held the controller responsible for the lack of data accuracy. Under the GDPR, the controller is liable for actions by the processor that violate the GDPR, unless the processor acts as a controller. Furthermore, the principle of accountability (Article 5(2) GDPR) places a proactive obligation on the controller to demonstrate compliance with data protection principles under Article 5(1) GDPR. The DPA analysed the contract between the controller and distributors of its products (processors) and concluded that YOIGO is a controller in accordance with CJEU case law[4] and EDPB Guidelines[5].
The DPA noted that the controller had no measures in place to detect errors or inaccuracies in its data, including measures to ensure that ID numbers correspond to existing IDs. Therefore, the fine imposed on the controller was based on data inaccuracy and the absence of technical and organisational measures.
Finally, the DPA stated that the controller could not be held accountable for the content of the calls with the data subject. However, due to the lack of data accuracy, the DPA was not able to investigate the potential violation of advertising calls without a legitimate basis.
The DPA found a violation of Article 5(1)(d) GDPR, based on the inaccurate information given by the controller during its investigation. The DPA imposed a fine of €70,000, taking into account the fact that the data inaccuracy was an obstacle during its investigations, and the fact that the violation occurred within a framework of data processing activities that the controller carries out on a regular basis.

AEPD (Spain) - EXP202205208


Complaint based on the principles of lawfulness, fairness and transparency
The court dismissed the controller’s argument that a violation of Article 5(1)(a) GDPR could not be made the subject of a complaint under Section 24 of the Austrian data protection law ("DSG") and Article 77 GDPR. The court took into account the CJEU judgement (C-33/22), which states clearly that a complaint under Article 77(1) GDPR does not need to be based on a violation of rights, but on a violation of data processing in the GDPR.
Automated decision-making
On whether assessing the data subject’s creditworthiness falls under automated decision-making under Article 22 GDPR, the court took into account the CJEU judgement C-634/21 OQ / Land Hessen. The CJEU held that “the automated establishment, by a credit information agency, of a probability value based on personal data relating to a person and concerning his or her ability to meet payment commitments in the future constitutes ‘automated individual decision-making’ [under Article 22(1) GDPR], where a third party, to which that probability value is transmitted, draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person.” (See para 73).
The court therefore dismissed the controller’s argument that it did not carry out automated decision-making under Article 22 GDPR, as the probability value that the controller provided to the energy supplier was the decisive criterion in refusing to conclude a contract with the data subject. Moreover, the court held that the fact that the decision led to the data subject being able to conclude a energy supply contract was a decision that “produces legal effects concerning a data subject or similarly significantly affects a data subject” within the meaning of Article 22(1) GDPR.
The court dismissed the controller’s argument that it only calculated the credit score and that any further decision is made by their contractual partners, and the controller could therefore not anticipate whether a decision is solely based on the credit score they provided. The court again took into account the CJEU judgement C-634/21 OQ / Land Hessen, which explicitly stated that such a restrictive interpretation would risks a circumvention of Article 22 GDPR. If the calculation of the credit score is only seen as a preparatory act and not a decision, it would create a gap in legal protection.
Therefore, the court held that the controller's creation of a credit score was automated decision-making under Article 22 GDPR. Moreover, the court held that no exceptions under Article 22(2) GDPR applied to the controller and thus, the controller's automated processing was unlawful. The court agreed with the DPA that the controller also violated the principles of “lawfulness” and “fairness” under Article 5(1)(a) GDPR.
The court further elaborated that the controller violated its information obligations under Article 13(2)(f) GDPR and Article 14(2)(g) GDPR, because it did not provide information to the data subject about the logic involved or the scope and intended effects of such processing for the data subject.
Access request
The court agreed with the findings of the DPA that the controller did not comply with the data subject’s access request under Article 15(1)(h) GDPR. The court again took into account the CJEU judgement C-634/21 OQ / Land Hessen, which held that the data subject has a right of access to the “meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject” (para 56). The court found that the data subject could not verify the lawfulness of the data processing with the information given by the controller as it did not include the specific information on the calculation of the credit score attributed to it. The court held that the information provided must be so comprehensive that the data subject can understand the reasons for the scoring value of the credit score. This court held that the term “logic involved” means the principle on which such a calculation is based and not the specific calculation formula.
The court dismissed the controller’s argument that this information was a trade secret. Although under Section 4(6) DSG, the right to information is generally excluded if it would jeopardize a business or trade secret, the court held that this was not an absolute right to refusal of information. The controller must carefully weigh up in each individual case the extent to which specific part of information would affect a business or trade secret. The data subject can still be provided with further information on how this credit score was calculated without disclosing business secrets, such as the specific calculation formula. The court agreed with the DPA that providing information on the calculation of the credit score would not result in a competitive disadvantage for the controller compared to market competitors, especially since all of them are subject to the GDPR.
Therefore, the court held that the controller violated Article 15(1)(h) GDPR by not providing the data subject with sufficient information. The court thus agreed with the DPA in ordering the controller to provide the data subject with the relevant information within a deadline of eight weeks.
The court thus dismissed the controller's appeal.

