holding_Datatilsynet (Denmark) - 2019-421-0028

Despite the procedures, guidelines and templates created and implemented by the controller, the Datatilsynet ruled that Udbetaling Danmark infringed both Articles 12(3) and 15 GDPR.
The authority stressed out that the controller did not provide the data subject with the necessary information pursuant to Article 15(1)(h) GDPR. Indeed, the controller did not provide the data subject with the specific information on whether automatic decisions have been made against the data subject. The authority issued that the controller should from now on answer clearly to the data subject if he/she has been subject to automated decision making. For example, the authority recommend that the controller could state in each response whether or not automatic decisions have been made vis-à-vis the data subject.
In addition, the authority pointed out that the controller answered to 2 subject access requests with undue delay. Although the controller claimed that they needed time to confirm the data subject identification, the authority ruled that the one-month deadline was not respected and thus that, Article 12(3) GDPR was infringed.

Datatilsynet (Denmark) - 2019-421-0028


holding_UODO (Poland) - DKN.5131.22.2021

The DPA found that the controller breached Article 5(1)(f), Article 24(1), Article 25(1), Article 32(1)(b) and (d), and Article 32(2) GDPR due to a lack of a reliably conducted risk analysis, combined with the lack of regular testing, measuring and evaluation of the effectiveness of the implemented technical and organisational measures to ensure the security of processing.
First, regarding the risk analysis, the DPA stated that, for the risk analysis, the controller should take into account the characteristics of the processes involved, assets, vulnerabilities, threats and existing safeguards as part of the processing of personal data taking place. The data controller determined that the loss of a USB-Stick was a "medium risk", which meant that "training for personnel on potential threats" was deemed a sufficient measure to reduce the risk to a "low level" risk. The DPA stated that such measures can not be regarded as sufficient. Nor do they suffice the requirement to put in place appropriate technical measures, since the controller obliged the users, like the probation officer that lost the USB-Stick, to implement technical safeguards on their own. Now, the user might not have enough technical knowledge to know how to implement such safeguards. Hence, ultimately, the lack of guidance resulted in the possibility for unauthorised persons to access the personal data processed on that medium.
Second, the DPA considered that the implementation ad hoc tests by the DPO, do not suffice the requirement of regular testing, since they are not "aimed at verifying the effectiveness of the implemented security measures. New risks may arise during the the implementation of individual processing activities. Hence, it is of utmost importance that such testing is carried out regularly, so that the results of these tests can be evaluated carefully.
It follows from the Polish DPA decision that by losing the memory stick, the President of the District Court committed a breach of, inter alia, the principle of confidentiality and integrity, as laid down in Article 5. Hence, the Polish DPA set an administrative fine of PLN 10,000, considering as a mitigating circumstance the good cooperation of the President of the District Court with the supervisory authority, undertaken and conducted in order to remove the violation and mitigate its possible negative effects.

UODO (Poland) - DKN.5131.22.2021


After obtaining the corresponding evidences, the AEPD understood that, as long as the not-erased-URLs are related to professional and not personal information of the claimant (and that CJEU judgement 13/05/14 clarified that the right to be forgotten can be declined due to the role of the claimant in the public life), they are excluded from the data protection regulation as per Articles 1 and 2 of the GPDR. In this sense, the AEPD decided to dismiss the claim from the Spanish citizen.

AEPD (Spain) - TD/00071/2020


In three steps, the court held that the information concerning former members of the Bundestag is protected insofar as they are still alive.
The court first established that the information concerning still living former members of the Bundestag constituted personal data. In accordance with Article 4(1) GDPR, an identifiable natural person is one who can be identified directly or indirectly, in particular by means of an association with an identifier such as a name. What is required is the possibility of establishing the identity of the data subject. In the context of determining whether a natural person is identifiable, account must be taken of all the means reasonably likely to be used by the controller or by any other person to identify the natural person, directly or indirectly (Recital 26 GDPR). In this light, the court held that the requested information constitutes personal data. The possibility that the living individuals concerned will be identified is not negligible. This applies irrespective of the fact that the plaintiff is only requesting information on the number of applications that have been decided, without naming names, and that the year of the decision does not necessarily correspond to the year of leaving the Bundestag. The group of persons potentially affected is limited which makes them identifiable.
Second, the court held that the still living MPs' interest in secrecy outweighs the plaintiff's interest in information. According to Article 9(1) GDPR, the transmission of special categories of personal data, such as health data, is prohibited unless one of the conditions of Article 9(2) GDPR, such as explicit consent, is met. According to Article 4(15) GDPR, health data are personal data relating to the physical or mental health of a natural person from which information about his or her state of health emerges. Consequently, the information sought by the plaintiff concerns specially protected personal data as the data as to whether the Bundestag administration has given a positive or negative decision on an application pursuant to "old-age compensation due to health problems" contains an assessment by the Bundestag administration of the physical and/or mental state of health of the applicant. Furthermore, access to information was also precluded by § 5.2(1) of the German Freedom of Information Act. According to this provision, the applicant's interest in information does not prevail in the case of information from documents insofar as they are connected with a mandate of the third party (in this case, the Member of Parliament).
Third, the court held that there are no grounds for exclusion for the information concerning deceased persons due to two reasons. Firstly, because natural persons within the meaning of Article 4(1) GDPR are only living persons (Recital 27 GDPR) the data concerning already deceased persons does not constitute personal data under the GDPR. Secondly, contrary to the arguments of the Bundestag, the post-mortem right of personality also does not prevent the disclosure of the concerned information. The deceased are not protected by the general right of personality under Article 2(1) in conjunction with Article 1(1) of the Basic Law as only living individuals are the bearers of this fundamental right. The protection of the post-mortem right of personality, also resulting from Article 1 (1) of the Basic Law, is an altogether separate right to the general right of personality. The post-mortem right of personality protects, on the one hand, a general right to respect, as well as, on the other hand, a right of the deceased to not be degraded or humiliated. Nevertheless, in the interpretation of the court, this right only protects against gross distortion, but not against mere questioning. In the present case, the disclosure would neither be connected with a degrading nor would it entail a gross distortion of the image of their life.

VG Berlin - 2 K 98/20


The Dispute Chamber of the GBA found that the use of personal data obtained via the data-bank of vehicles by customers of NV Informex, in particular insurance companies, for the purpose of creating personalized price offers constitutes direct marketing and violates Articles 5 and 6 of the GDPR and Article 25 of the Royal Decree of 8th of July 2013. The Federal Public Service Mobility and Transportation was ordered to bring this personal data processing in compliance with GDPR within 6 months.
The Dispute Chamber also issued a reprimand against the Federal Public Service Mobility and Transportation for violating Articles 12, 13, 14 of GDPR and ordered to bring the relevant information provisions in compliance with GDPR within 3 months.

APD/GBA (Belgium) - 34/2020


The Court upheld the claim. Regarding the first registration (on alleged domestic violence), the Court considered that, in 2019, the police had decided not to further investigate the allegations of domestic violence brought forward by the data subject's ex-wife. Hence, the Court stated that the report needed to be rectified in the sense that it must speak of "alleged" domestic violence. Moreover, the Court found that it must clearly follow from the report that the temporary ban to enter his previous home was instated by the judge in the divorce procedure and had nothing to do with the alleged domestic violence. Regarding the second registration, the Court found that the report did not accurately display that the new address his ex-wife had moved into with their son, and that he was not provided this information. The Court concluded that the personal data held by the Police was inaccurate, and ordered the police to grant the data subject's right to rectification and correct it.

Rb. Rotterdam - ROT 21/3636


The court upheld the controller's appeal.
First, the court noted that, according to Article 15(1)(h) GDPR, in case of automated decision-making the controller shall provide the data subject with an explanation about the logic behind the processing. However, this 'logic' shall not be understood as the algorithm or mathematical formula underlying the automated decision. Rather, the controller shall provide the following pieces of information: a) categories of personal data and why they are relevant to the creation of the profile; b) how the profile is created by automated means, with specific regard to the statistical method used; c) why the profile is relevant for the decision; d) how the profile is actually used in the context of the decision.
In the case at issue, the court held that the information provided by the controller was sufficient, as the controller disclosed all the elementes listed above in a comprehensive manner. Data used and their function in the weighting was clearly stated by the controller, alongside with the meaning of the results (the profile) and the statistical nature of the processing. The data subject could thus understand the processing of their personal data. The court stressed that a more accurate description of how the concrete weighting of the parameters took place would have amounted to the disclosure of the mathematical formula (i.e. the algorithm) governing profiling, which is not covered by the GDPR.

BVwG - W252 2246581-1/6E


holding_Rb. Gelderland - C/05/400739 / KG ZA 22-54

The Court decided that the registration was unlawful and ordered the controller to remove the special code “9 Dispute” from the registration pursuant to Article 17(1)(d) GDPR.
First, it considered that the data subject did not explain what the legal basis was to have the actual registrations removed (rather than only the special codes that are linked to the registrations), or why this should follow from the circumstances of the case. Hence, it rejected the claim to have the actual registrations removed.
Second, it considered that the claim to have the special codes (linked to the registrations) erased and to keep having these codes erased. The Court also rejected this claim since it could not assess any potential future registrations in advance. The Court stipulated that every registration must be assessed on the merits of that specific case.
Third, the Court assessed the lawfulness of the registration of special code “9 Dispute”, and whether it should be erased pursuant to Article 17(1)(d) GDPR. The Court stipulated the controller has the duty to prove adherence to the principle of lawfulness and transparency pursuant to Article 5(1)(a) GDPR. Moreover, it considered that the BKR added this code on its own behalf (and not on the behalf of credit providers), that BKR did not inform the data subject of this registration pursuant to Article 14 GDPR, and that this special code is not mentioned on their webpage which provides explanation on the different special codes. The Court concluded that the controller violated its duty to be transparent and to inform data subjects pursuant to Article 5 in combination with Article 14 GDPR.


