The Spanish DPA held that the access request was properly fulfilled, in spite of being properly attended after claim admission, so it decided not to impose any fine nor warning to the defendant.

AEPD (Spain) - TD/00261/2020


holding_Rb. Midden-Nederland - C/16/526196/ HA RK / 21-01

First, the Court acknowledged that the right to inspection under article 15 GDPR is not absolute or unlimited, but that its purpose is to enable the data subject to check if their personal data has been processed lawfully and in a correct manner. Moreover, the court acknowledged that an exception to this right are circumstances where it is impossible to fulfill this obligation adequately.
In addition, the court acknowledged that the principles of proportionality and subsidiarity must be complied in the recording of the personal data, as well as the maintaining of the data and subsequent changes. Moreover, the interference with personal data is only allowed for the purposes served by the processing, where the processing is the only possible way to achieve these purposes successfully.
In relation to the first request, the Court concluded that the information which was initially provided by the controller to the data subject was sufficient, meeting all the requirements in article 12 GDPR. Precisely, this information was provided in a clear and concise manner.
In relation to the fourth request, the Court concluded that the data controller was under no obligation to provide the data subject with the complete file. Precisely, in relation to the data subject’s medical personal data, the Court found that the data controller was right to inform the data subject of the medical adviser who had his personal data at disposal and concluded that this was done in a clear and concise manner. Therefore, the data controller did not breach the duty to inform.
In relation to the obligation to inform the data subject of the information submitted by Ms D, the Court found that the data controller was under no such obligation due to the circumstances of the case. In particular, the information submitted by Ms D was the divorce covenant. Therefore, it was reasonable of the controller to assume that the data subject had the divorce covenant at his disposal, which is why it was not necessary to inform him about this. For this argument, reference was made to article 14(5)(a) GDPR.
Moreover, the Court concluded that the data controller did not communicate the data subject's personal data to third parties, other than Ms D. Specifically, the Court found that this claim by the data subject was found on an unsound factual basis.
The court also concluded that the data controller had a sufficient and plausible legal basis to request information from Ms D for the purposes of arriving at a correct financial settlement.
In relation to a summary and transcripts of conducted (phone) conversations, emails and apps, the Court concluded that the data controller did not violate their obligation. To specify, the Court explained that according to article 15 GDPR, the data subject is only entitled to an inspection of the personal data in these email conversations relating to him. The data controller argued that after verification, such personal data was included in the information initially provided to the data subject before the proceeding in Court. The data subject did not sufficiently object to this.
Moreover, the Court noted that the possible internal notes in the data subjects’ file by the data controller’s employees also fall under the grounds of restriction under article 23 GDPR.
The court found two infringements by the data controller.
First, it found that the controller wrongfully disclosed the data subject’s email address and policy number to Ms D. Precisely, because the data subject did not consent to this, nor did the controller satisfy any on the grounds mentioned under article 6 GDPR. However, the Court concluded that an immediate notification sent to the data subject was not necessary under article 34 GDPR. In particular because the disclosed information did not represent a high risk to the data subject.
The second infringement concerns the processing of special personal data which was not in accordance with article 9 GDPR. Specifically, a reference was made to the data subject’s condition known as severe rheumatism. The Court concluded that the processing of this personal data constitutes a violation of the proportionality and subsidiarity principles.
In respect of the fifth question, the Court established that this is not a breach of the GDPR, but a dispute which should be solved under national civil law. Hence, the GDPR is not applicable.
In relation to the sixth question, the Court concluded that considering that the insurance still has not been settled, the personal data is still necessary for the purposes of the settlement. Hence, the data controller still has a legal basis for the processing of the data. However, once the dispute is settled, the data should be delighted in accordance with article 17 GDPR.
In relation to the 7th and final question, the Court gave a thorough analysis.
First, the Court confirmed that the GDPR and in particular article 82 provide a legal basis for compensation in procedures like the one at hand.
Second, the GDPR does not specify how (im)material damages should be determined and calculated, but leaves it up to all MS to decide this question due to the lack of common legislation. However, recital 146 states that the data controller should compensate the data subject in respect to all of the damages, while the concept of damages should be interpreted broadly in accordance with the CJEU’s case law.
The damages to be compensated must be real and certain. For the purposes of this case, the Court relied on article 6:95 et seq. of the Civil Code. The burden of proof was on the data subject.
In relation to immaterial damages, the data subject argued that he suffered a mental injury as a consequence of the disclosure of his information to Ms D. Furthermore, he argued that because of this mental injury he was forced to move to Spain. However, the Court found this claim is not sufficiently substined, and that the data subject failed to establish a causal connection.
In relation to the material damages, the data subject is seeking compensation for the move to Spain, medical and extrajudicial expenses. However, the Court found again that the data subject's arguments were not sufficient and that he failed to establish a connection between the costs and the data controller’s infringement.
The court ordered the data subject to pay the costs of the proceedings, which are assessed on the part of the data controller at a total amount of € 2,904 until the present judgment.


The Swedish DPA held that, although the intention of the Social Affairs Committee was to protect the resident from harming himself, the installation of CCTV cameras in the resident's bedroom is considered a big intrusion of the resident's privacy. This means that the processing of personal data has been disproportionate to the purpose. The processing of personal data that has taken place through the camera surveillance has thus not complied with Articles 5(1)(a)(i), 6, 9(2), and 13 GDPR.

Datainspektionen - DI-2019-7782


holding_ICO (UK) - Nottinghamshire County Council

The ICO held that the manager's oversight procedure was not sufficiently robust, as evident from the failure in this case. Also, Nottinghamshire County Council had not provided detailed training to its staff on redaction. The ICO held the breach to be serious as it could have resulted in actual physical harm to the mother and the children, given that it pertained to domestic violence carried out on the mother and children.
The ICO took note of the remedial steps taken by Nottinghamshire County Council, including comprehensive guidance in relation to the redaction of documents, and after taking into account all relevant materials and facts, reprimanded Nottinghamshire County Council under Article 58(2)(b) (UK) GDPR, for infringing Article 32(1) (UK) GDPR.


holding_RvS (Netherlands) - 202001625/1/A3

In establishing which data is being processed, the Court took note of the fact that Connexxion uses a Payment Service Provider (PSP) to process its financial transactions and applies the PAN Masking technique to secure these transactions. This technique only provides the last four digits of the bank account number to be stored at Connexxion while the preceding digits are anonymized.
The Court further noted that a contract is established when the passenger boards the bus and the mere fact that the passenger has no choice as to whom he concludes this contract with does not negate the existence of said contract. It went on to consider whether there is an agreement in place and held that “there is no evidence to suggest that an agreement with Connexxion does not qualify as an agreement within the meaning of Article 6(1)(b) GDPR.”
The Court further clarified that “the processing of personal data may be lawful if it is necessary for the performance of the contract.” In its application to this matter and whether the processing was necessary, the Court set out a three-step approach to its assessment and elaborated with reference to case law:
First, the Court turned to whether the purpose for processing said data was “well-defined and explicitly described". Second, the Court considered whether the processing of said data actually achieved that purpose. Thirdly, the Court concluded with a balancing of interests by stating that “[i]f the processing of the personal data is necessary to achieve the specific purpose in this sense, it must be assessed whether the invasion of privacy is proportionate to the interests served by the processing of the personal data.” The Court referred to the judgment of 20 September 2017 where it was held that “it must be assessed in light of the EU Charter whether the invasion of privacy is limited to what is strictly necessary to achieve the purpose. In particular, it must be assessed whether the purpose for which the personal data are processed cannot reasonably be achieved in another manner that is less detrimental to the persons involved in the processing of personal data.” The intensity of this investigation depends on the specificity of alternative which are tabled.
In its assessment for necessity, the Court noted that “[t]he mere fact that the processing of data is covered by or related to a contract does not mean that such processing is necessary for the performance of the contract.” It compared Article 7(b) Directive 95/46/EC to Article 6(1)(b) GDPR and found that the two are “almost identical”. Hence, it found that the Opinion and Guidelines (opinion 06/2014 of the former Article 29 Working Party and Guideline 2/2019 of the European Data Protection Board) were also relevant when interpreting the GDPR.
The Court then referred to various provisions in the General Terms and Conditions for City and Regional Transport 2015 in order to ascertain the terms of the contract in this particular matter. It clarified that “[t]he essential content of the agreement is therefore that a passenger can be transported from A to B in a safe manner in return for payment. This safety does not only relate to the competence of the driver and the quality of the means of transport, but also to the social safety of the traveller. In the opinion of the Department, ensuring safety of the traveller is an essential part of the obligations arising from the transport contract. Thus, the objective of the measure to require debit card payment on the bus is an integral part of that agreement.”
Whilst investigating the purpose behind processing the data, the Court found that the card payment measures were introduced as a safety mechanism for public transport operators and passengers alike. It took note of figures reflecting incidents (such as theft, robbery, threats with a weapon and more, known under the collective category of A-incidents) and the added vulnerability of passengers and operators to such incidents when payment is accepted in cash. The absence of cash on board makes public transport less attractive for those committing these deeds and the number of incidents was proven to the court to have dropped after the implementation of these measures. Therefore, the Court found that “the AP was entitled to consider safety a legitimate objective for the introduction of compulsory debit card payments...” and that “the mandatory debit card payment achieves the purpose for which it was established.”
In considering the requirement of proportionality the Court assessed the PSP used by Connexxion and the PAN technique put in place. It found that this limits the processing of personal data. It further took note of the fact that one can still travel on the bus without a card payment, by simply purchasing a ticket in advance (in cash) from any sales point or by paying with an anonymous chipcard. Therefore, the court held that “the invasion of privacy is proportionate to the interests served by the processing of the personal data.”
Thus, the appeal failed and the attacked decision was confirmed.

