The CNIL ordered CARREFOUR BANQUE to pay an administrative fine of €800000. Insofar as the company took the necessary measures to put an end to the breaches of which it was accused before the end of the proceedings, the CNIL did not issue an injunction against it.
However, in view of the seriousness of the breaches sanctioned and the number of people concerned, the restricted formation pronounced an additional publication sanction for a period of two years.

On the violation of the obligation to fairly process personal data
When a subscriber to the payment card also wanted to join the CARREFOUR loyalty programme, he had to tick a box which provided: “I accept that CARREFOUR BANQUE communicates to CARREFOUR FIDELITE my surname, first name and email”. CARREFOUR BANQUE undertakes not to transmit any other information to CARREFOUR FIDELITE”. Nonetheless, the French DPA noticed that CARREFOUR BANQUE also transmits to CARREFOUR FRANCE other information: postal address, telephone numbers, and the number of children declared by the subscriber.
The French DPA concluded that this was a violation of the principle of fairness within Article 5(1)(a) GDPR, as the information given to data subjects are imprecise and misleading. The French DPA outlined that despite the lack of definition of fairness in the GDPR, this was linked to the requirement of transparency within Article 12. More specifically, the CNIL highlights that:
  * CARREFOUR BANQUE transmits to CARREFOUR FRANCE more data than those restrictively listed at the time of subscription.
  * CARREFOUR BANQUE mentions CARREFOUR FIDELITE as the recipient of the data communicated by data subjects, whereas this service, attached to the company CARREFOUR FRANCE, had never been presented to the subscriber prior to this mention.

On the lack of accessibility to information on processing of personal data
Quoting Articles 12 GDPR, the French DPA distinguishes between :
  * Access to information relating to personal data protection: In this case, the user could access the information relating to the processing of his or her data, either by clicking directly on the "Protection of Banking Data" tab at the bottom of the page, or by accessing the Legal Notice which referred to the privacy policy, thus requiring several actions by the user. On this point, the CNIL recalls the WP29 guidelines on transparency, according to which data subjects should not have to search for information, but should have to immediate access to it. So the French DPA held that there was a violation of the obligation of transparency as per Article 12 GDPR. On the one hand, the vagueness of the title "Protection of Banking Data" does not make it easy for the data subjects that this tab refers the personal data protection. On the other hand, with regard to access to the privacy policy via the legal notices, the CNIL notes that users must first undertake several actions before being able to access this tab.
  * The information provided to data subjects throughout the online subscription process: According to the CNIL, the information provided throughout the payment card subscription process was not easily accessible by data subjects. Although CARREFOUR BANQUE did provide the information expected as first level information on the page presenting the payment card subscription process (identity of the controller, purposes of the processing, description of the rights recognized to data subjects), the CNIL nevertheless emphasizes that CARREFOUR BANQUE neglected to complement these mentions by allowing people to read complete information by means of a link to this information. This was a violation of Article 12.

On the vagueness of data retention periods
Based on Article 13(2)(a) GDPR and WP29 guidelines on transparency, the CNIL noted that the CARREFOUR BANQUE’s privacy policy were imprecise and vague about data conservation information.
Indeed, the privacy policy contained vague and undefined formulations that confused data subjects as to the extent and nature of the data collected. Furthermore, the information policy did not specify the retention periods for all data and did not specify the criteria used to determine these periods.

On the use of cookies on the website
The French DPA recalls the provisions of Article 82 of the French data protection law (loi informatique et libertés), which requires that any deposit of cookies or tracers must be preceded by the information and consent of users. This requirement does not apply to cookies whose sole purpose is to enable or facilitate communication by electronic means or which are strictly necessary for the provision of an online communication service at the express request of the user.
In this case, the CNIL notices that 31 cookies were automatically deposed on users’ device upon arrival on the site’s home page and before any action by the user. More specifically, two of them were intended to trace the user and three of them were intended for advertising targeting.
Concluding that these five cookies do not fall within the scope of the exceptions detailed in Article 82 of the French Data Protection law, the CNIL noted the breach of Article 82 and underlines that the deposit of these five cookies should have required the company to obtain the user's prior consent.

CNIL (France) - SAN-2020-009


holding_Rb. Rotterdam - 9519423 \ CV EXPL 21-35975

First, the court referred to the provisions of the Protocol Incident Warning System Financial Insitutions 2021, specifically Article 5(2)1 which lists the requirements for deletion of registers.
In the present case, tt concluded that a fraud was indeed committed and stated that this qualified as a criminal offence under Article 350 of the CPS.
Therefore, the Court considered that the principles of proportionality and subsidiarity were respected and that the controller had a legitimate interest in protecting the financial sector from fraud.
No violation was found and the data processing was considered as legal.


holding_Garante per la protezione dei dati personali (Italy) - 9861289

The DPA pointed out that medical records constitute 'data relating to health' in the sense of Article 4(15) GDPR. Pursuant to Article 9 GDPR, this special category of data can only be disclosed to third parties on the basis of an appropriate legal ground or prior written authorisation by the data subject. It emphasized that the data controller must comply with the principle of "integrity and confidentiality", according to which personal data must be processed in such a way as to ensure appropriate security. This includes the protection against unauthorised or unlawful processing by appropriate technical and organisational measures (Art. 5(1)(f) GDPR). The DPA acknowledged that the controller acted immediately to minimise the damage and took measures to prevent further breaches, having cooperated with the investigations. However, it held that the disclosure of the data subject’s health data to an unauthorised third party violated Articles 5(1)(f), 9 and 32 GDPR. In view of this, it imposed a fine of €5.000.


The AEDP found that the information provided was in breach of Article 13 GDPR. Therefore, the authority warned the controller (Article 83(5) GDPR) and requested to complete the notice respecting the criteria of Article 13 GDPR.