Thus, the AEPD understood that the defendant has infringed the integrity and confidentiality principle included at Article 5(1)(f) GDPR. Consequently, after considering some circumstances [(i) the local scope of the processing activity made by the defendant, (ii) the number of persons affected by the processing activity, (iii) there is no evidence that the defendant has adopted any measures in order to prevent such issues to happen again in the future, (iv) there is no evidence of wilful misconduct by the defendant, even being this issue a very serious breach of the law, (v) the link between the activity of the defendant and the processing of personal data, and (vi) the defendant has not the consideration of big company, despite it represents a big number of public workers throughout the country], the AEPD decided to impose a fine of 3,000 € to the defendant.

AEPD (Spain) - PS/00274/2019


Thus, the AEPD understood that the right of access has been duly fulfilled, and so it decided not to impose any fine nor warning to the defendant.

AEPD (Spain) - TD/00317/2019


According to the DPA, the processing did not meet the requirements under Spanish data protection law (Organic Law on Protection of Personal Data and Guarantee of Digital Rights or LOPDGDD). Article 20 LOPDGDD has specific requirements for data processing for credit information purposes. The DPA stated that the inclusion of the data subject’s debt in the ASNEF database was unlawful; the data subject’s debt was exonerated, and therefore the requirement of enforceability did not apply. The DPA also considered the fact that the controller was aware of this exoneration from the data subject’s data erasure requests.
Furthermore, the DPA considered this a violation of Article 5(1) GDPR and 6(1) GDPR. There is a potential presumption of lawfulness if the processing meets the conditions of Article 20 LOPDGDD. However, the processing was not lawful under the LOPDGDD, and the controller could also not rely on any of the legal basis under Article 6(1) GDPR.
Finally, the DPA dismissed the controller’s arguments. Under national bankruptcy law, the creditor is responsible for notifying credit information systems if previously reported debts have been exonerated. The contract between the data subject’s bank and the controller explicitly states that the buyer (the controller) is aware of this. The debtor is also allowed to carry out a request to update the information, however, it is not an obligation.
The DPA fined the controller €200,000. The DPA considered this a serious violation of the data subject’s rights, due to the lack of lawfulness and that it affected the data subject’s financial solvency.

AEPD (Spain) - EXP202303454


The DPC found that TikTok had infringed Article 46(1) GDPR in respect of the transfers of the personal data of EEA users via remote access to China. The DPC held that TikTok had failed to verify, guarantee and demonstrate that the supplementary measures and standard contractual clauses (SCCs) relied upon were effective to ensure that the personal data of EEA users were afforded a level of protection essentially equivalent to that in the EU.
The DPC also found that TikTok had infringed Article 13(1)(f) GDPR, the obligation on controllers to inform data subjects of their intention to transfer their personal data to a third country at the point of data collection in respect of their October 2021 privacy policy. The DPC held that TikTok failed to both name the third country in question (China), and to specify the manner in which this processing occurred (i.e. by remote access).
For these infringements, the DPC levied a fine of €530 million. This figure was comprised of a €485 million euro fine of their infringement of Article 46(1) and a €45 million euro fine for having infringed Article 13(1)(f). TikTok were also ordered to bring their processing into compliance within six months and ordered to suspend transfers to China if they fail to do so within that timeframe.

DPC (Ireland) - TikTok


The AEPD, however, dissented and stated that what the data subject asked for was not included within the framework of data protection.
Therefore, Article 16 GDPR cannot be applied. Article 16 refers to inaccurate personal data, not to the rectification of processes within the workplace.
The AEPD stated that it is not within their functions to rectify parameters that may affect the economic outcome or performance of individuals, regardless the data subjects consider the formula is accurate, since they affect various individuals and are therefore not considered personal data.

AEPD (Spain) - EXP202100300


The Belgian DPA found that the camera surveillance was in violation of the principle of data minimisation (Article 5(1)(c) GDPR) and CLA No. 68.
In this decisions, many references are made to CLA 68 on camera surveillance in the workplace. This is an important collective labour agreement for Belgian companies in the private sector as it lists the five purposes for which camera surveillance is permitted in the workplace:
  * Safety and health;
  * Protection of property;
  * Monitoring the production process (machines only);
  * Monitoring the production process (employees);
  * Monitoring employee performance.
The CLA states that for the last two purposes, camera surveillance cannot be continuous. As such, the controller's use of continuous surveillance was in violation of CLA No. 68.
Moreover, the purpose of the cameras communicated to the employees was security, not the evaluation of employees' performance. Consequently, the continuous monitoring of employees was not necessary for the purpose of maintaining security in the shops, and as such, was a violation of Article 5(1)(c) GDPR.
The Belgian DPA acknowledged that the surveillance was also a violation of Article 8 ECHR (right to private life), and referred to the European Court of Human Rights (ECtHR) case of Antović and Mirković v. Montenegro. This case also concerned CCTV surveillance in the workplace. Here the European Court of Human Rights held that covert video surveillance of employees at their workplace was a considerable intrusion into their private life, and thus was a violation of Article 8 ECHR.
As a result, the Belgian DPA issued a warning to the shop owner and recommended that they should take steps to adequately inform employees about the purposes of camera surveillance.

APD/GBA (Belgium) - 154/2023


holding_Datatilsynet (Denmark) - 2022-441-12449

The DPA held that in systems with confidential information about a large number of users, higher requirements must be placed on the controller to prevent unauthorised access to the data. In particular, the controller must store passwords in irreversible encrypted form at all times and in a way that ensures that they are not immediately readable and that it is not possible to recreate the password in a readable format. The DPA also emphasised that storing passwords in plain text poses a high risk to data subjects because they can be misused internally and because shopping platforms are known to be a common target of cyberattacks. Therefore, storing passwords in a readable format in a log file violates Article 32(1) GDPR. Consequently, the DPA reprimanded the Salling Group for the violation and ordered it to notify affected data subjects about the breach by 1 August 2022.

Datatilsynet (Denmark) - 2022-441-12449


The DPA determined that the controller had violated Article 6(1) GDPR because of a lack of a legal basis for processing. The DPA determined that this was a fraudulent contract because of a missing signature from the data subject. The processing by the controller was carried out without a legitimate reason.
The DPA originally fined the controller €30,000. That amount was reduced to €24,000 due to a voluntary payment by the controller.

AEPD (Spain) - EXP202202898


Following the meeting, the French DPA first found that the company had electronic commercial canvassing operations carried out on its behalf by service providers and was unable to provide proof of validly expressed consent by prospective customers to be ‘cold’ called. The data from these prospects came from the service providers, but the prospective costumers did not validly consent to receive 'cold' calls from the company, as they were not informed of the identity of the canvasser on whose behalf the consent was collected when ticking the box to consent to receive commercial canvassing by electronic means. Additionally, when the company did not collect consent directly from the prospective customers, it was the company's responsibility to obtain such consent before carrying out any canvassing activity. And pursuant to Article 7(1) GDPR, the company must be able to prove that it had such consent. Thus, the company failed to comply with its obligations arising from Article L. 34-5 of the French CPCE and Article 7(1) GDPR, as clarified by Article 4(11) GDPR.
Secondly, the DPA found no breach of Article 13 GDPR as the company's privacy policy was amended and clarified the data retention period. And even if there was no mention of the right to lodge a complaint with the French DPA in the company's privacy policy, this could be understood by the compilation of several documents, accessible from the website.
Moreover, regarding the information provided to prospective customers during ‘cold’ calls, the DPA established a breach of Article 14 GDPR since when the company collected a telephone number from a third party for ‘cold’ calls, it should have informed the person of the purpose of the data processing or the existence of various rights, while the costumers were not always made aware of this.
Fourthly, based on the complaints lodged by three complainants, the DPA considered that the company had failed to comply with its obligations under Article 12 GDPR. The DPA noted that the requests made by the complainants were clear and addressed directly to the company's DPO. However, the company failed to provide the data subjects with information on the measures taken in response to their requests within a maximum period of one month under Article 12(3) GDPR, confirming a breach of Article 12 GDPR. Taking this last consideration, the DPA noted that it was clear from the information gathered that the complainants' requests had been received by the company, meaning that it failed to fulfil its obligations to process the requests, failing to comply with Article 15 GDPR.
Additionally, the DPA addressed the company’s contract with its processor. During the inspections, the DPA found that all the relevant information under Article 28 GDPR was present. However, the document was amended without communicating this to the DPA, and not all the information required under Article 28(3) GDPR was included. The DPA noted that the new documents now contain all the necessary information. Nonetheless, it considered that the past processing operations still failed to comply with Article 28(3) GDPR.
The DPA also found safety obligations issues and a breach of Article 32 GDPR as it noted that the company should have implemented a robust authentication policy as a basic security measure to keep passwords secure and comply with the Articles' obligations. Meanwhile the MD4 algorithm used by the company to store employee passwords at the time of the inspections was obsolete and insufficiently robust to ensure the confidentiality of passwords. According to the DPA, it had been known for years that the MD4 algorithm is subject to vulnerability and is immediately exploitable by attackers.
Lastly, the DPA addressed the company’s failure to comply with the obligation to notify the DPA of a personal data breach. Indeed, on 5 February 2020, the company was informed by subscribers of a data breach as subscribers accessing their account were able to view information relating to other subscribers, such as their postal address and telephone number. The DPA noted that 10,154 people were affected by the breach, not a negligible number, and since the breach was likely to infringe on subscribers' right to privacy, the company should have notified the DPA of the personal data breach. Thus, there had been a breach of Article 33 GDPR.
Due to the numerous breaches committed, some structural and certainly serious while others less severe and taking into consideration as mitigating factors the measures taken by the company, which has brought itself into compliance on certain points, the French DPA fined the company €600,000, on the basis of Article 83 GDPR.

