holding_AP (The Netherlands) - Clearview

The processing of biometric data
The DPA found that the data processed by the controller fall into the definition of biometric data under Article 4(14) GDPR.
First of all, the DPA pointed out that the mere fact that individuals are shown recognizably in photos is not enough to consider these photos biometric data. On the contrary, this is the case when they are processed through a specific technical means allowing the unique identification or authentication of a natural person.
Secondly, the DPA noted that the controller uses an algorithm to convert the collected photos and the uploaded photos into vectors and stores the pictures and the corresponding vectors into a database. Therefore, the controller is using technical means.
Thirdly, the DPA held that the purpose of these technical means is allowing the unique identification of natural persons. Indeed, the search function compares the vectors of the uploaded pictures with the other pictures in the database and show in which other photos the data subject is being shown. It is also possible to obtain the URLs and metadata related to these images.
The territorial scope of the GDPR
Firstly, the DPA noted that the controller is not established in the EU, but only in the USA. The controller claims that it is not subject to the GDPR and, therefore, does not reply to access requests under Article 15 GDPR.
Secondly, the DPA pointed out that Article 3 GDPR does not limit the territorial scope of the GDPR to the territory of the EU. More specifically, according to Article 3(2)(b) GDPR, the GDPR applies to a controller that is not established in the EU but monitors the behaviour of data subjects in the Union.
Thirdly, the DPA verified that the controller processes personal data regarding Dutch data subjects. This results from the fact that the controller scraped Dutch websites and did not implement a filter images of Dutch data subjects.
Fourthly, the DPA noted that the controller’s privacy policy of 29 January 2020 informed EEA data subjects that they could file a complaint with the competent DPA.
Fifthly, the DPA pointed out that the other EU DPAs have already fined the controller as they believed it had been processing personal data of EU data subjects.
As for the monitoring requirement, the DPA noted that the algorithm is able to match pictures even if the data subject’s appearance changed over time. This means that the user of the service is able to follow the behaviour of the individuals shown in the images over the course of time. Therefore, especially since the clients of the controller are law enforcement authorities, the service can be used to monitor data subjects’ behaviours under Article 3(2)(b) GDPR.
On these ground, the DPA held that the processing of personal data by the controller for the purposes of providing this service falls under the territorial scope of the GDPR.
Clearview is the controller
The DPA noted that Clearview processes personal data in the context of setting up, maintaining and enriching the database and for training the facial recognition algorithm. On the contrary, the users of the service are not involved in these activities and they do not give instructions on how the database should be composed.
Therefore, the DPA held that Clearview determines the purposes and means of this processing and is to be regarded as controller under Article 4(7) GDPR.
Legal basis
The DPA noted that the controller claims it can carry out this processing according to Article 6(1)(f) GDPR. Therefore, the DPA analysed only if this legal basis could be used for the processing at hand. As a side note, the DPA however specified that other legal bases would not be applicable in this case.
The DPA recalled that to verify if a controller can rely on the legal basis provided for by Article 6(1)(f) GDPR, a three-step test must be conducted.
As for the first step, the controller (or a third party) must have a legitimate interest, i.e. an interest which is lawful, sufficiently clearly articulated and represent a real and present interest (see C-708/18, Asociaţia de Proprietari bloc M5A-ScaraA, para. 44).
In the case at hand, the DPA considered that this interest could be:
  * An interest of the controller itself to offer access to the platform against a payment. However, the DPA noted that, although the freedom to conduct a business comprises the freedom to perform economic or commercial activities, such freedom does not extend so far as to cover activities that almost fully coincide with infringing the fundamental rights of others. Therefore, this interest cannot be regarded as legitimate interest.
  * An interest of the third parties using the service to fight crime. On these points, the DPA noted that Article 6(1) GDPR excludes that public authorities can rely on legitimate interest within the context of exercising their duties. Therefore, also this interest cannot be regarded as legitimate interest.

Even though this test already fails as for the first conditions, the DPA decided to however go through the other two steps. As for the second step, the processing must be necessary to pursue the interest. The DPA found that this processing is not limited to what is strictly necessary, since the controller continuously collects an enormous quantity of data, even if it is not at all certain yet that the personal data in question are relevant for the searches.
As for the final step, the controller must operate a balancing of interests. The DPA noted that the controller failed to provide information about this balancing. Moreover, it recalled that this processing falls into the scope of Article 9 GDPR data, also involves children’s pictures and it is a large scale processing. Therefore, the interests and fundamental rights of data subjects are seriously infringed.
Moreover, since the data subject and the controller do not have any relationship, data subject cannot be considered to have any “reasonable expectation” (see Recital 47 GDPR) for their personal data to be processed in this way.
Finally, the controller does not put in place any safeguards to delete photos and data associated with them from the database once those photos are no longer published on the public internet.
Therefore, also this final step fails. More generally, the controller cannot rely on the legal basis provided for by Article 6(1)(f) GDPR for this processing.
On these grounds, the DPA found a violation of Article 5(1)(a) and 6(1) GDPR.
The processing of biometric data
The DPA noted that the processing at hand involves biometric data and is, therefore, forbidden according to Article 9(1) GDPR. The DPA pointed out that the only exception could be the one provided for by Article 9(2)(e) GDPR.
However, the DPA held that the mere circumstance that these personal data are found online does not mean that data subjects had the intention of making all those data accessible to the general public, explicitly and by clear affirmative action.
Therefore, the controller violated Article 9(1) GDPR.
Transparency obligations
The DPA held that the controller violated Article 12(1) and 14 GDPR since it failed to provide data subjects with the information set by Article 14 GDPR. According to the DPA, placing that information on the controller’s website is not enough. On the contrary, the controller should also take active steps to provide the data subject with the information in question.
Right of access
The DPA noted that the controller explicitly stated that it does not respond to access requests made by EEA data subjects. Moreover, in the case of the complainants, the controller did not reply to their access request. Therefore, the DPA found a violation of Article 12(3) GDPR read in conjunction with Article 15 GDPR.
Representative in the EU
According to Article 27(1) GDPR, if a controller is not established in the EU, it shall designate in writing a representative in the Union. However, the controller did not do so. Therefore, the DPA found a violation of Article 27 GDPR.
Sanctions and corrective measures
On these grounds, the DPA issued a fine of €30,500,000.
Moreover, it ordered the controller:
 1. to stop processing personal data of Dutch data subjects and to remove the personal data that Clearview unlawfully obtained;
 2. to provide data subjects with the information as referred to in Article 14 GDPR in a concise, transparent, intelligible and easily accessible form;
 3. to answer data subjects’ requests;
 4. to designate a representative in the EU

Finally, it ordered the controller to comply in three months, otherwise a penalty for non-compliance of €250,000 per month for each of the previous corrective measures is established.

AP (The Netherlands) - Clearview


The Federal Administrative Court of Austria (Bundesverwaltungsgericht - BVwG) agreed with the position of the DSB. In particular, it confirmed the balancing of interests performed by the DSB. Furthermore, it held that the controller was obliged to delete the published request for deletion under Article 17(1)(d) GDPR and that the controller could not invoke Article 17(3) GDPR, because non of its requirements were met in the case at hand.

BVwG - W176 2245370-1


holding_Rb. Midden-Nederland - C/16/530061 / KG ZA 21-617

The Court notes that it cannot establish that the user of the IP-address made the copyright infringement. In the hypothetical situation that an infringement would be established, the Court held that Ziggo would still need a permit from the DPA pursuant to Article 33(4)(c) UAVG. First, to connect the IP-address and NAW-data in order to send a warning and second, for the provision of NAW-data to BREIN. BREIN's argument that no personal data is processed by Ziggo on behalf of BREIN was disregarded by the Court, as Ziggo would use the IP-address provided by BREIN to connect the IP-address and NAW-data on behalf of BREIN.
Furthermore, the Court held that Ziggo would need a DPIA (Article 35 GDPR). The Court also dismissed BREIN's argument that this is not obligated because it only constitutes an IP-address and not the processing of large amounts of criminal data. The Court stated that the (possibly large) amount of personal data cannot be established yet. Moreover, BREIN itself demanded processing of personal data for all future infringements on the copyright of its members through an open directory.
The Court in preliminary relief dismisses BREIN's claims.


holding_Garante per la protezione dei dati personali (Italy) - 9815931

Based on the facts and the statements of the controller, the DPA found no objective element's that would allow for a sanction.
However, due to its failure to respond to the multiple requests of the DPA, the controller breached Article 157 (request for information and production of documents) in relation to Article 166(2) of the Code. Therefore, the DPA held that a fine was necessary.
The DPA held that, with reference to Recital 148 GDPR, the infringement could not be regarded as 'minor'. Having regard to the nature, seriousness and duration of the infringement, as well as the degree of responsibility and the way the DPA became aware of the infringement, the DPA fined the controller €2,000 for the aforementioned violations.