AEPD (Spain) - PS/00315/2019


holding_CNPD (Luxembourg) - Délibération n° 16FR/2022

The DPA generally agreed with the opinion of the head of the investigation. It considered firstly that for some cameras, the field of view was not limited to what was necessary to achieve the purpose of the processing, which was violating Article 5(1)(c), i.e. the principle of data minimisation. This was the case for example for cameras filming public area.
Secondly, the DPA found a failure to comply with Article 13, which imposes an obligation to provide information. It considered that multi-level information is not excluded. As regards employees, it held that the first level of information (warning sign) should include the most essential information such as identity of the controller, the purposes of processing and a reference to more detailed information (e.g. via a QR code). As for the third parties (customers, service providers, etc.), the DPA considered the same : first level of information (warning sign) should also include the most essential elements of the processing operation and a reference to the second level of information. In this case, the sign didn't include essential information nor a reference to a second level of information. The DPA underlined the fact that Article 13 requires information to be given at the time the data is obtained, which does not imply that a document must be hand-delivered to all third parties but that a reference to detailed information must be indicated on the signs.
Considering the violations of Article 5(1)(c) and Article 13, the Luxembourg DPA therefore imposed a fine of €10,000 in accordance with Article 83(2).
Taking into account the measures already taken by Company A, the DPA also ordered corrective measures: in particular 1) to stop filming the employees' workplans and, if this cannot be avoided at all, to arrange for their faces to be blurred, and 2) to obscure the public area within the cameras' field of vision. Another measure is the obligation to have a single place where all the information required by Article 13 is available.


holding_Garante per la protezione dei dati personali (Italy) - 9872646

First, the Italian DPA held that the processing of personal data carried out by the controller through the use of a video surveillance camera violated Articles 5 (1)(a) and 13 GDPR. The DPA stated that the processing of personal data must always comply with the general principles of Article 5, in particular the principle of transparency, which demands that data subjects must always be informed that they are entering a video surveillance area. Information that must be provided when personal data are collected from a data subject is listed in Article 13 GDPR. In this case, the controller failed to put up the required information signs, which is why he was convicted of the violation of the aforementioned articles.
Second, the Italian DPA held that the controller violated Article 114 of the Personal Data Protection Code (Codice in materia di protezione dei dati personali), an Italian national law. The Article refers to a different Italian national provision (Art 4 L. 300/1970), which provides rules for when and under which conditions video surveillance of employee's activities is allowed. In particular, it states that authorization from the Italian labor inspectorate is needed, which the controller did not obtain. The provision is applicable thanks to Article 88 GDPR, which holds that it is permissible for national laws to provide a greater standard of protection than already given by the GDPR with regard to the processing of workers' personal data.
Due to these violations, the DPA imposed a €3,000 administrative fine on the controller. The DPA took into consideration the severity of the violations, the lack of any previous convictions for data protection violations against the controller and the fact that the controller had sent evidence of the removal of the surveillance camera.


Before giving its decision on the question in dispute, the Belgian DPA reminded the defendant that the plaintiff's notary's mistake of publishing unnecessary data, was no reason for justifying that the defendant should not be held liable for a possible unlawful processing, as the SPF argued. A data controller always being accountable for the data they process, no matter in what way obtained, the liability of the defendant could indeed also be sought in this case.
Thereupon, the DPA states that even if the publication was an obligation under the applicable corporate law and the data processing herewith found its legal basis in Article 6(1)(c) GDPR, the principle of minimization of data pursuant to Article 5(1)(c) could not be undermined as it had been by the defendant. It is not because a data processing is justified by the law, that its controller can process data within its framework as pleases them. Saying otherwise would mean questioning the very essence of the principle of minimization. Thus, the plaintiff was right in claiming that the processing of the data linked with the publication had no legal basis as per Article 6 GPDR, since the data was not necessary for the defined purposes, and that it meant that the defendant had not been within their right to refuse an erasure of the plaintiff's data pursuant to Article 17 GPDR. The DPA therefore issued a reprimand towards the defendant according to their powers resulting from the Belgian law establishing the national data protection authority and ordered them to grant the plaintiff's request and erase the litigious data.

APD/GBA (Belgium) - 38/2021


holding_AP (The Netherlands) - z2019-28837

The DPA held that under Article 17(1) GDPR read together with Article 12(3) GDPR the controller needed to comply with erasure requests without undue delay and in any event within one month of receipt of the requests. According to the DPA, the fact that the data subjects did not use the designated email address, but the email address of the recruiter that approached them, does not change the controller’s duty to comply. The DPA noted that it also did not detract from the severity of the violation.
The DPA also stated that the controller bears responsibility for the actions of its employees who, in this case, failed to respond to the erasure requests. This responsibility includes preventing human mistakes. Although the controller had complied with more than 650 erasure requests and only three incidents occurred due to human mistake, the DPA held that it did not excuse the controller from its responsibility.
The DPA took into account the fact that the failure of complying with the erasure requests was most probably a human mistake of one of the controller’s employees, the fact that the controller described in detail how to handle (erasure) requests and GDPR-related complaints they receive in their personal inbox or via telephone, and the fact that the controller has now strengthened its policy regarding (erasure) requests to prevent cases like this in the future. Therefore, the DPA found the €130,000 base fine of the Dutch Fining Policy Rules 2019 disproportionately high. As a consequence, the DPA only issued a fine of €6,000 on the grounds of Article 58(2)(i) GDPR and Article 83(4) GDPR.

AP (The Netherlands) - z2019-28837


The DPA was critical of the failure of the controller’s system to prevent unauthorised access to bank account information, despite the repeated requests from the data subjects. Accordingly, the DPA ruled that the controller violated Article 5(1)(f) GDPR.
The DPA also found that the unauthorised access was attributable to a failure on the controller’s part to implement appropriate technical and organizational security measures. The DPA held that the controller thus also violated Article 32 GDPR.
Furthermore, the DPA attributed the unauthorised access to the poor design of the bank’s online banking system. The DPA rejected the argument from the controller that the issue was attributable to the data subject’s configuration of the display of their account, finding that an appropriate banking application should not allow access to anyone who is not the account holder or authorized person. The DPA thus found the design of the online banking system to be deficient, thus violating Article 25 GDPR.
The DPA imposed a fine of €3,500,000 on the controller for these infringements. The controller was also required to implement the appropriate technical and organisational measures necessary to ensure the confidentiality of customer’s banking data through their online banking platform.