CNIL (France) - SAN-2023-015


holding_Gerechtshof Amsterdam - 200.258.736/01

Court of Appeal is of the opinion that the documents as such could not be qualified as personal data within the meaning of the Wbp and the AVG: the requested data mainly relate to information regarding persons working at ABN AMRO, the question as to which persons had access to certain data and the question as to why, when and by whom the acts referred to by [Appellant 1] were performed. He also requested a large number of reports of telephone conversations and e-mail correspondence. On the basis of the CJEU case-law in Y vs MS and the Supreme Court, it cannot be said that such data can be regarded as personal data, since these (internal) documents relating to certain acts of ABN AMRO are not in themselves data about [Appellant 1], and these documents as such cannot be checked or corrected by [Appellant 1]. Therefore, ABN AMRO cannot be obliged to grant access to or a copy of these documents by invoking the Wbp and the AVG.

Gerechtshof Amsterdam - 200.258.736/01


holding_Datatilsynet (Denmark) - 2020-31-4326

The DPA reprimanded Jo:ga for failing to process the members´ personal data in accordance with Article 32(1) GDPR. The DPA found in particular that the company had not implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, namely by allowing an unlimited number of failed login attempts, and by using its members' dates of birth as a permanent password.
The DPA emphasized that known or easily accessible information such as a date of birth should only be used as an initial password, and should not be imposed as a permanent password. The DPA also stressed that the lack of sufficient security measures makes it possible for unauthorised persons to gain access to members´ personal information, e.g., by using a brute-force attack or acquiring members´ data.
The DPA ordered the company to bring the processing of its members´ personal data in line with the requirements set out in the Article 32(1) GDPR.

Datatilsynet (Denmark) - 2020-31-4326


holding_Persónuvernd (Iceland) - 2020112830

The Icelandic DPA dismissed the student’s claim regarding the alleged forced consent to the online monitoring of the exam and the disregard for their objection, confirming that the student had indeed been given the option of taking the examination in person at the campus. Furthermore, it explained that in any case, consent could not be a valid legal basis for this processing, since it could not be freely given in this context due to the nature of the relationship between the University and the student. However, it confirmed the university’s position with regard to its legitimate interest in monitoring the examination, and hence held that the processing was lawful under Article 6(1)(f) GDPR.
Regarding the student’s claim related to the potential exposure of their spouse’s medical data within the recordings, the DPA held that the complaint did not include a power of attorney from the student's spouse, and therefore only claims related to the student’s own personal data would be considered. Additionally, the DPA noted that in any case, due to the fact that audio recordings only took place during the roll call at the beginning of the Zoom session, and not throughout the examination itself, it was unlikely that their spouse’s medical data were captured in the recordings.
As to the security of the personal data, the DPA held that the university had implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk in the processing under Article 32 GDPR. The DPA took into account, inter alia, that a GDPR compliant processing agreement existed for the hosting of Zoom calls (which included restricted access to system administrators with strong passwords), that meeting data streams were encrypted, that the option for other attendees to record sessions was disabled, that recordings were deleted after 30 days, and that access to these recordings were only available to the heads of departments on the grounds of a reasonable suspicion that cheating occurred in an examination.
However, the DPA found that the university had not fulfilled its responsibility to properly inform the students subjected to the online monitoring as to the legal basis, purposes, security measures, and the student's data protection rights related to this processing. Therefore, the DPA held that this processing was unlawful under Article 5(1)(a) GDPR since it was not carried out in a transparent form, without providing the students the information required under Article 13 GDPR. Therefore, it issued a reprimand against the university on this point, and ordered them to adequately comply with this obligation in the future.

Persónuvernd (Iceland) - 2020112830


The Conseil d'État rejected the Data Subject's request, upholding the CNIL’s decision to close the complaint.
The Court found that the CNIL correctly applied GDPR regulations, specifically Article 55 and Article 56, which dictate that in cross-border data processing situations, the Lead Supervisory Authority is generally that of the main establishment of the controller, unless the data processing is confined to a single member state and significantly affects individuals only in that state.
In this case, the CNIL determined that the relevant data processing was indeed cross-border, handled by a central office in France, but the complaint was specific to the Data Subject employment in Ireland, making the Irish Data Protection Authority solely competent to address it.

CE - 464445


holding_ANSPDCP (Romania) - NTT Data Romania SA

The DPA investigated the breach and found that the controller failed to implement appropriate securit measure, and to monitor their effectiveness. The DPA also found that the controller failed to report the breach within 72 hours.
The DPA fined the controller RON 124,432.50 (€25,000) for violating Article 32(1)(b), (d) and (2) GDPR, as well as Article 33(1) GDPR

ANSPDCP (Romania) - NTT Data Romania SA


The District Court of Rotterdam held that searching a general system was not sufficient. The Court found that the controller's view that there were too many systems was not supported by evidence, unsubstantiated, and insufficient reasoning to suffice with the limited search it conducted and that the controller's general reference to grounds for exemption in the GDPR was insufficient. The controller had therefore not complied with the data subject's request.
Furthermore, the Court held that the controller should have specified purposes, recipients and sources per Article 15(1). The mere listing of the personal data found, followed with a general explanation of how the Tax Administration handles personal data was not enough. The Court held that this did not allow the data subject to verify the lawfulness of processing under Article 15 GDPR.
The Court declared the appeal well-founded, annulled the contested decision and ordered the controller to make a new decision, taking this judgement into account.

Rb. Rotterdam - ROT 22/2125


On the first point, the Council ruled that the appellant had already had direct access to his data via the YouForce personnel file, which means his request should not have been considered as access request.
On the second point, the Council established that the appellant did not object to the performance reports and assessments as such. He also did not object to having these reports digitalized, provided that the storage would take place on the premises of the municipality, for example on the computer of his supervisor. However, appellant did not want the reports to be stored by third parties, such as Servicepunt71 and RAET B.V. It was not made clear during the hearing which legal basis applied to this personal data processing by the municipality, but the Council considered the circumstances and came to the conclusion that the interest of the municipality for centralizing and streamlining HR administration while giving employees access to the information outweighs the interest of the appellant to have his data stored inside of the municipality. The Council took into account that the municipality had all contracts in place to ensure that Service71 complies with the GDPR and RAET B.V. was a reliable data processor. The appellant also did not clarify why the processing of his health data must be seen as illegal under Article 9(2)(b) of the GDPR, so this argument was skipped by the Council.
On the third point, the municipality explained that the company Mindtree was engaged by RAET B.V. for monitoring and technical management of the HRM tool, including the disk capacity monitoring, backup processes and system availability checks. No personal data of employees of the municipality of Leiden in general and personal data of the appellant in particular were processed by Mindtree. The appellant did not challenge these statements. The Council agreed with the Court in that there was no reason to assess the lawfulness of the personal data processing by Mindtree.

RvS - 202001651/1/A3


Thus, the AEPD understood that the defendant has infringed the lawfulness principle included at Article 6 GDPR, as it did not have the corresponding legal basis to process the personal data of the claimant when it charged him five invoices. Consequently, after considering some circumstances [(i) there is a wilful misconduct by the defendant, (ii) basic personal data have been affected, (iii) the duration of the infraction by the defendant, and (iv) the evident connection between the main activity of the defendant ant the processing of personal data], the AEPD decided to impose a fine of € 75000 to the defendant.

AEPD (Spain) - PS/00182/2020


holding_Gerechtshof Amsterdam - 200.251.466/01

The Amsterdam Court of Appeal considered that a request under Article 21 GDPR can be made at any time and several times. It also found that a provisional measure can be granted under Article 21 GDPR if an urgent action is needed.
However, in the present case, the Court stated that the applicant did not prove the urgent interest for the interim measures. Thus, the measures could not be granted and the dedicated claim was rejected as inadmissible.
The Court found that the applicant should have submitted a new request under Article 21 GDPR.

Gerechtshof Amsterdam - 200.251.466/01


The BVwG held that the data subject had not given his clear consent to the reCatpcha data processing.
Even though the controller had not listed Article 6(1)(f) GDPR as a legal basis for processing, the court analysed whether this could legitimize the data processing. The Google reCaptca service was held to be unnecessary and therefore the controller could not rely on a legitimate interest.
Therefore, none of the legal bases under Article 6(1) GDPR applied and the data processing violated the data subject’s right to privacy under §1(1) of the Austrian Data Protection Act. The BVwG therefore upheld the decision of the DPA.