BVwG - W292 2248672-1


holding_Datatilsynet (Norway) - 17/01281

The Norwegian Privacy Appeals Board (Personvernrådet) held that the missionary organization had legal grounds under Article (6)(1)(f) to process the personal data in question.

Datatilsynet (Norway) - 17/01281


The ICO found that LTH contravened Regulation 21 of PECR, which establishes that if a company wants to make calls to an individual who has a telephone number which is registered with the Telephone Preference Service Ltd ("TPS"), then that individual must have given their consent to that company to receive such calls. It stated that LTH used a public telecommunications service for the purposes of making 1,414,519 unsolicited direct marketing calls to subscribers who had registered with the TPS at least 28 days prior to receiving the calls, and had not given their prior consent to LTH to receive calls.
The ICO highlighted that consent, as defined by Article 4(11) GDPR, must be "freely given", meaning an organisation must be able to demonstrate how consent can be said to have been given freely. LTH were unable to do this; for all of LTH's third-party data providers, the data of individuals who purchased a product from one of their sites was passed to LTH for use in further direct marketing campaigns, without those individuals being given a genuine choice about whether to consent to such marketing from LTH. Generally, the applicable 'consent' mechanisms gave users no option but to agree to electronic marketing from third parties.
Consent was also not valid as it was not 'specific' since individuals were not able to select the method by which they might wish to receive direct marketing, nor from whom they may consent to receive it. It was also not 'informed'. The ICO emphasized that consent will not be informed if individuals are asked to agree to receive marketing from "similar organisations", "partners", "selected third parties" or other similar generic description. Rather, information should be clear and easy to understand.
The ICO concluded that a penalty in the sum of £145,000 was reasonable and proportionate. In particular, it considered the following aggravating features:
  * LTH's primary audience appears to be older people;
  * LTH adopted aggressive, coercive, and persuasive methods in its direct marketing;
  * the current owner of the business is now disqualified from acting as a director;
  * despite providing superficial responses to the ICO's various correspondence, LTH failed to co-operate with the ICO's investigation, because: it tended to refer the ICO to the third party data providers for information, rather than taking steps to obtain it itself (particularly notable given that it was information which a company would reasonably be expected to be in possession of when engaging in direct marketing campaigns); an LTH failed to provide accurate call figures when asked to do so.

ICO (UK) - LTH Holdings Limited


holding_Datatilsynet (Norway) - 20/01813

The DPA fined the hospital €76,870 (NOK 750,000) for breaching the requirements of internal control, security and safety for the processing of personal data under Article 32 GDPR, Article 24, Article 5(1)(f) and Article 5(2), as well as § 26(1) of the Personal Data Act and §§ 22 and 23 of the Health Records Act (pasientjournalloven) .
The DPA also pointed out that the highest-level management position, on behalf of the hospital, is accountable for the (negligent) violation.