RvS (Netherlands) - 202001625/1/A3


The Dutch Council of State held that the appeal was unfounded, and that the judgment under appeal should be upheld. The District Court correctly held that the AP was entitled to take the position that the Municipality no longer violates the GDPR if the order is lifted, and the District Court gave sufficient grounds for this opinion.
The Council of State agreed with the appellant that the short-term processing of personal data on the volatile memory of the card reader is processing within the meaning of the GDPR. However, it did not agree with the appellant that processing on the basis of Article 6(1)(e) GDPR must derive from law in a formal sense. Neither the GDPR, nor the Dutch Constitution, nor the EU Charter of Fundamental Rights require this. Instead, it follows from Recitals 41 and 45 that the GDPR does not require specific legislation for each individual processing operation; it is sufficient to have legislation that serves as a basis for several processing operations. The processing only has to be traceable to a law, which may therefore also be a lower regulation.
The Council of State found that the responsibility of the municipality to ensure the collection of household waste can be regarded as a task carried out in the public interest. The duty to exercise this task arises from Section 10.21 of the Environmental Management Act ('the Act'), the National Waste Management Plan adopted pursuant thereto, and the municipal waste plan 2012-2020. The Act instructs the Municipality to collect waste, as well as to into take account the current municipal waste management plan. In view of this, the processing of personal data in to prevent the use of waste containers by non-residents, in order to keep residual waste to a minimum - which is a principle outlined in the municipality waste management plan - falls under the Municipality's public interest. The Council of State highlighted here that generally, the purpose of data processing does not necessarily have to be aimed at a certain group of data subjects, rather it can be aimed at excluding another group, e.g. in this case non-residents.
The Council of State also held that, in determining whether the processing of personal data was necessary to prevent non-residents from using the waste containers, the Municipality was not required to review all possible alternatives; the fact that an alternative exists, does not in and by itself make the processing unnecessary, as controllers have some degree of freedom to decide how they carry out their tasks. That said, the Council of State emphasised that the more detailed, or 'intensive' the description of an alternative by a data subject, the more comprehensive the AP's investigation must be.
In addition, the Council of State emphasized that the fact that the processing of data must be necessary, does not mean that the processing is lawful only if the task in the public interest cannot be fulfilled without the processing of data. Processing will only not be necessary if there are other methods that can achieve the same objective, or if the processing is disproportionate.
The Council of State considered that the AP was entitled to take the position that the Municipality sufficiently demonstrated that the proposed alternatives do not achieve the intended purpose. For example, if the containers were open, it would not be possible to prevent non-residents from dumping their waste in them. Further, the use of a waste pass that is not linked to an address cannot achieve the aim of preventing abuse. In that case the circulation of waste cards cannot be monitored by the municipality and there is a chance that the waste cards will end up with companies or non residents. objective cannot reasonably be achieved in another manner that is less detrimental to data subject.
Further, the Council of State found that the necessity test in the ECHR is not stricter than the necessity test in the GDPR. Therefore, as the processing of data complies with Article 6 GDPR, the AP was entitled to take the view that the data processing does not violate Article 8 ECHR. Further, contrary to what the appellant argues, the extent of the processing plays a role in the consideration of the proportionality of the processing under Article 8(2), since from waste disposal pass are stored briefly on the volatile memory of the card reader so they can be checked against data on authorisation list. Data is then anonymised. and is thereafter not stored. This is limited in scope and restricted to what is necessary.
Finally, the Council of State noted that it did not follow the appellant's argument that the data processing conflicts with the principle of data minimisation. It stated that the starting point of the GDPR is not the prohibition of the processing of regular personal data, rather, the GDPR regulates such processing. There is also no fundamental right not to process regular personal data.

RvS - 201906880/1/A3


Thus, the AEPD understood that the video surveillance system infringed the data minimisation principle (Article 5(1)(c) GDPR) and, after considering certain factors [(i) the defendant has collaborated with the AEPD, (ii) there is no intentionality by the defendant, and (ii) the video surveillance system has been uninstalled and the property has been left by the defendant, but (iii) in the end, the alleged facts have been proven], it imposed a minor warning to the defendant.

AEPD (Spain) - PS/00082/2020


holding_High Court - McShane v Data Protection Commission (2025) IEHC 191

In respect of the question as to whether the data subject should have pursued a statutory appeal in lieu of judicial review, the Court held that in this instance, this failure would not preclude his application for judicial review. The Court referenced the language adopted by the DPC in their communication to the data subject, noting that they used the term “concerns” rather than a complaint and that it was not expressly stated that they were “dismissing” or “rejecting” the matter. The Court found that in their email, the DPC should have used the language in the legislation and informed the data subject that he had a right of appeal. In the present circumstances, it would be unfair to deny the data subject judicial review on this ground.
In assessing the reasonableness of the DPC’s conduct and their obligation to investigate the alleged infringement, the Court referenced the data subject’s initial complaint. The Court noted that the data subject made their complaint entirely about the alleged breach of his non-work-related personal data on the work device. This, it was held, was addressed by the DPC in their response to him. The Court found that DPC’s decision did not err sufficiently so as to warrant the Court's intervention, and that there were no grounds for finding that the test set out in Meadows was satisfied.
Accordingly, the Court refused the data subject’s application for judicial review.


The DSB held, that the respondent qualifies as a media company under § 1(1)(6) of the Austrian Media Act, because it is a company which creates the content of the medium and handles the production, distribution, broadcasting and retrievability of the medium. It further held, that the data processing (publishing the complainant's personal data in an online article) was carried out for journalistic purposes. As the complainant is an former politician and the article revolved around legal procedures that she is involved in there was a public interest in mentioning the complainant's name.
Under Article 9(1) DSG, Chapter III and Chapter VI of the GDPR do not apply on data processing carried out by media companies for journalistic purposes. Such GDPR violations must be tried before civil courts. Hence, the DSB considered itself not competent, rejected the complaint and did not investigate the alleged violation of Article 17 GDPR.

DSB (Austria) - 2020-0.303.727


The DPA recalled the controller's obligation to answer requests regarding data subject rights contained in Articles 15 to 22 GDPR in the period of one month or, depending on the complexity of the request, at least provide a justification for the delay.
In this case, the DPA also referred to the case law of the CJEU, specifically judgement C-131/12, and the Spanish Supreme Court about the right to be forgotten. The DPA made the following observations.
Firstly, the right to be forgotten can be found in Article 17 GDPR and Article 93 of the LOPDGDD, the Spanish data protection law. It establishes a right to request, among others, search engines to erase from the list of results links that contain personal data. However, this right is not unlimited. It must be balanced with conflicting interests of the public, including their right of access to information as well as freedom of expression. In order to balance the interests at stake, aspects such as the type of information, the time of the publication, if the information is of public interest or not should be taken into consideration.
Secondly, according to case law, search engines are considered controllers. They process information available on the internet, collect data, register, and organise it according to their indexing programmes, retain it in their servers and make it available to users. Hence, they control the purposes and means of processing.
Thirdly, the right of data subjects to directly request search engines to erase their data is essential due to the importance of Internet nowadays. The DPA held that a request cannot be simply ignored. An answer must be issued by the controller, even when no data of the requesting party was processed. Furthermore, the controller is obliged to require the correction of the deficiencies observed or, where appropriate, deny the request indicating the reasons and considering the above-discussed law.
In the present case, the information available through the URL links was considered personal data not related at all to the data subject's professional life or of public interest. In light of the above, the DPA upheld the complaint, claiming that the requested data should have been deleted. However, the DPA did not fine the controller because they proceeded to comply with the request during the course of the proceedings.

AEPD (Spain) - EXP202205791


The right to erasure
The Gothenburg Court of Appeals partly reversed the findings of the the FiS and found that Google had complied with Article 17 GDPR on the right to erasure with respect to both Complaint No. 2 and Complaint No. 8. In particular:
With respect to Complaint No. 2, the Gothenburg Court of Appeals found that the data subject had first only provided the main web address (URL) of the discussion thread where his/her name was mentioned, but had failed to provide the specific URLs where his/her name was mentioned each time. The Gothenburg Court of Appeal noted in this respect that Google's instructions on erasure requests clearly require the data subject to provide each and every URL that is part of the erasure request, as even small changes to the URL can lead to a different website. The Gothenburg Court of Appeal further noted that Google has set up a help page explaining the importance of providing each URLs in details. Finally, the Court of Appeals noted that, once the data subject had completed his/her erasure request by providing the specific URLs where his/her name was mentioned, Google had proceeded to the erasure of these pages without undue delay. Based on these considerations, the Court of Appeals concluded that Google had complied with Article 17 GDPR.
With respect to Complaint No. 8, the Court of Appeals agreed with FiS that Google had complied with Article 17 GDPR by removing the concerned search result three days before IMY had ordered Google to do so. Hence, the Court of Appeals concluded that Google had deleted the requested search results without undue delay, in accordance with Article 17 GDPR.