The AEPD upheld the complaint.
First, the AEPD concluded that the controller violated Article 12(2) and Article 12(3) GDPR. The DPA stipulated that the entitlement verification process must take place only when there are reasonable doubts regarding the identity of the person who made the request, and that this verification request must be necessary and appropriate. The controller did not prove the existence of reasonable doubts that justified the request of additional information to verify the data subject's identity. Instead, it was their standard procedure to ask for an ID. The AEPD stressed that it is clear from the case at hand that there are no doubts about the identity of the applicant, since the request for access to personal data was made from the same e-mail address used by the data subject when he registered an account, and uploaded his CV, on their web portal. Additionally, the controller only actually complied with the access request after the DPA had started to investigate the complaint.
Second, the AEPD concluded that the controller violated Article 5(1)(c) GDPR. It stated that the controller's procedure to comply with the rights of data subjects goes beyond of what is laid down in the GDPR. Hence, this results in inappropriate personal data processing activities that are not relevant and not necessary for the purpose of the case, and is contrary to what Article 25 GDPR states regarding the context, risk and purposes of the processing activities.
Third, the AEPD considered the seriousness of the case and decided to impose a fine for both violations. Regarding the fine for the violation of Article 12 GDPR, the DPA stated that the nature of the infringement affected the data subject to "exercise real control" over her personal data. Moreover, this violation was the result of a lack of an adequate procedure in place to deal with such requests. The DPA concluded that a fine of €50,000 was sufficient. Regarding the fine for the violation of Article 5(1)(c) GDPR, the DPA stated that nature of the violation was very serious, due to the fundamental aspect of the data minimisation principle, as well as the number of affected data subjects. Moreover, it considered the fact that the violation occurred because of the controller's negligence, and the absence of an adequate procedure to comply with the data protection principles. The DPA concluded that a fine of €250,000 was sufficient.
Therefore, the DPA imposed a fine of €300,000 on the controller pursuant to Article 58(2) GDPR. Moreover, it ordered the controller to bring its processing operations into compliance pursuant to Article 58(2)(d) GDPR.

AEPD (Spain) - PS/00003/2021


holding_Commissioner (Cyprus) - 17.05.23

The DPA upheld the administrative fine of €3,000 for its violation of Articles 5(1)(c) and 6 GDPR and Article 29(1) of Law 125(I)/2018, as there was no differentiation of the burdening and reducing factors compared to the first decision to justify a reduction of the fine.

Commissioner (Cyprus) - 17.05.23


First, the court pointed out that the recording occurred in 2016, i.e. a time when the GDPR was not yet in force. The court recalled that Article 24(f) of the then-applicable Italian Data Protection Code stated that the data subject's consent was not needed when the processing was necessary "to assert or defend a legal claim, provided that the data are processed exclusively for such purposes and for no longer than is necessary for the pursuit of those purposes".
On this point, the court noted that, according to national case law, this rule applies not only during the trial on itself, but also regarding all the preliminary activities that are necessary to gather evidence for the trial.
Therefore, in the case at hand, it is not relevant that the recording was made by a person that is different from the one that is using it in the labour trial. According to the court, what is relevant is the fact that the purpose for which the recording was used is defending a right during a trial.
Moreover, the court held that, when such a piece of evidence is presented in a trial, it is for the judge of that trial to decide whether to use and how to disclose that recording, after balancing the right to the protection of personal data with the right of defence.
In addition, the court pointed out that the same conclusion can be drawn in a case where the GDPR would apply. Indeed, the court noted that Article 17(3)(e) GDPR sets an exception to the right to erasure "for the establishment, exercise or defence of legal claims", and so does Article 21(1) GDPR.
Therefore, from the wording of the GDPR the court drew the principle that the right to data protection can be balanced with other fundamental rights and the latter can be considered to outweigh the former. In the case at hand, the court underlined that this is especially true since Article 36 of the Italian Constitution (Costituzione della Repubblica italiana) grants a high protection to the rights of employees.
Finally, the court highlighted that also the CJEU considers that, when personal data is used in a trial, it is for the national judge to balance the rights of the parties and decide whether personal data should be used in the trial (see C-268/21, Norra Stockholm Bygg, para. 58).
On these grounds, the court annulled the appealed judgement. Therefore, the decision of the DPA stands and is valid.

Cass.Civ. - 24797/2024


holding_AZOP (Croatia) - Decision 04-07-2022

The Croatian DPA noted that video surveillance constitutes processing of personal data and, as such, requires a legal basis under Article 6(1) GDPR.
In this case, the controller had no legal basis to monitor the public space next to the residential building. This was confirmed by Article 26 of the Croatian Act on the Implemendation of the General Data Protection Regulation which only allows video surveillance for a purpose that is necessary and justified for the protection of persons and property. It further noted that Article 32(1) of the Act on the Implemendation of the General Data Protection Regulation prohibits private parties from monitoring public space.
The DPA found a violation of Article 6(1) GDPR and ordered the controller, pursuant to Article 58(2)(d) GDPR, to adjust the location of the cameras within 15 days so that they do not monitor public space and to provide footage confirming that the infringement was rectified.

AZOP (Croatia) - Decision 04-07-2022


The AKI found that the data subject’s rights should not adversely affect the rights and freedom of the others, pursuant to Article 15(4) GDPR. Also, it found that the national law - Money Laundering and Terrorist Financial Prevention Act - could restrict the data subject’s rights. As a consequence, the controller’s answer was lawful and proportionate.

AKI (Estonia) - 2.1.-3/19/3971


The DPA held that the controller did not implement appropriate technical and organisational measures in order to ensure a level of security corresponding to the processing risk generated in particular by the destruction, loss, modification, unauthorised disclosure or unauthorised access to personal data. Hence, the controller violated Articles 32(1)(b) and 32(2) GDPR.
Pursuant to its Article 58(2) GDPR statutory powers, the DPA ordered the controller to implement corrective measures and to review and update the technical and organisational measures implemented as a result of the risk assessment, including the work procedures related to the protection of personal data, as well as to carry out a training for all individuals authorised to process personal data.
The DPA fined the controller 9,828.00 lei (ca. €2000) for its violation.

ANSPDCP (Romania) - 12.01.2023


holding_Persónuvernd (Island) - Case no. 2021101963

In its decision, the DPA noted that it is necessary to assess the legality of the continued processing of the data subject's personal data by weighing the legitimate interests of third parties against the interests and fundamental rights of the data subject. In the case at hand, the financial interests of Google LLC related to its search engine as well as the public interest in being able to access the concerned information were weighed against the data subject's interest in privacy and data protection.
For such an assessment, the DPA noted that it is particularly relevant if the concerned data subject is a public figure or if they hold a public position. Should that be the case, this may result in the data subject not enjoying the same privacy protection as private persons due to the importance of the freedom to discuss public matters openly. Although the data subject held a public position at the time when the news article was published, the data subject was not involved with projects of public importance at the time when the complaint was filed.
Due to the amount of time that has passed since the events covered in the news article took place and due the fact that the data subject no longer retained a public decision, the DPA held that the data subject's interest in privacy superseded the public's interest in the information and Google LLC's financial interests. The DPA concluded that the controller should have removed the search result based on the data subject's right to be forgotten and ordered it to do so.


The DPA were critical of the controller for firstly allowing the box containing the documents to be erroneously identified as something which could be disposed of in such a manner, and secondly, that no procedure existed whereby the person who disposed of them could be identified.
The DPA also noted that the fact that the negligent action was committed by an employee or third party did not absolve the club of responsibility for the incident. Accordingly, the DPA found that the club had violated Article 5(1)(f) GDPR, requiring the controller to implement appropriate technical and organizational security measures to ensure the security of processing.
The DPA initially set the fine at €1,000 but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may acknowledge its responsibility for the alleged violations and/or make a voluntary payment of the proposed fine. Each of these actions reduces the imposed fine by 20%. The controller opted to reduce the fine by 40%, both acknowledging its responsibility for the violations and paying the reduced sanction amount of €600.
The controller was also ordered to communicate to the DPA the adoption of technical and organizational measures to ensure the confidentiality of personal data undergoing processing, as well as a retention period and disposal method for such personal data.

AEPD (Spain) - EXP202414976


holding_Garante per la protezione dei dati personali (Italy) - 9524194

The Italian DPA imposed an immediate limitation on the processing performed by TikTok with regard to the data of users whose age could not be established with certainty.


holding_Garante per la protezione dei dati personali (Italy) - 10095836

The DPA considered the violation committed by the controller to be of a high level of severity, given the particularly sensitive nature of the personal data involved (images of the face following an aesthetic procedure) and the processing carried out (unauthorized sharing).
In light of these circumstances and in application of the principles of effectiveness, proportionality, and deterrence, the DPA imposed a financial penalty of €20,000 for violations of Articles 5 and 9 GDPR, as well as Article 2-septies, paragraph 8, of the Privacy Code.


