The Belgian DPA stressed that the controller, in its capacity, must comply with a request made by a data subject pursuant to Articles 15 to 22 GDPR, in compliance with the conditions set out in Article 12 GDPR, and to provide the data subject with information on the measures taken, as soon as possible and in any event within one month of receipt of the request.
Furthermore, the DPA noted that pursuant to Article 5(2) GDPR and Article 24 GDPR, the controller should be able to demonstrate its compliance with the data protection principles.
In light of the facts of the case, considering that the complainant clearly exercised their right to access under Article 15 GDPR, that on 14 June 2023, the data subject complained to have not received any answer and that the controller only replied on 7 August 2023, the controller exceeded the deadline established in Article 12(3) and (4) GDPR.
Therefore, the Belgian DPA found the controller to have breached Article 15 GDPR in conjunction with Article 12(3) and (4) GDPR, and it mandated the controller to comply with the data subject's access request within 30 days from the notification of the decision. Additionally, the controller was ordered to inform the DPA about the actions taken in response to the decision within the same timeframe.

APD/GBA (Belgium) - 11/2024


The AEPD concluded that, even if it was justified by the nature of the proceeding and related procedural issues, and by the Transparency Act, to publish data related to the grants, it should be done following the data protection principles. Therefore, the minimization principle applied, so data such as the personal ID should not be published, as it does not add any necessary information to the grant procedure.
Additionally, the data should not have been accessible to all the workers and parties with access to the platform, but only to the ones that were involved and needed to access the data.
The DPA took into account the will of the Council to change their bylaw if necessary, and the lack of bad faith.
Therefore, the AEPD concluded that the Council had violated Article 5(1)(f) for breaching the confidentiality principle, and issued a warning against it.

AEPD (Spain) - PS/00347/2020


Based on the facts presented, the AEPD held that the actions of the defendant infringed the following principles of processing pf personal data:
  * Article 5(1)(d) GDPR – Accuracy principle, as it was proven that in Vodafone’s systems, the products contracted by the complainant were in the name of a third party.
  * Article 5(1)(f) GDPR – Confidentiality principle, as Vodafone responded to the complaint with the response that was intended for another individual not for the complainant, meaning that Vodafone does not have appropriate security measures in place to protect the confidentiality personal data.
The AEPD held that this offense is considered ‘grave’ in accordance with Article 72(1)(a) LOPDGDD and falls under the criteria defined in article 83(5)(a) GDPR where a company can be fined up to €2 million, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.
The AEPD imposed a fine of €60000 for the violating Article 5(1)(d) GDPR and €30000 for violating Article 5(1)(f) GDPR.
In imposing the fine, the AEPD factored in that the infringement was considered negligent not intentional but significant and that the records affected corresponded to complainant ’s basic personal data such as name and address.
Vodafone España, S.A.U. acknowledged its responsibility in accordance with Article 85 (1) LPACAP which resulted in a 20% reduction of the penalty. Furthermore, it carried out the voluntary payment of the proposed fine before the resolution, so it benefited from an additional reduction of 20% (Article 85 (2) LPACAP). Therefore, Vodafone España, S.A.U benefited by the two 20% reductions and paid € 54000 instead of the initial € 90000.

AEPD (Spain) - PS/00415/2020


holding_ANSPDCP (Romania) - Warning issued to Bucharest Municipality (District 4)

The ANSPDCP found that the staff of the General Directorate of 4th District Local Police were hierarchically obliged to wear audio-video surveillance devices ("BADGE" type) during their working hours, without any legal provisions in force to govern the use of portable audio-video surveillance systems in the activity of local police officers. Therefore, the personal data (image and voice) were processed without a legal basis by using audio-video surveillance devices ("BADGE" type). The Romanian DPA issued the warning because the controller processed the personal data (image, voice) without fulfilling the legality conditions provided in Article 6(1) GDPR. In addition, the ANSPDCP applied a corrective measure through a remediation plan according to which the controller must ensure the compliance of the processing operations, performed by using the "BADGE" surveillance portable device, with the provisions of Article 5 and Article 6 GDPR.


The DPA considered that either Article 6(1)(c) - the processing is necessary for complying with a legal obligation - or Article 6(1)(e) - the processing is necessary for the performance of a task carried out in the public interest - could apply to this case. However, it ultimately concluded that neither could apply, because the processing was the result of a mistake. Furthermore, the DPA concluded that the processing was also unlawful because it failed to meet the requirements of Article 5(1)(e) - data subjects shall not be identifiable for longer than is necessary - and Article 5(1)(f) - data shall processed so as to ensure appropriate security for it. It stated that it was not going to answer the question of whether or not the Association had a responsibility to report the breach, despite both parties to the complaint agreeing that a breach had taken place.

Persónuvernd - 2020010677


The HDPA found that the politician acts as data controller for this communication and that he did not obtain the recipient's consent. However, the politician provided and satisfied the rights of access and objection.
The HDPA upheld the complaint and imposed the proportionate fine of EUR 1000.

HDPA (Greece) - 37/2020


The BVwG did not (yet) take a decision on the merit of the case but stalled the procedure it filed a request for preliminary ruling on the question the interpretation of Article 15(3) GDPR in August 2021. See decision BVwG - W211 2222613-2/12E.
Once the CJEU has passed its judgment on the matter, the BVwG will resume the case.

BVwG - W252 2239742-1/11Z


The Administrative Court of Cottbus (VG Cottbus) held that the installation of a water meter with a radio module may already be considered data processing (Article 4(2) GDPR). Although the installation does not yet directly process data in the sense of storage, a necessary preparation, which is undoubtedly only aimed at enabling data processing, is also subject to Article 4(2) GDPR.
In the present case, the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller Article 6(1)(e) GDPR. The municipal water supplier's by-laws explicitly state that it collects data on consumption via measuring equipment and that this is done using a water meter and its readout.
Article 12(5) GDPR in conjunction with Article 18(1)(d) GDPR does not prevent the charging of an administrative fee for the deactivation of the radio module of the water meter if the interests of the controller outweigh those of the data subject and the customer only objects in principle to the collection of data and does not invoke any grounds under Article Article 21(1) GDPR arising from their particular situation. The mere concern for one's own data protection and fear of "forced digitisation" are only general or principled interests, but not particular or individual, so that Article 21(1) GDPR does not apply.

VG Cottbus - VG 4 K 1191/19


holding_Persónuvernd (Iceland) - Case no. 2021020294

The DPA rejected the data subject's complaint.
First, it assessed based on what legal basis the school administer had processed the personal data. It noted that Article 6(1)(c) GDPR allows the processing of personal data if it is necessary to fulfil a legal obligation. Based on a national law, it was the role of the school administrator to manage the day-to-day operation and work of the school. Moreover, the DPA considered that to receive e-mails and messages from their subordinates, including regarding their well-being at work and communication with other staff, regardless of who initiates such disclosure, falls within the work cycle of a school administrator. Therefore, the DPA held that the controller had processed the personal data on a valid legal basis.
Second, the DPA considered whether the controller upheld the Article 5(1) GDPR principles "fairness and transparency" and whether the data subject was adequately informed pursuant to Article 14 GDPR. The DPA argued that if processing of personal data was based on the nature of the working relationship between the supervisor and subordinates, as outlined above, the personal data would not be considered to be obtained from a third party. However, Article 14 GDPR would only apply if personal data had been collected from a third party. Consequently, the information obligations of controllers pursuant to Article 14 GDPR would not have to be upheld in order to meet Article 5(1) GDPR's requirements for fairness and transparency.
Lastly, the DPA held that the controller was also under a legal obligation to share the concerned personal data with the Minister of Education and Culture, as the school falls under the supervision of the Minister. Consequently, there was a legal obligation to hand over documents after a relevant request. Here as well, the personal data was processed lawfully pursuant to Article 6(1)(c) GDPR.


First, the DPA established that the manual records formed part of a ‘filing system’ as defined by Article 4(6) UK GDPR.
Second, the DPA held that Birthlink violated Article 5(1)(f) UK GDPR, the principle of integrity and confidentiality and Article 32(1) and Article 32(2) UK GDPR, security of processing, for failing to ensure appropriate security and organisational measures to the processing of the personal data. In particular, it failed to implement a data retention policy, a data destruction policy, any sufficient internal approval process for the destruction of the files and any data protection training for members of staff.
Third, the DPA found that it violated the principle of accountability, pursuant to Article 5(2) UK GDPR. In the absence of appropriate policies, procedures and staff training, Birthlink was not able to demonstrate compliance with its obligations under Article 5(1)(f) UK GDPR.
Third, it held that Birthlink breached Article 33 UK GDPR by failing to notify the DPA within 72 hours of the personal data breach.
Lastly, the DPA imposed a fine of GBP 18,000 (€20,707). For the calculation of the fine it took into account the irreplaceable nature and sensitivity of the destroyed data, the seriousness of the infringement and high risk to affected individuals' rights.