Google's practice of informing webmasters
The Gothenburg Court of Appeal upheld the FiS decision that Google's practice to regularly inform webmasters of the removal of search results was contrary to Article 5(1)(a) GDPR (principle of lawfulness), Article 5(1)(b) GDPR (principle of purpose limitation) and Article 6 GDPR (absence of valid legal basis for the processing). The Gothenburg Court of Appeals found in this respect that Google had systematically ignored the Article 29 Working Party's Opinion on the right to erasure over an extended period of time. Although the Opinion is not strictly binding, the Gothenburg Court of Appeal pointed out that the Article 29 Working Party's mandate is to ensure that the European Union's data protection rules are applied consistently in all Member States, and that controllers should thus consider such opinions and guidelines. In conclusion, the Gothenburg Court of Appeal found that Google's practice to inform webmaster of deleted search results was contrary to the GDPR, and upheld the fine of €4,800,000 million (SEK 50 million) imposed on Google by FiS.

KamR Göteborg - 2232-21


The AEPD considers that BBVA's actions breached the principle of lawfulness in Article 6(1) GDPR because it had no legal basis for processing the complainant's data. The initial sanction the AEPD envisaged was €100,000 but BBVA was able to terminate the sanctioning procedure by paying €60,000 and acknowledging its responsibility, as provided for in Spanish administrative law.

AEPD (Spain) - PS/00427/2021


Firstly the AEPD decided to initiate a sanctioning procedure against the entity BUBO MEDIA, S.L. for the alleged infringement of Article 21.1 of the LSSI, typified as minor infringement in Article 38(4) (d). The fine associated with this infringement is calculated in EUR 1500. However, two attenuating circumstances of the Spanish Law on Common Administrative Procedure of Public Administrations (Article 85) can be applied, which may respectively reduce the fine by 20%. The first mitigating factor is to acknowledge their responsibility within the time allowed for the submission of claims. The second mitigating factor is, at any time prior to the resolution of the proceedings, to make voluntary payment of the proposed penalty.
On June 9, 2020, BUBO MEDIA, S.L. proceeded to pay the sanction in the amount of EUR 900, applying therefore the two previously mentioned reductions. This implied the recognition of their responsibility and the resignation to any action or appeal in administrative channels against the sanction. After these events, the AEPD decided to terminate the procedure.

AEPD (Spain) - PS/00142/2020


The AEPD found that the controller had violated Article 5(1)(f) GDPR and Article 32 GDPR.
The AEPD highlighted that the controller could only show that its employees had signed a confidentiality agreement but that there were no other organizational measures in place which would have prevented this data breach. In addition, the AEPD criticized that apart from a one-hour training session at the beginning of the employment relationship, employees were not adequately informed on complying with the GDPR in their delivery functions.
As there was no system in place to see whether letters had actually reached the intended address, the AEPD found that the controller’s function as a postal service provider proved an aggravating factor in this case as it requires the controller to have such a system in place.
Therefore, the AEPD imposed a €120,000 fine for the infringement of Article 5(1)(f) GDPR and a fine of €80,000 for the infringement of Article 32 GDPR. Additionally, the AEPD ordered the controller to implement a tracking system as well as training for employees informing on GDPR compliant delivery of letters.

AEPD (Spain) - EXP202318430


The French DPA held that Google's updated cookie system was compliant, as the implementation of the "reject all" button offered a means of users refusing the storage of and access to their information, pursuant to Article 82 of the French Data Protection Act.
Consequently, the French DPA decided to dismiss the periodic fine of €100,000 per day in the case of non-compliance, as the updated cookie banner was lawful.

CNIL (France) - SAN-2023-012


The DPA held that Google had not complied with the previous order by the DPA by failing to remove search links sufficiently and within a reasonable time. Google had, therefore, processed personal data in violation of the GDPR.
The DPA also held that Google had processed personal data in violation of Articles 5(1)(b) and 6 GDPR by sending notifications to webmasters that search results had been deleted. Furthermore, the notice given to data subjects concerning these notifications was found misleading in a manner contrary to Article 5 (1)(a) GDPR.

Datainspektionen - DI-2018-9274


The Court held that those responsible for processing personal data, as well as those who, in the course of their duties, have knowledge of the personal data processed, are bound by professional secrecy, even after the end of their functions (Article 10 of Lei 58/2019), which directly mentions Article 38(5) GDPR. Lei 58/2019 is a national law for GDPR implementation). This duty of secrecy must give way to the duty to provide legally required information, particularly to the judicial authorities, and to the duties of the National Commission for Data Protection (Article 8 of Lei 58/2019).
The Court held that the records collected by the controller are personal data which fall under the concept of protection of privacy and for which there is an obligation of confidentiality for the controller. The court considered the possibility of creating "individual driver profiles" with these records and held that this information is likely to limit the freedom of movement of clients of the controller and that this information could involve risks of intrusion in private life if strict mechanisms for processing, storage and access to the information are not established.
The Court stated that this case presented a conflict between the duty of professional secrecy and the duty to cooperate with the administration of justice, which should be resolved through a judgment of proportionality through a judgment of weighting and coordination between these duties.
In a balancing test of the interests at stake, the Court concluded that making the information available about the controller's clients and their private matters was not proportional in relation to the scope of the availibillity of the information.. The Court further stated a failure to obtain the information didn't jeopardize the applicant's interest in locating the vehicles. The success or failure of seizing the vehicles would not depend on the lifting of the profesional secrecy of the controller. The Court held that is was therefore not appropriate to lift the professional secrecy of the controller.

TRL - 7159/08.7TBCSC-A.L1-7


The litigation chamber of the Belgian DPA closed the case, considering that there was not enough elements to find a violation of the GDPR by the defendant who was still alive.

APD/GBA (Belgium) - 85/2021


holding_Rb. Amsterdam - C/13/673049 / HA RK 19-338

The court ruled that the plaintiff did not provide enough indications to contradict the statement of the defendant that the removed phrases did not contain personal data. The request to provide the removed phrases is denied.
The court rules that the internal notes and correspondence must be qualified as personal thoughts from employees which are only intended for internal consultation and deliberation and therefore can’t be qualified as personal data in the sense of the GDPR. Besides, the purpose of the request is not consistent with the purpose of Article 15 GDPR. The request was made in relation to a family dispute, while the purpose of Article 15 GDPR is to enable data subjects to verify whether their personal data is correct and to verify whether their personal data is processed lawfully. The request is denied.


holding_Datatilsynet (Denmark) - 2021-31-5085

The DPA limited its decision to the content of the controller's reply to the data subject access request and did not consider whether they replied within the time limits set out in Article 12(3) GDPR.
Then, the DPA held that the large number of documents which could contain information about the data subject essentially related to the controllers where the data subject worked as a board member and a managing partner, as well as to ongoing legal proceedings. In this respect, the DPA assumed that any personal information from those documents appeared to be an "accessory" to the processing purpose (in this context, business operations) and thus must be considered as describing the function that the data subject performed.
Moreover, the data subject did not specify their request enough for the controller to reduce the number of documents to check. As a result, responding to the request would require the identification, collection, review and assessment of more than one million documents distributed among different controllers to determine whether personal data about the data subject would have to be handed over.
Consequently, the DPA held that the controllers were not obliged to search for and review the documents to identify and hand over information about the data subject because the request was excessive, according to Article 12(5)(b) GDPR.

Datatilsynet (Denmark) - 2021-31-5085


The AEPD concluded that the defendant could have breached Article 13 GDPR, Article 7 GDPR and Article 22(2) LSSI: there was no identification of the data controller, no possibility to give a separate consent for each purpose, and there was not enough information on the use of cookies. Consequently, after considering some aggravating circumstances [(i) intentionality by the defendant, (ii) period of time in which the infringements had been happening], the AEPD understood that, in case the sanction procedure resulted in a successful decision, this infringement would be fined with 13,000 € to the defendant. In this sense, the AEPD offered the defendant the possibility to settle the issue before the decision took place by agreeing to a voluntary payment of part of the fine and by acknowledging its liability. The defendant agreed and the sanction procedure was closed by the AEPD.

AEPD (Spain) - PS/00234/2020


The BVwG ruled that the union unjustifiably requested proof of identity of the data subject and had not dealt with the latter's request for deletion. In this regard, it followed a previous position of the Austrian DPA according to which the union had not informed the data subject about why it had reasonable doubts regarding their identity.
The Court held that since the union did not doubt the identity of the person with regard to their resignation, it cannot raise such doubts regarding to the deletion of personal data in terms of Article 12(6) GDPR. A bona fide recipient can be either be in doubt with the identity of the declarant or not.
Any further request for proof of identity contradicts the facilitation requirement of exercising data subjects right pursuant to Article 12(2) GDPR. The union had therefore violated the data subject's right to erasure by not dealing with the content of the data subject's request for erasure pursuant to Article 17 GDPR.