BVwG - W298 2274626-1/8E


holding_Rb. Amsterdam - C/13/692003/HA RK 20-302

The Court found that Uber's contract termination procedure does not constitute automated decision making under Article 22 GDPR. In view of this explanation from Uber, the court assumed that the decision to temporarily block access to the Driver app after a fraud signal was taken automatically, without human intervention. However, this temporary blocking had no long-term or permanent effect, so that the automated decision had no legal consequences or significantly affected the driver.
Subsequently, the Court concluded that the argument of the applicants that they were not informed in advance by Uber about the possible consequences of fraudulent acts is not supported by the facts. After all, it is not disputed between the parties that different conditions apply to the contractual relationship between Uber and the drivers, including 'Community Guidelines', 'Driver Terms' and 'Services Agreements'.
The Court concluded that for two of the applicants it must have been sufficiently clear from the messages from Uber they received and the explanation that Uber provided to them which fraudulent actions led to the deactivation of their accounts. According to the Court, there is therefore no violation of transparency obligations.
However, two other applicants were in a different position. According to the Court, Uber has not clarified which specific fraudulent actions resulted in their accounts being deactivated. In the Court's view, the decision to deactivate their accounts was insufficiently transparent and verifiable. As a result, Uber must provide them with access to their personal data pursuant to Article 15 of the GDPR insofar as they were the basis for the decision to deactivate their accounts, in such a way that they can are able to verify the correctness and lawfulness of the processing of their personal data.


holding_Datatilsynet (Denmark) - 2020-442-8862

First, the DPA noted that the controller is obliged to take appropriate technical and organisational measures to ensure an appropriate level of security relating to its processing. Now, the DPA found during its investigation that the controller, before both updates, did not qualify and perform any tests to identify how the update on the platform would affect the integrated database. In this regard, the DPA emphasised that even minor changes in integrated systems can lead to significant risks of data subjects, the sensitive nature of the personal data and the fact that there were two breaches. Lastly, as explained, the controller did not inform the Authority. Considering all of the foregoing, the DPA concluded that the controller violated Article 32(1) GDPR.
Second, the DPA considered that the breach of health data poses a high risk to the rights of the citizens concerned. Moreover, it noted that the controller notified the data subjects affected by the data breach via a health professional notification. However, the DPA found that this notification satisfied the requirements of Article 34(2) and Article 33(3) GDPR.
The DPA expressed serious criticism to the controller for violating Article 32(1) GDPR. Moreover, it issued a warning pursuant to Article 58(2)(a) and ordered the controller to bring its processing operations into compliance with the GDPR, pursuant to Article 58(2)(d) GDPR.

Datatilsynet (Denmark) - 2020-442-8862


The Belgian DPA found that the Authority had obtained the personal data of the Complainant for a specific purpose, namely to investigate and impose a fine for illegal dumping in the context of the GAS procedure.
The Belgian DPA stressed that the Authority did not need to reveal the identity of the Complainant to the four suspects to be able to investigate the illegal dumping and impose a fine. In other words, the four suspects were not part of the category of recipients to whom the personal data should have been disclosed for the purpose of the processing to be achieved. As a consequence, the Belgian DPA found that there had been a breach of the principle of purpose limitation pursuant to Article 5(1)(b) GDPR, since the disclosure of the Complainant's personal data by the Authority to the four suspects was not in accordance with the intended purpose for which the data were initially provided by the Complainant. Furthermore, the Belgian DPA found that the disclosure was made without the prior consent consent of the Complainant. As a consequence, such processing had no valid legal basis pursuant to Article 6(1)(a) GDPR. The Belgian DPA therefore also found a breach of Article 6 GDPR.
Despite the existence of these breaches, the Belgian DPA noted that, in the course of the proceedings, the Authority had explicitly acknowledged having committed a serious error, and had stated that it understood the importance of handling confidential data with care. The Authority also timely reported this incident to the Belgian DPA, and presented concrete measures to avoid such incidents in the future. For these reasons, the Belgian DPA decided to issue a warning, but did not impose any fine on the Authority.

APD/GBA (Belgium) - 130/2021


Involvement of the group's DPO
The court held that in order for the DPO to comply with its obligation to inform and advise the controller under Article 39(1) GDPR, it is necessary and imperative for the DPO to be involved in questions and projects involving issues relating to the protection of personal data at the earliest possible stage. The court found that the handling of the requests and complaints by data subjects was done by a local contact point without intervention of the group's DPO. The group's DPO was only involved when a data subject was not satisfied with the handling by the local contact point. Although the controller referred to regular communications via telephone, video conferences and e-mails between the local contact point and the group's DPO, it did not provide any documentation of these communications. It was also not demonstrated that the group's DPO had preliminary been consulted about putting into place the GDPR Board.
The court dismissed the controller's argument that the DPA did not take into account that the controller appointed its own DPO during the investigation. The DPA only considered the facts as they existed on the day it started its investigation. The court agreed with the DPA that any changes made by the controller during the investigation would not eliminate an established breach and would not relieve the controller from their responsibility.
The court also dismissed the controller's argument that the CNIL came to a different conclusion during its investigation of the parent company of the group and the other entities located in France. The court held that the CNIL's finding had no relevance as it did not concern the activities in Luxembourg and both the court and DPA are not bounded by decisions from administrative authorities or courts in other countries.
Thus, the court found that the DPO was not directly involved in all data protection-related matters. Therefore, the controller violated Article 38(1) GDPR and Article 39 GDPR.
Available resources for the DPO
The court held that the controller did not present any information about formalising the working time devoted to data protection of the local contact point. The court also noted that the local contact point was the only lawyer in the controller's company in Luxembourg. The court held that the DPO had to be involved in all personal data protection related matters, general consultation was not sufficient. The court then took into account the volume of activities of the controller in Luxembourg (70 sites, between 1600 and 2100 employees and 25000 consumers per day), which would have justified at least one full time person being devoted to data protection. The court thus found that the controller violated Article 38(2) GDPR by not providing sufficient resources to its DPO.
Imposed fine
Concerning the proportionality of the fine, the court took into account Article 83 GDPR and the seriousness of the violation. The court found that the fine was proportionate as the violations that were found were serious, involved potentially a large number of people and lasted at least from 25 May 2018 to 1 October 2020.
Thus, the court dismissed the appeal and upheld the DPA's decision that the controller violated Article 38(1) and (2) and Article 39 GDPR.

TADM - 46401


The DPA confirmed that the data subject correctly exercised his right to erasure. It also reiterated that the controller had explicitly stated that it had been unable to delete the e-mail address of the data subject from its address list. Thus, the DPA determined that the controller did not fulfil the principle of accountability under Article 5(2) GDPR, because it did not show that it could comply with the data subject's erasure request and was also unable to show that it facilitated the exercise of data subject's rights in Articles 15 - 22 GDPR, in this case, the right of erasure.
The DPA held that a by not granting the request to erasure, the controller had violated Articles 5(2) GDPR, 12(2) GDPR and 17(1) GDPR.
The DPA also determined that the controller's action of asking the data subject for additional e-mail addresses violated Article 5(1)(c) GDPR, the principle of data minimization. A controller had to be able to erase personal data from its database without asking additional e-mail addresses of data subjects. However, the DPA also confirmed that the controller's practice of sending mails using the 'BCC' feature was in line with the data minimisation principle, because this made it possible to e-mail different recipients without disclosing the identities of all recipients in the e-mail.
The DPA ordered the controller to comply with the erasure request pursuant of Article 58(2)(c) GDPR.

APD/GBA (Belgium) - 04/2023


holding_Tietosuojavaltuutetun toimisto (Finland) - 1150/161/2021

The Finnish DPA found that the firm had violated Articles 33(1) GDPR (notification of data breaches to the DPA) and Article 34(1) GDPR (communication of data breaches to data subjects) for having failed to report in due time the data breaches to the Finnish DPA and to the data subjects, respectively.
Furthermore, the Finnish DPA found that Article 5(1)(f) GDPR had been violated because the Firm had failed to implement appropriate security measures to ensure the integrity and confidentiality of the personal data. The Finnish DPA also considered that the Firm had violated its security obligations under Articles 24(1), 25(1), 32(1) and 32(2) GDPR. Finally, the Finnish DPA considered that the firm had failed to respect the principle of accountability enshrined in Article 5(2) GDPR, as it could not demonstrate compliance with the core principles of the GDPR.
The Sanctions Board of the Finnish DPA decided to impose a fine of €145,600 for infringement of Article 33(1) GDPR, a fine of €145,600 for infringement of Article 34(1) GDPR, and a fine of €316,800 for infringement of Article 5(1)(f) GDPR. In total, the administrative fine thus amounted to €608,000, representing around 4.2% of the Firm's turnover for the year 2020.


holding_Garante per la protezione dei dati personali (Italy) - 9771545

The Italian DPA held that the controller violated the principle of fairness and in particular the principle of storage limitation by keeping the data subject's account active after inhibiting her access to it (Article 5(1)(a)(e) GDPR). The DPA specified that, according to its own case law, work emails of employees must be deactivated at the end of the employment relationship. The DPA further clarified that the data rights of workers must be protected in the employment relationship regardless of the legal nature of the relationship itself. The data subject's position as an independent contractor thus did not change this.
The DPA also held that Article 13 GDPR was violated, as the controller failed to provide the data subject with the required information on the processing of her personal data. Finally, the DPA held that the company violated Articles 12(3) and 15 GDPR by failing to respond to the data subject's access request.
The DPA orders the controller to adopt suitable organisational technological measures to allow the data subject to access the email account and to deactivate it within 7 days. Additionally, to adopt an automated system to provide relevant third parties with an alternative (email) address and suitable measures to prevent the display of incoming messages within 10 days. The DPA further orders the controller to adopt measures to ensure requests from data subjects to exercise their rights are handled in a suitable and timely manner. The DPA prohibits the controller to further process personal data on the email account, without prejudice to the preservation necessary for the ongoing procedures regarding the breach of confidentiality. The DPA imposed a fine of €50.000 on the controller.