ICO (UK) - Birthlink


holding_CNPD (Portugal) - Deliberação 2022/140

The DPA found that the controller had violated the integrity and confidentiality principle from Article 5(1)(f) GDPR by not defining organisational measures for safeguarding information, policies or guidelines for the secure management of information. Nor did the controller determine a procedure, together with the Eastern European Immigrants' Association, that would regulate access and handling of the processed data. The exception regarding the non-existence of these policies and/or guidelines was an e-mail from the IT Division on the security of computer access passwords, email and internet. Article 5(1)(f) GDPR was also breached by allowing people outside the controller's services to access computer equipment used for processing personal data without a specific access profile, as well as by granting them access to information of refugees supported through the Helpline. The principle was further breached by the controller for its use of Excel files for the management and storage of information relating to a group of vulnerable parties (refugees). These Excel files did not have any audit records. Therefore, these files did not allow anyone to know who accessed them, when the files were accessed and what operations were carried out. The fact that the excel files were password protected did not mitigate this fact.
The DPA also found that the data storage periods had not been defined, nor were the criteria for establishing storage periods. This constituted a violation of the storage limitation principle ((Article 5(1)(e) GDPR)). Also, no information was provided to the data subjects about the identity of the controller, the purposes of the processing, the recipients or categories of recipients, the rights of the data subjects, or the right to lodge a complaint with a supervisory authority. The DPA noted that, at least, the entities that were involved in this procedure were known to the controller, so they could have been mentioned to the data subjects, together with their data subject rights. Lastly, the DPA highlighted that the only reference made to data protection legislation was obsolete. Hence, the DPA concluded that the controller also violated Article 13 GDPR. The DPA also found that the controller had not appointed a DPO which resulted in a violation of Article 37 GDPR. A DPO was only appointed after the start of this procedure, on 22 September 2022.
The DPA also found that no data protection impact assessment (DPIA) had been carried out in order to analyse the processing of personal data in this context, which was required when processing data of vulnerable data subjects, according to the EDPB Guidelines on Data Protection Impact Assessment (p. 12). However, the DPA did not specify that Article 25 GDPR had been breached.
The DPA acknowledged that this was an emergency situation and that this could mitigate the degree of gravity of the infringement with regard to some elements, such as parts of the information obligation (Articles 13(1) and 13(2) GDPR), as well as the storage limitation obligations. However, the DPA also remarked that some other violations constituted proof of structural incompliance and were therefore of more gravity. Also, according to the DPA, the Helpline project had been discussed within the Setúbal Local Council for Social Action (CLASS), and therefore important matters such as the fundamental right to privacy and data protection from vulnerable people such as refugees should have also been discussed, despite the urgency.
For the above violations, the CNPD imposed a fine of €120,000 for the violation of Article 5(1)(f) GDPR and a fine of €100,000 for the violation of Article 37 GDPR. The DPA issued a reprimand for the violations of Article 5(1)(e) GDPR and Article 13 GDPR. This resulted in a total fine of €220,000. The two fines were nonetheless accumulated together, following Portuguese legal principles, which resulted in a fine of €170.000.

CNPD (Portugal) - Deliberação 2022/140


The Spanish data protection authority ('AEPD') concluded that Xfera Móviles carried out the processing of the claimant's personal data without his/her consent, in violation of Article 6 of the GDPR.

AEPD (Spain) - PS/00415/2019


holding_Datatilsynet (Norway) - 20/03293 (decision 2)

The DPA held that controller must sort out and document the responsibilities related to their role as controller, as well as review and update the internal control system for managing privacy and personal data protection in the organisation.
The controller must comply with the order within six months. If they fail to do so (with the deadline set to 9 April 2023), the DPA will consider a daily penalty until the order has been complied with in full.


holding_Datatilsynet (Denmark) - 2020-431-0061 (Helsingor decision no. 2)

The Danish DPA held that the Municipality violated Articles 5(2), 24, 35(1) and 44 GDPR.
Failure to be able to demonstrate that data is processed lawfully, fairly and in a transparent manner
The DPA found that the Municipality of Helsingor (i) in its risk assessment did not include the risk scenarios that may arise as a result of the data processor design and the system choices, (ii) did not carry out sufficient testing of the scope and operation of the selected hardware and software used, and (iii) was not able to document how the municipality controlled Google's access to the personal data. Consequently, the DPA held that the Municipality did not demonstrate that personal data were processed lawfully, fairly and in a transparent manner pursuant to Article 5(2) GDPR in conjunction with Article 5(1)(a) GDPR.
Failure to demonstrate that processing is performed in accordance with the GDPR
The DPA noted that the Municipality expressed doubts as to whether Google would always comply with its contractual obligation to not use data collected in core services for marketing purposes. The DPA pointed out that under Article 28(1) GDPR, the controller may only use such processors that provide sufficient guarantees for implementing appropriate technical and organisational measures to comply with the GDPR. Hence, given the Municipality’s own assessment of the risk entailed in engaging with Google as a processor, the Municipality was held to violate Article 24 GDPR in conjunction with Article 28(1) GDPR. The DPA placed particular emphasis on the Municipality’s failure to put in place technical or organisational measures to mitigate the high risk posed to the data subjects.
Failure to carry out a data protection impact assessment
The DPA stated that any processing that is likely to result in a high risk to the rights and freedoms of natural persons, even if the probability of that risk realizing is low, triggers the obligation to carry out a data protection impact assessment under Article 35(1) GDPR. Since the Municipality itself admitted that it could not be excluded that the processor would act in violation of their agreement, the DPA held that by not conducting an impact assessment, the Municipality violated Article 35(1) GDPR.
Data transfers to third countries
First, the DPA did not take a position on the extent to which the Municipality transferred personal data to other third countries than the United States. Nevertheless, it recommended that the Municipality ensures that any such transfers are in accordance with the GDPR.
Second, the DPA considered the transfers to the United States. The Municipality, in its capacity as the controller, instructed its processor (Google Ireland) to transfer personal data to a sub-processor (Google LLC) in the United States. The transfer was based on standard data protection clauses pursuant to Article 46(2)(c) GDPR. In C-311/18, Schrems II, the CJEU clarified that the use of SCCs does not always constitute "an adequate means of ensuring the effective protection of the personal data transferred to the third country in question in practice. That is the case, in particular, where the law of that third country allows its public authorities to interfere with the rights of data subjects in relation to that data." The DPA found that the personal data of Danish citizens transferred to Google LLC could be obtained by US law enforcement authorities. Consequently, the Municipality of Helsingor was obliged to ensure that additional measures were put in place to comply with Chapter V of the GDPR, such as encryption of the personal data. The Municipality claimed that the data were encrypted. However, the DPA did not consider the encryption in this case to be effective, as the Municipality itself admitted that Google LLC may have access to the information in plain text.
Consequently, the DPA found that the transfer of personal data that the Municipality of Helsingor has instructed Google Cloud EMEA Limited to carry out did not take place in accordance with Article 44 GDPR in conjunction with Article 46(2)(c) GDPR.
Corrective measures
As a consequence, the DPA issued a reprimand against the Municipality and banned the processing of personal data using Google Chromebooks and Workspace for Education (previously G Suite for Education) until brought in line with the GDPR. Furthermore, until the Municipality of Helsingor complies with the GDPR, the DPA suspended transfers of data to the United States that were carried out by Google Cloud EMEA Limited as data processor for the Municipality.


holding_Court of Appeal of Brussels - 2020/AR/1160 (First Interim Decision)

The Court of Appeal decided the following: Article 66 GDPR gives the possibility for a procedure of urgency and from this article (and Article 66 and Article 62 GDPR), the European lawmaker did not intend to make decision of a DPA provisionally enforceable.
The Court continues to explain that decisions are provisionally enforceable during an appeal when the appealing courts entirely reviews the case (rules regarding independency and impartiality of judges are the same). The DPA however, is a body created by an administrative body of the government and its judges are appoint by vote of the Chamber of Representatives and thus the same rules regarding judges do not apply.
The Court of Appeal does not entirely review the administrative decision, but only its merits regarding applicable law and good governance. In cases of urgency and when requested, the provisional enforceable aspect of the decision can be suspended.
The appeal against an administrative decision can only be effective if there is no pressure o the appealing party to immediately pay a fine or to align itself with the appealed decision.
The Court of Appeal states that the DPA failed to adequately motivate its decision and thus the provisionally enforceability cannot be granted automatically. When the DPA sends a document to a defending party, principles of good governance must allow for a reply by the party and the DPA must take the reply into consideration in its decision. The name of the 'document' of the reply does not matter, as the procedure for administrative bodies are not as stringent as those for courts.
If the DPA only considers the 'formal conclusion' when motivating its decision (and not the aforementioned 'document'), the duty of motivation is breached. If the DPA would be able to 'chose' to which arguments to reply, the principles of the rule of law would also be breached. Interpreting this any differently would mean the DPA would be able to ignore the remarks in the document, which is not a sign of good governance.
The Court of Appeal suspends the provisional enforceability of the decision. Any actions already taken must be reverted.


holding_Datatilsynet (Norway) - 18/02140

The DPA first instructed Bergen municipality to enable two-factor authentication in their systems, cf. Article 5(1)(f) GDPR, cf. Article 32(1)(b). Second, the DPA fined the municipality about €158,315 (NOK 1,600,000) for the lack of sufficient technical and organisational measures required by Article 5(1)(f) and Article 32(1)(a) and Article 32(1)(b).