Datatilsynet (Norway) - 20/01813


After conducting their investigation, the IMY held that Klarna had violated various GDPR provisions related to information on the purpose and legal basis for the processing of personal data, the recipients of various categories of personal data, international data transfers, retention periods, data subject rights and automated decision-making, including profiling. As a common thread, the IMY held that each one of these breaches also entailed a violation of Articles 12(1) GDPR, 5(1)(a) GDPR and 5(2) GDPR.
Regarding the information provided by Klarna on the purpose and legal basis for the processing of personal data related to the "My Finance" and "My Economy" services, the IMY held that this information was not concise, clear and easily accessible, and did not meet the requirements of Article 13(1)(c) GDPR.
With regards to the recipients, the IMY held that Klarna provided incomplete and misleading information on who were the recipients of different categories of personal data when such data were shared with Swedish and foreign credit reference agencies, in violation of Article 13(1)(e) GDPR.
Specifically on the topic of international data transfers, the IMY noted that a mere statement that personal data will be transferred to third countries, without naming these countries, was not adequate information for data subjects in this sense. Moreover, the IMY held that Klarna not only failed to provide information about the countries outside the EU/EEA to which personal data was transferred, but also as to where and how data subjects could access documents regarding the safeguards applicable to the data transfers where no adequacy decision exists between the EU and these countries, in breach of Article 13(1)(f) GDPR.
Furthermore, the IMY also held that Klarna provided incomplete information about the periods for which personal data would be retained and the criteria used to determine those periods, in violation of Article 13(2)(a) GDPR.
Regarding data subject rights, the IMY held that Klarna did not provide them with adequate information related to the right to erasure of personal data under Article 17 GDPR, restriction of processing concerning the data subject under Article 18 GDPR, the right to object under Article 20 GDPR as well as the right to data portability under Article 21 GDPR, in violation of Article 13(2)(b) GDPR.
As to automated decision-making, including profiling under Articles 22(1) and (4) GDPR, the IMY noted that it was not clear whether Klarna used its own internal scoring model based on, among other things, both internal and external financial information, or what types of data are included in the financial information, such as information on liabilities with other creditors. The IMY also observed that no information was provided regarding the logic behind these processes, their significance, the types of personal data that played a decisive role when subject to a negative decision, or the foreseeable consequences for data subjects, in breach of Articles 13(2)(f) and 14(2)(g) GDPR.
In order to determine their administrative fine, the IMY took into account that Klarna is a multinational company that processes many different categories of personal data on a large number of data subjects, including privacy-sensitive data such as financial data and creditworthiness, and that these breaches were ongoing for a long period of time. Based on these considerations, the IMY issued a fine of approximately €730,000 (SEK 7,500,000) against Klarna Bank AB.

IMY (Sweden) - DI-2019-4062


The Slovenian DPA (IP) held that a bar owner does not have a legitimate interest in monitoring the various server rooms and outdoor terrace of the bar with video surveillance, but does have a have a legitimate interest in monitoring the bar counter (where bottles of higher value and the cash register are contained) and the bar entrance. Accordingly, the DPA gave the bar fifteen days to adjust the viewing angles of its surveillance cameras to record only the counter and entrance.
The DPA explained that video surveillance is the processing of personal data (Article 4(2) GDPR) and the operator of video surveillance is responsible for complying with the principles set out in Article 5 GDPR, including data minimization, purpose limitation and storage limitation. In assessing the adequacy of procedures and measures to ensure an adequate level of security of personal data, the bar must also comply with Article 32 GDPR, which provides that controllers and processors shall ensure a level of data security appropriate to risks to the rights and freedoms of individuals by, for example, endeavoring to maintain the confidentiality of data subjects.
According to national law (ZVOP-1), video surveillance of a business premises may be carried out for the safety of people or property, to ensure control of entry into or exit from or from business or business premises, or if, due to the nature of the work, there is a possibility of endangering employees. Thus, the bar has a legitimate interest, as recognized in Article6(1)(f) GDPR, in processing data limited to those purposes. In contrast, there is no provision allowing for the general surveillance of employee workplaces, such as server rooms, if the protection of people in these workplaces can be achieved by milder means. The interest of the bar manager in securing the bar rooms also does not outweigh the interests and freedoms of bar guests. The IP thus concluded that there is no legitimate interest, based in a need for data processing, for video surveillance of spaces where guests are located and where employees work.