The DPA found that the controller's consent banner violated Article 22.2 of the Spanish Law on Services of the Information Society and Electronic Commerce (Ley 34/2002, de 11 de julio, de servicios de la sociedad de la información y de comercio electrónico - LSSI) which requires service providers to obtain consent before installing non-essential cookies. The use of pre-ticked boxes is not a valid basis for consent, and the impossibility to reject cookies miscategorized as essential is not legal either.
For these violations, the DPA ultimately fined the controller €18,000; an inital €30,000 fine was reduced by 40% because the controller voluntarily acknowledged responsibility for the infractions and agreed to pay the fine before final resolution of the sanctioning procedure.

AEPD (Spain) - EXP202103886


The appeal is unfounded.
The Council of State ruled that the appellant did not make it plausible that the Minister did not provide all the documents covered by her request. Also, in view of Article 15(1) of the GDPR, the appellant has no right to personal data of third parties. This includes information by which a third party can be directly or indirectly identified. The Minister has therefore rightly omitted/deleted the litigated passages.

RvS - 202002834/1/A3


The Litigation Chamber stated the "invite a friend" functionality made the provider a controller within the meaning of the GDPR, and such processing of personal data did not fall within the scope of the "household exemption". Therefore, the GDPR applied in full.
Only the data subject whose personal data are processed can validly consent to the processing of this data. The collection of contact details can take place only on a compare and forget basis: all data of non users of the platform should be deleted. That was not the case here.
No consent is required for an e-mail invitation to the user's non-member contacts under the following conditions (already stated by the Article 29 WP):
  * no pressure should be applied to the transmitter or receiver;
  * the provider is not allowed to choose the addressees of the message;
  * the identity of the user sending the message must be clearly indicated;
  * the user sending the message must be aware of the full content of the message to be sent on his behalf.
The social media provider claimed that others social media providers were following the same practices. However, the litigation chamber considered that was not a proper argument.
As conclusion, the litigation chamber imposed a fine of EUR 50,000 for processing personal data of non-members of the website without an appropriate legal basis, as well as personal data of members.

APD/GBA (Belgium) - 25/2020


holding_Garante per la protezione dei dati personali (Italy) - 9932951

The DPA assessed that the failure to reply to the request of the complainant by the data controller could be considered excusable since the complainant made an unclear request, as it referred to compensation for damages and to a streaming reproduction that the data controller never carried out.
However, it also found that the data controller breached Article 136 of the Italian Privacy Code, Article 137(3) of the Italian Privacy Code, Article 139 of the Italian Privacy Code and Article 6 of the Deontological Rules, and to the general principles of lawfulness and fairness in the processing of personal data set out in Article 5(1)(a) GDPR.
The DPA stated that a will is not a public document to which anyone with an interest may have access, even if such data was public and acquired lawfully. Moreover, the fact that the complainant's data were essential for the validity of the holographic will did not make them essential for the right to report, which could have been pursued without providing all the complainant’s personal data. In fact, the data disseminated were more than those necessary for proper information as it exposed the data subject well beyond the circle of her acquaintances, as by publishing it, the online newspaper made the data available on the Internet to an indeterminate number of people. Since the complainant was not a public figure, the reproduction had to be subject to the requirements of fairness, relevance, non-excessiveness and necessity in relation to the public interest concerned.
Thus, the DPA prohibited the data controller from further processing the complainant’s first and last name, date of birth and address of residence, and it fined the data controller €10,000 under Article 58(2)(i) GDPR and Article 83 GDPR.


holding_Datatilsynet (Norway) - 20/02042

1. The DPA held that Innovation Norway did not have a legal basis as per Article 6(1)(f) GDPR to conduct the credit ratings in question.
 2. They also held that Innovation Norway hadn't followed up on their own internal policies and procedures and these were insufficient.
 3. They also held that Innovation Norway breached their duty to notify the DPA three of the (first) personal data breaches (unlawful credit ratings), however they upheld it at the fourth.
For these breaches, the DPA fined Innovation Norway NOK 1,000,000.

Datatilsynet (Norway) - 20/02042


The ICO confirmed that the information requested (names of the examiners and date of the thesis' assessment) can be considered personal data related to the President Tsai Ing-wen.
Then, the DPA evaluated if the disclosure of this information would have been lawful, fair and transparent, according to the Art. 5(1)(a) of the GDPR.
With regards to the lawfulness of the request, one of the legal bases listed in Article 6(1) of the GDPR must apply to the processing. In this case, the Supervisory Authority specified that the 'legitimate interest' (art. 6(1)(f)) would underlie as the most appropriate basis.
Therefore, the ICO proceeded to assess the three-part test (legitimate interest, necessity and balancing tests) to see what would be the outcome.
As mention above, the data subject was interested in the legitimacy of President Tsai’s 1984 thesis (legitimate intest test) and, in his view, disclosing the names of the examiners who assessed the thesis, and the date when they ‘signed it off’, would have been necessary to support that the thesis was a valid piece of work (necessary test).
However, The Authority clarified that the fact that the thesis was officially listed in the publicly searchable University library provided the confirmation of a qualification of the President Tsai Ing-wen, thus the disclosure of the requested information would not be necessary for this purpose.
Furthermore, moving to the balancing test, the ICO interpreted this to mean that neither President Tsai nor the examiners would have expected their personal data to be released so many years before the introduction of the FOIA. Whilst President Tsai might reasonably expect this now, in particular in order to end the 'ongoing public controversy' on this topic, the Commissioner considered that disclosure remains beyond the examiners’ expectations. It is therefore possible that disclosing this information would cause them distress.
Taking into account this evaluation, the Authority rejected the request of the data subject and confirmed the choice of the University of London to withhold these pieces of information, in the light of the insufficient legitimate interest of the individual to take priority over the data subjects’ fundamental rights and freedoms.

ICO - FS50908339


holding_Datatilsynet (Norway) - 21/03823-45

The DPA highlighted that regardless of whether the appointment of a DPO is mandated in accordance with Article 37(1) GDPR, the requirements for the role in Articles 38 & 39 GDPR apply if a DPO is appointed by the controller. Accordingly, the DPA found that the presence of absence of such mandate could not influence the levying of sanctions.
The DPA was critical of the absence of documented reasoning for the termination of the DPO on the basis that one is not required under Article 37(1) GDPR. On this point, the DPA found a violation of Article 24 had occurred, with such documentation being necessary to demonstrate compliance with the GDPR, as required by Article 24. The DPA also noted that the actual processing activities of the controller were much broader than that claimed by them in the course of the investigation, and that when assessing the scope of processing activities, controller must also have regard to the activities that entity performs as a data processor.
In respect of the absence of published contact details of the DPO, the DPA found that the controller had violated Article 37(7).
The DPA found that there was a lack of evidence to conclude that the controller failed to involve the DPO in all matters in relation to data protection, in violation of Article 38(1) GDPR. It was held, however, that there existed a lack of policies detailing how the DPO should be involved, in violation of Article 24 GDPR.
The DPA found that the controller infringed Article 38(2) GDPR in failing to provide the DPO with the resources necessary to perform the tasks outlined in Article 39 GDPR.
In spite of the revelations of the investigation, the DPA found that there was insufficient evidence to conclude that the DPO was independent in the exercise of their function.
Overall, the DPA found that the controller infringed Articles 24(1) & (2) GDPR in not having implemented sufficient organisational measures to ensure and demonstrate compliance. The DPA concluded this for a number of reasons. Firstly, the PDA foundt hat there was insufficient documentation to establish that the DPO was being involved in data protection issues in a timely manner. Secondly, the DPA found that there existed no process for establishing a line of contact between the DPO and the highest level of management. Thirdly, the controller was found to have failed to document and establish the independence of the role of the DPO, particularly ensuring the distinction between the role of associate lawyer and the DPO function. Fourthly, the DPA concluded that the controller lacked appropriate documentation to ensure general GDPR compliance. This conclusion was reached based on the inadequate documentation to standardise procedures in the areas of internal data sharing and governance, ownership of business systems, and a general lack of certainty as the role played by the controller in respect of certain data, i.e. whether they were a controller or processor.
The DPA ordered the controller to carry out a detailed assessment as to whether they are required to appoint a DPO in accordance with Article 37(1), to update their ROPA and ensure it accurately depicts the organisation’s processing activities, and if found to be required to appoint a DPO, to implement appropriate procedures and policies for ensuring the position’s independence, reporting line to highest levels of management, establish a separate DPO email address, and document the DPO’s shareholding in the organisation.
The DPA also imposed a fine of NOK 4,000,000 (€351,477.64) on the controller.

Datatilsynet (Norway) - 21/03823-45


Controller responsibility
With reference to Article 8 GDPR, the AEPD points out that the processor carries out their function on the instructions of the controller and that therefore violations of the GDPR are attributable to the controller. As Articles 5(2), 24, 28 and 32 GDPR set out, compliance monitoring of the processing is attributable to the controller regardless of the involvement of a processor. The AEPD established that the processor was acting on the instructions of the controller in sending the advertisements.
Gravity of the violation and setting the fine
The AEPD held that the controller did not adopt the required diligence as it did not prevent the processing after the request had been made.
Therefore, on the 12 April 2024, the controller was fined €50,000 under Article 83(5)(a) GDPR for violating Article 6(1) GDPR. In setting the fine, the AEPD purported that the violation of Article 6(1) GDPR is of sufficient gravity to warrant the fine of €50,000 in light of the controller’s annual turnover.