The Supreme Court clarified that in Estonia, due to the unique structure of their legal system, fines for GDPR violations are imposed through misdemeanour procedures by a supervisory authority. The same is confirmed by the derogation for Estonia in recital 151 GDPR. This approach must have the same effect as fines imposed directly under the GDPR, ensuring that data breaches are effectively sanctioned even after the regulation comes into effect. As a result, the Supreme Court identified a contradiction between national law and EU law.
§14 of the Penal Code requires an identification of a responsible natural person in order to assign liability to a legal person. On the other hand, under the GDPR, legal persons can be fined for certain type of data breaches without needing to identify the specific individual responsible for the violation. Same was confirmed by the CJEU decision in the Deutche Wohnen case in which the Court stated that the GDPR does not differentiate between natural and legal persons when determining liability for data breaches.
Moreover, the Supreme Court noted that national courts must ensure that EU law takes precedence over conflicting national laws. They must ignore any national provision that conflict with directly applicable EU law to ensure its full effect, regardless if the national law provides a higher standard of protection.
However, in the meantime, the Penal Code has been amended in a way that it provides broader grounds for liability attributable to the controller. More specifically, based on current version of Penal Code § 14(1)(2) it is not necessary to identify the natural person who committed the alleged act within the framework of the activities of the legal person and on behalf of the legal person in order to attribute liability for the violation of the requirements of the GDPR to the legal person.
At this moment, the Supreme Court cannot definitively determine whether the principles of foreseeability, definiteness, and non-retroactivity of law are met for retroactively applying liability guidelines to legal persons before 1 November 2023, the day the Penal Code was amended. If a court in a pending misdemeanour proceeding questions whether these general principles and the specific derogation for Estonia might justify not applying the GDPR, it can seek a preliminary ruling from the CJEU.
Nevertheless, the Supreme Court took into account the controller’s argument and assessed that pursuant to § 29(1)(5) of the VTMS, misdemeanour proceedings must be terminated upon expiry of the limitation period. In misdemeanour proceedings, the statute of limitations is an absolute obstacle to the proceedings, which does not allow further proceedings. Since two years have passed since the misdemeanour was completed on 11 February 2024, and the statute of limitations has not been suspended, the misdemeanour proceedings against the controller must be terminated.
The Supreme Court, therefore, annulled the decision of the first instance court and terminated the misdemeanour proceedings. This termination is based on § 29(1)(5) of the VTMS which states that proceedings must be terminated if the statute of limitations for the misdemeanour has expired.

RKHKm - 4-23-742


The DPA first dismissed the arguments of the controller. According to the DPA, the controller could have stated the requirement of providing the documents early (such as in the application site, or in the e-mails sent to the candidates). In terms of discrimination and legal obligations, the DPA also stated that the law did not foresee an employer requesting this information at the interview stage. Rather, this is carried out at a later stage when the candidates have been selected.
The DPA considered this a violation of the principle of data minimisation (Article 5(1)(c) GDPR). The hiring process of the controller meant that it had to process the data of all candidates it was going to interview. Furthermore, the fact that the controller later changed the process shows that a less invasive way of hiring candidates was possible, and that the previous process did not respect the principle of data minimisation.
The DPA highlighted the sensitive nature of personal data related to criminal convictions. Specific requirements for processing are set in Article 10 GDPR. The DPA stated that a person’s criminal record constituted personal data related to criminal convictions, including cases where there is an absence of criminal convictions. While it is generally not permitted to request criminal records during the hiring process, it is allowed in certain professions authorised by law and with specific guarantees. The DPA stated that EU law allowed the controller to request candidates’ criminal records. However, the wording of the law limited this to “selected persons”, meaning it is not necessary to do so during the interview phase. As a general rule, according to the DPA, the privacy of the employee always prevails. This is because requesting this information can be a discriminatory practice carried out by companies.
Finally, the DPA considered it unnecessary for the controller to know about the candidates’ civil status and number of children; the controller relied on a resolution by the Spanish Tax Agency, however, the DPA clarified that this was unrelated to the hiring process and therefore not applicable.
The DPA fined the controller €100,000: €75,000 for requesting data related to criminal convictions without a contractual relationship, and €25,000 for requesting data related to civil status without a contractual relationship. The DPA considered this a serious violation, as the controller was aware of the legal framework related to requesting these documents. Furthermore, as a company that regularly and systematically processes personal data, the DPA considered that the controller had the responsibility to more rigorously guarantee the protection of personal data principles according to national case law.

AEPD (Spain) - EXP202405048


The OGH overturned the decision of the OLG and restored the decision of the first instance court. It held that
  * a lawsuit under Article 79 GDPR regarding the alleged violation of Article 15 GDPR is indeed feasible. Article 79 GDPR is not limited to certain data subject rights such as erasure under Article 17 GDPR. This is in line with the OGH's previous case-law.
  * "marketing classifications" under § 151(6) GewO qualify as personal data. The term "information" in Article 4(1) GDPR is not limited to statements about verifiable characteristics or factual circumstances with regard to the data subject but also includes evaluations and assessments him or her. Hence, also a statistic probability that is assigned to a certain data subject qualifies as personal data. This is in line with case-law by the Austrian Administrative Court (W 258 2217446-1 on the presumed "affinity for a political party").
  * the data subject does not have a legal interest in a declaratory judgment that the controller is under the legal obligation to provide access under Article 15 GDPR in the case of further access requests by the data subject. The controller had already fulfilled the data subject's access request and declared to comply with the data subject's objection under Article 21 GDPR by refraining from any further processing of his or her data. Therefore, further access request are not to be expected and the data subject has no legal interest in the requested declaratory judgment.

OGH - 6Ob127/20z


holding_Garante per la protezione dei dati personali (Italy) - 9780409

First, the website consisted in a telephone directory. However, its data processing had no legal basis since the current regulatory framework did not allow the creation of generic telephone directories that are not extracted from the DBU (Data Base Unico), the single electronic archive that collects the telephone numbers and customer data of all the national telephony Operators disseminated through public directories. Moreover, it was recalled that for the inclusion of personal data in such lists, the express, free, specific, informed and documented written consent of the contractors is required. As the website did not conform to these criteria, the DPA held that there was a breach of Article 5(1)(a), Article 5(1)(d), Article 5(2), Article 6 GDPR and 129 of the Code.
The data controller also breached Article 12(2), Article 15 GDPR, Article 16 GDPR and Article 17 GDPR since it proved impossible for the data subject to know the origin of the data and the methods and purposes of the processing, as well as to request the rectification of inaccurate data or their erasure.
A breach of Article 24 GDPR was also found because there was a total lack of adequate technical and organisational measures to ensure that the processing was carried out in accordance with the rules on personal data protection. Moreover, the provision of a contact form that proved ineffective in receiving requests for cancellation also constituted a breach of Article 25 GDPR, since the technical measure adopted was not capable of protecting the rights of the data subjects. Article 12(1) and Article 13 GDPR were also breached due to the lack of an adequate privacy policy on the website. Finally, the data controller breached Article 31 GDPR and 157 of the Code for not having adequately cooperated with the supervisory authority.
It is also worth noting that anyone could enter a person’s personal details (names, address, social networks) on the website with no ways to trace the origin of the person who entered the data into the website, this therefore created a high risk of confidentiality. Moreover, the conduct had a generalized scope and extended to a large number of data subjects (357,046).
Thus, in light of these different infringement and pursuant to Article 58(2)(f), the Italian DPA imposed a prohibition on the data controller to collect, further store and publish personal data and imposed a fine of 50, 000€ to the data controller pursuant to Article 58(2)(i) and Article 83(5). As set forth in Article 166(8) of the Code, the controller had the right to settle the dispute, with the fulfillment of the prescriptions issued and the payment, within the term of thirty days, of an amount equal to half of the fine imposed.


The AEPD held that the controller breached the data processing principle of integrity and confidentiality (Article 5(1)(f) GDPR) and the security of processing (Article 32 GDPR) and fined it €55,000.
First, the AEPD determined that the initial delivery company was incorporated by GEOPOST, which should be considered as the controller for the procedure.
The AEPD considered that the confidentiality of the data subject's information was not guaranteed in accordance with Article 5(1)(f) GDPR. In fact, it was posted such that any neighbour or visitor could see extensive personal data. With regard to Article 32 GDPR, the AEPD noted that the provision is infringed both if the controller fails to adopt appropriate measures to ensure the security of personal data and if these measures are established but not observed. In this case, even though there were acceptable security practices in place, a personal data confidentiality breach still occurred; thus, the AEPD found, Article 32 GDPR was infringed. The policies were insufficient to defend the infraction and also could not be considered as mitigating measures for the sanction.

AEPD (Spain) - PS/00670/2022


Personal data
The NAIH first established that the software processed personal data since the data subject was indeed identifiable within this processing, due to the fact that the customer service calls are assigned a unique internal identification number that can be linked to the both the caller and the customer service employee. According to the NAIH, this processing was analogous to case law from the Court of Justice of the European Union C-582/14, which established that dynamic IP addresses are also personal data.
The NAIH also stated that the use of AI to identify emotional states should be considered processing of a sensitive nature, and could fall under the special category of personal data within the meaning of Article 9(1) GDPR in certain cases. However, the NAIH held that in this specific case Article 9(1) GDPR did not apply to the processing, since the voice analysis did not produce data that in itself could uniquely identify a data subject (and therefore could not be considered biometric data), and due to the fact that no meaningful inference as to the physical or mental state of health of the data subject could be drawn from the result of the processing.

Automated decision-making and profiling
The NAIH held that automated decision-making was carried out in this case, since it is not a prerequisite that the software makes the decision itself, and that it is sufficient if the processing is intended to produce an outcome that influences the decision-makers. The NAIH also established that profiling also took place according to the definition in Article 4(4) GDPR, since the prioritisation of dissatisfied customers based on keywords and emotions implies the evaluation of personal aspects cited in this provision.
Based on these assessments, and the fact that this is a novel technology, the NAIH noted that the processing created increased risks to fundamental rights, which also imply increased responsibilities on the controller. Therefore, the NAIH held that before rolling out the automated voice analysis using emotional AI, the Bank should have assessed whether the processing was feasible under the current technical and social circumstances, and taken into consideration appropriate safeguards to comply with data protection laws and the principle of data protection by design. Based on these considerations, the NAIH held that the Bank’s failure to carry out these obligations constituted a violation of Articles 24(1) GDPR, 25(1) and 25(2) GDPR.