IP (Slovenia) - 0611-10/2021/11


holding_Garante per la protezione dei dati personali (Italy) - 9677521

The Italian DPA (Garante) held that Dr. Marini had violated the basic principles of processing in Article 5 GDPR by collecting information on infectious diseases from patients regardless of the type of intervention to be carried out to provide care. In this way, Dr. Marini processed personal data about HIV infection status in a way that is not relevant to the purpose for which it can be processed. Information about infection history can only be collected in order to know the patient's clinical history and to identify the most appropriate therapy. Further, information about HIV infection can only be collected if it is deemed necessary by the treating physician for the type of health intervention.
Using HIV infection information to refuse treatment, is not, however, a legitimate and necessary basis for processing such data. The DPA explained that Dr. Marini failed to process the complainant’s health data with the concrete purpose of evaluating the best therapy for the patient, offering him the required service, and possibly also taking additional measures against the risk of contagion.
Therefore, and pursuant to Article 83 GDPR, the DPA issued the dentist with an administrative fine of € 20,000.


Despite the findings by the investigation service, the DPA closed the proceedings regarding some findings, while for other findings the DPA stated that it would continue to investigate.
For findings 1 (concerning advertising profiling only) and findings 2, 3 and 4, the DPA closed the proceedings because it had reached a settlement with the same controller regarding the use of cookies. According to the DPA, the subject matter of the current complaint with regard to cookies was also covered by the settlement. Because of this settlement, the DPA stated that it would not take action regarding findings 1 (concerning advertising profiling only) and findings 2, 3 and 4. The DPA closed the proceedings with regard to these findings pursuant of Article 100(1)(1) WOG. For findings 1 (with regards to the processing of registration data), 5 and 6, the DPA stated that it would continue to examine the substance of the complaint.

APD/GBA (Belgium) - 170/2022


holding_Datatilsynet (Denmark) - 2018-7320-0166

The Datatilsynet noted that data controllers must carry out a concrete assessment on whether there is a reasonable doubt about the identity of a data subject. Pandora’s general practice to ask for identification without providing any exceptions did not comply with Articles 5(1)(c) and 12(6) GDPR. It ordered Pandora to carry out this assessment. Finally, it stressed that this is the first case where the Datatilsynet has taken a decision as the leading supervisory authority under the "one-stop shop mechanism" in connection with cross-border processing of personal data.

Datatilsynet (Denmark) - 2018-7320-0166


The DPA advised that if a company is to introduce measures regarding temperature checks, these measures must be necessary and justified. On the topic of video cameras, the DPA said that the use of biometric measures for the purpose of recording working time is generally not allowed, as it is an invasive way of processing personal data, and there are milder and equally effective measures for recording working time.