Datatilsynet (Norway) - 18/02140


holding_Persónuvernd (Iceland) - 2021102040

The Icelandic DPA rejected the complaint. The DPA noted that pursuant to Article 6 GDPR, personal data may be processed if it is necessary for the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data are outweighed.
Based on this provision, the DPA agreed with the controller that if they had to look up the phone numbers of every single person in the national register sample for every survey, it would entail a lot of time-consuming work and could have a negative effect on the quality of research. In addition, Gallup uses the phone number database to keep track of those individuals who have declared to the company's staff that they no longer wish to be invited to participate in the company's research. The DPA therefore held that the controller may therefore have a legitimate interest in saving data subjects' phone numbers in the company's internal database, and the processing may be necessary for those purposes.
The DPA pointed out that there is an obligation to provide data subjects with information pursuant to Article 14 GDPR. Nevertheless, according to Article 14(b)(5) GDPR, the obligation does not apply to the extent that its costs would be excessive. In the opinion of the DPA, this exception applies to the controller's processing. All persons who agree to participate in a survey by the controller are informed at the beginning of the call that information on the processing of personal information can be found in the controller's privacy policy on its website.
Pursuant to Article 21 GDPR, data subjects may object to the processing of their data when this is done on the legal basis of legitimate interest. If a data subject raises objections, the controller suppresses their phone number in their database to avoid contacting them again.
Considering everything mentioned above, the DPA held that the controller did not violate the GDPR with its processing.

Persónuvernd (Iceland) - 2021102040


First, it is relevant to clarify the position of Silvarnergía in this complaint. The contract between Silvanergía and BEC established the former as a processor. However, the contract was not signed. Therefore, the DPA treated Silvernergía as a controller, in accordance with Article 4(7).
The DPA deemed the processing of the data subject’s personal data by the controller unlawful for three reasons. First, the controller's calls to the data subject (BEC' clients) for customer attraction did not rely on the legal basis of Article 6(1). Second, the DPA found that BEC did not have a contract with the controller for processing the data subject’s personal data. Consequently, the processing of the data subject’s personal data by the controller violated Article 28(3). Third, the DPA pointed out that the data subject has not even given their consent to the controller for processing their personal data.
Therefore, the DPA imposed a fine, according to Article 83(5)(a) in conjunction with Article 71 Organic Law on Protection of Personal Data and Guarantee of Digital Rights 3/2018 (LOPDGDD). Among other criteria, the fine amount was determined based on the controller's grave negligence and the type of data involved in the infringement. Under Article 83(2)(b), such a negligence was attributed to the controller’s use of personal data without directly obtaining it from the data subject, as well as the processing of that personal data without informing the data subject. Further, under Article 83(2)(g), the controller processed data that could uniquely identify the data subject, such as their ID number, Universal Supply Point Code number, and digits of their bank accounts.
The fine was initially set at €5,000, but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may make a voluntary payment of the proposed fine and waive their right to appeal. This action reduces the imposed fine by 20%. The fine can be reduced by a further 20% if the controller acknowledges its liability. The controller opted for both and reduced the fine by 40%, paying the reduced sanction amount of €3,000, based on Article 85(3) Law 39/2015.
Lastly, in addition to the administrative fine, the DPA imposed on the controller to cease processing its clients' personal data.

AEPD (Spain) - EXP202313830


holding_LAG Schleswig-Holstein - 6 Ta 49/22

The court upheld the original decision. The controller infringed the GDPR by filming the data subject and publishing the clip because the data subject had not given written consent and was not informed about the purpose of the data processing or their right to withdraw consent. The data subject is entitled for maximum damages of up to €2,000, but not €6,000 as requested.
The data subject does not have to prove that damage within the meaning of Article 82(1) GDPR has occurred, as a breach of the GDPR itself constitutes non-material damage. Recital 146, sentences 1 and 6 GDPR support this interpretation, as the claims for damages serve to support the objectives of the Regulation and in particular to provide effective protection of individuals’ rights.
The court confirmed that damages in this case can amount to a maximum of €2,000. The controller did not film the data subject in intimate situations or discriminate them and the data subject gave verbal consent to be filmed. Furthermore, the controller reduced the harm by taking the video down immediately after the data subject requested it. However, on the other hand, the controller was not only using photographs, but moving images for a commercial purpose.
The court found that damages of €6,000 would not be justified in these circumstances. In similar cases, even lower amounts than €2,000 were awarded, or the cases were more severe because the controller’s actions were discriminating.

LAG Schleswig-Holstein - 6 Ta 49/22


The DPA rejected the argument of the controller that sending an email with promotional content was necessary for the performance of the contract under Article 6(1)(b) GDPR. It found that the purpose of informing the ticket holders about the contractual conditions and safety precautions could also have been achieved by publishing the information on the controller's website. It further found that the email constituted direct marketing according to Article 21(2) GDPR and by not providing the possibility to opt-out of receiving similar emails in the future the controller violated Article 12(2) and 21(2), (4) GDPR. Consequently, the DPA held that the controller violated Article 5(1)(a), (c), (2), 6(1), 12(2) and 21(2), (4) GDPR and, therefore, issued a fine of €10,000 against the controller.

APD/GBA (Belgium) - 71/2022


The EDPS found infringements with regards to purpose limitation, transfers to a third country and further, unathorised disclosure of personal data.
Purpose limitation: The EDPS found that it was not sufficiently defined in the International License Agreement (ILA) which types of personal data are to be processed for which purposes. Instead, there was only a list of purposes stating that Microsoft uses these data for:
  * troubleshooting
  * billing
  * remunerating Microsoft staff, internal reporting and business modelling,
  * financial reporting following the use of the system for own reasons (analytics)
  * to improve the service
  * security risk management
  * protection of intellectual property

These stated purposes were considered to be too vague and general pursuant to the Art 29 WP. The Commission and Microsoft could not demonstrate that all these data were necessary and that a less intrusive collection of data would be insufficient to achieve the purposes cited. In addition, some of these purposes were actually not in the interest of the Commission but for purposes of individual to Microsoft (like remuneration of their personnel). In this case, the processor acts as controller; thus, these purposes and the data used for this purposes should have been precisely defined. Also, if data were used for purposes other than for which they were collected, the compatibility of these new purposes with the original ones should have been assessed.
As a processor, Microsoft should have processed the personal data on documented instructions by the Commission. This was not ensured as the Commission did not issue sufficiently clear documented instructions to Microsoft. For example, though the Commission gave instructions for analytics and improvement of the service, these instructions were not sufficiently detailed and precise and did not exclusively concern uses of data for the purposes of the controller. Some instructions were given orally, but this was not enabled by the ILA and the oral instructions were not documented.
The Commission did not assess whether it is necessary and proportionate to transmit data to Microsoft Ireland and its sub-processors. Further details of this infringement are given under the part on further unauthorised disclosure or personal data.
Transfer to third countries: The Commission transferred personal data to Microsoft, a company established in the US. This raises questions about adequacy for such transfers to a third country.
After the reference date, the Commission adopted the Transatlantic Data Privacy Framework (TDPF), which is an adequacy decision in respect of recipients in the US who register under this framework. The EDPS found that even when the software and data storage is property of Microsoft, it is directly transferred to these subcontractors and cannot therefore be covered by the TDPF to Microsoft US and onward transfer from Microsoft US to other subcontractors under SCCs. The EDPS found that in was not clearly specified in the ILA what types of personal data can be transferred to which recipients in which third country. The Commission also did not appraise the transfers and therefore could not determine whether any supplementary measures are necessary.
In addition, the Commission should have performed a data transfer impact assessment and (as there are no SCCs applicable by EUIs as exporters) should have submitted the DPAs with these processors or subprocessors in third countries to the EDPS for approval. Because it failed to do this, the Commission did not implement effective supplementary measures for these transfers.
Another issue was that the “EU storage guarantee” offered by Microsoft did not cover all types of data. Some data may be accessible to recipients in third countries. The “EU Data Boundary” also has numerous exceptions and exclusions which cover customer data, service generated data, diagnostic data and professional services data.
Further unauthorised disclosure or personal data: A specific reference was made to Article 9, which concerns transmission of personal data by EU institutions to recipients established in the EU. According to the EDPS, this article is also applicable to transmission of personal data to processors of EUIs. Therefore all transmission of personal data should be in the public interest and if the data subject’s legitimate interests may be prejudiced, the controller has to weigh the competing interests and establish that it is proportionate to transmit the personal data. The purpose of management and functioning of the Commission, use of products the staff is familiar with etc. was not found to be the purpose of processing of the personal data by MS. As long as the purposes are not specified, specific and explicit, it is not possible to do this balancing.
In addition, the EDPS found that the Commission did not ensure that transfers take place “solely to allow tasks within the competence of the controller to be carried out”.
The EDPS determined that organisational and contractual measures to restrict/prevent access of third country authorities were not sufficient, and that further technical measures are thus necessary. The EDPS also found that the organisational measures applied are only limiting transfers but does not ensure that transfers are protected. Further, the encryption is only found to be an adequate measure if the controller is in control of the encryption key. In this case, customers control the keys, but Microsoft has access to the encryption key, and thus, even when law does not oblige it to decrypt the data on an authority request, it may do it voluntarily. Also, the ILA does not detail encryption of data other than “customer data”, i.e. diagnostic data, service generated data or professional services data.
The contract also enabled the processor not to notify the Commission about a request of disclosure also when EU or Member State law did not prohibit this notification and enabled recipients in third countries not to notify requests for disclosure also when the law prohibiting it did not constitute a necessary and proportionate measure in a democratic society respecting the essence of the fundamental rights and freedoms recognised by the Charter.