Lack of proper information and right to object
The NAIH noted that no information was given to the data subjects regarding the voice analysis, in particular about the specific types of data processed, as well as how their emotional reactions were processed and assessed. According to the NAIH, this constituted a breach of Articles 12(1), 13, 5(1) and 5(2) GDPR.
Furthermore, according to its previous assessments regarding automated decision-making and profiling, the NAIH held that absence of information given to data subjects regarding their right to object lead to a breach of Article 21 GDPR. Additionally, the NAIH also considered that processing for customer retention purposes constituted a marketing purpose similar to customer acquisition, and that therefore the Bank violated data subjects’ right to object under Article 21(2) GDPR as well.

Balancing of interests and lawfulness of processing
The NAIH held that the Bank had provided no concrete evidence that it had carried out an adequate balance of interests between its claimed legitimate interest to carry out the processing, and the rights of the data subjects involved.
The NAIH noted that according to the technical documentation provided by the Bank, the effectiveness of the emotion analysis software is actually relatively low, and that the Bank had failed to prove that, in its current form, its use was suitable to achieve its proposed objectives in a way that was proportionate to the effect on data subjects’ rights. The NAIH also noted that the Bank had not demonstrated that any alternatives to this processing were considered.
The NAIH also cited the European Data Protection Board and European Data Protection Supervisor’s Joint Opinion 5/2021 on the Artificial Intelligence Act, which states that “the use of AI to infer emotions of a natural person is highly undesirable and should be prohibited, except for certain well-specified use-cases, namely for health or research purposes.” Based on these criteria, the NAIH concluded that the Bank’s stated efficiency purposes were not proportionate to justify the use of a form of data processing that EU data protection bodies have considered undesirable and constitute a high risk to data subjects' fundamental rights.
The NAIH also noted that not only the voices of the Bank's customers were analysed, but also the voices of its employees. The NAIH stated that although monitoring performance and quality assurance may give rise to legitimate interests in certain circumstances according to labour law, the question of suitability and proportionality was also relevant in this case, especially because employees are in a vulnerable position in the context of a labour relationship. The NAIH established that these factors were not taken into account due to the Bank's failure to conduct an adequate balance of interests, and that an adequate system of guarantees was not provided for employees.
Therefore, the NAIH held that the bank could not claim legitimate interest as a valid legal basis under Article 6(1)(f) GDPR (or any other legal basis listed in Article 6(1) GDPR) for the processing in question. It therefore held that the Bank had violated Articles 5(1)(a), 6(1) GDPR and 6(4) GDPR.

Fine and order to comply with GDPR
Based on these considerations, the NAIH imposed a fine of HUF 250,000,000 (approximately €700,000) on the Bank, and ordered the Bank to cease its use of AI to analyse emotions in the recordings of customer service calls unless it provided proof, within 60 days, that: an appropriate scope of data was defined; a proper data impact assessment was carried out; and a valid legal basis was provided which ensured that data subjects’ rights are protected to the maximum extent possible.
With regard to the Bank's employees, the NAIH held that processing should be limited to what is necessary for the purposes for which it is intended, and that they should be provided with appropriate information, indicating the assessment criteria and consequences, and including a specific balancing of interests that addresses their vulnerability due to the nature of their labour relationship, with appropriate internal safeguards.

NAIH (Hungary) - NAIH-85-3/2022


holding_Garante per la protezione dei dati personali (Italy) - 9556625

The Italian DPA noted that MISE failed to appoint a DPO by the established deadline (May 25, 2018).
Furthermore, it has found that there was no adequate legal basis for the online publication of managers' personal data, as there were less intrusive methods to ensure that SMEs would have access to the managers' consultancy services, such as ensuring restricted access to said information through the use of passwords and usernames. As such, the Authority found that the dissemination of their personal information also consisted of disproportionate processing of data.
In light of the above and given that the MISE has appointed a DPO then, the Italian DPA issued a fine of €75,000.


The Spanish DPA held that the defendant cannot rely on the argument that the notification would arrive too late using burofax. The defendant could just send the notification earlier.
The DPA nonetheless outlined that notification via notification on the public notice board was authorised by virtue of Article 9(1)(h) of the Law on Horizontal Properties ("Ley de Propiedad Horizontal"). However, it also held that publishing the claimant's personal data on a public notice board was in breach of Article 5(1)(f) GDPR ("integrity and confidentiality").
Therefore, the Spanish DPA held that there was an infringement of the GDPR. It imposed a warning sanction on the neighbourhood community.

AEPD (Spain) - PS/00143/2020


holding_CNPD (Luxembourg) - Délibération n° 3018

Luxembourg DPA argues it cannot proceed against a company established abroad that has not designated an EU Represenative.


On the controllership
The IDPC concluded that C-Planet was the controller of the data base, considering that no factual elements could substantiate the view of C-PLANET that a third party (name redacted) was the controller of this specific database.

On the lawfulness of the processing
The IDPC concluded that although some of the data was collected from the Electoral Register, a proper legal basis under Article 6(1) GDPR was still needed in this case, which also stems from Article 5(1)(b) GDPR.
The IDPC also considered the processed personal data which was not publicly available such as data subjects' ballot box number, voting document number, district, date of birth, phone number and sex. According to the General Elections Act, this data is only made available to political parties. The Electoral Commission confirmed that this data was not made available to the party delegates mentioned in the investigation.
Finally, a reference was made to special categories of data since the database contained numerals identified from 1 to 4, which the IDPC confirmed to be referring to the political opinions of the data subjects. This category, which was not processed by the Electoral Commission, is subject to particular protection under Article 9(1) GDPR. The IDPC confirmed that none of the exceptions under Article 9(2) GDPR were applicable to lawfully process this data. This therefore amounted to a violation of Article 9(1).

Obligation to provide information to the data subjects
The IDPC established that Article 14 GDPR was particularly relevant, since the data was obtained from third party sources. In this regard, the controller is obliged to inform the data subjects of the details of the processing operations, which is an essential condition for ensuring the transparency and fairness of the processing, as well as enabling the data subjects to exercise control over their personal data. The IDPC confirmed that the controller did not inform the affected data subjects in the manner prescribed by Article 14 GDPR, and hence violated this provision.

Obligation to notify the data breach (Article 33 and Article 34 GDPR)
The IDPC considered that the breach entailed a high risk for individuals considering the following elements: the sensitivity of the data involved, the large volume of data within the breach, the risk of harm for individuals, the ease with which individuals could be identified, the severity of consequences for the affected individuals, and the number of affected individuals.
Therefore, the IDPC held that the controller should have notified the IDPC no later than 72 hours after becoming aware of the breach, and should have also communicated the breach to the data subjects, as no exception to these obligations were applicable, therefore violating Article 33 and Article 34 GDPR.

On the technical and organisational measures
According to Article 32(1) GDPR, controllers and processors should implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, and a non-exhaustive list of these measures is provided. A detailed report by an auditor concluded that technical measures were lacking, especially considering the nature of the data and the risk involved.
The IDPC also took into account the large-scale nature of the database, and the fact that the data at stake was matched or combined with other data. The IDPC noted that the controller did not even evaluate the risk at stake and the impact of the processing activities, and hence made it impossible for them to manage a risk that had not even been previously identified. Therefore, the IDPC held that the controller violated Article 32 GDPR by not implementing the appropriate technical and organisational measures to ensure a level of security appropriate to the risks involved.

On the corrective measure
Based on the criteria of Article 83 GDPR, the IDPC decided to impose a fine of €65,000 against C-Planet, and ordered the controller to erase the personal data contained in the database file stored on the compromised server with immediate effect, and provide the IDPC with evidence thereof.

IDPC (Malta) - CDP/DBN/31/2020


The AEPD brought forward Recital 59, emphasizing the controller to facilitate data subjects the access of their rights.
Furthermore, the AEPD argued that there is a legitimate interest of the data subject to access the evidence and that new techniques to anonymize images would allow to prevent harm to third parties. There is no reason why the data subject should not be able to have access to the recordings that may constitute a fundamental part of the selection process to obtain a job.
Accordingly, the AEPD concluded that the controller still had the obligation to provide an answer, either by means of granting access to the data or by means of a justified refusal.

AEPD (Spain) - TD/00183/2021


The DPA held that the controller violated Article 5(1)(e) GDPR because personal data was kept for more than 36 months.
First, the DPA held that purpose and the deletion period stated by the controller could only concern the personal data of "subscribers" and not of "members", because "members" were paying immediately for a service or document. The DPA also held that some purposes were not identified by the controller, such as the purpose to provide a document for "members", accounting purposes and tax purposes.
The DPA held the retention of data could appear justified for the purposes of providing documents, accounting and tax purposes. However, according to the DPA, when relevant personal data had to be retained longer than the retention period, some extra measures needed to be implemented. The data had to be stored in a temporary separate storage location, for example in a dedicated archive database or in a separate part of an existing database. This data shouldn't be kept for a longer period then what's necessary for the respective purposes of the controller. The DPA also held that only authorized people should have access to this data. None of these described measures were implemented by the controller in this case.
The DPA also found that the manual anonymization procedure at the request of users concerned a small number of accounts. Anonymization was not implemented for 25% of accounts where this should have been the case. The DPA also held that no automatic anonymization procedure was implemented by the controller. Therefore, the controller was able to keep identifying data without any time limit. Because of these facts, the DPA held that Article 5(1)(e) GDPR had been breached, despite the fact that the controller had deleted inactive user-accounts during the procedure.
The DPA also held that article 32 GDPR was violated because of several security problems. The DPA discovered that the controller stored passwords in plain text in a database. Furthermore, users were not allowed to create a password of more than 8 characters, without any complexity requirements and other security measures. Passwords were also transmitted in plain text during email conversations with users. Finally, users were not warned when their password was being changed, thus not ensuring a safe level security protecting against identity theft.
Considering the high number of users (3.7 million) and the sensitivity of the data concerned (bank related, name, address, phone numbers etc.) the CNIL considered the infringement as 'serious' and enforced a €250,000 fine.