AEPD (Spain) - EXP202213437


The Court agreed with the appellant: legal basis of the processing of her personal data by ING is legitimate interest and not the legal obligation under the Dutch Financial Supervision Act (Wet op het financieel toezicht). This means, that she has the right to object to her personal data processing based on Article 21(1).
However, the Court rejects the appeal as such because the principles of necessity and proportionality are respected in this case. The appellant could not demonstrate that maintaining the registration would disproportionately affect her. The fact that she is financial reliable (even though challenged by ING) does not mean that she does not need protection from excessive loans. The mortgage rejection was done via phone and the appellant did not make use of the internal complaint procedure to challenge the rejection. Temporarily withdrawal of the record until the appellant gets another loan would represent disproportionate risks to the financial institutions.

GHDHA - 200.274.807 / 01


The Spanish National High Court (AN) analysed Recital 171 GDPR and noted that the Regulation had entered into force 20 days after its publication in the Official Journal of the European Union, that is, on May 24, 2016,
However, the Regulation only became directly applicable and mandatory in all its elements in each Member State as of May 25, 2018, therefore providing, the Member States and their respective Supervisory Authorities, of a period of 2 years for their preparation, application and interpretation of the different rights and obligations that it establishes. Therefore, both Directive 95/46 and the former Spanish Data Protection Act were fully valid and applicable to the case at hand at the time of the infringement, while the AEPD applied the GDPR to the case.
The AN held that the GDPR was not applicable when the alleged infringement happened, in April 2018, and that it had been retroactively applied by the AEPD, what goes against the constitutional principle of non-retroactivity of the law, enshrined in Article 9(3) of the Spanish Constitution.
The Court further clarified that the GDPR only could have been applicable if it had been more favourable to the infringer than the law that was in effect at the moment. Consequently, the AN upheld the appeal and annulled the sanction imposed by the AEPD on the controller, ordering the refund of the amount of the fine.

AN - SAN 1863/2021


The DPA issued a fine of €100,000 against the controller (0.34 % of the 2020 turnover).
Additionally, the DPA issues a reprimand for non-compliance with Article 30 GDPR.

1. Sensitive data
First, the DPA clarified that the processing of temperature of passengers via thermal cameras is a processing of sensitive data (health data) and the airport is the controller.

2. Legal basis
The DPA held that the airport relied on Articles 6(1)(c) and 9(2)(i) GDPR to process the data. Regarding Article 9(2)(i) GDPR, the DPA recognised that the the protection against COVID-19 was a matter of public interest in the area of public health. The DPA considered that no legal obligation existed since the protocol invoked by the controller to justify the processing was not legally binding and did not contain the obligation to conduct a monitoring of the temperature of the passengers. Moreover, the protocol was not precise enough regarding the purposes pursued and the circumstances of the monitoring. Additionally, it was not published and therefore not accessible to the passengers. The DPA also decided that the necessity was not demonstrated since the protocol itself referred to the recommendations of the European Union Aviation Safety Agency and European Centre for Disease Prevention and Control that considered that the temperature control was not proven to be efficient.

3. Transparency principle
The DPA also concluded that transparency principle was violated (Articles 5(1)(a), 12 and 13 GDPR). The fact that thermal cameras were used was not mentioned in the privacy policy or any other document. Also, the controller cannot rely on press articles to consider that passengers were properly informed. There was not reference to the exact and precise legal basis to which the airport referred as being basis for the legal obligation to monitor the temperature of passengers. The mere fact that the legal basis was available at the official journal is not sufficient (and such publication occured after the beginning of the processing).

4. Purpose limlitation
The DPA found that the purpose was, though explained, not sufficiently and explicitly defined, finding a violation of Article 5(1)(b) GDPR.

5. Obligation to conduct a data protection impact assessment (DPIA)
The DPA agreed with the inspection service and considered that a DPIA was required prior to the start of the processing operation. The fact that there was an alleged emergency is not exception to this obligation. The DPA also concluded that the quality of the DPIA was not meeting the requirements of the GDPR since the consequences and risks for rights and freedoms for the data subjects were not mentioned. The DPA concluded that the DPIA did not assess correctly the necessity of the processing. The lack of tools provided by the DPA for DPIAs is not an excuse to have a DPIA that is not meeting the requirements of the GDPR. Consequently, the DPA found a violation of Article 35 GDPR.

6. Security and integrity of the data
The DPA did not consider that the security of the data was compromised due to the low risk of illegal access to the images. It still advised to hold the password and the login to access the images in a different document (Articles 5(1)(g) and 32 GDPR).

7. Data protection by default and data minimisation
The DPA concluded that there was no violation of Articles 25 and 5(1)(c) GDPR, since the images were deleted every day, no names of the persons were stored, and the period of storage of the images was limited to what was necessary to find a person in the airport.

8. Records of processing activities
The DPA considered that the record of processing activities (Article 30(1) GDPR) was not complete enough, considering that the categories of recipient were not mentioned in the record.

9. Involvement and independence of the data protection officer (DPO)
Finally, the DPA did not share the conclusion of the inspection service that the controller's DPO was not independent enough (considering the position of the DPO in the hierarchy of the controller). The fact that the DPO needs to report every two weeks to the legal director is not incompatible with the requirement of independence, as it is accepted that a DPO has to report to a superior. However, the DPA expressed concerns regarding the suspension of the activities of the DPO due to the crisis, which could prevent the DPO from being fully involved in the in all issues relating to the processing operations of the airport. The DPA thus did not find a violation of Article 38 GDPR.