EDPS - 2021-0518


holding_Datatilsynet (Denmark) - 2020-31-3354

In building its argumentation, the DPA also relied on Recital 32 GDPR, as well as paragraph 62 of the CJEU Planet49 case (C-673/17) which states that:
“Active consent is thus now explicitly provided for in Regulation 2016/679. In this respect, it should be noted that, pursuant to recital 32 in the preamble to that regulation, consent may be given, inter alia: by ticking a box when visiting a website. That recital, on the other hand, expressly excludes that silence, pre-ticked boxes or inactivity may constitute consent."
The DPA emphasised that consent presupposes voluntariness, which was clearly not present since it was not possible to refrain from giving consent to the processing in question.
Furthermore, website visitors were not free to choose in a granular fashion between different processing purposes, such as statistics or marketing (the DPA referred to this as the "requirement of granularity").
Finally, the Datatilsynet reiterated that "consent must be an expression of an unequivocal expression of will on the part of the data subject." As confirmed by the Planet49 case, this requires active action and not merely inactivity.

In relation to controller's new consent solution, the DPA has become aware that the solution contains the following wording:
“Subsequent processing takes place on the basis of your consent and in special cases on the basis of legitimate interest.”
The DPA's "immediate opinion" is that a wording such as the above is not transparent and easy to understand for a website visitor. Instead, the text of consent should only include the processing(s) covered by the consent. The data controller should therefore be aware of the basis for the processing of personal data that is relevant in the design of the consent text.
The Datatilsynet also notes that a website visitor by clicking on "cookie settings" in the new consent solution is presented with the opportunity to object to the website's legitimate interests in relation to statistics and marketing.
It is the Data Inspectorate's assessment that such a setup makes it unclear to the website visitor which processing basis(s) actually form the basis for the website's processing of personal data in relation to statistics and marketing. The DPA therefore encourages the controller to reconsider the design of its new consent mechanism.

Datatilsynet (Denmark) - 2020-31-3354


holding_Datatilsynet (Norway) - 20/01896

No, Gveik AS did not have legal grounds for processing the personal data of the complainant for credit scorings, as per Article 6(1)(f). For this offense, the company was fined NOK 75,000.
They also didn't have sufficient internal controls for the use of credit scoring in their business, as per Article 24. For this offense, the company is required to establish corresponding internal controls and submit a written confirmation and actual documentation of the internal controls, to the DPA.
The DPA also noted that Gveik AS likely didn't have sufficient technical and organizational security measures, but didn't find strong enough evidence to add further penalties for this.

Datatilsynet (Norway) - 20/01896


holding_Dublin Circuit Civil Court - 2023 IECC 11

The court found that the data subject’s relationship with her family members had been damaged due to the data breach. The court reiterated that a breach of the GDPR does not automatically warrant damages. The court highlighted that in this case, the data subject had been retraumatised through the actions of the controller.
The court classified the data breach as serious in nature and awarded the data subject with damages in the sum of €7,500. In setting this number, the court highlighted the controller’s role in handling sensitive data and the high level trust required.


The DPA noted that when a controller obtains personal data, it must provide the data subject with all information regarding their processing activities pursuant to Article 13 GDPR. In the present case, the controller omitted this obligation. The DPA therefore held that the controller violated Article 13 GDPR by neither informing the data subject nor including any clause about the processing of personal data in the contract.
The DPA found that since the main activity of the controller was direcltly linked to the processing of personal data, the controller was required to have a higher level of rigorousness, professionalism and, consequently, responsibility regarding the processing.
Because of this aggravating circumstance, the DPA imposed a fine of €5.000. The DPA further ordered the controller to bring its operations into compliance with Article 13 GDPR and thus making sure to inform its clients about the processing of their data.

AEPD (Spain) - EXP202103039


holding_ANSPDCP (Romania) - Softehnica S.R.L

The DPA considered that the ransomware attacked happened due to the lack of technical and organisational measures. Moreover, the controller did not implement regular testing, evaluation and assessment of the effectiveness of technical and organisational measures already in place. This entailed that both the security of data processing, including the ability to ensure the confidentiality, integrity, availability and continuous resilience of the processing systems and services could not be assured.
As a consequence of this failures, name, surname, home address, e-mail address and contact details of data subjects were disclosed unlawfully, in breach of Article 32(2) and 32 (3) GDPR.
The DPA deemed it appropriate to impose a fine of RON 24,866 (€5,000) to the controller.

ANSPDCP (Romania) - Softehnica S.R.L


The DPA held that Uppsalahem AB had processed personal data in breach of Article 6 (1) (f) GDPR by conducting camera surveillance of common areas in an apartment building.

Datainspektionen - DI-2020-4534


holding_Datatilsynet (Norway) - 21/03177

The Norwegian DPA fined the controller €29,880 for lack of sufficient technical and organisational measures under Article 32(1)(b) GDPR and Article 5 GDPR, and for having published personal data on their website without lawful grounds under Article 6 GDPR and Article 5 GDPR.

Datatilsynet (Norway) - 21/03177


holding_Tietosuojavaltuutetun toimisto (Finland) - 3116/163/20

The DPA considered whether data subjects were informed in the survery of the purpose and legal basis of the processing of personal data, and the voluntariness of responding to the inquiry. This decision was based on Article 5(1)(a) GDPR (principle of lawfulness, fairness, and transparency); Article 12(1) GDPR (controller's responsibility to communicate in a concise, transparent, intelligible and easily accessible form using clear and plain language); and Article 13 GDPR (detailing the information to be provided to the data subject).
The DPA evaluated the inquiry form used by the controller and found that it was unclear whether returning was voluntary or mandatory. Furthermore, neither the form nor the accompanying information sheet sufficiently clarified how the data would be used. No information was provided to explain that the collection of the personal data was needed to identify how many children required day care, and the information did not clarify whether day care could be denied based on the answers provided. In its response to the investigation, the controller had stated that the information was required in order to process refunds if children were not attending day care. However, it was not clear whether the personal data would be processed to determine the arrangement of child care at home, the processing of payment refunds, or both.
Taking into account the above-mentioned points, the DPA found that the purpose of personal data processing had not been sufficiently communicated, and that the controller had therefore infringed their transparency obligations under Articles 5(1)(a), 12, and 13 GDPR. Accordingly, the controller was reprimanded pursuant to Article 58(2)(b) GDPR.


The Spanish DPA held that Vodafone Spain unlawfully processed the complainant's personal data, as the company had no lawful basis to send them invoices belonging to one of its customers. It found this to constitute a severe and negligent violation (Article 83(2)(a) and (b) GDPR) of Articles 5(1)(f) and 32 GDPR, as the complainant's data was neither processed with integrity and confidentiality nor appropriately safeguarded.
It originally imposed a fine of €30,000 for the violation of Article 5(1)(f) GDPR and €20,000 for the violation of Article 32 GDPR, but this was reduced to a total fine amounting to €40,000 because Vodafone Spain made use of a reduction procedure proposed by the DPA.

AEPD (Spain) - PS/00111/2021


The Supreme Administrative Court dismissed the argument that there was a lack of case law from the Supreme Administrative Court on Article 57(1)(f) GDPR and referred to its decision in the case 2023/04/0254. In this case, the Supreme Administrative Court held that in proceedings concerning a data protection complaint, the DPA must observe the principle of material truth arising from §37 and §39(2) of the Austrian data protection law ("AVG") on a case-by-case basis in order to guarantee effective legal protection to a data subject who considers that their rights under the GDPR have been violated and to ensure compliance with the GDPR. The Supreme Administrative Court then held, unlike the DPA's view, that the DPA should not only investigate a case to the extent appropriate, but find out the material truth of the case.
However, the Supreme Administrative Court held that a referral back is only used in the event of serious gaps in the investigation. Referral of the case back to the administrative authority to carry out necessary investigations can therefore be considered if the administrative authority failed to carry out all necessary investigative activities or if it took completely unsuitable investigative steps to determine the relevant facts. The Supreme Administrative Court held that this also applies if there are concrete indications that the administrative authority, such as the DPA, omitted (difficult) investigations so that these could then be carried out by the administrative court.
The court then took into account the investigation of the DPA in the present case and held that there were no serious investigative gaps. Therefore, the court held that the additional investigative steps deemed necessary by the Federal Administrative Court could have been carried out by themselves without difficulty - within the framework of an oral hearing before the court.
The argumentation of the Federal Administrative Court that it would be necessary to question the third party to whom the data subject's personal data was forwarded in order to clarify the essential question of fact, combined with the statement that the DPA had to carry out a comprehensive investigation regarding this, did not justify a referral back according to the Supreme Administrative Court.
According to the Supreme Administrative Court, the argument that the referral back would save costs did also not support the Federal Administrative Court's decision. The Supreme Administrative Court repeated its prior statement that when supplementary investigations are to be carried out, the interest of speed takes priority. It was therefore irrelevant whether the completion of the proceedings conducted by the administrative authority would cost more as the opening of a new appeal against in this case the DPA at the Federal Administrative Court would lead to an overall extension of the proceedings.
The Supreme Administrative Court thus held that the decision by the Federal Administrative Court should be annulled.