CNIL (France) - SAN-2022-018


holding_Garante per la protezione dei dati personali (Italy) - 9761383

The Garante held that public entities can only disclose personal data when it is permitted by law, and that therefore the legal basis invoked by the Agency under Article 6(1)(b) GDPR regarding the necessity of the processing for the performance of a contract was not applicable in this case. As to the legal basis under Article 6(1)(c) GDPR regarding the Agency’s legal transparency obligations, the Garante noted that the resolution in question was of a different nature than the type of public acts and documents which national law require public entities to publish, and that therefore this was not a valid legal basis either.
Additoinally, the Garante rebutted the Agency’s claims that it had not disclosed any personal data related to criminal offenses only because neither the specific criminal offenses with which the data subject had been charged, nor any conviction, had been mentioned. The Garante cited Court of Justice of the European Union case law which states that any information relating to judicial proceedings against a person, including the opening of an investigation or the initiation of a trial, themselves constitute personal data relating to criminal convictions and offenses pursuant to Article 10 GDPR (see here). Therefore, the Garante reiterated that the disclosure of this data by the Agency required a specific legal basis under national law, and also to be compliant with the principles of data protection under Article 5(1) GDPR, in particular the principle of lawfulness, fairness and transparency, as well as the principle of data minimisation. The Garante also held that the fact the data subject might have made this information public himself was irrelevant regarding the disclosure carried out by the Agency without an applicable legal basis to justify it.
Based on these considerations, the Garante issued a fine of €8000 for the violation of Articles 5(1), 6 and 10 GDPR, and proposed no corrective measures in light of the fact that the document had already been taken off the website and de-indexed on search engines.


Thus, the AEPD understood that the defendant has infringed its collaboration duties as per Article 58(2) GDPR, according to which, he/she shall provide the AEPD with any information required in the course of an investigation. Consequently, after considering some mitigating circumstances [the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them, as per Art. 83(2)(a)], the AEPD decided to impose a warning to the defendant.

AEPD (Spain) - PS/00408/2019


holding_Datatilsynet (Norway) - 20/02319

The DPA held that Komplett Bank ASA had:
  * violated Article 6(1) GDPR by processing personal data for direct marketing purposes without a lawful basis. The DPA held that main subject-matter of the contract was the issuance of a credit card, not direct marketing, and that the controller's use of Article 6(1)(b) GDPR «Necessary for the performance of a contract» was unlawful.
  * violated Articles 12(1) and 13(1) GDPR by providing misleading information about the lawful basis used for processing of personal data for direct marketing purposes.
  * violated Article 12(3) GDPR by exceeding the time limit for responding to the data subjects requests for information.
  * violated Articles 13(2) and 21(4) GDPR by not making the data subject aware of his right to object to the processing of his personal data for direct marketing purposes.
  * violated Article 21(3) GDPR by not respecting the data subject's prior objection to direct marketing.
For the above violations, the DPA issued Komplett Bank ASA a Compliance Order and Reprimand.

Datatilsynet (Norway) - 20/02319


On the admissibility, the CNIL replied that the admissibility of the complaints would in any case have no influence on the legality of the procedure because the CNIL’s competency is not subject to the receipt of a complaint, the DPA can initiate proceedings ex officio on the basis of its own findings.
On the alleged violation of the defendant's rights to a fair trial, the CNIL rejected both arguments.
On the failure to comply with transparency and information obligations:
In essence, the CNIL acknowledged that Google has made progress in terms of transparency and control given to users over their personal data. It then comes to the notion information accessibility, according to which the data subject must be able to determine in advance which processing operations will be performed. The CNIL notes that Google has scattered the information in several documents, not all of which are directly accessible, and that Google's design choices fragment the information (buttons and links must be clicked to access the relevant information). According to the CNIL, the amount of information to be read before data processing operations can be identified is too large. Finally, the data subject will have to cross-reference the information to understand what processing operations are being carried out.
The CNIL therefore concluded that there is a general lack of accessibility of information; Interestingly, the CNIL also concedes that exhaustive information, from the first level, would be counterproductive and would not respect the requirement of transparency.
The CNIL goes on to point out that the processing operations carried out by Google are "particularly massive and intrusive" and that the data come from many sources.
The information provided to the user must be clear and comprehensible, in accordance with Art. 12 GDPR, and it is in the light of the processing operations carried out that the clear and comprehensible nature must be analysed.
In short, with regard to the information made available by Google, the CNIL considered that:
- the purposes of the processing operations are described in a way that is far too generic given the scope and consequences of the processing operations carried out;
- the description of the purposes does not allow users to measure the extent of the processing and the degree of intrusion into their private sphere;
- the description of the data collected is imprecise and incomplete.
The lack of clarity and understandability must also be analysed according to the legal basis on which the processing operation is based (in this case: consent). The CNIL states that Google's formulations do not allow the user to distinguish between personalized advertising (carried out using user data, and on the basis of their consent) and other forms of targeting based on legitimate interest.
Finally, the CNIL stresses that Google's efforts with regard to the tools it makes available to users (information pop-up, privacy check-up, dashboard) only partially contribute to the objective of transparency. As the information must be provided at the time the data is collected, the tools in question are only made available once the Google Account has been created, in other words after a multitude of data processing operations have been carried out.
Regarding the lack of a legal basis for the implementation of processing operations:
Google declared that it only relies on consent for processing operations related to targeted advertising, and complies with the GDPR in this respect.
Consent must be informed. In view of the dissemination of the information, the CNIL considers that this requirement is not met. In particular, it is not possible to view the Google services, sites and applications referred to by Google in its Terms of Use and Privacy Policy.
Consent must be specific and unambiguous. The CNIL noted first of all that when creating a Google account, the user has the possibility to modify certain parameters. However, settings related to account customization and display of targeted ads were enabled by default. The CNIL concluded that:
- consent was not validly obtained because it was not given through a positive act but by an opposition to the processing operation (opt-out)
- consent was not specific because the acceptance of the T&Cs and the privacy policy was only possible in bulk, thus preventing a granular choice of processing. The CNIL noted that at the very least, before the user is given the choice of accepting or refusing everything, he or she should be given the opportunity to give his or her specific consent for each processing operation.
For all these reasons, the CNIL decided to impose a penalty of € 50 million and an additional to have the decision published.
On June 19th 2020, the Supreme Administrative Court (Conseil d'Etat) confirmed fully the CNIL's decision in CE - N° 430810.

CNIL (France) - SAN-2019-001


holding_Garante per la protezione dei dati personali (Italy) - 10095791

The authority held that the controller violated Articles 5(1)(f), 25, and 32 GDPR by failing to implement appropriate security measures. Therefore, the authority fined the controller €10,000.
The authority clarified that controllers are responsible for the security of the processing of personal data even when processors and sub-processors are involved. The authority referenced EDPB Guidelines in this regard[1].


holding_Datatilsynet (Denmark) - Civilstyrelsen indstilles til bøde

The Danish DPA held that removable storage devices (including USB flash drives) pose a higher risk for data subjects. At the same time, encryption is a relatively easy security measure for the controller to implement. Therefore, especially in these cases, encryption must be regarded as a necessary and required security measure. Moreover, the DPA emphasized that where the controller processes large volumes of sensitive and confidential information, appropriate guidelines for the use of USB flash drives must be provided to whoever handles them. Hence, the DPA held that by not encrypting the personal data in question, and by not having any guidelines on the use of removable storage devices and portable media, the Agency was in violation of its security obligations under the GDPR. In addition, the DPA held that the Agency was in violation of Article 33(1) GDPR for not reporting the breach after it became aware of it.


Firstly, the DPA noted that a person's name, first name and photograph are considered personal data under Article 4(1) GDPR and the publishing of such data is considered to be processing under Article 4(2) GDPR.
Secondly, the APD noted that each processing activity should have a legal basis according to Article 5(1)(a) GDPR read together with Article 6(1) GDPR. The DPA examined consent, contract and legitimate interest as possible legal bases.
Regarding consent, the DPA stressed that consent seemed impossible because there can be no 'free' consent in the context of an employee-employer relationship according to Article 6(1)(a) GDPR and Article 4(11) GDPR.
Regarding contract, the APD stated that to successfully invoke the performance of a contract as a legal basis, the processing needs to be necessary to perform that contract according to Article 6(1)(b) GDPR. Since the data subject's contract had already ended in 2021, the controller could no longer invoke this legal basis. Additionally, the DPA stated that the controller would also not be able to invoke contract as a legal basis during the employment contract, since the publishing of the data subject's photo on the controller's social media and website did not seem necessary to perform that the employment contract.
Regarding legitimate interest, the DPA performed a legitimate interest assessment composed of a purpose test, a necessity test and a balancing test between the consequences for the data subject and the consequences for the controller. Concerning the purpose test, the DPA confirmed that attracting new employees can be considered as a legitimate interest for the controller. Regarding the necessity test, the DPA did not find it necessary to publish images of employees to reach this purpose, especially since the employee in question was no longer working for the controller. Concerning the balancing test, the DPA considered that it may not be within the data subject's reasonable expectations as a former employee that her photograph be published on the data subject's website and social media to recruit new colleagues. Especially, since the data subject was employed by a competitor. The DPA also took into account that the data subject had not been employed by the controller since 2021. The DPA found that that legitimate interest as a legal basis under Article 6(1)(f) GDPR did not apply.
The DPA noted that no other legal bases under Article 6(1) GDPR seemed to apply and therefore did not need to be examined. The DPA concluded that the publication of the the data subject's photograph constituted unlawful processing.
Thirdly, the DPA confirmed that the data subject has the right to request the erasure of her personal data under Article 17(1)(d) GDPR. This Article establishes that the data subject may obtain the erasure of their personal data if such data has been unlawfully processed. The DPA held that there might have been a breach of Article 17(1)(d) GDPR.
Finally, Article 12(3) GDPR indicates that the controller shall provide information on action taken regarding data subject's rights without undue delay. The data subject exercised this right on 31 August 2023 and the controller responded the same day that it refused to erase the photographs since this was covered by the work regulations. The DPA therefore held no infringement regarding Article 12(3) GDPR as the controller did respond (negatively) to the request.
Therefore, the DPA ordered the controller to comply with the data subject's erasure request within 30 days of the notification of the decision.