AEPD (Spain) - EXP202307696


First, the DPA determined that there was no legal basis for the processing of the data subject's e-mail address, in violation of Article 6 GDPR.
Second, the DPA determined that the controller did not respond to the data subject's requests for erasure within one month, which resulted in violations of Articles 12(3) and 17 GDPR. The fact that the data subject did not address her request for erasure to the controller's DPO but to its customer service did not justify the controller's failure to reply in time. Nevertheless, there was no obligation in the GDPR for data subjects to submit their requests electronically, nor was there an obligation to send requests only to a specific e-mail address, pursuant to Article 15(3) GDPR.
The DPA reprimanded the controller pursuant to Article 58(2)(b) GDPR.

BlnBDI (Berlin) - 631.457.4 521.14765.10


The EDPS held that there had been violations by the CJEU, on its own webpages of several provisions of Regulation (EU) 2018/1725.
- Article 37 (accessing and storage of information on a terminal device), on the basis that the CJEU did not inform the user about the potential for YouTube cookies to be set if they accepted, nor did they provide a mechanism to refuse all cookies on the website.
- Article 7 (conditions for consent), "as the CJEU did not provide its website users with a way to withdraw their consent regarding the use of cookies as easily as giving it - such as a ‘reject’ button displayed in the same place and in the same manner as the ‘accept’ button. Instead, in order to reject cookies, users had to click on the button ‘more information’ and go almost to the bottom of the page to withdraw their consent."
It held that there were partial violations of
- Article 14 (transparency), in relation to the CJEU's website's own YouTube cookies. In relation to the third party websites, Fashion ID applied, as the CJEU had no obligation to inform users of cookies laid by a website linked to by that website, regardless of whether it was a service the CJEU were using to deliver material or the branding on the site.
The CJEU rectified all breaches following the complaint, in co-operation with the EDPS. As a result, the EDPS did not use any of its corrective powers. The EDPS also used the complaint to deploy its Website Evidence Collector (WEC).
In relation to linked pages of third party services that the CJEU used to host branded conference videos, which laid Google and DoubleClick cookies without information or a possibility to reject, these were in breach of the law but did not fall within EDPS jurisdiction, and the CJEU had no obligation to provide information on cookies on pages it linked to (Fashion ID applied). This case clarified and confirmed that a withdraw button is needed to be placed as clearly as an accept button in order for consent to be valid to cookies and similar technologies. The EDPS took no formal action as the CJEU engaged rapidly with the organisation and rectified all breaches following the complaint.

EDPS - 2019-0878


The DPA issued a reprimand against the company and ordered it to:
  * comply with the right to object within a month after the notification of the decision;
  * stop the processing of personal data for direct marketing purposes;
  * erase all the data of the complainant (except if another legal basis could justify the processing for another purpose)
  * notify all the recipients in accordance with Article 19 GDPR.

APD/GBA (Belgium) - 80/2021


The AEPD determined that the collection of data for entering a real state contract entails processing of personal data. Therefore, the controller had the obligation to provide the information required by Article 13 GDPR. However, the controller had not provided the data subject such information. The controller only mentioned the former Data Protection Act from 1999, and did not inform about the rights that the data subject is entitled to under the GDPR.
Hence, the AEPD fined the controller €2000, reduced to €1200 because of an early payment and recognition of responsibility, for a violation of Article 13 GDPR. In order to determine the amount of the fine, the DPA took into account, the absence of previous sanctions on the controller, the lack of benefit obtained by the controller and the small size of the controller.

AEPD (Spain) - PS/00177/2021


holding_AZOP (Croatia) - Decision 29-11-2021

The DPA held that the collection and processing of personal data, including an ID card copy, by the controller is lawful under Article 6(1)(c) GDPR when performed to fulfill legal obligations prescribed by ZSPNIFT.
The DPA stated that state that the controller had a justified reason based on the ZSPNIFT for which it is obliged to unequivocally establish the identity of the client by collecting a copy of the applicant's identity card, as well as a certain amount of personal data.
Furthermore, the DPA held that personal data must be processed lawfully under one of the legal bases set out in Article 6 of the GDPR, and the principles of lawfulness, fairness, and transparency require the data subject to be informed about the processing procedure and its purposes. In this case, the DPA found that the controller fulfilled its obligation under Article 13 of the GDPR by informing the data subject about the processing of his personal data, as evidenced by the correspondence and the document detailing the information on the processing.
In this administrative procedure, it was determined that the conditions for fair and lawful processing of personal data, as per Articles 5 and 6 of the GDPR, were met. The data controller demonstrated a lawful legal basis for processing the data subject's personal data, including the collection of a copy of his ID card. As a result, the data subjects's personal data was processed in a fair, lawful, and transparent manner in accordance with GDPR requirements.

AZOP (Croatia) - Decision 29-11-2021


The DPA seemed to infer that identifying a client at a bank for just the sake of providing them with a bank service involves a processing operation which must be carried out in compliance with Article 32 GDPR. The Spanish DPA considered the bank to have failed in adopting appropriate security measures by not verifying the data subject's identity in a reliable manner. As highlighted by AEPD, it was negligence that would have been overcome if available protocols would have been correctly followed. For example, correctly comparing and verifying both the photograph and the signature of the document that was presented in the request.
By not using appropriate technical and organisational measures to ensure a level of security appropriate to the risk, the controller violated Article 6 and Article 32 GDPR.

AEPD (Spain) - EXP202201721


holding_Datatilsynet (Norway) - 21/02504

The DPA found that the controller lacked a legal basis as per Article 6(1) GDPR, and informs in their decision that the relevant legal basis as per the GDPR, is Article 6(1)(f). The DPA found that the controller had also breached Article 5(2) GDPR, cf. Article 24.
For this, the DPA intends to fine the controller NOK 50,000 (€5,000), for conducting a credit rating without a legal basis under Article 6(1) GDPR and for not adhering to the accountability principle as per Article 5(2) GDPR, cf. Article 24. The DPA also requires that the company implement internal controls of their credit rating process. The controller has four weeks to fulfill the penalties, unless they appeal.
The controller has three weeks to appeal the decision, otherwise it will take full effect.

Datatilsynet (Norway) - 21/02504


The court rejected the application for interim relief in its entirety.
The court held that the application regarding the mask exemption certificates was already inadmissible when the data subjects filed the complaint, because, according to the uncontested statement of the controller, it transmitted all of the certificates to the prosecutor's office and did not store any certificates anymore. The court further reasoned that, because the duty to wear a mask in school was dropped on 2 April 2022, there were no indications suggesting that the data subjects will have to show further certificates in the near term.
Regarding the collection of test certificates, the court also found the application to be inadmissible. The court established that on 30 April 2022, four days before the decision was rendered, the relevant provisions of the 16. BayIfSMV have expired so that there is no duty to show test certificates anymore to participate in classes. The court also found no indications the school will collect test certificates of the data subjects again in the near term, because a reintroduction of the duty was not foreseeable at this time.
Regarding the storing of test certificates, the court concluded that the application was admissible but unfounded. The court did not decide on the disputed question whether a data subject has a right to an injunction under the regime of the GDPR [editorial note: see Comment section], because it found that the data subject's request can be construed as a request for deletion under Article 17 GDPR. However, the court concluded that the application against the storing of the test certificates was unfounded, because the controller processed the data in accordance with the Ordinance and the Ordinance in conjunction with Article 6(1)(c) and (e), (2), (3) GDPR constituted a valid legal basis for the processing. In this regard, the court referred to the decision by the Higher Administrative Court of Bavaria (Bayerischer Verwaltungsgerichtshof - BayVGH) from 04 November 2021 (25 NE 21.2634) in which the BayVGH established that the provisions in question were not invalid under the constitutional right to informational self-determination or under Article 9 GDPR.
Regarding the storing of test certificates after the expiration of the relevant provisions on 30 April 2022, the court found that the law does not determine whether the test certificates collected before must be immediately deleted or whether they can be stored for the 14 days period beyond 30 April 2022. The court reasoned that the purpose of the 14 day period is that that the school can monitor compliance with the access restriction to classes and investigate any cases where the validity of the certificate is doubtful. Therefore, the court did not see why the certificates collected shortly before the 30 April 2022 should immediately be deleted on that day. Moreover, the court held that interim relief can only be granted in the form of restriction of processing as Article 18(1)(d) GDPR established only a right to restriction as long as the lawfulness of the processing can not be finally assessed.