BVwG - W274 2237071-1


holding_UODO (Poland) - DKN.5112.13.2020

The DPA held that the agreements between the GGK and the poviat starosties concerned the creation and maintenance of common elements of the technical infrastructure intended to store and make available certain data filing systems, but did not constitute a legal basis for making available the data, including the land register numbers. Such a basis would need to result from commonly binding legal provisions.
Since the GGK could not provide a valid legal basis for its processing of personal data, the UODO held that the publishing on the GEOPORTAL2 was not in line with the principle of lawfulness in Article 5(1)(a) GDPR, as none of the conditions of Article 6 GDPR were satisfied. The data disclosed in the land register of natural persons includes, among others, names, surnames, parents’ names, PESEL number (personal identification number), and property address. The DPA therefore held that a large number of data subjects may be exposed to identity theft in such a situation.

UODO (Poland) - DKN.5112.13.2020


Firstly, the CNIL indicated that Article 6(1) GDPR establishes the legal bases of processing. The DPA also pointed out that commercial prospecting by telephone can be carried out on the legal basis of the controller’s legitimate interest or on the basis of consent.
Regarding the controller’s legitimate interest, the CNIL added that the controller must ensure that the processing does not infringe the rights and interests of the data subject, taking into account their reasonable expectations. The CNIL held that regarding the fact that the controller was not listed as a partner from the data supplier, the controller could not rely on Article 6(1)(f) GDPR to justify its commercial canvassing operations by telephone, as the protection of the interests, freedoms and fundamental rights of the data subjects took precedence over the legitimate interests of the controller.
Regarding consent, the CNIL stressed that concerning commercial canvassing operations, when the data subject’s data has not been collected directly from them by the canvassing organization, consent may be obtained by the initial collector on behalf of the organization that will carry out subsequent canvassing operations. If this is not the case, it is up to the prospecting organization to obtain such consent before proceeding with the processing. The CNIL considered that the design of the forms on the data supplier’s website did not allow data subject’s to express a valid choice as the interfaces particularly highlight the “Validate”, “I validate” or “I answer questions to apply” button, whose size and color make it stand out from the other information provided. The words used also suggested the conclusion of the data subject’s registration process rather than the transmission of data to partners and the location of the button on the form gave the impression that it must be clicked to complete the registration and take part in the competition. The CNIL also found that the hyperlink text which allowed data subjects to partake in the competition without agreeing to the transmission of their data to partners was presented in the body of the text in characters much smaller in size than those used for the buttons and without any particular emphasis. The CNIL also found that the forms submitted by the controller in its observations did not sufficiently inform the data subjects either. Therefore, the CNIL considered that the consent was not unambiguous and free as per required under Article 4(11) GDPR.
In the absence of a legal basis enabling the controller to base its commercial canvassing operations by telephone, the CNIL considered that a breach of Article 6 GDPR was constituted.
Secondly, the CNIL also pointed out that a simple contractual commitment by a data broker to comply with the GDPR as well as the rules applicable to commercial prospecting do not constitute a sufficient measure (see CNIL, SAN-2022-021). Thus, the DPA considered that the contractual obligations that the controller imposed on its suppliers did not exonerate the controller from its liability, despite the possible existence of liability on part of suppliers.
Finally, the CNIL noted that during the phase of current use, which corresponds to the time required to achieve the purpose of the processing, the data is kept in an “active base” and is accessible to all departments responsible for implementing and processing. At the end of this phase, when the data is no longer used to achieve the set objective, but is still of administrative use to the controller (for example the management of a possible dispute), it must be possible to consult only on an ad hoc basis and for a specific reason, by specially authorized people. With regards to this case, the CNIL held that the information they found did not make it possible to establish that persons would have access to the data without having a need to know. Therefore, the DPA concluded that there was no breach of Article 32 GDPR.
Thus, the CNIL imposed a €310,000 fine on the controller for breaching Article 6 GDPR.

CNIL (France) - SAN-2024-003


Without prejudice to the results of the final investigations corresponding to the sanction procedure, the AEPD understood that the defendant could have breached the lawfulness of processing principle as per article 6(1) GDPR: on the basis of the available evidences, the defendant did not take the due diligences to ensure the lawfulness of the data processing activity, and it neither proved the lawfulness of such when required by the AEPD. Consequently, after considering some aggravating circumstances [(i) there is a negligence/intentionality by the defendant, and (iii) basic personal data have been affected], the AEPD understood that, in case the sanction procedure resulted in a successful decision, this infringement would be fined with 60,000 € to the defendant. In this sense, the AEPD offered the defendant the possibility to settle the issue before the decision takes place by agreeing to a voluntary payment of part of the fine, with two possible discounts based on earliness (48,000 €) and acknowledging of guiltiness (36,000€). The defendant agreed to both, so it paid 36,000 € and the sanction procedure was closed by the AEPD.

AEPD (Spain) - PS/00303/2020


The Council of State rejected the appeal.
First, the Council stated that the municipality complied with the data subject's access request within the decision time of one month as per Article 12(3) GDPR. Second, the Council of State held that the right to rectification of personal data pursuant to Article 16 GDPR only applies to inaccuracies that can be easily and objectively ascertainable. Since the letter of 14 Novemer 2018 concerned impressions and conclusions with which data subject did not agree, the Council found that the rejection of the request for rectification was well-founded.
Lastly, although it is not disputed between parties that the forwarding of email of 13 January 2017 without removing data subject's email address was unlawful, the Council of State had previously considered that a violation of the GDPR does not automatically entitle the data subject to compensation. Because the data subject could not plausibly demonstrate that the infringement caused damages, this ground of appeal was also rejected.

RvS - 202100213/1/A3


The DPA held that it had the jurisdiction to decide this complaint. First, the recordings of natural persons with surveillance cameras are personal data. Second, the fact that the controller placed the cameras on his own property does not trigger the "household exemption" under Article 2(2)(c) GDPR. When the cameras also record, as in this case, public or private spaces, this provisions doesn’t apply. Therefore, the GDPR was applicable.
The DPA held the controller had violated the principle of lawfulness, fairness and transparency under Article 5(1)(a). For instance, had not installed a public sign signalling a video recording was taking place as required among the others by Article 7(2)(6) Camerawet.
The DPA held that the controller did not comply with the legal obligation to register the purpose of video surveillance at the local police office. Since it was obligatory to register the purpose of camera surveilance to the police, the controller violated Article 5(1)(b) GDPR. The DPA also held that a late registration would not remedy the initial violation.
The DPA held that the controller violated the "data minimisation" principle under Article 5(1)(c) GDPR because the camera used to record more than the controller's private premises. The SA confirmed the violation even if the controller had corrected the camera's orientation during the proceedings by making sure the surveillance cameras only recorded his own backyard. The controller stated that the camera had a ‘moving function’, where the camera could automatically chance the angle to get a different view. The controller disabled this function at the advice of the police.
The DPA held that the controller violated the accountability principle (Article 5(2) GDPR and Article 24(1) GDPR) on two grounds. The first ground was the fact that the controller was unable to show how data subjects were informed in a transparent and fair way, unable to show that the data was processed with specified, explicit and legitimate purposes and unable to show that not more personal data was processed than what was necessary for the purposes pursued by the controller. The second ground was the fact that the controller also didn’t have a registry for video footage and for activities altering this footage. This was however an obligation for the controller according to Article 7(2)(5) Camerawet and Articles 7, 8 and 9 Camerabesluit.
The DPA held that it had to be assessed whether or not the controller could use legitimate interests as a legal ground for processing (Article 6(1)(f) GDPR). Following the CJEU's case law, there must be a legitimate interest, the processing must be necessary for this interest and a balancing test has to take place of the legitimate interest of the controller/third party against the interests and fundamental rights of data subjects. The DPA held that preventing burglary, vandalism or theft can be seen as a legitimate interest, with a reference to the EDPB Guidelines 3/2019. The DPA held that the necessity-test should be assessed with the data-minimisation principle (Article 5(1)(c) GDPR ) in mind, which states that processing must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. It was already decided that the controller had violated this principle. The constant recording of neighbours private premises cannot be seen ‘relevant’, so processing could certainly not be ‘necessary’ for the legitimate interest of the controller. The DPA also held that the legitimate interest in question failed the balancing test. It held that the constant recording of the data subjects was a serious infringement on their fundamental rights. There was also a less intrusive option available in the form of putting a casing around the camera to obstruct part of its view. The DPA also considered it a factor that it was beyond the objective expectations of the data subjects that the surveillance camera was positioned in a way such as in this decision.
The DPA gave the controller a warning.