APD/GBA (Belgium) - 35/2024


The DPA held that the data subject had exercised its right to be forgotten according to Article 17(1) GDPR and had done so in a way as described in the privacy policy of the controller. Since the controller did not provide an answer at all, the DPA held that it had violated Article 12(3) GDPR (the controller failed to answer within a month), Article 12(4) GDPR (The controller failed to provide a reason why it did not comply with the request) and Article 17(1) GDPR. The DPA held that the controller had to comply with the request of the data subject and ordered the controller to delete the personal data within 30 days, based on Article 58(2)(c) GDPR and Article 95 §1,5 WOG. The DPA also held that the controller had notify the DPA within 30 days about the result of this decision.

APD/GBA (Belgium) - 137/2022


The DPC found the following violations:
1. Article 33(1) GDPR, for failure to notify the DPC the data breach concerning storage of user passwords in plaintext. 2. Article 33(5) GDPR, for failure to document personal data breaches concerning the storage of user passwords in plaintext. 3. Article 5(1)(f) GDPR, for failure to implement appropriate technical and organisational measures to secure users’ passwords against unauthorized processing. 4. Article 32(1) GDPR, for failure to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk including confidentiality of user passwords.
Highlighting that an unaddressed personal data breach can result in damage such as loss of control over personal data, the DPC reprimanded MPIL pursuant to Article 58(2)(b) GDPR and issued a fine of €91 million pursuant to Article 58(2)(i) and Article 83 GDPR.

DPC (Ireland) - Meta Ireland


holding_Tietosuojavaltuutetun toimisto (Finland) - 8979/162/21

On the basis of the information provided by the controller, the DPA considered that the processing of personal data in accordance with Article 4(2) GDPR also covers situations where the controller requires the data subject to disclose documents containing personal data and where the controller reviews them.
The DPA stated that the objective of the right of access is the opportunity of the data subject to stay informed about the lawfulness of the processing and to confirm it. The DPA emphasised that public authorities may not require the data subject to provide them with information based on the data subject's access request, and thus may not use the right of access as a means of obtaining information.
On the basis of the information gathered, the DPA held that the controller had violated Article 6(1) GDPR and Article 10 GDPR by requiring foster parent applicants to exercise their right of access, as it had no legal basis to process the personal data in question. As a result, the DPA issued a reprimand to the controller in accordance with Article 58(2)(b) GDPR.


holding_Garante per la protezione dei dati personali (Italy) - 10077129

The DPA started this ex officio procedure on the basis of Article 58(1)(a) GDPR due to some alarming preliminary considerations.
First, the party to the contract with the controller is OpenAI OpCo LLC, while according to the contract the data will be shared to OpenAI Ireland Ltd. Moreover, the contract is made with GEDI Gruppo Editoriale S.p.A., however the editorial content referred to belong to subsidiaries to GERI.
Second, the legal basis for the processing, namely the transfer of data from GEDI to OpenAI, was Article 6(1)(f) GDPR. However, considering that the data processing will be of “large scale” and of “particular nature”, the DPIA did not sufficiently consider this in the context of Article 9 and 10 GDPR.
Third, it is unclear how the claimed legal basis would also be relevant to train OpenAI’s artificial intelligence operations.
Fourth, the transparency requirements as per Article 13 and 14 GDPR were not met.
In light of all these considerations, under Article 58(1)(a) GDPR, the DPA deemed it fit to issue a warning for the plausible violations of Article 9, 10, 13 and 14 GDPR.


The Hellenic DPA, took into account that the registration of the data subject in the List of Inadmissible Third Country Nationals happened because of the judicial expulsion. Also the DPA considered the fact that the judgment imposing the deportation has been annulled. Thus, the DPA decided that the registration needs to be automatically ceased according to the provisions of the immigration legislation.

HDPA (Greece) - 14/2014


The appellate Court firstly highlighted that, contrary to the controller’s claims, there are no special formality requirements for the validity of a signed power of attorney, either under Austrian civil law, or for identity verification under the GDPR.
The Court noted that the controller is obliged to demonstrate that they are not in a position to identify a data subject where they refuse to respond to a data subject right request on that basis.
The Court held that in requesting the hand-signed power of attorney, the controller failed to demonstrate that they were not in a position to identify the data subject, and infringed Article 12 GDPR.
Accordingly, the Court rejected the appeal.

OLG Graz - 2 R 192/24h


The preliminary relief judge cannot order DPA to investigate the decommissioning of the ATB system because the judge cannot be sure that the DPA will get the same order as the result of the main proceedings.
The judge founds it important that the ATB system stayed in use until the end of 2019, so it was possible to buy such ticket at the time of the applicant’s objection to the DPA. Also, Dutch DPA’s enforcement powers regarding foreign transportation companies would need to be considered separately as NS is indeed acting as a processor to those companies.
Lastly, the preliminary relief judge did not agree that the dissemination of the ATB system would be irreversible. If at any point NS is found violating the GDPR by not offering an option to buy tickets without providing personal data, it will be the obligation of NS to provide a solution.

RvS - 202001629/2/A3


The AEPD considered that the conduct of the company "bieNNova" infringed Article 21 LSSI (Ley de Servicios de Sociedad de la Información y de Comercio Electronico).
Article 21 establishes that it is forbidden to send advertising or promotional communications by e-mail or any other equivalent means of electronic communication that have not been previously requested or expressly authorised by the recipients of such communications.
Article 38(4)(d) of the same law graduates the sanction as minor, defining the conduct as "the sending of commercial communications by electronic mail or other equivalent means of electronic communication when such mailings do not comply with the requirements set out in Article 21 and do not constitute a serious infringement".
In this case, the aggravating circumstance of the existence of intentionality was taken into account (Article 40(a) LSSI).
The AEPD fined the controller €2000 for failing to comply with Article 21 LSSI.

AEPD (Spain) - PS/00362/2020


holding_RvS (Netherlands) - 202004638/1/A3

The court in turn assessed the lawfulness of (1) the original processing and (2) all further processing.
(1) The original processing consisted of the Minister obtaining the agricultural and technical data of the partnership per Article 24 of the Agriculture Act in order to carry out a task of public interest as referred to in Article 6(1)(e) GDPR. The purpose of collecting this agricultural and technical data is the agricultural census, which describes the structure of the Dutch agricultural sector for the purpose of research and the development of policy. Of the data obtained for this purpose, the minister only wants to pass on the name, address and so-called Chamber of Commerce number of the partnership to the Sector Organisation for Arable Farming.
The court found this processing to be lawful.
(2) The purpose of passing on the data of the partnership was to make it easier for the 'Brancheorganisatie Akkerbouw' to register companies and to collect the financial contributions used to finance its research within the framework of the Joint Program of arable farmers. The court highlighted it was not disputed that this is a different purpose than the purpose for which the Minister originally obtained and processed this data. No consent had been given for this processing.
The court held this further processing to be unlawful, as it was incompatible with the initial purpose for which the appellant's personal data had been collected. It allowed the appeal and overturned the original judgment.

RvS (Netherlands) - 202004638/1/A3


holding_Datatilsynet (Denmark) - 2021-31-5743

The DPA held that the controller violated Article 32(1) GDPR. The obligation under Article 32(1) GDPR to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk normally entails preventing unauthorized third parties' access to personal data and thereby a data breach.
The DPA observed that in its risk assessment, the controller should have considered and mitigated the risk that its employees would not comply with the internal procedures in place due to lack of space or stressful situations in the store. Similarly, the controller should have taken into account that the personal data stored on the data subject's TV, such as his browsing history, could include special categories of data. The TV could also contain the data subject's financial information, such as a credit card number.
Considering these risk factors, the DPA held that that the personal data on the TV should have been encrypted or deleted before it was stored in the warehouse, or it should have been stored sufficiently securely before such deletion. The controllers in such situations must ensure that its employees are aware of the internal procedures for handling personal data and that these procedures are being continuously updated.
Consequently, the DPA reprimanded the controller for violating Article 32(1) GDPR.