APD/GBA (Belgium) - 47/2022


The District Court Amsterdam rejected the claim.
First, it considered that the DPA has limited resources and receives tens of thousands complaints every year. Hence, the DPA has to consider which complaints they handle, and which complaints have a higher priority to be dealt with. The Court found that it follows from Article 57(1)(f) GDPR that the DPA has this margin to decide whether or not a complaint must be dealt with. The Court also acknowledged the DPA’s argument that this case was not that important in terms of societal impact. The Court therefore rejected the data subject’s claim.

Rb. Amsterdam - AWB 21/3724


After reviewing the facts of the case, the HDPA first stated that the telephone number of an individual constitutes "personal data" under Article 4(1) GDPR because it makes a person identifiable. Moreover, the HDPA held that ZENITH, who transferred the contact details of its customers to the processor based on a contract signed between them in order for the latter to conduct calls for marketing purposes, must be considered as a "controller" under Article 4(7) GDPR and the latter company as a "processor" under Article 4(8) GDPR.
Furthermore, the HDPA stated that both the controller and the processor companies were in breach of GDPR provisions. Specifically, the processor failed to implement appropriate technical and organisational measures for ensuring an appropriate level of security under Article 32(2) GDPR since it was their employee who made the relevant mistake. On the other hand, the controller was responsible for offering the appropriate tools and guidelines in order to prevent unlawful calls from being conducted and for supervising the processor's methods. Lastly, the HDPA states that it was the controller's duty to act upon the individuals' complaints. However, according to the HDPA, instead of addressing the problem and offering specific guidelines to the processor, the controller only provided them with general and inadequate guidelines.
Therefor, the HDPA fined the processor €30,000 under Article 58(2) GDPR and Article 83(4) GDPR for the breach of Article 32(2), Article 32(4) GDPR and Article 28(3) GDPR. As for the controller, the HDPA issued a reprimand under Article 58(2) GDPR for the breach of Article 28(3) GDPR.

HDPA (Greece) - 52/2021


holding_Datatilsynet (Norway) - 21/02293

The DPA held that the company had conducted an unlawful credit rating in violation of Article 6(1)(f) GDPR, issued a €20,000 fine and ordered them to implement internal controls of their credit rating process in line with Article 24 GDPR.
Despite the controller's arguments against a fine, the DPA noted the following aggravating factors in support of a fine:
  * Credit ratings are a significant intrusion into data subjects' private life.
  * The significant number of credit ratings the controller conducts.
  * Lack of sufficient routines for conducting credit ratings (that would likely have prevented the mistake).
  * The mistake could have been easily avoided by confirming the address directly with the new customer.

Datatilsynet (Norway) - 21/02293


On the request for a stay of proceedings
First, the companies requested that per Article 66 of the CNIL's rules of procedure, the CNIL stay these proceedings pending the decision to be handed down by the Council of State in the appeal against its first decision against Google and pending the conclusions of the new EDPB working group on cookies.
The CNIL rejected this request, as it considered that there were no acceptable grounds for staying the proceedings.

On the complaint alleging breach of the ne bis in idem principle
Second, the companies argued that the restricted formation cannot rule again on the same facts as those concerned by deliberations No. SAN-2020-012 and No. SAN-2021-004, without violating the ne bis in idem principle, as it considered the parties and material facts in those case to be identical.
The CNIL responded that the two procedures do not concern the same facts, as these cases included an injunction relating to the information of users on the purposes of cookies subject to consent and on the means available to refuse cookies, whereas the one at hand concerned the refusal methods themselves, and not only the information. It also highlighted that this procedure concerned both the websites "google.fr" and "youtube.com", whereas the previous procedure concerned only the website "google.fr".
As such, the CNIL rejected the complaint based on the violation of the ne bis in idem principle.

On the competence of the CNIL

The material competence of the CNIL and the non-application of the "one-stop shop" mechanism provided for by the GDPR
The processing operations investigated by the CNIL in this case were carried out in the context of the provision of publicly available electronic communications services via a public electronic communications network offered within the European Union. As such, it considered they fell within the material scope of the ePrivacy Directive. Article 5(3) of that directive was transposed into domestic law through Article 82 of the French Data Protection Act. The CNIL therefore considered itself materially competent under these provisions to monitor and sanction the access or registration of information by companies in the terminals of users of the "google.fr" and "youtube.com" websites in France.
The companies contested the jurisdiction of the CNIL. They argued they should be subject to the procedural framework provided for by the GDPR, or the 'one-stop shop' mechanism, under which the Irish DPA (DPC) would be the lead supervisory authority (LSA). They considered that the absence of specific rules on determining the competence of the supervisory authority in the case of cross-border processing operations falling within the scope of the ePrivacy Directive should be replaced by the application of the procedural framework provided for by the GDPR. Interestingly, the companies further argued that the EDPB's announcement regarding the creation of a working group on cookie banners in response to the significant number of complaints recently filed with supervisory authorities by noyb was evidence that the EDPB considers that cookie-related breaches fall directly within the scope of the GDPR and, therefore, the 'one-stop shop' mechanism.
First, the CNIL responded that a distinction should be made between, on the one hand, the operations consisting in depositing and reading a cookie on a user's terminal and, on the other hand, the subsequent use that is made of the data generated by these cookies ("subsequent/further processing"). The former are governed by special rules, set by the ePrivacy Directive - in this case, by its Article 5(3) - and transposed into national law, the latter is governed by the GDPR and, as such, may be subject to the "one-stop-shop" mechanism in the event that they are cross-border. This case only concerned the read and write operations carried out on the terminal of the user located in France visiting the Google Search and YouTube search engines.
Second, it held that where a processing operation may fall within both the material scope of the ePrivacy Directive and the material scope of the GDPR, reference should be made to the relevant provisions of the two texts which provide for their articulation. The rule laid down in Article 5(3) of the ePrivacy Directive, according to which reading and/or writing operations must systematically be subject to the prior consent of the user, after having been informed, constitutes a special rule with regard to the GDPR, since it prohibits the legal bases mentioned in Article 6 GDPR from being invoked in order to be able to lawfully carry them out. The control of this rule is therefore a matter for the special control and sanction mechanism provided for by the ePrivacy Directive, and not for the data protection authorities and the EDPB under the GDPR. It stated that the French legislator entrusted this task to the CNIL. Thus, the "one-stop shop" mechanism provided for by the GDPR could not be applied to the processing operations covered by the Directive, as the companies claimed.
Third, the CNIL confirmed that the 'one-stop-shop' mechanism is not applicable to facts that are materially covered by the ePrivacy Directive, by referring to the Opinion No 5/2019 of the EDPB and the CJEU decision C-645/19 (Facebook Belgium) upholding this opinion.
Finally, the CNIL stated that the creation of a working group on cookies in response to the large number of complaints filed by noyb did not mean that the EDPB considered that all violations related to cookies necessarily fall within the scope of the GDPR. Furthermore, pursuant to Article 70(1)(u) GDPR, one of the EDPS's tasks is to promote cooperation and the effective bilateral and multilateral exchange of information and best practices between supervisory authorities. The purpose of the working party was thus only to exchange views on the analysis of the numerous complaints lodged by noyb.
Thus, the CNIL held that the "one-stop shop" mechanism provided for by the GDPR was not applicable to the present procedure and that it was competent to control and sanction processing operations consisting of reading and/or writing information in the terminal of users located in France implemented by companies falling within the scope of the "ePrivacy" Directive, provided that they fall within its territorial jurisdiction.