VwGH - Ra 2023/04/0259


The Conseil d'Etat confirmed the decision of the CNIL in all points and considered that the CNIL was competent to deal with the case since Google did not have a main establishment in the EU at the time of the decision of the CNIL. The Conseil d'Etat also confirmed that Google's privacy policy was not sufficiently transparent since the information was disseminated throughout several documents and was not easily accessible. The Conseil d'Etat also confirmed that the consent obtained by Google was not valid since it was not sufficiently informed and specific (the users had to accept all processing operations without the possibility to refuse specific processing operations in the first layer of information). Finally, the Conseil d'Etat confirmed that the fine was not disproportionate considering inter alia the seriousness of the violation, the financial capacity of Google, the impact of people and the duration of the violation.

CE - N° 430810


The BVwG first of all assessed whether the pronouncement of the DSB constituted a decision within the meaning of section 58 et seqq. of the Austrian General Law on Administrative Procedures (Allgemeines Verwaltungsverfahrensgesetz, AVG). In this, the court took into account objective criteria and giving importance to the form and content of the decision. Further, it considered that attention should be given to the language used and whether this undoubtedly had a normative character, making reference to Austrian case law.
The BVwG held, with respect to the letters of the DSB of 11 and 13 January 2023, that they lacked the formal and content-related requirements to be considered a decision, instead, they merely constituted communications of the DSB to the data subject. If the court were to consider the DSB’s communications as decisions, this would mean that the BVwG would have to decide on the legality of a decision by the Irish DPC. In this context the BVwG referred to its case-law in asylum law matters, whereby the decisions of national authorities cannot be reviewed by the courts of another state as this would go against the principle of national sovereignty of international law. The BVwG held that this principle is transferable to data protection cases. Hence, the BVwG concluded that it cannot review the legitimacy of a decision by a lead supervisory authority in accordance with Article 60(7).
Further, the BVwG considered that it would violate the constitution and higher administrative case-law by carrying out a task that is not within its competences provided for by law.
The court specified that the DPC's decision constitutes a decision in accordance with Article 60(7) for which the DPC and not the DSB is the competent authority.
For these reasons, the court dismissed the appeal.

BVwG - W292 2267784-1


The Court considered that it was not obvious that the complainant’s wish to access his data was contrary to the purpose of the GDPR. The fact that these data could be used in another procedure also did not not lead the Court to believe that there was an abuse of rights. The Court also pointed to the case law, from which it follows that the access request where another procedure is concerned only constitutes an abuse of rights in special circumstances. For example, if rights or powers have been used so manifestly without reasonable purpose or for a purpose other than that for which they were granted. The Court saw no reason to rule that there had been an abuse of rights by the complainant.
When deciding whether the Directorate was a controller or a processor, the Court considered the following. The Directorate failed to provide the documents (required following Article 28(3) GDPR) to demonstrate that the purposes and means of processing were determined by the DT&V and that the Directorate had no factual influence over the key elements of the personal data processing. Considering that the term “controller” must be interpreted broadly, the Court ruled that the Directorate was wrong in assuming that it was a data processor.
The Court declared the appeal against the Directorate’s decision well founded.

Rb. Rotterdam - ROT 19/5030


holding_Datatilsynet (Denmark) - 2020-431-0061 (Helsingor decision no. 3)

The DPA assessed that the municipality had not identified and managed all relevant risks, including those related to the contract with the vendor (Google) and other publicly known risk issues pertaining to the procured technology (here, they specifically refer to the Dutch government's DPIA for Google Workspace, the DPIA conducted on behalf of Groningen and Amsterdam universities in March 2021, as well as the updated one of August 2021). The DPA further noted that the municipality also had not sufficiently reduced risks they have identified themselves.
Next, and after assessing the municipality's own documentation, the DPA believes that Google, in several areas, acts as a stand-alone controller that uses personal data for their own purposes. Here, the DPA refers to Google's direct responses to the municipality and, in particular, Google's description and reference to the Google Cloud Privacy Notice (as per 20 April 2022). In this document, Google describes their role as a controller and use of for example "Service Data" for its own purposes.
Finally, the DPA found that the documentation from the municipality did not fulfill the requirements for a DPIA. For example, the municipality had not assessed relevant risks, not even for the the processing activities they had initially described, and, further, they had only partially described necessary security measures. In addition, the municipality did not disclose whether they had asked their data protection officer for input as per Article 35(2) and Article 39(1)(c).
In conclusion, after reviewing the new documentation submitted in the case, the DPA held that the municipality's processing by using Google Chromebooks and Workspace for Education is still not in line with the GDPR. Further, the DPA held that the new documentation is not in line with Article 35(1) and 35(7), as well as Article 36(1).
Thus, the DPA upheld the 14 July 2022 decision, but amended it to inform the municipality of a ban against processing personal data by using Google Chromebooks and Workspace for Education.
The ban is effective immediately and lasts until the municipality has brought the processing in line with the GDPR as outlined in the 14 July 2022 decision, as well as in line with Article 35(1), 35(7), and Article 36(1). For processing where a prior consultation is required under Article 36(1), the ban is effective until the DPA has provided such consultation as per Article 36(2) or the DPA otherwise permits the processing until such consultation is ready.


holding_Tietosuojavaltuutetun toimisto (Finland) - 4680/182/18

On the basis of the information provided by the controller, the DPA emphasised that Section 6(1)(1) of the Finnish Data Protection Act, which is based on Article 9(2)(g) GDPR, applies only to the processing of the personal data of insured parties and claimants. The DPA considered that the insurance contract has not yet been concluded at the insurance application stage, and the provisions of the Finnish Data Protection Act cannot be extended to a data subject applying for insurance. Therefore, Section 6(1)(1) of the Finnish Data Protection Act cannot be applied to the processing of health data of insurance applicants and to requesting their health data from health care units.
The DPA stated that the consent requested by the controller concerned an unspecified set of health data stored in the patient information systems of various health care units. The data subjects could not control whether their personal data was processed or not or for what purposes it was processed. Thus, the consent requested by the controller was not sufficient to fulfil the requirements for the processing of special categories of personal data according to Article 9(2)(a) GDPR.
On the basis of the information gathered, the DPA held that the controller had violated Article 9 GDPR. As a result, and in accordance with Article 58(2)(d) GDPR, the DPA ordered the controller to bring its processing operations into compliance with the provisions of Article 9 GDPR.


First, the Court considered whether the measure was necessary by assessing the proportionality and subsidiarity of the measure. It held that the requirement of proportionality was met since the cameras do not allow the processing of biometrical data, and clear images of filmed people are justified by the fact that, in cases of damage, it needs to be clear against whom the charges are to be made. The requirement of subsidiarity was also met since the objective of the surveillance could be achieved in a less intrusive manner.
Second, the Court conducted a balancing test of the interests of both parties. It considered that it is guaranteed that the data subject (and persons visiting her) will not be filmed more than necessary. Moreover, the Court noted that the controller had drawn up privacy regulations and had taken measures to limit the undesirable consequences of camera surveillance as much as possible: images would be deleted - in any case - after four weeks: the video recorder is password-protected; the recorder is placed a locked room; only a limited number of members of the Board of the VvE are allowed to check the images; and log files of the actions performed in kept a logbook. Lastly, the Court considered that people that pass by the camera, are informed about the camera surveillance (via a sign).
Therefore, the Court concluded, with regard to the balancing test, that the interest of the controller in securing the communal property and that of the residents, and in being able to make a substantiated report if necessary, outweighed the data subject’s interest of the protection of her privacy.