Datatilsynet (Denmark) - 2021-31-5743


holding_NAIH (Hungary) - NAIH-373-31/2023

The controller infringed the principles of - accountability as it did not prove the existence of legitimate interest in processing the data of the addressees of the mailing - lawfulness as the legal basis of the mailings was not proven - purpose limitation in respect of some mailings as the purpose was different from what was stated - fairness as it stated a wrong reason for requesting the data from the official register - lawfulness in respect of sending the newsletters - transparency as it did not provide appropriate information to the registrants - the rights of the data subjects by not deleting their data when consent was withdrawn. The DPA ordered the controller to permanently delete the data stored in its database of the data subjects who unsubscribed from the newsletter, or whose contact information was unsuccessful, in a documented manner, levied a fine and ordered to publish the decision. Alleviating circumstances were mainly that during the investigation, the practice was already discontinued and that the reason of the infringement was negligent and not intentional. The large volume of data processed and that data of minors were processed, were aggravating circumstances as well as that the processing was oriented to generating profitable business.

NAIH (Hungary) - NAIH-373-31/2023


holding_Rb. Midden-Nederland - AWB - 20 3811

The court considered whether the child's personal data was legally shared with the tax office under the GDPR, and where it was not, whether the representative of the child have a right to monetary compensation.
It held that whilst there was an infringement of the GDPR, the claimant is not entitled to compensation as damages could not be proven.
The court considers that there is a proper legal basis in the law for sharing the data in the start-messages in the form of Article 38 of the Algemene wet inkomensafhankelijke regelingen (General law on income-related schemes) which requires state organs to share all relevant information with the tax office which they may need to fulfil their obligations.
However, the data sharing through start-messages as required by the agreement between the SVB and the tax office is excessive. The court considers that data of all children is shared, whereas only about 42% of them qualify for the child-related budget. The agreement could therefore also have specified that when the tax office receives an application for the child-related budget, it requests data on the child in question from the SVB. This would eliminate 58% of the personal data processing without prejudice to the overall aim of the law and agreement. The court considers that the current setup of the agreement therefore fails the test of proportionality and subsidiarity (as established by the Dutch Supreme Court decision in the case of Santander, issued under the Dutch Personal Data Protection Act), and that the processing is not necessary. Additionally, the court considers that the current setup thus also interferes with the principle of data minimization.
Be that as it may, this infringement of the GDPR does not entitle claimant to a compensation of damages. Claimant failed to substantiate that it led to any concrete damages to his daughter. In line with Dutch jurisprudence, the mere infringement of a fundamental right does not lead to damages for which compensation can be sought. The court further considers that damages under the GDPR are not punitive in nature. The obligation in this respect does not go beyond full compensation of the actual damage suffered. Since such damage has not been demonstrated, there is no right to compensation.

Rb. Midden-Nederland - AWB - 20 3811


The DPA examined the rules for the removal of identification data displayed on theDPA's decisions in order to be posted on its website.

HDPA (Greece) - 64/2022


holding_ANSPDCP (Romania) - Realmedia Network SA

The DPA held that the controller violated Articles 32(1)(b) and 32(2) GDPR for not implementing adequate technical and organizational measures to ensure a security level according to the processing risk.
Consequently, the DPA fined the €8,000.


holding_Rb. Midden-Nederland - UTR 21/2729

The central question of this ruling is whether or not the data subject's request could be seen as a rectification request within the meaning of the GDPR. The court ruled that the data subject’s request to rectify changes made to his employee file could not be classified as a request within the meaning of Article 16 GDPR. The court stated that Article 16 GDPR is limited to rectifying incorrect personal data and completing personal data which is incomplete. The court stated that this was not the initial intention of the data subject, who only made his request more specific at the hearing for this ruling. However, even with this clarification, the data subject was not able to prove that his request was a rectification request within the meaning of Article 16 GDPR.
The court also noted that the request did also not qualify as a request for getting access to personal data (Article 15 GDPR), erasing personal data (Article 17 GDPR) or restricting the processing of personal data (Article 18 GDPR).
The court concluded that the data subject's request was not a request within the meaning of the GDPR. Therefore, a (lacking) response from the controller to this request was not a "decision" (Besluit) within the meaning of Article 6(2)(b) of the General Administrative Law Act (Awb), a Dutch administrative law provision. The data subject's request itself could also not be regarded as an "application" (aanvraag) in the sense of Article 1(3)(3) Awb either.
Because of the fact that both the request from the data subject, as well as the (lacking) response from the controller did not fall under these national provisions, the appeal was deemed inadmissible by the court.

Rb. Midden-Nederland - UTR 21/2729


The Court found that the processing of the customer's sensitive data was not necessary for the execution of the relevant contract. Such a clause violates the principle of data minimization as provided for in Article 5(1)(c) GDPR. Consequently, according to Article 1418 of the Italian Civil Code, the contractual clause was declared invalid as contrary to mandatory rules.

Cass.Civ. - 1/26778/2019


The AEPD found that the data controller has infringed not only the integrity and confidentiality principle, but also the accountability principle of Article 5(2) GDPR and, after considering some aggravating circumstances [(i) the data controller has performed a not intentional, but significantly negligent action; (ii) basic personal identification data have been affected (name, surname, domicile)], it decided to impose a fine of 30,000 € to the data controller.

AEPD (Spain) - PS/00425/2019


holding_Garante per la protezione dei dati personali (Italy) - 10068155

First, the DPA pointed out that referring to the Italian Law 104/1992, notoriously known in Italy for entitling to disability benefits, combined with the reference to the fact that data subject was suffering from "illnesses", is enough affirm that the email contained health data as defined by Article 4(15) GDPR.
Secondly, the DPA noted that, pursuant to Article 2-ter of the Italian Data Protection Code, a public administration can disclose personal data only if a specific piece of legislation authorises it to do so.
On this point, the DPA held that, even though the recipients of the email were employees of the controller, this rule however applies. Pursuant to the data minimisation principle, the controller should share personal data among its employees only when that specific employee needs to know the information.
The DPA held that in the case at hand this did not happen, since the data was disclosed to the warehouse employees, that did not need to know the data subject's health and disability status. The DPA emphasized that colleagues' potential prior knowledge of the employee's health condition was irrelevant.
Therefore, the DPA found a violation of Articles 5, 6 and 9(2)(b) GDPR and of Article 2-ter of the Italian Data Protection Code.
On these grounds, the DPA fined the controller €10,000 and ordered the controller to implement appropriate measures to prevent unauthorized internal circulation of employees' health data, even when such information might be already known to colleagues through workplace interactions.


holding_Datatilsynet (Denmark) - 2021-41-0149

The DPA held that visitors of the controller's website did not give informed consent, as visitors who clicked on "Accept all" did not receive information about all processing purposes. Namely, information about the preferential purpose only appeared from the "second layer". As a result, the consent did not meet the requirements of Article 4(11) GDPR, and thus the controller could not rely on Article 6(1)(a) GDPR as a legal basis for the processing.
Furthermore, the DPA also held that using a traffic light-like colour and design scheme in the consent solution constitutes a form of "guiding" (nudging). Therefore, as it interferes with the user's ability to make an informed choice, it is incompatible with the principles of lawfulness, fairness, and transparency of Article 5(1)(a) GDPR. Consequently, the DPA reprimanded the controller for the identified violations.

Datatilsynet (Denmark) - 2021-41-0149


ICO confirmed that Solarwave Limited contravened regulation 21 of PECR, by making unsolicited direct marketing calls to subscribers who had registered with the TPS at least 28 days prior to receiving the calls, and who had not given their prior consent to Solarwave to receive calls.
ICO also found that the conditions under section 55A DPA for the imposition of a monetary penalty were met.
First, if found that the contravention was serious due to (among other) a substantial number (73,217) of unsolicited calls over a nine-month period, for which Solarwave Limited could not demonstrate that it held valid consent. Valid consent was defined by reference to the concept of consent in the General Data Protection Regulation (GDPR).
Second, ICO found that Solarwave Limited acted negligently. It stated that companies have at their disposal detailed guidelines on carrying out marketing and on consent under the GDPR, which is why Solarwave Limited knew or ought reasonably to have known that there was a risk that this contravention would occur. Also, in line with standard practice of the TPS to notify the company of complaints, Solarwave Limited must have been aware of the contraventions. In addition, ICO found that Solarwave Limited failed to take reasonable steps to prevent the contravention. Relying on the assurance of third-party providers that the data had been screened prior to purchasing, without undertaking proper due diligence, was not considered as acceptable.
Finally, ICO took account some aggravating features of the case, such as the fact that Solarwave Limited was seen to be rude and persistent when making calls and that it continued to make unsolicited calls pending the outcome of ICO’s investigation.
Taking into account all of the above, ICO has decided that a penalty in the sum of £100,000 is reasonable and proportionate.