On the territorial jurisdiction of the CNIL
The CNIL considered it was territorially competent under Article 3 GDPR since the processing that was the subject of the present procedure, namely consisting of accessing or recording information on the terminals of users residing in France when using the Google Search engine and YouTube, in particular for advertising purposes, was carried out within the "framework of the activities" of the company Google France, which constituted the "establishment" of the Google group in France. In response, Google argued that its establishment in the EU was located in Ireland. The CNIL considered a range of CJEU case law (included but not limited to Google Spain C-131/12, Weltimmo C-230/14) and its findings in the previous decision SAN-2020-012, which pointed towards a broad interpretation of 'establishment' and 'in the context of the activities' and rejected this argument. As such, it held that French law was applicable and that it was materially and territorially competent to exercise its powers, including the power to impose sanctions on processing operations falling within the scope of the ePrivacy Directive.

The determination of the controller
The CNIL held that Google LLC and Google Ireland Limited jointly determined the purposes and means of the processing consisting of accessing or recording information in the terminal of users residing in France when using the Google Search engine and YouTube.

On the failure to comply with the obligations relating to cookies
The CNIL finally assessed whether the companies had complied with Article 82 of the French Data Protection Act.
It noted that, in order to give consent to the reading and/or writing of information on their terminal, users visiting the home page of the sites "google.fr" and "youtube.com" only had to click on the "I accept" button on the pop-up window, which made the window disappear and allowed them to continue browsing. On the other hand, the users going to these same home pages and wishing to refuse cookies had to click on the "Personalise" button of this first window, which took them to an interface on both the "google.fr" and "youtube.com" sites, offering them the choice of activating or deactivating cookies, on which they had the possibility of carrying out various actions.
The investigator for the CNIL considered that making the mechanism for refusing cookies more complex than the one for accepting them amounted to discouraging users from refusing cookies and encouraging them to opt for the "I accept" button. This led to their conclusion that the methods of refusing cookies implemented by the companies on the sites "google.fr" and "youtube.com" did not comply with the provisions of Article 82 of the French Data Protection Act, as clarified by the enhanced consent requirements set out in the GDPR.
In response, the companies argued that neither the ePrivacy Directive, nor the RGPD, nor Article 82 of the Data Protection Act provided that the action of refusing cookies should be as simple as accepting them. "They [also added] that, for many years, the CNIL itself had not deduced this principle even though the regulations in question had remained unchanged since the RGPD came into force. They point out that the CNIL cannot, through its guidelines and recommendations, introduce new requirements relating to the refusal of consent and consider that it is up to each data controller to choose the most appropriate method of obtaining consent."
The CNIL rejected this, restating its powers, which include drawing up and publishing guidelines, recommendations or benchmarks intended to facilitate the compliance of personal data processing with the texts relating to the protection of personal data. It was in this context the DPA had issued its previous deliberations which provided guidance to stakeholders on the implementation of concrete measures to ensure compliance with these provisions, so that they implemented these measures or measures of equivalent effect. Indeed, the guidelines' main purpose "is to recall and clarify the law applicable to the reading and/or writing of information [...] in the subscriber's or user's electronic communications terminal equipment, and in particular to the use of cookies".
It thus considered that it had not created any new obligations for the actors in its recommendation, but has limited itself to illustrating in concrete terms how Article 82 of the law should be applied. The position according to which it must be as simple for users to refuse cookies as to consent to them was even endorsed by the French Council of State in CE, 19 June 2020, No. 434684, pt 15.
Further, the CNIL highlighted that users residing in France who visit the Google Search engine and/or YouTube had to perform a single action to accept cookies, whereas they had to perform five to refuse them. It was therefore not as simple to refuse cookies as to accept them. It referred to studies that showed that having a "refuse all" button on the first-level consent interface led to a decrease in the rate of consent to accept cookies. It therefore considered that making the mechanism for refusing cookies more complex than the one for accepting them actually discourages users from refusing cookies and encourages them to prefer the ease of the "accept all" button.
"In view of the above, the [CNIL held] that there [had] been a breach of the provisions of Article 82 of the [French] Data Protection Act, interpreted in the light of the GDPR, insofar as the companies [did] not provide users located in France, on the websites "google.fr" and "youtube.com", with a means of refusing to read and/or write information to their terminal that is as simple as the one provided for accepting its use.
Thus, the CNIL:
  * imposed a fine of €90,000,000 on Google LLC for failing to comply with Article 82 of the French Data Protection Act,
  * imposed a fine of €60,000,000 on Google Ireland Limited for failing to comply with Article 82 of the French Data Protection Act,
  * ordered Google LLC and Google Ireland Limited to modify, on the websites "google.fr" and "youtube.com", the methods for obtaining the consent of users located in France to the reading and/or writing of information in their terminal, by offering them a means of refusing these operations that is as simple as the mechanism provided for their acceptance, in order to guarantee the freedom of their consent;
  * attached to the injunction a penalty of 100,000 euros (one hundred thousand euros) per day of delay at the end of a period of three months following notification of this decision, with proof of compliance to be sent to the restricted panel within this period;
  * made its decision public on the CNIL website and on the Légifrance website, which will no longer identify the companies by name at the end of a two-year period from the date of its publication.