APD/GBA (Belgium) - 138/2022


First, the court stated that the controller should take all reasonable measures to verify the identity of a data subject who is making a request referred to in Articles 15 to 21 GDPR and can request further information regardless of whether he has doubts about the identity (Article 12(6) GDPR and [Recital 64]). Furthermore, the court ruled that the minister had discretion to the manner in which it established the identity of the data subjects. Therefore, the measures proposed by the minister were valid, especially considering that the relevant data are special category of personal data (Article 9(1) GDPR).
Second, the court stated that Minister could not have used the proposed identification method at the time of the decision due to technical reasons.
Lastly, the court found the appeal unfounded and rejected the data subject's request for damages.

RvS - 202305323/1/A3


Firstly, Article 37(1)(a) GDPR establishes that the controller shall designate a DPO when the processing is carried out by a public authority or body. This article applies to the municipality and the DPA reiterated the importance of a DPO in order to ensure compliance with said article, especially within public authorities who process large amounts of personal data, some of which is sensitive data. The CNIL found that the municipality did not designate a DPO and therefore failed to comply with Article 37(1)(a) GDPR.
Secondly, Article 31 GDPR states that the controller should cooperate within the DPA in the performance of its tasks. The CNIL noted that the municipality did not respond to the different letters, formal notices and decisions addressed to it by the DPA, thus failing to comply with Article 31 GDPR.
The DPA fined the municipality €5,000 and ordered the controller to appoint a DPO with a penalty of €150 per day of delay at the end of a period of 2 months following the notification of the decision. The CNIL also ordered the municipality to put a message on their official website for 4 days, informing the users of said decision.

CNIL (France) - SAN-2023-018


The DPA found five breaches of the GDPR against the controller:
 1. Regarding the failure to demonstrate consent, the DPA held that Criteo failed to ensure that data subjects gave their consent to the placement of the tracker on their devices in violation of Article 7(1) GDPR. The DPA discovered instances in which the controller’s tracker was used by several of the controller's commercial partners without data subjects’ consent. According to the DPA, obtaining consent from Internet users for the processing of data concerns both Criteo and its commercial partners pursuant to Article 7 GDPR. The DPA insisted on a dual system of responsibility (joint controllership) to ensure an effective right to consent at every stage of the processing.
 2. Concerning the lack of information and transparency, the DPA considered Criteo's privacy policy to be incomplete and unclear about the intended purposes of the data processing, thus violating Articles 12 and 13 GDPR. Some purposes were only vaguely formulated, so that data subjects could not fully understand which personal data were used for which purposes.
 3. As to the failure to comply with the right of access, the DPA established that Criteo did not adequately fulfil data subjects’ right of access in breach of Article 15(1) GDPR. When data subjects requested access to their personal data, Criteo only provided data from a subset of its database tables and did not disclose the information from other relevant tables.
 4. As to the failure to respect the right to withdraw consent and delete data, the DPA found a violation of Articles 7(3) and 17(1) GDPR. When data subjects exercised their right to withdraw consent or requested deletion of their data, Criteo stopped displaying personalised ads but failed to remove the identifier assigned to the data subject or delete the related browsing events.
 5. Lastly, the DPA highlighted the lack of agreement between the joint controllers in breach of Article 26 GDPR. The agreements between Criteo and its commercial partners did not contain specific obligations in relation to the requirements of the GDPR, such as data subjects' rights, data breach notification or impact assessments.

CNIL (France) - SAN-2023-009


The Administrative Court of Berlin dismissed the data subjects' claim. The court agreed with the DPA that it had rightfully declared itself incompetent in the matter.
First, it held that church data protection such as in the case is subject to church supervision and not to state supervision. According to Article 91(2) GDPR, churches are entitled to establish their own independent supervisory authorities. While the wording of the provision does not clearly state whether such authority must be of an official nature or independent, the court interpreted the provision based on its systematic nature. As Article 91(2) GDPR explicitly mentions that the specific supervisory authority must fulfill the conditions of Chapter VI of the GDPR, such reference would be redundant if only state authorities were allowed since such authorities have to fulfill these regulations in any case. This position is also supported by Recital 128 GDPR. Therefore, the court found the independent nature of the church supervisory authorities to be GDPR-compliant.
Second, it clarified that church data protection law must be understood as a comprehensive data protection rule within the meaning of the GDPR. According to Article 91(1) GDPR, churches may apply their own comprehensive rules relating data protection if they are in line with the GDPR. The court saw that compliance was sufficiently given in the data protection laws of the two big Christian churches in Germany.
Third, the court dismissed the argument of the data subjects that the church supervisory is only competent for members of the respective religious community and that for non-members the state authorities are competent. It underlined that the competence of the church supervisory authority is only dependent on the fact that a church institution has acted and that Article 91(1) GDPR does not establish any additional requirements like the data subjects being members of the respective religious community.
In a last step, the court found that the DPA did indeed have no obligation to further investigate the case. Also, its decision had been correct as the court could not find a data protection violation by the controller because the information requested by the questionnaire was necessary for the controller to fulfill their obligations for church taxing purposes.

VG Berlin - 1 K 391/20


The Supreme Court established an infringement of Article 2 of the Italian Worker’s Statute, Article 3 of the Italian Worker’s Statute and Article 4 of the Italian Worker’s Statute and Article 113 of the Italian Privacy Code, Article 114 of the Italian Privacy Code and Article 160 of the Italian Privacy Code in connection with the protection of the confidentiality of the employee, Article 8 ECHR, and based on the set of principles expressed in the Privacy Code and the GDPR, specifically those of data minimisation, proportionality, purpose limitation, transparency and fairness.
The Supreme Court stated that it is necessary to ensure a proper balance between the requirements of the protection of corporate interests and assets related to the freedom of economic initiative and the protection of the dignity and privacy of the worker, depending on the circumstances of the claim.
In this case, the Supreme Court ruled that the monitoring of all the communications on the defendant’s company laptop was unjustified as it was indiscriminate, unbounded and because the applicant did not inform the defendant of the possible monitoring of his company laptop’s communications or the nature and extent of the monitoring.

Corte di Cassazione - 18168


holding_Raad van State - ECLI:NL:RVS:2023:4155

The Council of State held that the District Court had correctly interpreted the scope of Article 2(1)(d) GDPR, as a result they were correct to dismiss the data subject’s claims.
The Council of State held that the processing activities of the FIOD fell under Article 2(1)(d) GDPR, regardless of whether it is under the administration of the Ministry of Finance. The determining factor of whether a ‘competent authority’ falls under the scope of Article 2(1)(d) GDPR is its purpose. In this case, the FIOD is tasked with preventing criminal offences and thus its purpose is to maintain the rule of law. Consequently, their processing activities fell under Article 2(1)(d) GDPR and so, this excluded the application of the GDPR from the FIOD’s processing activities.

Raad van State - ECLI:NL:RVS:2023:4155


The DPA noted that the right to be forgotten (Article 17(1) GDPR) is not applicable when processing is necessary to exercise the right to freedom of expression and information (Article 17(3)(a)). It explained that balance must be found between the freedom of expression of information and the right to protection of personal data.
The DPA agrees with the data subject that the inclusion of an article in name-based search results may constitute a more serious interference with the right to privacy, since it is more accessible and can play a decisive role in the spread of that information. However, the data subject did not address a search engine, but an online archive. The DPA will therefore only address the applicability of Article 17(1)(c) and it's exception laid down in Article 17(3)(a).
The DPA stated that the freedom of expression and journalistic liberty (Article 10 ECHR) are an important pillar in a democratic society. Online archives specifically are of special importance because of their accessibility to the general public. Only very pressing reasons justify an intervention with these fundamental rights. The mere fact that an article has negative connotation is not sufficient to compromise the integrity of online archives. The DPA further noted that the article has societal relevance (for investors and entrepreneurs) contained no factual inaccuracies. In addition, the data subject could reasonably expect media attention, as he initiated contact with them. Lastly, access to the article was limited to subscribers. The DPA thus found the processing in line with the adequate measures of Article 89 GDPR.
The DPA therefore held that the controller lawfully refused the data subject's request for erasure pursuant to Article 17(3)(a).

APD/GBA (Belgium) - 104/2022


First, the Court of Appeal rejected the appeal. It considered that Veilig Thuis processes personal data and carries out a task in the public interest and for reasons of public health, as follows from the Dutch Social Support Act 2015 (Wmo). Therefore, Article 13(3)(b) and Article 17(3)(c) GDPR apply, and the deletion request must be assessed on basis of the Wmo. After the assessment, the Court confirmed District Court’s Decision, since it considered that the substantial interest of Veilig Thuis outweighed the interest of the mother.
Second, the Court of Appeal did not order the mother to pay the cost of proceedings made both in the first instance and in the appeal proceedings. It considered that the right to an effective remedy, pursuant to Article 79 GDPR, entails that “irrespective of the outcome of the substantive side of the appeal, if a difference of opinion regarding the implementation of the [GDPR] is actually at issue.” The Court considered the height of the costs (€ 5,856.00) and found that it was disproportionate to order the mother to pay the costs of proceedings because this would preclude her right to an effective remedy.