VG München - M 3 E 22.667


Following these initial steps (commencement letter, inquiry issues paper, draft decision, other relevant materials, submissions made by VIEC) the DPC issued its final decision. This decision identified three issues for determination, and proceeded to analyse these issues in turn. Firstly, an assessment of the risks of varying likelihood and severity for the rights and freedoms of natural persons of natural persons associated with the processing in question, having regard to VIEC’s own assessment of the risks. Secondly, whether the measures implemented by VIEC prior to the breach were appropriate to ensure ongoing confidentiality, particularly concerning special category data. Thirdly, whether these measures were appropriate in light of any obligations to implement a process for regularly testing, assessing and evaluating the effectiveness of its technical and organisational measures in respect of the security of the system.
With regard to the first question (assessment of the risks), the DPC observed the high number of data subjects involved and the sensitive nature of the data processed, and thus determined that the processing of data by VIEC is to be considered high risk. In addition, there were no specific references to the data protection in the company’s 'risk management policy'. According to the DPC, the VIEC’s use of its email system, and in particular the storing of biometric data and the lack of appropriate technical measures, created the risk of unauthorised access and disclosure. This constituted a high risk to the rights and freedoms of natural persons in terms of both likelihood and severity.
On the second issue, (measures implemented by VIEC to address the risks) the DPC made a number of observations. With regard to data governance, VIEC's data protection policy appeared to be outdated since it referred to the Data Protection Acts of 1988 and 2003 and did not make reference to the GDPR or the Data Protection Act 2018. Similarly, the Employee Data Policy did not refer to the GDPR. This would suggest that these policies were not reviewed or updated prior or after the GDPR’s entry into force. Furthermore, there was no evidence that VIEC had provided phishing training to its employees prior to the data breach taking place. Moreover, in terms of technical measures, the majority of user passwords were not set to expire and VIEC did not implement multi-factor authentication for users logging into accounts. There was also no journaling in place for emails at the time of the breach, and the controller was therefore unable to search for the original phishing email. Furthermore, with reference to VIEC’s submissions above regarding the impact of the Covid-19 pandemic, the DPC noted that, while the pandemic brought additional challenges, the shortcomings in the controllers processing of data and data security have existed since the implementation of the GDPR.
Addressing the third and final question (processes to test, assess and evaluate the effectiveness of measures) the DPC observed an overall lack of any technical measures to ensure ongoing confidentiality, integrity, availability, or resilience. In terms of organisational measures, VIEC had developed policies to avoid and minimise risk. The company was therefore clearly aware that the use of its email system for the storage and transfer of personal and special category data may present risks to the integrity of the data. However, no follow up action was taken to ensure that these policies were being followed or were effective. Overall, the lack of appropriate testing of technical and organisational measures, led the DPC to conclude that they did not meet the standard required by Articles 5(1)(f) and Article 32 GDPR.
The DPC concluded that the processing by VIEC failed to ensure that the personal data was processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage. The processing by the author of the phishing attack was unauthorised and unlawful. The processing by VIEC itself of personal and special category data on its email system prior to the phishing attack, without adequate security measures, placed such data at risk of being unlawfully accessed.
The DPC further added that the adequate technical and organisational measures that may have been employed by VIEC could have included, among others, appropriate encryption of personal data being transferred over external networks, and provision of suitable phishing training. Regular testing of the measures employed would also go some way to ensuring the security of processing.
Therefore, the DPC held that VIEC infringed Articles 5(1)(f) and 32(1) GDPR, and made an order pursuant to Article 58(2)(d) GDPR, obliging VIEC to bring its processing operations into compliance with the GDPR; and also issued a reprimand upon the controller pursuant to Article 58(2)(b) GDPR. In accordance with article 83 GDPR, and taking into account the factors outlined in Article 58(2)(i) GDPR, the DPC also imposed an administrative fine of €100,000.

DPC (Ireland) - IN-21-2-5


The Slovenian DPA advised that each controller of personal data must have a legal basis for such processing.

IP - 07121-1/2020/2281


One of the first arguments of the defendant is that it couldn't have known the identity of the third party as they are forbidden from collecting identification data for commercial purposes (article 127 WEC) when migrating from a prepaid to a postpaid abonnement.
However, the Dispute Chamber states that according to article 122 WEC, that this is possible when sending invoices or to protect the private life of the clients. The defendant had to check the identity of the third party, it is a legitimate purpose to prevent identity fraud with phone numbers as the impact on a data subject can be drastic.Not checking this is marked as grave negligence.
The defendant states that the impact on the personal life of the complaint is minimal which the Dispute Chamber dismisses as conversations are very personal and it is easy to access WhatsApp because only a phone number is required. SMS is also used for very personal things such as reminder of meetings (e.g. hospital, special categories of data) or it can be used to impersonate someone. The possession of a phone number creates a significant risk to the personal life of the data subject.
The Dispute Chamber states that defendant failed to respect the data breach notification deadline under Article 33(1) as this data breach poses a high risk to the data subject.
To determine the risks, the Dispute Chamber used the Guidance of WP29 250rev.01[1]. Possible damages for the usage of a phone number are discrimination, identity theft- and fraud, financial loss and reputation damage.The fact that it concerns one person and for a very short time are irrelevant as the risk is very high.
The controller must always implement the necessary technical and organisational measures to be in compliance with the GDPR and be able to demonstrate said compliance (Article 5(2) and Article 24 GDPR). It is one of the corner stones of the GDPR.
The defendant, as such, failed to take proactive measures: there was no verification of the identity of the third party and the data breach was not notified nor was it justified why this data breach was not necessary nor were there any logs on the data breach which is a breach of Article 33(5).
And even if a data breach poses no risks, it must still be logged internally.

APD/GBA (Belgium) - 05/2021


In the court's opinion, the controller was free to decide to process the personal data within the organization, or to outsource the processing to an external organization as processor, in this case DEX Online Services. In that context, Dex Online Services could rely on the basis of the controller, whereby he remained responsible for the processing that it had outsourced to Dex Online Services. Contrary to the plaintiff's submission, DEX Online Services as processor is not under any obligation to ensure that the controller, meets the obligations referred to in Article 6 GDPR.
In the court's opinion, the DPA was able to take the position that the accountability duty of the controller with regard to compliance with Article 5 (1) GDPR has been fulfilled . As the DPA explained at the hearing, this was substantiated in this case by submitting the signed processing agreement between the controller and DEX Online Services.
The court concluded that the respondent has rightly taken the position that there is no obvious violation of the GDPR and that there is no reason to further investigate the plaintiff's complaint.

Rb. Rotterdam - ROT 19/3036


The AEPD held that according to Article 22 of the Spanish Data Protection Act (Ley Orgánica de Protección de Datos Personales y Garantía de los Derechos Digitales – LOPDGDD), security cameras can be installed in order to preserve the safety of persons and property, as well as the security of premises, but that recording of public streets is only permitted to the extent that it is essential for these purposes. Additionally, the AEPD held that any recording of private premises cannot take place without consent.
Morever, the AEPD held that when installing video cameras, the information requirements under Articles 12 and 13 GDPR must be fulfilled by placing a sign in a sufficiently visible place which announces that the video processing of personal data is taking place, the identity of the data controller, and the possibility for data subjects to exercise the rights provided for in Articles 15 to 22 GDPR.
Since the individual did not submit any defense in order to justify why the cameras were pointed towards the street and adjacent private areas, the AEPD issued a fine of €1500 against the individual (€1000 for a violation of the data minimisation principle under Article 5(1)(c) GDPR, and €500 for a violation of the information requirements under Article 13 GDPR). Additionally, the AEPD ordered the individual to either take down the cameras, or to redirect them facing his property and place a sign containing the aforementioned information requirements.

AEPD (Spain) - EXP202100639


The Information Commissioner's Office held that Global One infringed Articles 22 and 23 PECR.
Global One relied on consent obtained by another organisation (Y) to send these text messages. However, the ICO's view is that third parties cannot rely on consent provided to an organization when the consenting individuals did not know how their data would be used by third parties. Organisations can generally only send marketing messages to individuals who specifically consented to receiving them. Indirect consent collected by a third party is only authorised where it is freely given, specific and informed (Article 4(11) GDPR).
As there is no evidence of individuals consenting to third party marketing, the ICO concluded that Global One did not have the necessary valid consent to send marketing messages. Therefore, Global One breached Article 22 PECR.
The ICO also held that Global One breached Article 23(b) PECR as it did not provide a valid contact point for recipients of marketing to send a request to refuse marketing. There was also no procedure in place for handling such requests from individuals.
The ICO therefore decided to imposed a fine of €11600 on Global One for breaching Articles 22 and 23 PECR. The ICO concluded that the contravention was serious and negligent. The fine can be reduced by 20% if paid within a month.

ICO (UK) - Global One 2015


Indecap had stated that the file was attached to the email as a result of a mistake made by an an individual employee. However, as the data controller, Indecap is responsible for all the processing of personal data that takes place under its management or on its behalf. Thus, the Swedish DPA chose to fine Indecap and not the employee.
Indecap is a securities company, meaning that the nature of its work imposed high protection standards as it processed, among other things, financial information and national security numbers. These high standards are also reflected in national law. Chapter 1, section 11, first paragraph of the Securities Market Act (2007:528) states that a person who is or has been affiliated with a securities company may not unauthorisedly disclose or use what he or she has learned in his or her employment or during the assignment about someone else's business or personal circumstances. It was clear that the processing in question therefore entailed high risk.
In accordance with Article 32 of the GDPR, Indecap has an obligation to protect the personal data that the company processes by taking appropriate technical and organisational measures. The personal data processing took place within the framework of Indecap's core business, for which the company should have had a good ability to ensure an appropriate level of security. According to Indecap's own information, the reason for the erroneously attatched file was that it had been named a similar name to another file that contained general information about the funds' performance. This suggests that Indecap did not had sufficiently clear instructions to prevent documents containing customer data from being mixed with other public documents. Moreover, the breach involved a large number of data subjects (approximately 52,000 persons).
For these reasons, the Swedish DPA held Indecap to have breached Article 32(1) GDPR and fined them around €43,700.

IMY (Sweden) - DI-2021-3422


The DPA considered that the controller failed to inform and facilitate the data subject’s erasure request in accordance with Article 12(2) GDPR and Article 12(3) GDPR in relation to Article 17 GDPR. The DPA noticed that the controller should have erased the personal data following the erasure request and informed the data subject of any measure taken.
Furthermore, the DPA pointed out that the controller may have breached Article 5 GDPR and Article 24 GDPR, stressing its obligation to implement technical and organizational measures to ensure compliance with the GDPR. The DPA took into consideration the time taken by the controller to answer the erasure request and the failure of the controller in deleting the article concerned. According to the DPA, those two factors highlighted the possibility of technical and organizational deficiencies in right’s requests management.
The DPA warned the controller and stressed that the aim of the warning is to prevent such a breach from happening again.