CNIL (France) - SAN-2021-023


The AEPD ruled that the sending of email without Bcc: the email recipients constituted a violation of the principle of integrity and confidentiality (Article 5(1)(f) GDPR). Regarding the fining, the authority decided to issue a warning sanction instead of a fine, although the sanction is still mentionning that the infringement at stake is subject to a fine according to Article 83.5 GDPR, in the lights of Recital (148) GDPR.

AEPD (Spain) - PS/00367/2019


The two complaints
On the question of whether Google had failed to remove search results without undue delay, the court upheld the DPA's decision on one of the complaints and dismissed the other. The latter was dismissed because the court concluded that the actual date on which the DPA's supervisory decision became legally binding was three days after Google removed the search result at issue.

Informing webmasters
The court ruled that Google's routine of regularly sending information to webmasters constituted a processing of personal data incompatible with the purpose for which the data was originally collected, and that there was no legal basis for the processing.
The court clarified that where a search engine invokes a legitimate interest and considers that the removal of a search result infringes freedom of expression and information [Article 17(3)], an assessment of the legitimate interest must be carried out before the search engine agrees to remove the search result. The court held that once a search engine removes a search result, this means that the competing legitimate interests have already been weighed against each other and the result was considered to be in favor of the data subject. The court concluded that a search engine should not undertake a new balancing of legitimate interests as to whether the webmaster should be notified. The court found that carrying out a new balancing of legitimate interests would mean that the data subject's right to be forgotten was not effectively and fully protected.

Sanction fee
While the court found Google's practice unlawful, it also ruled that the fine imposed on Google for failing to delete individual search results without undue delay should be substantially reduced. The reduction was due to the fact that the findings of the DPA on one of the complaints were rejected. The Administrative Court therefore reduced the penalty fee from a total of SEK 75 million to SEK 52 million.

FiS - 7565-20


The DPA reversed its previous decision, upholding the data subject's appeal for reconsideration and requiring the controller to answer the data subject's access request within 10 business days.
The DPA noted that bank transactions are personal data under Article 4(1) GDPR and are as such subject to the right of access guaranteed by Article 15 GDPR. The DPA did not, however, explicitly decide on the parties' arguments regarding the LCCC.

AEPD (Spain) - TD/00293/2021


The court found no violation of Article 15 GDPR, but found a violation of Articles 16 and 17 GDPR.
Firstly, the controller’s response was GDPR-compliant for the purposes of Article 15 GDPR. An incomplete response to an access request was not inherently a violation of Article 15(3) GDPR. The controller had provided a summary of the data subject’s personal data, along with an explanatory note outlining the processing purposes. In reaching its conclusion, the court referenced CJEU judgment of 4 May 2023 (ECLI: EC: C: 2023: 369), wherein it was established that Article 15(3) GDPR does not confer the right to obtain a copy of complete documents if these are not necessary to enable the data subject to effectively exercise the rights conferred on him by the GDPR. This response was sufficient to fulfil the specificity requirements of Article 15(3) GDPR, thus there was no violation of Article 15(3) GDPR.
Secondly, the controller’s failure to enforce the data subject’s erasure request was a violation of Article 17 GDPR. Given that the data subject’s data was unlawfully processed to begin with, they were entitled to the erasure of their personal data under Article 17(1)(d) GDPR. Moreover, the court concluded that the controller had no grounds to argue the application of Article 17(3) GDPR, which outlines instances where a controller may lawfully refuse an erasure request. The court found that “the defendant (controller) could not reasonably have considered it necessary to retain the claimant’s personal data in connection with archiving, investigation or legal proceedings.”
Thirdly, the court found that the controller’s refusal to rectify the data subject’s data was a violation of Article 16 GDPR. However, the right to rectification under Article 16 GDPR was to be disregarded in this case, as the data subject’s erasure request was upheld.
The controller (defendant) was ordered to reimburse the data subject’s court fees and legal costs.

Rb. Noord-Holland - HAA 21/6573


The CNIL issued a favourable opinion on the DPIA and approved the processing.
Firstly, the CNIL noted that the basis for processing were legal and fell within the provisions that the controller was seeking to rely upon. In this instance, the controller sought to rely upon Article 6(1)(e) GDPR and Article 9(2)(j) GDPR. Article 6(1)(e) GDPR establishes a lawful basis for the processing of data related to the performance of tasks carried out in the public interest. While, Article 9(2)(j) GDPR establishes a lawful basis for the processing of sensitive data (in this case health data) for purposes in the public interest. The CNIL decided that as the research concerned a national study on epilepsy for the purpose of improving the national health care system, the controller’s reliance on the above grounds was lawful, as it was fell within the definition of “public interest.”
Secondly, in its DPIA, the controller argued that to fulfil its disclosure obligations under Article 14 GDPR to the data subjects involved would involve a disproportionate effort given the number of data subjects concerned in the study. In total, this amounted to approximately 1.84 million people. The controller proposed instead of communicating the information required by Article 14 GDPR to each individual data subject, to publish the relevant information on its website, as well as the website of the Paris hospitals, and on the website of the French Association of Epilepsy. The CNIL approved of this and allowed for the controller to rely on the Article 14(5)(b) GDPR exception.