IP - 07121-1/2020/1677


holding_EWCA - Dawson-Damer v Taylor Wessing LLP

The Court of Appeal held that 'privilege' in the LLP exception is limited to legal professional privilege. It falls to the data controller to show that the supply of a copy of the information in permanent form would involve disproportionate effort. The High Court judge was wrong not to exercise its discretion under section 7(9) DPA 1998 to order the data controller to comply with the request.
On Issue 1 - Extent of the Legal Professional Privilege Exception:
The purpose of Directive 95/46/EC (the Directive) was to regulate the activities of data controllers on a territorial basis. Therefore, the words "legal proceedings" in sched. 7 para. 10 DPA 1998 refer to legal proceedings in any part of the UK. If Parliament had intended to legislate for events which occur outside the territory of the UK, it would have introduced provisions specifying which parts of the world were relevant for this purpose and under which conditions the privilege applied. The LPP exception is expressly limited to legal professional privilege. Documents not disclosable to a beneficiary of a trust under trust law principles are not within the LPP exception. Insofar as the exception was interpreted purposively as also including documents covered by the trustees' right of non-disclosure, the Directive would have to name appropriate objectives which could support an interpretation along these lines. However, the DPA does not contain such exceptions.
The court concluded at para. 45 that the LPP exception “relieves the data controller from complying with a SAR only if there is relevant privilege according to the law of any part of the UK.” Since the data in question is not covered by the LPP under English law and no other exemption under the DPA 1998 applies, the SAR must be granted.
On Issue 2 - Whether compliance with the request would involve disproportionate effort:
The public interest reasons set out in the Directive for giving people control over the data held about them require that SARs should be enforced so far as possible. Under section 8(2) DPA 1998 the data controller is obliged to supply copies of information constituting personal information to the data subject, "unless …the supply of such a copy is not possible or would involve disproportionate effort." The effort, the data controller undertakes must be weighed in a proportionality exercise against the potential benefits that the provision of the information could bring to the data subject. That includes the possibility that there may be limits to a search in certain circumstances, see Ezsias v Welsh Ministers [2007] EWHC B15 (QB).
The court held at para. 75 ff, that “It falls to the data controller to show that the supply of a copy of the information in permanent form would involve disproportionate effort”. However, “disproportionate effort must involve more than an assertion that it is too difficult to search through voluminous papers”. The data controller “must produce evidence to show what it has done to identify the material and to work out a plan of action.”
On Issue 3 - Whether the request can be declined because the data subject intended to use the information against the data controller:
The purpose of the Directive is to protect fundamental rights conferred by EU law. The court found that nothing in Directive or the DPA 1998 limits the purpose for which data subjects may request their data or allows data controllers not to provide data based solely on the on the basis of the purpose of the data subject. Also, Parliament has not expressly required data subjects to show that they have no other purpose. The court distinguished Dunn v Durham County Council [2003] 1 WLR 2305, Lin & Anor v Commissioner of Police of the Metropolis [2015] EWHC 2484 and Kololo v Metropolitan Police Commissioner [2015] 1 WLR 3702. Durant v Financial Services Authority [2004] FSR 573 at para. 27 also does not establish a “no other purpose rule” and should only be interpreted to mean that “a person could not claim that something was personal data because it would assist him in obtaining discovery or in litigation or complaints against third parties.” (para. 111)
The court found that the trial judge had wrongly refused to enforce the request just because the appellants intended to use the information obtained in other proceedings. The section 7(9) DPA 1998 discretion must be applied with a view to fulfilling the purposes of the DPA.


holding_ANSPDCP (Romania) - Materiale Constructii Online SRL

Following the complaint, the DPA started an investigation. However, the controller did not provide the information requested by the DPA.
Therefore, the controller was sanctioned with a €2,000 fine for violating Article 58(1) GDPR and Article 83(5) GDPR.


holding_AZOP (Croatia) - Decision 04-05-2023

Following the investigation, the key findings are:
(1) The controller did not clearly and accurately inform the data subjects about the processing and regarding the legal basis as required by Article 13(1) GDPR. This resulted in the non-transparent processing of the data subjects' personal data of which there were (at least) 132,652 at the time of the monitoring. The controller did not take measures to comply with its transparency obligation.
(2) Contrary to the provisions of Article 28(3) GDPR, the controller did not have a processing agreement with the processor regarding the processing which concerned 83,896 data subjects. According to the DPA, the absence of such agreement implied a lack of security. Indeed, no rules were established regarding the technical and organizational measures in place.was important.
(3) The controller did not take appropriate technical and organizational measures when processing personal data, as requested by Article 32(1)(b) and (d) GDPR. This implied a risk for the security of the personal data of all data subjects concerned (at least 132,652). The DPA recalled that these data were of a financial nature and thus quite sensitive. The DPA determined that the violation has been ongoing since at least 2019 and has not yet been remedied.
The DPA issued a fine of €2,265,000 for these three violations.