APD/GBA (Belgium) - 162/2024


holding_Garante per la protezione dei dati personali (Italy) - 9756853

The Garante stated that Arte del Vivere, as a data controller, proved to be completely unable to guarantee compliance with GDPR and the data subject’s deletion request. The Garante also noted that the company showed a total lack of control over the role of the data processor, including a failure to provide documentation in this regard. Additionally, the Garante stated that the company, as the controller, should have adequate measures to intervene in order to handle the data processed, and was directly responsible for the non-deletion of the complainant's data, regardless of the individual responsibilities delegated for processing purposes. Therefore, the Garante held that these organisational deficiencies led to the failure to grant the data subject his right to the deletion of his personal data, in violation of Articles 12 and 17 GDPR. Based on these violations, the Garante issued a fine of €5000 against Arte del Vivere.
The amount of the fine was based on the following aggravating factors: the seriousness of the violation, given that almost 2000 data subjects' personal data were published without an update since 2014, many of which might have been added without a specific request from these data subjects, as was the case with the complainant; the controller’s negligence and failure to carry out its obligations and grant the data subject’s rights under GDPR, which it seems to have ignored until the intervention of the Garante; the fact that the controller displayed an omissive conduct when the Garante made its initial requests for information, making it necessary to employ the Financial Police in order to address the Garante’s notification, which resulted in increased costs within the procedure, and the impossibility of carrying out a thorough investigation in the preliminary phase.


holding_Datatilsynet (Norway) - 21/03126

Pursuant to Article 58(2)(i) GDPR and Article 83(4)(a) GDPR, the DPA imposed an administrative fine of €220,337 (NOK 2 500 000) against Argon Medical Devices, Inc. for violating Article 33(1) GDPR by failing to notify a personal data breach without undue delay.

Datatilsynet (Norway) - 21/03126


The IMY (Swedish DPA), after highlighting the fact that Bonnier set up the framework for the accessing of the personal data by the affiliate countries, held that Bonnier News AB was a joint controller in respect of the processing activities. This included the initial collection of the data, the storage of that data in the databases, the profiling of the data subjects and the use of the data for the purposes of customised advertisements and direct marketing.
The IMY further reasoned that as the behavioral data base distinguished users based on cookie identifiers, and the users can be individually identified from them, the behavioral data base constituted personal data.
The IMY then considered the validity of the controller’s reliance on legitimate interest as a lawful basis for the profiling of user data. It was found that the interest being pursued was legitimate, and the processing in question necessary for the pursuit of the interest.
The IMY then turned to assess the balancing of interests. In respect of the making available of completed behavior profiles, it was noted that the overall benefit of the processing was for the controller to generate revenue from advertisements. The IMY disagreed with the controller’s assertion that the processing would be consistent with the reasonable expectations of the data subject, finding that the profiling was extensive in nature and not something which could be reasonably expected without consenting. The IMY thus found that the privacy interests of the data subjects outweighed the interest being pursued by the controller and as such, the controller infringed Article 6(1) GDPR.
With respect to the processing of simple behavioral profiles, allowing for the mapping of individuals through observation and the use of cookies, the IMY again held that the data subject’s interest in privacy outweighs the interests of the controller. The IMY reasoned that the monitoring of data subject behavior to provide targeted advertisements could give the data subject’s the feeling that they are being monitored.
The IMY thus found that the controller had processed personal data for profiling based on behavioral data for the purposes of enabling targeted advertisements without a lawful basis, infringing Article 6(1) GDPR.
The IMY issued a fine of SEK 13,000,000 (€1,157,483.21).

IMY (Sweden) - DI-2019-11737


On whether Google Ireland Limited is a controller
The court disagreed with the first instance court and held that Google Ireland Limited is the controller. The court held that it is irrelevant whether the controller only offers access to the search engine and took into account the CJEU judgement in C-131/12 - Google Spain and C-231/22 - Belgian State and held that the mere display of information containing personal data constitutes the processing of such data. The fact that the company itself does not decide which and how search results are displayed is therefore irrelevant according to the court. By offering German internet users access to the search engine, it provided users with the search results prepared by its parent company Google LLC and thus carried out data processing within the meaning of Article 4(2) GDPR.
The court further noted that naming Google LLC the controller in the privacy policy did not release Google Ireland Limited from its own responsibility in connection with data protection.
On the unlawful processing
The court took into account the CJEU’s judgement in C-460/20 - TU, RE v Google and held that the operator of a search engine is obliged to grand a request for erasure if the data subject can provide sufficient evidence that the information contained in the search results is manifestly inaccurate or at least part of it.
The court found that the data subject provided enough evidence that showed that the article provided inaccurate claims about the data subject. When weighing up the data subject’s interests, the court took into account the fact that the false allegation constituted criticism of the data subject and was therefore not value-neutral.
Therefore, the court held that the data subject’s personal data was processed unlawfully under Article 17(1)(d) GDPR and that the processing was also not necessary for exercising the right of freedom of expression and information under Article 17(3)(a) GDPR. The court therefore ordered the controller to delete the search results that linked to the article in question.
On the claim for injunctive relief
The court held that Article 17(1) GDPR grants the data subject a right to injunctive relief in addition to the right to erasure. The court imposed a fine of up to € 250,000 for each violation if the controller violates the injunctive order.

OLG Köln - 15 U 60/23


The DPA considered that SOLOCAL acted as a controller in carrying out direct marketing on behalf of its customers and in transferring the data for companies to carry out the direct marketing themselves. The DPA considered SOLOCAL potentially as a joint controller with its partners.
First, the way in which consent was collected in the online forms did not comply with consent requirements under the GDPR or national law (Postal and Electronic Communications Code or CPCE[1]). The DPA found that the design of the forms did not allow the user to give free and unambiguous consent. The forms gave a significant prominence to the buttons allowing processing for direct marketing purposes compared to the option of not consenting to direct marketing. According to the DPA, the user’s expression of wishes must relate precisely with the processing and cannot be inferred. This was supported by CJEU case law such as Planet49. Any inappropriate influence preventing the data subject from exercising their will render the consent invalid. Therefore the controller could not rely on consent as a legal basis (Article 6(1)(a) GDPR), given that the conditions for consent under Article 4(11) GDPR or Article 7 GDPR were not met.
The DPA also dismissed the controller’s argument on foreseeability. The DPA stated that rules relating to direct marketing and consent were available years before the investigation took place. This was especially the case considering the case law, guidelines and legal provisions it had cited to support its arguments on consent above.
The DPA did not consider the controller’s contractual measures as sufficient. The contractual framework was broad and placed a significant responsibility on the collectors of the data. The controller had the proactive obligation to carry out regular checks and to implement necessary consequences for the lack of validity. Furthermore, the controller had also failed to demonstrate that the data subject gave consent to process their data for direct marketing purposes under Article 7(1) GDPR and Article L. 34(5) CPCE. This was especially serious for one of the data brokers, because the controller was unable to receive information despite several requests.
Finally, the DPA considered the legal basis to transfer the data unlawful. Under Article 6(1)(f) GDPR, the interests and fundamental rights of the data subject may prevail over those of the controller taking into account the reasonable expectations of the data subject. Here, the DPA stated that the controller could not rely on legitimate interests in this case, considering the fact that the data subjects were not informed and therefore could not have reasonably expected such processing.
The DPA fined the controller €900,000, and ordered it to cease direct marketing activities in absence of valid consent. The severity and high number of people concerned were considered aggravating factors.

CNIL (France) - SAN-2025-001


The BVwG did not issue a decision on the merits of the case but remitted it to the DSB, ordering it to establish the facts of the case properly. It held that the DSB failed to assess which personal data of the data subject had actually been shared with the attorney. Furthermore, the Court pointed out that the DSB had also failed to establish when and how the respective data were shared with the attorney. In particular, the BVwG criticized that the DSB merely invited the parties to exchange submissions but took no further steps to objectively establish the facts of the case. Lastly, the BVwG held that the DSB failed to take into account Article 6(1)(e) and Article 9(2)(f) GDPR in their legal assessment but merely held that § 1 DSG had not been violated. The DSB will now have to follow the BVwG's orders, establish the facts of the case and assess it under Article 6 and 9 GDPR.

BVwG - W256 2240235-1


holding_ANSPDCP (Romania) - Briza Land SRL

The Romanian DPA initiated an investigation, and found that the real estate agency had indeed not responded to the request and failed to grant the information requested by the data subject, in violation of Article 15 GDPR. Therefore, the DPA issued a fine of approximately €2000 (9892.6 lei in local currency) against the controller.
The DPA also issued a corrective measure against the agency, ordering it to communicate to the data subjected all the information they had requested regarding the processing of their personal data, and to do so in 5 working days from the communication of the decision.

ANSPDCP (Romania) - Briza Land SRL


holding_Datatilsynet (Norway) - 20/03500

The DPA found that the Parliament, despite having identified several risks, lacked sufficient technical and organizational measures, including two-factor authentication, thus breaching Article 32(1)(b) GDPR and Article 32(1)(d), cf. Article 5(1)(f) GDPR.
For this, the DPA fined the Parliament about €196,400 (NOK 2 million).

Datatilsynet (Norway) - 20/03500