CNIL (France) - SAN-2023-0076


The Subdistrict Court concluded that the municipality has violated the GDPR by causing data leaks and is therefore liable for damages towards the claimant. In the circumstances of this case there was no reason to award material damages compensation, but there is reason to award (limited) immaterial damages to the claimant. The Court considered the damage compensation claim based on the Dutch Civil Code. The Subdistrict Court arrived at the conclusion that the security measures taken by the claimant could not be regarded as reasonable costs to prevent or limit damage because of the data leaks. The municipality can only be responsible for the breach of the social security number, phone number and email address of the claimant, and nothing else. It was taken into account that the claimant opted in for the public application process, making his address and name publicly available. Against this background it cannot be seen that, because of the data leaks, claimant was forced to secure his home to protect himself, his family, and his possessions. When it comes to the non-material damage compensation, the Subdistrict Court rules that the claimant had not, or at least insufficiently, demonstrated that he has suffered psychological injury because of the unlawful actions of the municipality. Only a strong psychological discomfort, such as temporary feelings of stress or anxiety, are sufficient for compensation of immaterial damage. However, the privacy of the claimant has been violated repeatedly by the municipality because of the unlawful publication of his social security number, the e-mail address, and the telephone number without his consent. These data are sensitive by nature, especially the social security number. The adverse consequences of leaking these, such as identity fraud, are obvious. Therefore, the Court ruled that the claimant was eligible for 500 EUR in non-material damages compensation.

Rb. Noord-Nederland - 8187989


First, the DPA confirmed that Nordax Bank was the controller because it decided both the purposes and the means of the processing. The processing in question was the selection of addresses from Iper's address register for direct marketing purposes. This selection was carried out on behalf of Nordax and was based on selection criteria determined by Nordax. Because Nordax Bank was the controller, it was also responsible for handling the data subject's requests. The fact that Nordax claimed that Iper was responsible for the address register did not change this. Also, the fact that Nordax only received de-identified data from Iper was also irrelevant for its responsibility for the processing.
Second, the DPA held that the controller violated Article 15 GDPR by failing to handle the data subject's request for access. It should have given the personal data and information to the data subject with the assistance of its processor Iper. It also should have recognised the data subject's initial request as an access request.
Third, the DPA determined that the controller violated Article 17 GDPR by not handling the data subject's request for erasure. None of the exceptions in Article 17(3) GDPR were applicable. Nordax therefore violated Article 17(1) GDPR.
Fourth, The DPA determined that the controller violated Article 12(3) GDPR because the controller had provided incorrect information. The controller had incorrectly informed the data subject on 12 February 2019 that he was blocked from the controller's direct marketing operation, while this was not the case at the time.
Fifth; The DPA determined that the controller violated Article 12(6) GDPR by requesting additional information of the data subject before complying with the data subject's second objection request on 9 July 2019. Nordax already had access to all the information necessary to comply with the objection of the data subject.
Lastly, the DPA concluded that the controller violated Article 12(3) GDPR once more by not informing the data subject that, in accordance with his second objection request of 9 July 2019, he would no longer be subject to the controller's direct marketing operation.
The DPA held that this was a minor infringement and reprimanded the controller pursuant of Article 58(2)(b) GDPR. The DPA further ordered the controller to comply with the access request pursuant of Article 58(2)(c) GDPR and to deal with the erasure request pursuant of Article 58(2)(d) GDPR. Also, the DPA ordered the controller pursuant of Article 58(2)(d) GDPR to provide the data subject information on the measures taken to comply with the data subject's objection to the processing in accordance with Article 12(3) GDPR.

IMY (Sweden) - DI-2020-10696


holding_Rb. Gelderland - C/05/404834 / HA ZA 22-245

Concerning the data subject's claim under Article 15 GDPR, the Court noted that the controller stated, with reasons, that a significant portion of the requested recordings could not be provided, because they did not exist. The Court held that it was the data subject's responsibility to assert and provide evidence that the controller actually had these recordings available. The data subject, however, did not provide such evidence. The Court deemed it not plausible that the controller had more recordings at its disposal than it claimed to have, and rejected the claim under Article 15 GDPR on this point.
Regarding the residual recordings, the Court pointed out that Article 15(3) GDPR gives the data subject the right to be provided with a copy of the personal data being processed. The Court followed that this right does not automatically entitle a data subject to access a copy or transcript of the original document on which their data is recorded. For example, a data subject is not entitled to the latter, in so far as the objective pursued by that right of access can be fully satisfied by another form of provision (CJEU 17 July 2014, ECLI:EU:C:2014:2081).
The Court recalled that, in its defence against the counterclaim, the controller stated that if the data subject wanted to know if and what personal information it stored relating to them, they could have sent an access request to the controller. The Court came to the conclusion that the data subject did not request such access to their data prior to their claim. Moreover, the data subjects did not substantiate that they were not able to check whether their personal data was correct and lawfully processed by relying on the rules in Article 15 GDPR. In addition, the court concluded that the data subject did not clarify their intent to safeguard the rights of others whose personal data was also processed in the conversation. Hence, the controller could not provide the data subjects access to the full Zoom conversations. In other words, the Court held that the GDPR does not oblige the controller to provide the defendants with access to the records to the extent claimed by the data subjects. The Court thus also rejected this claim.
Therefore, The Court denied the data subjects’ claim based on Article 15(3) for the access to the Zoom-call recordings. The Court did grant the data subject's claim under article 843a CCP for two Zoom calls.


Thus, the AEPD understood that the video surveillance system may have infringed the data minimisation principle and, after considering some circumstances [(i) the defendant is a natural person, and (ii) there is no evidence of the actual images recorded by the video surveillance system], it decided to impose a minor warning to the defendant. The AEPD also requires the defendant (i) to prove the actual images recorded by the video surveillance system, (ii) to prove the reason for the installation of the video surveillance system and (iii) to include the corresponding information poster in a visible area. Additionally, the AEPD also reminds that, in case the defendant does not comply with these requirements, this could lead to an economic sanction procedure due to a serious breach of the 73(o) of Spanish Data Protection Law (LOPDGDD).