GHSHE - 200.297.497 01


The HDPA imposed a fine of € 175,000, concluding that the controller violated Articles 5(1)(a), 6(1), 12, 13, 14, 15(e), 25, 30, 35, 58(1)(e).
First, the HDPA considered it ambiguous which and when legal bases may apply to the processing of data carried out by the 'Hyperion' and 'Centaurus' systems. In particular, the HDPA considered that Article 6(1)(f) GDPR is expressly excluded from provisions of the GDPR discussing processing carried out by public authorities in the exercise of their functions. It also observed that there was no specification of legal basis according to the category of data subjects (workers, vulnerable groups, minors, NGO workers, etc.). With regard to the processing of data, the HDPA found no evidence for the controller's claims that special categories of data were not processed. It considered that the Centaurus system's surveillance could process religious beliefs, racial or ethnic origin, or other special categories of data. It thus found that the controller should have articulated an appropriate legal basis for such processing under Article 9 GDPR.
Second, the HDPA also found a violation of the principle of lawfulness under Article 5(1a) of the GDPR. It found that the information provided to the data subjects was inadequate, as it was clear from the file that the data subjects did not understand Greek or English. Thus, the information did not comply with transparency requirements in violation of Articles 12, 13, and 14 GDPR.
The HDPA also considered the controller's lack of cooperation. In particular, it noted that the controller failed to submit data protection contracts had been concluded with data processors because it claimed they were confidential. As a result, the HDPA found a violation of Articles 15(e) and 58(1)(e) GDPR, which permit supervisory authorities to obtain all information necessary for the performance of its tasks. The vague, incomplete, confusing and contradictory information provided also resulted in a violation of Article 31 GDPR.
Fourth, the HDPA noted the controllers failure to complete the record of activities prior to the start of the programmes. Accordingly, it found a violation of Article 30(1) GDPR.
Fifth, as noted by the controller, the data protection impact assessments were limited and was not carried out prior to the start of each processing operation. The HDPA thus found a violation of Article 35(1), (2) and (3) GDPR. It also found that this failure to carry out a comprehensive and coherent data protection impact assessment by default and prior to processing violated Article 25(1) and (2) concerning data protection by design and default.
Finally, the HDPA noted that the interconnections of the systems with other government data systems were not explained and these potential risks were not assessed. Such failure to comply with the principle of accountability by not providing complete, accurate and clear information or adequately documenting the lawfulness processing constituted a violation of Article 31 GDPR.
The Greek DPA imposed a fine of € 175,000 for this violation and instructed the controller bring processing into compliance within 3 months.

HDPA (Greece) - 13/2024


The court recognised the controller’s interest in lowering its financial risk. If the controller enters into a contract in which it periodically charges the client for its services without a pre-paid system, there is a certain risk of the client not paying for services made in advance. This risk increases when the client is handed a mobile phone at the beginning of the long term contract. Therefore, a risk of being defrauded exists for the controller.
The court further recognises the possible advantage of a standardised notification about the contract conclusion to Schufa. In cases where a (potential) client enters several mobile phone contracts by using their real name without a sensible reason, this can thus be noticed.
However, concerning the standardised transfer of data to Schufa without any specific suspicion the court concludes that in the balancing test necessary under Article 6(1)(f) GDPR the data subject’s interest override the interest of the controller. This is due to the fact that a client typically doesn’t expect this kind of data transfer. Especially, customers can expect being asked for their explicit consent prior to such a transfer. If the controller insists to transmit data to Schufa it can condition the closure of a contract on the data subject’s consent to the data transfer.
Due to this possibility, the automated transfer of data to Schufa goes beyond the strictly necessary criterion referred to in Recital 47.
If the controller does not ask for consent upon closure of the contract it might still transmit data to Schufa if circumstances appear that make it likely that the customer has provided misleading information, especially about their creditworthiness, or if specific risk factors occur.
Therefore, the controller unlawfully submitted the data subject's personal data to Schufa. This constituted an infringement in terms of Article 82(1) GDPR.
However, the court held that there is no damage and rejected the respective claim. The burden of proof lies with the data subject even though there is no specific threshold of severity that needs to be met. The data subject failed to prove a non-material damage.
On the one hand, the data subject did not confirm in the oral hearing the previously claimed constant fear of uncomfortable further inquiries, a general uncomfortable feeling, and a feeling of powerlessness. The court therefore considers the previous written statement a text module.
On the other hand, the court believed the data subject that he was angry about the data transfer. This, however, did not amount to a non-material damage.
The court does not believe the claim made by the data subject that he has trouble sleeping at night due to the data transfer.

LG Stuttgart - 27 O 60/24


holding_Tietosuojavaltuutetun toimisto (Finland) - 7587/163/20

The DPA held that the controller violated Article 17(1)(a) GDPR by not complying with the data subject's right to have their data deleted. Instead, the controller should have deleted the data to the extent that it was no longer necessary to store it. Additionally, the controller violated Articles 12(3) and 12(4) GDPR by providing the data subject neither with information on the measures taken in response to the request nor with the reasons for not taking any actions. As a result, the DPA reprimanded the controller.


holding_Datatilsynet (Norway) - 20/02178

The DPA (Datatilsynet) held that the company had breached Article 6(1)(f) GDPR for lack of legal basis, Article 21 for lack of considering an objection, Article 13 for lack of information and Article 24 for lack of internal controls concerning the company's access to employees' inboxes (emails). The DPA also found that the company had breached the fundamental principles as per the GDPR, specifically Article 5(1)(a) and 5(2).
For this, they were fined NOK 400 000 (€38,800) and required to update their internal routines and submit a written confirmation of the latter, including documentation, to the DPA within four weeks (unless they appeal the decision).

Datatilsynet (Norway) - 20/02178


holding_Tietosuojavaltuutetun toimisto (Finland) - 9707/152/19

The DPA first stated that the data subject's access request was submitted correctly and that a third party may make a request under Article 15 GDPR on behalf of the data subject.
It then proceeded by holding that the data controller did not comply with Article 12(3) GDPR and Article 12(4) GDPR, to ensure the data subject's right of access without undue delay.
The DPA stated that Article 12(3) GDPR provides for time limits within which the controller must inform the data subject of the action taken to respond to an access request. Considering that the data subject submitted a request under Article 15 GDPR several times in 2017, 2018 and 2019, that the controller did not refuse to implement the right of the petitioner, nor did it indicate that it needed additional time to implement the right and that it implemented the data subject's right in April 2021, the controller breached Article 12(3) GDPR by failing to implement the right of the data subject under Article 15 GDPR within the time limit.
The DPA also addressed Article 12(4) GDPR, which states that if the controller does not intend to exercise the data subject's right, it must inform the data subject without undue delay and at the latest within one month of receipt of the request. In this regard, the controller also breached Article 12(4) GDPR since it did not inform the data subject for almost three years of the reasons why the right under Article 15 GDPR could not be implemented within the time-limit.
The DPA, thus, fined the data controller €1,600 on the basis of Article 83 GDPR.


On the controller's violation of Article 15 GDPR
The court found that the controller did not comply with its legal obligation to the data subject under Article 15(1) GDPR between 22 January 2020 and 5 April 2020 despite two explicit requests from the DPA. The court found that the negative information provided by the controller to the data subject on 5 April 2024 was clearly inadequate. As the controller was still processing the data subject’s email address at that time, the controller was obliged under Article 15(1)(c) GDPR to inform the data subject of the recipients or categories of recipients the email address had been disclosed or was still being disclosed. The controller’s initial failure to provide information to the data subject and its subsequent failure to provide sufficient information therefore each constituted a violation of Article 15(1) GDPR.
On the DPA's discretion on taking corrective measures
The court held that if the DPA finds a violation of the GDPR, it is obliged to react in an appropriate manner in order to remedy the violation. This is why they have corrective powers under Article 58(2) GDPR. Although the DPA has the discretion to choose whether to exercise their corrective powers, the court held that the DPA may need to adopt a corrective measure if the violation interferes so severely with the rights of the data subject, that taking corrective measures is the only lawful course of action for the DPA, or if only taking these measures will lead to the creation of lawful conditions.
Although the DPA requested the controller twice to provide information, the court found that this was not a formal corrective measure under Article 58(2)(c) GDPR. The requests lacked a binding nature and did not use the term “order”. Therefore, the court found that the DPA did not exercise any corrective powers under Article 58(2) GDPR at the time of the decision.
The court also found that the DPA closed the case by sending a final notification to the data subject without ensuring that the data subject’s request was or would be remedied. The court held that the DPA concluded its investigation prematurely and failed to fulfil its duty to process the data subject’s complaint with all due care and to remedy the violation.
Moreover, the court held that without information about the recipients of the data subject’s personal data, the data subject could not make an informed decision as to whether they wanted to exercise their rights under the GDPR, in particular the right of access and the right to rectification, against these recipients. The court held that this is precisely the essential meaning and purpose of the right of access. The court held that this showed the necessity of taking a formal corrective measure, especially as the data subject did not have the opportunity so far to exercise their rights under the GDPR towards the recipients and will no longer have it in view of the deletion.
Therefore, the court held that the DPA did not fulfil its obligation to take corrective measures, even though there were clear violations of Article 15(1) GDPR by the controller. The court found that issuing a reprimand under Article 58(2)(b) GDPR or imposing an administrative fine under Article 58(2)(i) GDPR would be considered most appropriate. Although the court held that it was up to the DPA’s discretion to choose which corrective measure was most appropriate, it stated that the DPA could only choose between these two measures.
Conclusion
Thus, the court ordered the DPA to take a corrective measure against the controller under Article 58(2) GDPR, revoking the DPA’s final notification of 24 March 2020.