ICO (UK) - Solarwave Limited EN


The Regional Court of Cologne (Landgericht Köln - LG Köln) rejected the data subject's lawsuit. It found that the the data subject had no right to erasure under Article 17(1)(a), (c) or (d) GDPR, because the controller was processing the data lawfully under Article 6(1)(f) GDPR and the processing was still necessary in relation to the controller's purposes of providing relevant credit rating information to to its customers.
First, the court reasoned that the services of a credit rating agency are carried out in the public interest, but Article 6(1)(e) GDPR could not constitute a legal basis for the processing because there was no specific legal basis in Union or Member State Law as required by Article 6(3)(b) GDPR.
Second, the court found that the interests pursed by the controller and its customers overrode the interests of the data subject under Article 6(1)(f) GDPR. The court determined that the purpose of the controller's activity is to provide the customers of the controller with relevant credit rating information and to help lenders fulfill their legal obligation to check the financial capacity of their contract partners, thereby safeguarding the stability of economic transactions in Germany. The court held that these interests - although partly of abstract nature - can be considered in the balancing act under Article 6(1)(f) GDPR and rejected the opinion of the Higher Regional Court Schleswig (OLG Schleswig - 17 U 15/21) that the interests of the controller's customers can only be considered under Article 6(1)(f) GDPR if a request to information was made to the controller. The court further held that the "Rules of Conduct" itself do not constitute a valid legal basis for the processing and do not substitute the balancing of interests by the courts under Article 6(1)(f) GDPR, but can generally be considered a fair result if there are no specific atypical circumstances to the contrary. Moreover, the court rejected the view of the OLG Schleswig (17 U 15/21) that information about insolvency proceedings must be deleted by a credit rating agency after 6 months according to the objective pursued by § 3(1) InsoBekV. The court found that § 3(1) InsoBekV is not directly applicable, because it only refers to the official publication of information about an insolvency proceedings under www.insolvenzbekanntmachungen.de and not the processing of the data by a credit rating agency. It also found that § 3(1) InsoBekV cannot be applied analogously, because the two requirements of an analogous application were not met. The first requirement is an unintended gap in the law which the court found was not there, because the legislator once intended to prescribe shorter retention periods for credit rating agencies but in the end did not pass such a provision because of concerns about its conformity with EU law. The court also reasoned that the second requirement was not met, which is that the situation in question is in every crucial characteristic comparable to the situation regulated by the provision. It found that the situation regulated by § 3(1) InsoBekV is crucially different because it refers to a public accessible database and not a credit rating agency. Moreover, the court found that it is legally not persuasive to refer to a national provision in order to interpret and apply a EU provision, such as Article 6(1)(f) GDPR, without their being an escape clause like Article 23 GDPR.
Third, the court held that the data subject did not validly object to the processing of the data under Article 21(1) GDPR, because he did not bring forward any "grounds relating to his [...] particular situation". It found that this requires the data subject to provide facts which form an atypical situation and give the interests of the data subject a special significance. The court reasoned that the consequences of the entry brought forward by the data subject did not establish such an atypical situation. Regarding a new apartment and a new job, the court found that the data subject did not sufficiently show that he was in fact looking for a new apartment or a new job. Regarding a new bank account, the court considered it sufficient that the data subject already had one. Regarding a new mobile phone and power supply contract, the court reasoned that this is not an atypical but a typical consequence of a discharge of residual debt. Finally, the court held that, even if there were "grounds relating to [the data subject's] particular situation", the interests of the controller and its customer would have overridden the data subject's interests.

LG Köln - 28 O 221/21


holding_Commissioner (Cyprus) - 11.17.001.010.064

Violation of Article 24(1) GDPR
The DPA determined that the controller violated Article 24(1) GDPR, because the controller did not implement appropriate technical and organizational measures in advance to ensure that its processing was GDPR compliant. The DPA confirmed that the procedure described in Article 31 KEF.170 did not enable the possibility to provide the consent form to another party other than the land owner (data subject). The controller did not implement measures to detect and/or verify any breach. The DPA stated that the controller would have been able to the determine whether the consent form was delivered to the owner, if it had established a procedure that would allow it to check this. The DPA provided two examples how this violation could have been avoided. One example was that the controller could deliver the form in duplicate. This way, one of the two forms could be returned to the controller with a signature from the data subject to confirm the delivery of the consent form. The DPA later confirmed that the controller had adopted this recommendation.
Violation of Articles 5(1)(f) and 32 GDPR
The DPA also determined that the controller violated Article 32 GDPR, because the controller did not implement appropriate measures in advance in order to prevent the unauthorized disclosure of the consent form. The DPA stated that the controller had the sole responsibility as the controller for training and informing its staff. This responsibility was also accepted by the controller. The training and periodic briefings that the controller already provided were deemed inadequate by the DPA.
The DPA also determined that the controller violated the principle of integrity and confidentiality (Article 5(1)(f) GDPR) because the personal data of the data subject was processed in such a way that allowed unauthorized and/or unlawful processing.
After considering several mitigating (8) and aggravating (6) factors, the DPA fined the controller €5,000. For example, The DPA considered the fact that the breach only affected one data subject as a mitigating factor, while it considered the non-participation of all staff in data protection related training as an aggravating factor.


The Spanish DPA acknowledged the right of the Ministry of Defence to obtain such recordings through the camera, with grounds on Article 6(1)(e) GDPR and Article 22 of the Spanish Data Protection Act (LOPDGDD), that allows the recording of public spaces when it is necessary to ensure the security of strategic facilities, as long as they do not record the inside of private homes.
However, the AEPD held that there had been a violation of Article 5(1)(c) GDPR. Even if the Ministry had a legal basis for the treatment, the minimization principle shall always be complied with. The AEPD concluded that some of the cameras gathered images that were not strictly necessary for security purposes (such as the ones that recorded a whole avenue, obtaining images of private parking spots, or the ones pointing to the facade of buildings), therefore infringing Article 5(1)(c).
For this, the AEPD warned the Ministry of Defence, given that the Spanish Data Protection Act does not allow for fines to public institutions.

AEPD (Spain) - PS/00028/2021


The DPA held that the controller violated Article 5(1)(f) GDPR by not using the security measures available to the controller, and by allowing unauthorised persons to access the data. The controller also violated Article 32 GDPR by failing to have reasonable security measures on place based on the possible estimated risks. In particular, a messaging system should have been used that guaranteed delivery only to the person/s in positions who must have access to the documents in order to carry out their functions.
The AEPD declined to fine the controller, instead ordering the controller to adopt security measures to prevent the dissemination of health data via email so that processing is carried out with complete security.

AEPD (Spain) - EXP202303130


The DPA first confirmed that the data subject correctly exercised his right to erasure. The DPA held that the controller breached Articles 12(3) GDPR, 12(4) GDPR and 17(1) GDPR because it did not respond in time to the erasure request and even sent a promotional e-mail after the request had been submitted. The DPA ordered the controller to comply with the erasure request and ordered the controller to provide the DPA with an update within 30 days on which action it had taken.

APD/GBA (Belgium) - 02/2023


The court held that the data subject did not present any reasons why the processing of the personal data was unlawful, nor has there been any such evidence. She is therefore not entitled to the erasure of the personal data in the RvdK files under Article 17(1)(d) GDPR. It also pointed out that these proceedings could not lead to a judgment on the measure to terminate custody.

The court also ruled that RvdK was obliged by statutory law to retain the contested personal data in the files for the envisaged time period, according to the Dutch Archives Act. In the case of a custody order the time period would be 100 years. This means that, even if the personal data of the data subject and her children were unlawfully processed by the RvdK, the provisions of Article 17(3)(b) GDPR would in principle preclude the right to erasure.

RvS - 202206218/1/A3


With regard to the completeness of the personal data provided to the claimant, the court considered that there is no reason to doubt the defendant's position that it has provided all the information necessary pursuant to Article 15 GDPR. The court is of the opinion that the claimant has not demonstrated that it likely that information was missing, and the mere existence of a suspicion of missing information is not sufficient in this context. The court referred to a judgment of the Council of State of 31 March 2021 (ECLI:NL:RVS:2021:675).
The Court did not rule on the legality of the defendant's processing of the claimant's personal data for customer research purposes under Article 6(1)(e). Rather, it merely ruled that the defendant had acted in accordance with with Articles 17(1) and 21(1) GDPR when handling the complainants (inferred) objection to the processing. The court stated that, in its opinion, the fact that the defendant claims that its initial processing of the data was not unlawful, does not alter the fact that the respondent had deleted the e-mail address for this purpose and has stopped processing it.
Finally, with respect to the damages for the harm suffered as a result of the disclosure of his personal data to third parties, the court stated the following:
  * The claimant had not demonstrated that he suffered material or immaterial damage as a result of the provision of his personal data to third parties through the letter of 25 June 2019 or the provision of his e-mail address to KCM;
  * The adverse consequences of the breach (regarding the letter) and alleged breach (regarding the transfer to KCM) are not obvious, and in any case, are not so serious as to be qualified as violating a fundamental right.
  * The claimant has also not made it clear why the provision of personal data concerning him in the mistakenly addressed letter or the provision of his e-mail address for customer research can be qualified as 'harm of his person', which is the legal ground for the compensation of immaterial damages under Article 6:106 (1)(b) Dutch Civil Code. He has also not made it plausible what adverse consequences the provision of this information had for him, and there is no indication that the data has been misused.
  * In this way, the infringement of the GDPR will not automatically lead to compensable damage;
The court therefore rejected the claim for damages insofar as it is related to the letter of June 25, 2019 and the provision of the plaintiffs e-mail address to KCM.

Rb. Overijssel - AK 20 2097


On 15 March 2021, with the aim of protecting the rights of individuals, the IP issued a provisional decision to taxpayers - the Ministry of Public Administration (MPA), the Ministry of Health and the National Institute of Public Health (NIJZ) - imposing an obligation to provide clear, accurate and reliable information in accordance with Article 13 of the General Regulation (GDPR) - including who manages all personal data, what their purposes are and the legal basis for their processing - and restricting further processing of the personal data collected.

IP - N/A


The AEPD considered that the controller had correctly assessed the risks and implemented adequate measures to mitigate them. Their three-strikes mechanism for users that fake their location is deemed to be enough to deal with the alleged risk. Therefore, the DPA decided to archive the case.

AEPD (Spain) - E/09208/2018