Rb. Amsterdam - AMS 20/3251


holding_Garante per la protezione dei dati personali (Italy) - 9853406

Issuing its decision, the Italian DPA sought to emphasise, from the outset, the fundamental importance of the “civic right/duty” of voting and engaging in democratic process, at such a delicate time for a country’s public institutions and political life; the election of a new Parliament. Such a fundamental and impactful right should be considered carefully and presented in a manner that is very different from that used in the case at hand – especially regarding activities carried out by a multinational business entity.
Following this, the Italian DPA conducted an analysis of the substantive issues raised, in order to verify at least whether there is a prima facie case of unlawfulness in the processing under way and whether or not there is a real danger to the rights and freedoms of Italian citizens – also with a view to putting in place safeguards provided for by the legal system.
Firstly, with regard to the lawfulness of processing, there was no clear indication of the legal basis for the processing of data through the EDI function. Based on the information provided to the DPA, which they note contained very little information and was not provided in a timely manner, the processing operations do not appear to be grounded in consent (Article 6(1)(a) GDPR). The purpose appears to relate to the pursuit of a public interest or, at the very last, of an interest for the public good (Article 6(1)(f) GDPR). However, Meta is a private company which is not established in the Italian Republic, it clearly pursues commercial objectives and its main business consists in providing a social media platform the operation of which is financed by the sale of advertising space, preferably linked to profiling of users. Therefore, the supposed objective of protecting a primary public interest such as the holding of democratic elections and the free exercise of the right to vote appears to fall outside of the scope defined by Meta’s business objectives. Additionally, it cannot be understood how purposes related to the public interest from a very high-level perspective may fall within the terms of a contractual relationship that has been or is about to be established between Meta and its users (Article 6(1)(b) GDPR). Additionally, there appears to be a major inconsistency between Meta’s alleged philanthropic and social purpose and the collection of data from Italian citizens in a specific electoral context; data which thereafter becomes part of Meta’s business activities according to unspecified mechanisms and terms. Finally, there appears to be no agreement or formal mandate by which the Ministry of the Interior entrusted Meta with the task of informing citizens of the voting operations. In light of the above, these elements allow the identification of a prima facie case of unlawfulness of the processing of personal data of Italian citizens.
With regard to the processing activities by fact-checkers, the information provided to the Italian DPA by these entities during its investigation further compounded the concerns raised by the DPA; in particular, that the processing activities are not underpinned by consent and fall outside of specific control by data subjects. The DPA expressed that Meta’s use of fact-checkers should be further investigated.
Additionally, regarding the processing of special category data, the DPA found, despite Meta’s assertions that it does not process such data through these features, enough evidence to conclude that there was a prima facie case of unlawfulness with regard to a possible infringement of Article 9 GDPR. In doing so, the DPA points to the lack of means to determine the EDI function is only communicated to citizens over 18, the lack of anonymity of the data processed, and the likelihood of the data revealing a subject’s political orientation, which is specifically identified as special category data under Article 9 GDPR.
Furthermore, the DPA stated “one cannot but find that” Meta’s processing in this regard is both excessive and unnecessary, establishing an infringement of Article 5(1)(c) GDPR principle of data minimisation. With regard to the storage limitation principle, Meta’s admission that data is aggregated within 90 days shows evidence of further processing to pursue an undefined purpose, a violation of Articles 5(1)(e) and 13(2)(a) GDPR.
In light of all of the above, the Italian DPA held that, while the DPC is the lead supervisory authority under Article 56(1) GDPR, it is necessary to undertake urgent corrective measures regarding Meta’s processing activities in relation to Italian elections, in order to protect the rights and freedoms of Italian citizens. The Italian DPA had submitted, to the DPC, an explicit request to consider taking urgent corrective measures, but received no substantive feedback. Furthermore, given the nature of the data involved, the gravity of the infringements, the envisaged retention of data, and the number of users potentially effected, the Italian DPA considered that a reasoned derogation from the cooperation mechanism under Article 60 GDPR should apply, and implemented the urgency procedure provided for in Article 66(1) GPDR.
The DPA made an order finding that the processing is likely to infringe the legislation in force (pursuant to Articles 57(1)(a) and 66(1) GDPR); issued a warning to Meta, valid for 3 months, to the effect that any processing of personal data under the terms described would be in breach of the provisions described above (Article 58(2)(a) and 66(1) GDPR); and stating they reserve the right to initiate the relevant procedures with a view to adopting final measures (Article 66(2) GDPR).


The Spanish DPA recalled that the public administrations act as controllers for the processing of personal data and on some occasions as processors. As a result, they are subject to the GDPR and must fulfill all its obligations, including the obligation to appoint a data protection officer (Article 37 GDPR). This obligation had to be fulfilled starting from 28.05.2018, the date of entry into force of the GDPR.
The Spanish DPA issued a reprimand against Ayuntamiento de Arroyomolinos for violating Article 37 GDPR. The reprimand was issued by virtue of the power conferred by Article 58(2)(b) GDPR.

AEPD (Spain) - PS/00257/2020


The DPA found that the controller had infringed Article 32 GDPR in failure to implement appropriate technical and organisational security measures in respect of the collection and dissemination of the footage.
The DPA found that the fact that the recording of the footage taken on the staff member’s mobile phone evidenced that CCTV footage could be accessed by staff members with no responsibility for the security of the store. The DPA also noted that the CCTV system allowed for the recording of footage by a secondary device and was critical of the use of WhatsApp as a means to transfer the footage. Finally, the DPA highlighted that the footage in question included the personal data of not only the data subject, but of other customers in the store with no effort made to deidentify those data subjects before disseminating the footage.
In determining the appropriate sanction to be imposed, the DPA was influenced by the stark lack of diligence in the protection of personal data undergoing processing by the controller, as well as its high turnover. The DPA initially set the fine at €20,000. However, pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may acknowledge its responsibility for the alleged violations and/or make a voluntary payment of the proposed fine. Each of these actions reduces the imposed fine by 20%. The controller opted to reduce the fine by 40%, both acknowledging its responsibility for the violations and paying the reduced sanction amount of €12,000.

AEPD (Spain) - EXP202407160


holding_APDCAT (Catalonia) - CNS 14/2022

The APDCAT answered, advising the controller that the disclosure of a securty guard's identifying data would be lawful processing.
The basis for lawfulness of processing would be Article 6(1)(c) GDPR, necessecity for compliance with a legal obligation. The Spanish national law on transparency, access to public information and good governance (LTC) obligated the controller to disclose information in its possession as a result of the public service it provided, which included the identification data of its security personnel.
The LTC also required the controller to notify any parties affected by the disclosure, in this case any security guard whose data was being disclosed, which the APDCAT said would allow a security guard to exercise the right of opposition provided for in Article 21 GDPR.
Another Spanish national law, law 5/2014, of 4 April, on Private Security, limited the data that could be disclosed to the professional ID number of the security guard in question.

APDCAT (Catalonia) - CNS 14/2022


The AEPD determined that this behaviour infringed Article 5(1)(f) GDPR, because it discloses personal data without the consent of the data subject. The Spanish law regulating private ownership of housing allows in its Article 19(3) Home Owners' Associations to publish of (personal) data in certain cases: for notification purposes, when other means have not resulted, for calling for meetings and for the publication of meetings memorandum. However, they are not allowed to publish personal data for mere informative purposes that are not supported by a legal ground.
The AEPD warned the Home Owners' Association and gave them a month to rectify the level of security of the data.

AEPD (Spain) - PS/00190/2020


holding_Datatilsynet (Denmark) - 2021-442-13805

The DPA held that the Customs and Tax Administration had not processed personal data in line with Article 34(1) GDPR. They expressed serious criticism of the way the CTA had dealt with the personal data breach, in particular i) that the CTA first, incorrectly, reported to the DPA that they had notified the affected data subject shortly after, and ii) that they blamed their late response on "extraordinary circumstances" due to vacation period, which the DPA does not agree is a valid excuse.

Datatilsynet (Denmark) - 2021-442-13805


holding_Tietosuojavaltuutetun toimisto (Finland) - 4431/161/21

On the basis of the information provided by the controller, the DPA considered that Section 82 of the Finnish Motor Liability Insurance Act does not give the controller the right to directly access all patient records, but that the information requested must be necessary for the settlement of the claim. As a general rule, insurance companies may not request all information about customers' healthcare appointments, but this information must be limited and specified on a case-by-case basis.
The DPA emphasised that, in addition to the necessity requirement under the Finnish Motor Liability Insurance Act, the controller must also comply with the data minimisation principle as well as data protection by design and default when receiving personal data. Accordingly, the controller should have reasonably limited the information requested, erased unnecessary information disclosed to it and ensured that it processed only personal data necessary for the purposes of the processing.
The DPA found that the processing of all information about the patients' healthcare appointments also failed to meet the fairness requirements for the processing of personal data, as the data subjects have a justified reason to expect that the insurance companies will only process the information necessary to settle the claim.
The DPA also noted that although it is the healthcare provider's responsibility to sort the information to be disclosed, insurance companies must still review all the information they receive and erase any unnecessary personal data. However, billing issues between healthcare providers and insurance companies must be resolved by means other than the systematic and large-scale collection of patient information.
On the basis of the information gathered, the DPA held that the controller had violated Article 5(1)(a) GDPR, Article 5(1)(c) GDPR and Article 25(2) GDPR. As a result, the DPA issued a reprimand to the controller in accordance with Article 58(2)(b) GDPR. Pursuant to Article 58(2)(d) GDPR, the DPA also ordered the controller to comply with the principles of fairness and data minimisation as well as data protection by design and default when processing the patient information.
In addition to the reprimand and the order, the Sanctions Board of the DPA imposed an administrative fine of €52,000 on the controller pursuant to Article 83 GDPR. The Board considered that the controller's practice was intentional, and that it had not taken action to mitigate the damage suffered by data subjects.


holding_Rb. Oost-Brabant - ECLI:NL:RBZWB:2023:7274

The Court held that the Municipality was entitled to reject the data subject's erasure request (Article 17 GDPR) and their Article 22 GDPR claim.
In relation to Article 17 GDPR, the Court held that the Municipality had a legitimate aim in retaining the data and assessing whether the data subject could be rightly classified as a taxable person. Moreover, the Municipality was legally obligated to retain the data under national administrative law (Article 17(3)(b) GDPR).
On the issue of Article 22 GDPR, the Court held that the Municipality had adequately demonstrated that all automated tax calculations were subject to sufficient human intervention, and thus did not fall under the scope of Article 22 GDPR. Consequently, they were entitled to reject the data subject's Article 22 GDPR claim.


holding_Rb. Midden-Nederland - C/16/502323 / HA RK 20-122

The initial request of the applicant was indeed very broadly formulated. However, the applicant has subsequently explained that he was looking for specific emails between NWO-I and his former employer. Moreover, the applicant was able to demonstrate an email chain where he was mentioned.
The Court noted that the right of access does not extend to (parts of) internal notes that contain the personal thoughts of employees of the data controller and that are exclusively intended for internal consideration. However, this exception does not apply in this case because the personal data were shared with third parties outside of NMO-I.
NMO-I must provide the applicant with the complete overview of all personal data it processed via emails with third parties concerning the applicant and his former employer. NMO-I must also provide copies of underlying documents, but it can edit out the names of the senders and recipients.