VG Ansbach - AN 14 K 20.00941


holding_ANSPDCP (Romania) - Fine against a Property Owners Association

The DPA fined the Property Owners Association for failing to provide the requested information, in violation of Articles 83(5)(e) and 58(1)(a) and (e), and asked for the relevant information to be sent within five working days following the communication of the decision.


The ICO starts its ruling by stating that complying with the present request would not be a burden for the DfE, and moved on to consider if the requested information constituted personal data as defined by the Data Protection Act 2018 (‘DPA’).
By referring to section 3(2) of the DPA, the ICO stated that the withheld information in the audio record falls within the definition of ‘personal data’, it relates to and identifies the data subjects concerned. Audio recording would reveal the identities of individuals involved and would capture information related to religious views due to the hearing relating to alleged extremism. Moreover, the requested data does include special category data. Here, the commissioner refers to article 9 of the GDPR. ‘There will be clear references to the religious beliefs of some of the individuals’ and it would be difficult to separate out the special category data without rendering some of the remaining information meaningless, particularly as the request concerns audio recordings. As none of the conditions required by article 9 of GDPR for processing special category data are satisfied there is no legal basis for its disclosure. Processing any special category data in the recordings would therefore breach principle of DP and so this information is exempt under section 40(2) of the FOIA.
The ICO has gone on to consider if there are conditions defined by an article 6 of GDPR (in this case art.6 (1)(f)) to allow for the lawful processing of the remaining personal data in the audio recordings that is not special category data. The ICO considered three-part test: Legitimate interest Necessity and Balancing tests. While the ICO acknowledges that the disclosure of the requested information is necessary to meet the legitimate interests identified by the complainant, it determined that that legitimate interest is insufficient to outweigh the data subjects’ fundamental rights and freedoms.

ICO - FS50848833


holding_Garante per la protezione dei dati personali (Italy) - 9815665

Firstly, the Italian DPA held that the dissemination of personal data (such as publications on the Internet) by public entities is permitted, when provided for by law. Secondly, the matriculation number is considered an identification number, as it allows third parties to trace the identity of the data subject, and not authorised personnel only. Consequently, the DPA held that a matriculation number on online publications falls under the definition of "personal data" in Article 4(1) GDPR.
The DPA reminded the controller that, as defined in Recital 26 GDPR, pseudonymisation is a mere technical measure and still makes it possible to trace the identity of a data subject in an indirect way or through use of additional information. With regards to the press release, the DPA held that there was no derogation from the principles on the protection of personal data. The DPA also reiterated that the principles of lawfulness and data minimisation apply to publication on online public notice boards, as clarified in the "Guidelines on the processing of personal data, also contained in administrative acts and documents, carried out for the purposes of publicity and transparency on the web by public entities and other obligated entities".
The DPA found a violation of Article 2-ter of the Code on the Protection of Personal Data, as the provisions cited by the controller did not meet the requirement of a valid legal basis. Furthermore, the DPA found a breach of Articles 5(1)(a)(c) and 6 GDPR because the online dissemination of the data subject's personal data lacked an appropriate legal basis. The DPA confirmed that the controller did not meet the requirement of lawful processing of personal data.
In conclusion, the DPA imposed a €3,000 fine on the controller for the violation of Articles 5(1)(a)(c) and 6 GDPR.


The AEPD decided to accept the allegations of the controller and considered that the controller had not violated Article 45 GDPR nor any of the subsequent Articles from Chapter V of the GDPR. The AEPD took into account that the controller had stopped using Google Analytics short after the Schrems II ruling and that it had never used the obtained information to identify specific users.
Therefore, the DPA concluded that, at the time of issuing the decision, the controller was not in breach of the GDPR under the competential scope of the AEPD.

AEPD (Spain) - E/10529/2021


First, the Supreme Administrative Court ruled that the Party implemented sufficient technical and organisation measures designed to implement data protection principles, (Article 25(1) and Article 25(2) GDPR), ensure the security of processing against risks and adequately supervise all users (Article 32(1) and Article 32(4) GDPR). All measures included the activities of the Secretariats as well, according to their privacy and cybersecurity policy. The Supreme Administrative Court also pointed out that the assessment of the appropriateness of the measures is based upon their capacity to mitigate, not eliminate the risks. Additionally, according to the Party’s privacy policy, their official internal means of communication is done through the user’s official email accounts and any communication using other digital media or online applications are personal communications of those who use them which the Party cannot and in any case has no legitimacy to control.
Second, the Supreme Administrative Court held that it was not justified beyond reasonable doubt that the Minister processed personal data for statistical purposes in relation to his official duties as an executive of the Party or was in any case instructed to do so. Therefore, the Party was not the controller of this processing.

Consequently, the Supreme Administrative Court annulled the contested decision in so far as it imposes a fine of €30,000 to the Party for the infringement of Article 25(2) and Article 32 GDPR and the related obligation to remedy the deficiencies found in the measures for the protection of personal data. It also annulled the contested decision for the part it imposed a €10,000 fine for the infringement of Article 5(1)(a) and Article 6(1) GDPR for processing of personal data relating to statistical analysis as inadequately reasoned.

ΣτΕ - 658/2025


holding_Datatilsynet (Denmark) - 2020-432-0047

First, the DPA found that the Næstved Municipality violated the principle of lawfulness, fairness, and transparency, Article 5(1)(a) GDPR. It emphasised that "the texts on the website led visitors to believe that the municipality processed personal data for marketing purposes, even if this was not the case".
Second, the DPA found that Næstved Municipality's processing of website visitors' personal data for statistical purposes took place in the scope of the municipality's public authority, and thus within the framework of Article 6(1)(e) GDPR. The DPA considered that the processing of personal data for statistics was related directly to its duty to guide and assist citizens, since the website's efficiency and ease were optimised through the statistics. In this regard, the DPA found it important that these statistics were provided by a third party who anonymised the statistics irreversibly. Lastly, the DPA considered that the sub-processing that was carried out by AWS, did not lead to an international data transfer because this was laid down in an agreement and "publicly guaranteed".

Datatilsynet (Denmark) - 2020-432-0047


First of all, the DPA recalls that:
- a video surveillance system falls under the provisions of the GDPR when the equipment used makes it possible to collect and store personal data;
- such processing of personal data must at all times be consistent with the principles of data protection found in Article 5 of the GDPR, and fulfill one of the lawful bases for processing as set out in Article 6 of the GDPR.

Recording and use of images from the surveillance cameras
As the complainants had not given their consent to the processing of their personal data, no other condition for the lawfulness of processing was possible in this context, except the "legitimate interests" under Article 6(1)(f) of the GDPR.
The Belgian DPA therefore conducts a "legitimate interests assessment" by following the three-part test:

Purpose test
Is there a legitimate interest behind the processing?
The DPA found that the defendants had a legitimate interest in placing the surveillance cameras in order to ensure the protection of their property and fight burglary, vandalism or theft. The damages caused to the goods belonging to the defendants in the period prior to the installation of the surveillance cameras show that the legitimate interest on the part of the defendants was moreover real and currently existing (and therefore not a purely hypothetical).

Necessity test
Is the processing necessary?
The DPA found that some surveillance cameras were set up in a way that cannot be regarded as necessary and in accordance with the data minimisation principle. The extensive and constant filming of the public highway cannot indeed be regarded as 'relevant', let alone 'necessary', for the defendants to safeguard their legitimate interests.

Balancing test
Is the legitimate interest overridden by the fundamental rights and freedoms of the data subject?
The surveillance cameras also did not withstand the weighting test, considering the seriousness of the infringement of the rights and freedoms of the complainants.
To come to this conclusion, the DPA pointed out that:
- Continuous monitoring of the public highway, i.e. 24 hours a day, 7 days a week, constitutes a serious breach of the fundamental rights of the complainants. This also applies to the continuous monitoring of private domains of the complainants.
- This is all the more true when other less intrusive processing proves possible, by adjusting the position of the surveillance cameras.
- The rights of many other people were violated, such as the complainants’ children, or drivers of vehicles passing by on public roads in front of the defendants’ homes.
- It is beyond the objective expectations of the data subjects concerned by the surveillance cameras.
- The surveillance cameras were not installed in accordance with the provisions on the installation of security cameras under national law (law of 21 March 2007 regulating the positioning and use of video surveillance cameras).
The DPA Litigation Chamber therefore upheld that the images made by the surveillance cameras were not processed in a lawful way under Article 6(1)(f) GDPR. Those unlawful processing operations were, by their very nature, sufficient in themselves to show that insufficient measures have been taken by the defendants to respect the data protection principles of the GDPR, and therefore also constitute an infringement of Article 25(1) of the GDPR.