AZOP (Croatia) - Decision 04-05-2023


holding_Datatilsynet (Denmark) - Gyldendal A/S

The DPA held that the controller violated the principles of storage limitation and accountability by keeping the personal data of a large number of data subjects for longer than necessary. Therefore, it reported the controller to the police and recommended a fine of €134,427 (DKK 1,000,000).

Datatilsynet (Denmark) - Gyldendal A/S


The mother’s appeal to the Council of State was declared well-founded.
According to the Administrative Jurisdiction Division of the Council of State, • Article 15(1) GDPR only gives a data subject the right to obtain information about the personal data concerning him/her, and therefore does not provide a basis for providing personal data to third parties • Article 15(4) and recital 63 GDPR indicate that the right to obtain a copy must be without prejudice to the rights and freedoms of others.
The files covered by the request include documents in which only personal data of the mother are included as well as documents containing both personal data of the mother and the father.
As far as his own personal data are concerned, the father can be regarded as a data subject as referred to in Article 15(1) GDPR. But with regard to the mother’s personal data, the mother is the “data subject”. The personal data of the mother cannot therefore be provided to the father on the basis of Article 15 GDPR. To that extent, the decision of the Minister for Legal Protection was taken in breach of Article 15 GDPR, and the Court wrongly failed to recognize it.
The Minister’s view that there is “no undue serious infringement”' of the mother’s rights and freedoms is too light, since Article 15(4) GDPR requires in this case that her rights and freedoms are not infringed.

RvS - 201905709/1/A3


The DPA held that the data subject had exercised their right to object to the processing in accordance with the GDPR. Pursuant to Article 17(1)(c) GDPR, the burden of proof for the existence of overriding legitimate grounds for the continued processing is on the controller and not the data subject. The DPA highlighted that by denying the requests due to Google's alleged inability to access the contents of the relevant web pages, Google was placing the burden of proof on the data subjects. By this logic, the data subjects would have had to gather additional information from the relevant web pages themselves in order for Google to act on the requests. As a result, the data subjects would in practice be forced to pay to be able to exercise their rights.
Against this background, the Swedish DPA reprimanded Google for violating Articles 12, 17 and 21 GDPR.

IMY (Sweden) - DI-2022-2351/2372/2373/2374/2375


The DPA found a breach of the national ePrivacy implementation law (LSSI)[2]. Article 22.2 LSSI on the installation of cookies before the user's consent. The exemptions under this Article apply to cookies with technical functions. However, non-technical cookies were used without the user's prior consent. Furthermore, it was impossible to reject them, as they do not disappear after revoking or rejecting all consents.
The DPA decided this infraction was minor based on Article 38(4)(g) LSSI. According to the criteria of Article 40 LSSI, the sanction was evaluated based on the existence of intent demonstrated by the controller's lack of due diligence.
The fine was initially set at €,5000 but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may make a voluntary payment of the proposed fine and waive their right to appeal. This action reduces the imposed fine by 20%. The fine can be reduced by a further 20% if the controller acknowledges its liability. The controller opted for both and reduced the fine by 40%, paying the reduced sanction amount of €3,000.

AEPD (Spain) - EXP202414144


The Romanian DPA found that the data controller could not rely on any legal basis for the processing at stake. It therefore violated the provisions of Article 5(1)(a) and (b) in conjunction with Article 6 GDPR.
As such, the data controller was fined 14,776.50 RON (the equivalent of €3,000).
The Romanian DPA also ordered to anonymize the data published on the controller's website.

ANSPDCP (Romania) - 19.04.2023