The HDPA fined the controller €10,000 for unauthorised disclosure of personal data by bank to the data subject's wife under Article 5 (1) (a) GDPR and Article 5 (1) (f) GDPR. An additional €50,000 was added for the violation of the obligation to notify the breach to the supervisory authority under Article 33 GDPR.
First, the Hellenic Data Protection Authority established the violation of Article 5(1)(a) and (f) GDPR, committed through the unlawful transfer of the complainant's personal data. The transfer of data from the controller to the complainant's wife was unlawful, in violation of the principle of legality and transparency of processing and in violation of the principle of data confidentiality. This unauthorised processing (disclosure by transmission) constitutes a personal data breach, according to the definition of Article 4(12) GDPR, even if it is attributed to an error of an employee of the Bank
Second, the Hellenic DPA considered the violation of the obligation to notify the breach to the supervisory authority, in accordance with Article 33 GDPR. Under Article 33, the controller should have reported the breach within 72 hours to the Supervisory Authority.

HDPA (Greece) - 35/2023


holding_Datatilsynet (Denmark) - 2018-32-0232

The Danish DPA found that the new subscription for the purpose of handling deletion requests is not necessary under Articles 5(1)(c) (data minimisation principle) and 6(1)(e) GDPR.

Datatilsynet (Denmark) - 2018-32-0232


1) Data retention proportionate to the purpose of processing under Article 5(1)(e) GDPR
The CNIL clarifies that while the controller must comply with judicial requests for data, the controller would not face any criminal sanctions if it had deleted data as it was no longer necessary to process it for the controller’s specified purposes. Thus the CNIL did not accept the controller’s argument for warranting the six year storage policy.
As the data is collected for a specific purpose which is the management of the commercial relationship, the CNIL states that as soon as the purpose changes, the controller must take action in differentiating the data. The practice of categorically compiling all customer data into an active database without any differentiation or archiving policy therefore constituted a violation of Article 5(1)(e) GDPR. In relation to the managing of commercial relationships, the CNIL recommended a maximum storage period of three years after the commercial relationship has ended.
2) Processing limited to necessary data under Article 5(1)(c) GDPR
The CNIL stated that the categorical recording of telephone calls was excessive and that a sample would be sufficient for quality control and training purposes.
3) Prior consent to the processing of special category data under Article 9 GDPR
The CNIL points out that the mere act of recording the conversations, storing some and deleting others at the end of the day falls under the definition of processing under Article 4(2) GDPR, therefore rejecting the controller’s argument. Contrary to the provisions of Article 4(11) GDPR, the CNIL notes that the company does not provide any specific information to the data subjects with regard to the collection and processing of data collected from the form on the website and does not explicitly collect their consent for the processing of such data. Similarly, in the context of chat or text consultations, no information on the processing of such data is provided or consent as required under Article 9(2)(a) GDPR.
The CNIL therefore concludes a violation of Article 9 GDPR as the mere willingness to enter information into a form or share personal information through the chat options does not equate to the fully informed consent to the processing of this sensitive data.
3) Processing for marketing purposes under Article L.34-5 of the Post and Electronic Communications Code (Article L34-5 Code des postes et des communications électroniques)
The CNIL stated that the improvements made to the form still do not meet the required standard of allowing the data subject to easily access a clear description of the marketing purposes and partners as required by the French provision.
4) Conclusion and setting the fine
The CNIL concluded that the controller had violated Article 5(1)(e) & (c) GDPR, Article 9 GDPR and Article 34-5 of the French domestic provision (Article L34-5 Code des postes et des communications électroniques). With reference to the controller’s annual turnover, a €200,000 fine was set for the breaches of the GDPR through Articles 5(1)(e) & (c) and Article 9 GDPR and a €50,000 fine for the breach of Article L.34-5 of the French Post and Electronic Communications Code.

CNIL (France) - SAN-2024-014


holding_Datatilsynet (Denmark) - 2019-812-0035

The DPA found that different legal grounds are relevant in this case, such as Article 15 GDPR, sections 15 and 19 of the Danish Law Enforcement Act and provision of the Public Administration Act.
The DPA is not competent to decide which legal ground will have the best results for the complainant as it is a matter of administrative law.

Datatilsynet (Denmark) - 2019-812-0035


holding_Rb. Midden-Nederland - C/16/542054 / KG ZA 22-341

The District Court of Midden-Nederland (Rechtbank Midden-Nederland - Rb. Midden-Nederland) heard the case. The Court stated that the data subject's did not consent to the disclosure of their personal data and this does not fit with the purpose for which the data was initially processed. It must therefore be tested against Article 6(1)(f) and (4) GDPR.
The Court noted that (1) there must be legitimate interest, (2) the disclosure must be necessary and (3) it had to balance the interests of both parties: the right to protection of personal data and the safety of the research group and the right to information and effective legal protection of the parents.
Initially, the Court found that the parents had a legitimate interest to access the personal data of, at least, the representative of the paranormal group. Then they could learn more about what exactly happened at the graves of their children and get answers to the questions they still had. The Court also held that the condition of necessity had been met.
However, the Court held that the safety aspect weighed heavily. The mayor had also received threats, after which a conviction followed. Although the interests of the parents were important, they did not outweigh the interests of the data subjects.
Moreover, the alternatives to get answers have not yet been exhausted by the parents. They even turned down previous proposals from the municipality. The data subjects did not want a personal conversation with the parents, and such a conversation cannot be forced.
Lastly, the Court stated that it's doubtful whether the data subjects acted unlawfully towards the parents. Therefore, it was not proportional to take an irreversible decision like the provision of personal data.
Ultimately, the Court held that the municipality was not obliged to provide the name and address details of the data subjects and denied the parents' request.


holding_Personvernnemnda (Norway) - 2021-03

Personvernnemnda decided that the amount of the fine was correctly assessed by the DPA. However, they reduced it from NOK 400,000 (approx. €38,300) to NOK 250,000 (approx. €23,950) because of the long time it took the DPA to process the case. It took almost 16 months for the DPA to send the notices of orders and fines after all facts of the case were essentially clarified. According to the Personvernnemnda this processing time could generally be justified by the fact that the authortiy has limited resources. However, this did not apply here as the case was neither factually nor legally particularly complex. Personvernnemnda also noted that the fact that the DPA apologised for the long processing time was not sufficient compensation.

Personvernnemnda (Norway) - 2021-03


The AEPD held that by processing personal data without the data subject’s clear, affirmative, informed and free consent, or any other valid legal basis, the online store had violated Article 6(1) GDPR.
The AEPD also held that the online store had violated its obligation under Article 13 GDPR to provide data subjects information related to the processing of their personal data when collected from them, in particular by not having a privacy policy and not disclosing any details as to who the controller of that personal data would be.
Lastly, the AEPD held that the online store’s use of non-essential cookies without having a cookie banner violated Article 22.2 of the Spanish Law of Information Society Services (LSSI), which establishes that clear and complete information on the use of cookies and the purposes of the data processing must be provided to data subjects, as well as the possibility to reject non-essential cookies.
Taking into account that the online store was owned by a private individual, the AEPD issued a fine of €1000 for the each of the three aforementioned violations, for a total fine of €3000. Due to the fact that the individual voluntarily paid the fine and expressly accepted their responsibility, the fine was reduced to €1800.
The AEPD also ordered the owner of the store to incorporate an adequate privacy policy and cookie banner in order to comply with GDPR and national data protection provisions.