Transmission of the images to third parties
According to the DPA, the transmission of the images made by the surveillance cameras in the context of the environmental law litigation also constituted a breach of article 6.1(f) of the GDPR, as the images were unlawfully made in the first place, thus constituting unlawful processing impacting the further processing.

Taking of photographs in the event of an (alleged) offence
On the other hand, the making of a picture and the further processing thereof, was judged lawful under Article 6(1)(f) of the GDPR, as the processing was necessary for the defendants to safeguard a legitimate interests (i.e. to collect evidence of an infringement and bring this to the attention of the competent authorities), and did not appear to be so intrusive for the fundamental rights of the data subjects to outweigh the legitimate interests of the defendants. The taking of the photograph therefore withstood the assessment test.
The DPA Litigation Chamber therefore imposed a fine of € 1500 for the infringements of Article 6 of the GDPR. In addition, it issued a reprimand to the defendants for not respecting article 25.1 of the GDPR while placing their video surveillance system.

APD/GBA (Belgium) - 74/2020


The AEPD held that the federation had violated Article 37 GDPR for not having appointed a DPO. They also held that the federation had violated Article 13 for not having provided in their privacy policy the mandatory information provided by the GDPR.
For both these violations, the AEPD issued a warning.
However, the AEPD held that there was no violation regarding consent due to the fact that it is a public federation that, according to the law, processes the data that the sports clubs collect, and that therefore the obligations regarding consent lay on such clubs.

AEPD (Spain) - PS/00285/2020


The DPA held that the legal basis for the processing of personal data of members of the council of parents and employees of a public institution may be the Access to Public Information Act. Therefore (taking into account exceptions from free access) the publication of minutes of parents' council, which contain only public information, is permissible.
If the minutes of the meetings of the council of the institution or of the parents' council contain protected personal data or other data, the disclosure of which is not admissible (exceptions are specified in paragraphs 5a and 1 of the ZDIJZ), these parts of the minutes must be covered before publication.
Data related to the use of public funds or to the performance of a public function or employment relationship of a civil servant pursuant to the third paragraph of Article 6 of the ZDIJZ do not belong to protected personal data.

IP - 07120-1/2021/181


The Supreme Court stated that the first two claims of the appellant had to be considered together as they were interrelated. It noted that the previous court had ruled that data processing by an algorithmic system could be considered transparent when the data subjects knew how the algorithm worked.
Regardless of the explanation, the Supreme Court focused on the lawfulness of the processing and found that it is necessary for the data processing carried out by an algorithm to be subject to consent. This means that the data subjects had to give their consent freely for a specific data processing and that information on the data processing had to be provided on the basis of Article 13 of the (now updated) Italian Privacy Code.
Therefore, because the data subjects were able to recognize the algorithm and the data processing, which was described to them by the appellant in an unambiguous and specific way, the Supreme Court repealed the judgment by the Court of Rome. Thus, it also found that it was not necessary to consider the third reason brought by the appellant.

Cass.Civ. (Italy) - 28358


holding_Commissioner (Cyprus) - Decision of 27 November 2023

After further investigations, the DPC concluded that the controller had failed to implement appropriate technical and security measures, thereby violating Article 32 GDPR and the principle of accountability under Article 5(2) GDPR.
In light of Article 83 GDPR and taking all the above into account and also the fact that the controller is part of the wider public sector, the DPC considered it appropriate to impose a fine in the amount of €45,000 on the controller.


The DPA found that by requiring to the data subject to submit his request in a written, signed and dated form, the controller imposed excessive conditions for the exercise of the data subjects' rights, in breach of Articles 12. Also, the DPA found that the data controller violated Article 13 GDPR since the information notice did not provide complete, correct, accurate, and updated information.
The DPA imposed a fine of RON 9871 (approximately €2000) for these violations. In accordance with Article 58(2)(d) GDPR, the DPA also imposed corrective measures.
First, the DPA ordered the data controller to facilitate the exercise of data subjects' rights by removing the excessive condition of requesting the data subjects to submit a "written, dated and signed" request, when exercising their rights.
Second, it ordered the controller to take appropriate measures in order to comply with the GDPR provisions, so that, in the future, the personal data used for direct marketing will only be processed based on the data subject's consent, to implement related internal procedures in this respect and to amend the relevant sections on the website to reflect such flow.
Third, the DPA ordered the data controller to amend its information notice, in order to provide the data subjects complete, correct, accurate and updated information in respect to the processing of their data.

ANSPDCP (Romania) - 13.03.2023


holding_Datatilsynet (Norway) - 21/00872

The DPA held that the controller had violated Article 6(1) GDPR and Article 6(3) GDPR, thus also Article 5(1)(a) GDPR, for lack of legal basis for publishing CVs online. Further, as the controller is subject to a national regulation stipulating that the information in the CVs is confidential, the DPA held that they had violated Article 5(1)(f) GDPR.
For these violations, the DPA fined NAV (the controller) €486,700 (NOK 5,000,000).

Datatilsynet (Norway) - 21/00872


holding_AZOP (Croatia) - Decision 05-10-2023

DPA has concluded: 1. The controller did not take appropriate technical measures to protect the processing of the personal data contained in the storage systems, which is contrary to Article 32 paragraph 1 point b) and paragraph 2 of the GDPR; 2. The controller processed the personal data of respondents who are not in a debtor-creditor relationship in their database without the existence of a legal basis from Article 6, paragraph 1 of the GDPR; 3. The controller processed special category (health data) in its database without the existence of a legal basis from Article 6, paragraph 1, and in connection with this, Article 9, paragraph 2 of the GDPR; 4. The data controller did not inform the data subjects in a transparent and prescribed manner about the processing of their health data in the privacy policies, which is contrary to Article 12 paragraph 1 of the GDPR and, in this regard, to Article 13 paragraphs 1 and 2; 5. For the recording of telephone conversations with data subjects in the period from May 25, 2018 to January 16, 2019, the data controller did not have an established legal basis from Article 6, paragraph 1 of the GDPR, and in this connection there was also a violation of Article 5, paragraph 2; 6. The controller did not inform the data subjects in an understandable and clear way about the processing of personal data in the form of recording telephone conversations, and thus acted contrary to Article 12, paragraph 1 of the GDPR.
Regarding the point 1 it was determined that the data controller did not implement sufficient TOM that could timely recognize in the processing system (the main database in which personal data of about 370,000 data subjects are processed) activities that deviate from the usual ones (e.g. increased number of retrievals data in the database, transfer of data outside the system, compromise of user access, etc.). Precisely because of deficiencies in the security system, the insecure processing of personal data on a large scale number of respondents, and the company lost control over the movement of data and could not explain the causes or methods of data exfiltration.
It was established that EOS Matrix also processed data of data subjects who are not debtors nor legal representative (most often telephone number and first and last name and residential address).
Regarding the processing of health data, it was established that EOS Matrix, after communication with respondents, actively recorded comments related to the debtor's state of health in the internal database. Particularly worrying is the situation where the health condition of the subjects was monitored down to the details of individual diagnoses, which included terminal illnesses, and which almost exposes privacy to the maximum level to persons who are authorized to access the application (database) used by EOS Matrix employees. The arguments of EOS Matrix was that data subject had provided such information. DPA stressed that this does not mean that the same can be actively entered into the database. As a result of the above, it cannot be considered that there is an exception for the processing of health data from Article 9, paragraph 2, point e) of the GDPR. Furthermore, the reference to the legal basis regarding the execution of the contract, as well as the legitimate interest (which was referred to by the company in question) cannot be a legal basis either, since the processing of health data is not necessary to achieve the intended purpose. If the goal is better collection towards the debtor and avoidance of communication due to the health condition, then the same purpose could be achieved by recording a general comment about the need to avoid contact for a certain period of time due to the personal condition of the debtor, without highlighting precise health data.
Also, and related to the processing of health data, it was determined that EOS Matrix defined that it does not and will not process health data. This method resulted in non-transparent processing of data.
Also, in the period from May 25, 2018 to January 16, 2019, the data of 49,850 data subjects were processed, i.e. telephone conversations were recorded without determining the legal basis. The test of legitimate interest was conducted on January 16, 2019.
Furthermore, regarding the recording of telephone conversations, it was established that EOS Matrix since 2014 has been using the functionality of recording telephone conversations with debtors, but indicating that the conversation "may" be recorded.
It has not been determined how exactly 181,641 personal data were exfiltrated, and considering that in this specific case it is a question of the possible commission of the criminal offense of unauthorized use of personal data and criminal offenses against computer systems, programs and data, and also under the jurisdiction of the Ministry of the Interior. The DPA actively cooperates with the Zagreb Police Department and the Zagreb Municipal State Attorney's Office, which conduct investigative activities.
As a result of the above, it was undoubtedly established that the personal data submitted to the DPA via USB stick were excluded from the database of EOS Matrix!

AZOP (Croatia) - Decision 05-10-2023