AEPD (Spain) - PS/00603/2021


holding_Tietosuojavaltuutetun toimisto (Finland) - 3831/161/21

The DPA stated that tying the storage period of purchase data to the duration of the customer relationship had resulted in the data being stored in a form that enables identification of the data subject for potentially very long periods, even decades. A storage period based on the duration of the customer relationship could therefore lead to very long storage of the purchase data, even for the lifetime of the data subject.
Moreover, according to the DPA, some of the purchase data could be used to infer detailed information about the person's life situation, lifestyle and movements. Purchase data may also indirectly reveal personal data belonging to the special categories of personal data within the meaning of Article 9 GDPR. For example, customers had the opportunity to collect loyalty points by using certain healthcare services. The risk associated with the processing of such data increases the more extensive data is collected and the longer it is stored.
Hence, the DPA considered that the controller should have defined the storage period for purchase data on a purpose-specific basis and assessed it separately from the storage period of other personal data needed to manage the customer relationship. The controller should have determined the storage period for purchase data already before engaging in any personal data processing activities since data subjects must be informed of the storage period when collecting personal data in accordance with Article 13(2)(a) GDPR.
On the basis of the information gathered, the DPA held that the controller violated Article 5(1)(e) GDPR, Article 25(1) GDPR and Article 25(2) GDPR, as the storage period of purchase data tied to the duration of the customer relationship was not necessary for the purposes for which the controller processed the personal data. Furthermore, the DPA stressed that in compliance with data protection by default, the controller should have ensured that a data subject would have the opportunity to influence the level of collection of their personal data from the beginning, for example, by choosing in the registration form the level of data collection they want.
As a result, the DPA issued a reprimand to the controller in accordance with Article 58(2)(b) GDPR. Pursuant to Article 58(2)(d) GDPR, the DPA also ordered the controller to define a storage period for purchase data according to the purpose of use and to erase or anonymise purchase data older than the defined storage period.
In addition to the reprimand and the order, the Sanctions Board of the DPA assessed the necessity of imposing an administrative fine pursuant to Article 83 GDPR. The Board concluded that several factors would have justified the imposition of a fine. The infringement concerned 3.49 million data subjects, and the amount of data collected for each data subject had been significant. However, the Sanctions Board considered that tying the storage period of purchase data to the duration of the customer relationship had not yet led to such long storage periods to the extent that an administrative fine should be imposed.


The DPA found that the combination of a clause in a subscription contract and verbal consent did not meet the standards under Article 7(1) GDPR. Freedom of consent could not be demonstrated through the contracts signed by data subjects. It lacked a specific, clearly separated clause dedicated to the use of images. The acceptance of image processing was not distinguishable from acceptance of general and specific contractual terms. Furthermore, the administrative file contained no evidence to demonstrate that such verbal consent had been effectively requested and obtained. The DPA held that the controller thereby violated Article 7(1) GDPR.
Furthermore, the DPA found that the controller breached the principle of storage limitation. The company's internal records indicated that images and videos were retained indefinitely. They did not give a specific storage period nor assessed the necessity based on the original purpose. They thereby failed to establish and observe a defined data retention period. Therefore, the DPA also found a breach of Article 5(1)(e) GDPR
Finally, the DPA was critical of the arrangement between the fitness franchise and its local gym operator. They claimed to function as joint controllers, but this was not the case in actuality. According to EDPB Guidelines 07/2020, joint controllership must be based on a factual analysis of actual influence over the processing purposes and means. In practice, the fitness franchise exclusively determined the way in which personal data was processed. The local gym carried out instructions without real decision-making power. Since the local gym did not share control over the data processing operations, it should have been qualified as a processor rather than a joint controller. Accordingly, the DPA ruled that the fitness franchise violated Article 28(3) GDPR
Consequently, the DPA imposed a fine of €36,000 on the controller. Following recognition of responsibility and prompt payment, this amount was reduced to €21,600. The controller was also ordered to implement corrective measures. They needed to ensure that the recording and publication of images and videos of data subjects is carried out with a correct legal basis. Second, comply with data retention periods, and to formalise a compliant processor agreement.

AEPD (Spain) - EXP202309454


holding_Tietosuojavaltuutetun toimisto (Finland) - 2245/163/2019

The DPA noted that it is not necessary to provide a phone number to receive a receipt, since, even in case of a technical failure, one can contact the customer support to receive a receipt. However, customers knew not about this possibility because the payment machines, in case of a technical default, did not inform the customer that they could do so. Moreover, the DPA considered that, according to Article 25(2), the controller had to implement appropriate technical and organisational measures to ensure that, even in case of a technical failure, it would not collect more data than necessary. Since the controller neglected to implement those measures, the DPA found that the controller violated Article 5(1)(c) and Article 25 GDPR.
In accordance with Article 58(2)(d) GDPR, the DPA ordered the controller to bring its processing operations into compliance with the GDPR. Hence, the controller has to implement such measures that, in case of a technical failure in a payment machine, the customer will not have the impression that they would need to provide their phone number in order to receive a receipt.


The data protection authority ruled in favour of the plaintiff and summoned the data controller to comply with Art. 12, 15 and 17 GDPR by answering the data subject’s requests. Furthermore, the DPA reminds that an infringement to Art. 12, 15 and 17 GDPR are to be considered particularly grave with regard to the nature of the data processing involving special categories of personal data.

APD/GBA (Belgium) - 13/2019


The Hellenic DPA (HDPA) noted that a search engine provider that receives a deletion request based on the particular situation of the data subject must delete the personal data in accordance with Article 17(1)(c) GDPR unless it is able to demonstrate that there are "compelling and legitimate reasons" overriding the interests, rights, and freedoms of the data subject for the inclusion of the specific search result, pursuant to Article 21(1) GDPR. Additionally, the HDPA considered that the information in question was outdated, as it was older than fifteen years and concerned issues that were no longer of interest to the readers. Based on this data, the conditions for removing the mentioned links from Google search results under the complainant's full name are met, and, therefore, the examination of additional criteria for their deletion was unnecessary.
For these reasons, the HDPA partially accepted the application and ordered the controller to immediately proceed with the deletion of two links (13-14) that appeared as search results with the complainant's first and last name in the Google search engine and postpone the hearing and decision regarding the other seven links (1-6, 11) until the data subject provides:
(i) evidence showing the date of cessation of her business activity and
(ii) the convictions and records relating to her, including any decision of the Supreme Court on an appeal.

HDPA (Greece) - 11/2024


Preliminarily, regarding the cooperation mechanism, the CNIL considered that although the commercial canvassing operations were carried out exclusively from France, targeting French nationals, the controller transmitted recordings of canvassing calls to Belgium in order to promote its stores there. The CNIL added that the controller’s customer database contained all the customer data for HUBSIDE.STORE in Europe. Therefore, the CNIL found that the controller carried out cross-border processing and communicated the relevant information to the supervisory authorities concerned under Article 60(3) GDPR. None of the authorities raised any relevant and reasoned objection to the draft decision sent. Thus, under Article 60(6) GDPR they were deemed to have approved it.
Firstly, regarding the obligation to obtain consent from data subjects for commercial prospecting by electronic means (SMS), French national law, in particular Article L. 34-5 of the Postal and Electronic Communications Code (“CPCE”) establishes that consent is necessary for commercial prospecting by electronic means. Read in conjunction with Article 4(11) GDPR, an organization carrying out commercial canvassing by electronic means must collect the unambiguous, specific, free and informed consent of the data subject.
The CNIL added that that the forms used by the data suppliers did not allow data subjects to express a valid choice reflecting their preferences regarding the transmission of data for commercial prospecting purposes. The DPA found that the “VALIDATE”, “I VALIDATE” or “I ANSWER QUESTIONS TO APPLY’ button was highlighted by their size and color, which made it stand out from other information provided. The CNIL pointed out that the text used suggested the conclusion of the data subject’s journey rather than the transmission of data to partners. The location of the button also gave the impression that it must be clicked to complete the registration and take part in the competition.
On the other hand, the hypertext link which enabled data subjects to take part in the game without agreeing to the transmission of their data to partners was presented in the body of the text and in characters of a much smaller size. Therefore, it did not appear intuitive that it was possible to take part in the competition without clicking on one of the aforementioned buttons. Thus, the CNIL considered that the consent obtained was not unambiguous and free, violating Article L.34-5 CPCE and Article 4 GDPR.
Secondly, regarding the legal basis for the telephone canvassing, the CNIL considered legitimate interest and consent. On legitimate interest, the CNIL indicated that non-electronic commercial canvassing may be carried out in the basis of the controller’s legitimate interest if the processing does not infringe the rights and interests of the data subject. The controller must also take into account their reasonable expectations.
In the present case, the controller considered that the competition forms used did not enable the data subject to reasonably expect to receive commercial prospecting offers. The CNIL held that as the controller did not appear on the nominative list of partners to which the hyperlink in the form sent to, this exceeded the reasonable expectations of the data subjects. Therefore, the controller could not rely on legitimate interest.
On consent, the CNIL found that the forms implemented by the data suppliers did not enable valid consent to be obtained. Therefore, the CNIL considered that the controller did not obtain valid consent, and that there was no legal basis to the commercial canvassing operations by telephone.
Thirdly, regarding transparent information, the CNIL considered that in the present case, Article 14 GDPR applied to the controller as the data has not been collected by the controller itself. The CNIL held that the controller did not provide all the information required by Article 14 GDPR and did not offer the possibility to the data subject to obtain more complete information. Thus, the CNIL concluded that there was a breach of Article 14 GDPR.
Finally, regarding the security of processing, the CNIL indicated that under Article 32 GDPR, the controller must implement appropriate measures to ensure the confidentiality of data and prevent it from being processed unlawfully. The CNIL noted that the controller kept its customers’ personal data after the end of the contractual relationship without any intermediate archiving measures. However, the DPA decided that nothing established that persons would have access to said data without having a need to know. Therefore, the CNIL indicated that there was no breach of Article 32 GDPR.
The CNIL imposed a total fine of €525,000 on the controller: €200,000 for the infringement of Article L. 34-5 CPCE and €325,000 for the violation of Articles 6 and 14 GDPR.

CNIL (France) - SAN-2024-004