AEPD (Spain) - PS/00454/2019


The Federal Administrative Court (Bundesverwatungsgericht – BVwG) upheld the decision and reasoning of the DSB.
First, the court elaborated on Article 15 GDPR though these statements were not necessary for the decision of the case. It held that a data subject has no general duty to cooperate, but at most an obligation to specify if the controller processes a large amount of data and the data subject makes a very general request or is only interested in specific information or data processing. In these cases, the controller can request clarification from the data subject, but has no right to do so. The data subject may nevertheless insist that all data be disclosed. This means that the two-stage information procedures that occur in practice, in which the data controller initially only provides information on master data and only provides comprehensive information at the express request of the applicant, are perfectly permissible, provided that the applicant is made aware of this fact.
Second, the court determined that the DSB was not allowed to close the proceedings informally but should have issued a formal notice according to § 24(6) BDSG because the data subject had objected with reasons against the termination of the proceedings.
Third, the court stipulated that the complaint about the delayed (Article 12(3) GDPR) response by the controller does not amount to a new complaint under § 13(8) AVG but is encompassed by the original complaint as a minus to it. However, it reasoned that a data subject has no right to have a past infringement of the GDPR determined by the data protection authority since § 24(1) BDSG and Article 77(1) GDPR refer to “infringes” in the present tense and not “has infringed”. Moreover, the court referred to Recital 63 according to which the right of access is intended to enable data subjects to be aware of the processing of personal data concerning them and to verify its lawfulness. In order to achieve this goal, it is not necessary for data subjects to have infringements which have been remedied in the meantime declared as unlawful. It also cited the decisions of the Supreme Administrative Court of Austria (Verwaltungsgerichtshof – VwGH, 2006/06/0330) and of the Austrian Constitutional Court (Verfassungsgerichtshof – VfGH, VfSgl. Nr. 12.768).
At last, the court determined that the "matter" of a proceeding (§ 13(8) AVG) which alleged non-disclosure under Article 15 GDPR cannot be entirely severed from the question of the completeness of the answer to the request. The core of the right of access is that the controller must disclose the specific content of all data being processed. However, the objective of Article 15 GDPR to enable the data subject to exercise their other rights must be considered as well. Therefore, if this objective is achieved by the answer, disputes about the sufficiency of specific parts of the answer may be considered as a different matter. This does, naturally, not apply to expressly limited requests of confirmation as to whether data about the data subject is being processed under the first part of Article 15(1) GDPR. Such matters are resolved with a simple yes or no answer.

BVwG - W274 2246166-1


The DPA first held that not ensuring the appropriate security of the personal data of the data subject by sending their medical information to third parties violated the principle of integrity and confidentiality under Article 5(1)(f) GDPR.
Furthermore, the controller was responsible for implementing appropriate security measures according to Article 32(1)(b) GDPR, for guaranteeing no alteration of the personal data and evaluating the possible risks related to the processing. The DPA remarked that the type of data that was exposed fell within Article 9(1) GDPR. With this in mind, the Spanish DPA found a violation of Article 32 GDPR since the lack of security measures adopted represented a structural problem of the controller.
Lastly, the DPA found a violation of Article 33 GDPR when the controller did not notify the personal data breach, which entailed a risk to the rights and freedoms of the data subjects, to the competent authority no later than 72 hours after becoming aware of it.
The DPA also considered aggravating circumstances in relation to Article 5 and Articles 32 and 33 GDPR. First, there was the duration of the infringement under Article 83(2)(a) GDPR; second, there was the categories of the data affected under Article 83(2)(g) GDPR; and third, there was the linking of the controller's activity with the processing of personal data under Article 76(2)(a) LOPDGDD.
Consequently, the DPA imposed a fine of €132,000 after applying reductions of 20% for a voluntary payment and another 20% for the acknowledgment of responsibility before the final resolution.

AEPD (Spain) - PS/00080/2022


The IP held that the Slovenian Police had misinterpreted their obligations under the consultation procedure under Regulation (EU) 2018/1861. This obligation requires that where an entry ban is issued against a third country national who holds valid residence in another Member State, the imposing country should consult them. If, as was the case here, the third country can confirm the existence of the residence, the entry ban should be removed from the SIS II.
The IP also rejected the Slovenian Police’s argument that Cyprus’ status as a non-Schengen country absolved them of their duty to consult under Regulation (EU) 2018/1861.
Accordingly, the IP found that the Slovenian Police had unlawfully refused the data subject’s request for erasure under Article 17 GDPR. The IP ordered the deletion of the SIS II alert within three days.

IP (Slovenia) - 0603-56/2024/6


The Spanish DPA finalized an agreement with the data controller after the start of an investigation of a probable infraction to Article 5(1)(f) GDPR. The alleged and possible GDPR breach was connected to the controller message sent to all community residents with individualized information about their heating consumption. Since this information is considered personal data, it could be understood as an illegal sharing of personal information.

AEPD (Spain) - PS-00085-2024


holding_ICO (UK) - Birmingham Children's Trust Community Interest Company

The ICO determined that BCTCIC were responsible for certain infringements of the UK GDPR resulting in a personal data breach in relation to Article 5(l)(f) UK GDPR and Articles 32(1)(b,) and 32(2) UK GDPR.
The Commissioner acknowledged that when the incident occurred BCTCIC was aiming to deliver its services between two neighbouring families and in the absence of certain data necessary to complete the CP Plan, BCTCIC attempted to act upon initiative using data copied from a related meeting statement with West Midlands Police. The Commissioner also acknowledged representations from BCTCIC and that whilst the disclosure caused no actual harms; there was an expectation of harm in the form of distress to both the data subject and family.
The Commissioner concluded that BCTCIC fell short of achieving appropriate technical and organisational measures to ensure the security of the personal data in this case. However the Commissioner welcomed the remedial steps taken and decided to issue a reprimand to BCTCIC in relation to the infringements of Articles 5(1)(f), 32(1)(b) and 32(2) of the UK GDPR.


holding_Datatilsynet (Denmark) - 2021-442-13989

The Danish DPA held that the controller did not implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk under Article 32 GDPR. The DPA was of the opinion that controllers must perform adequate testing in order to be able to identify and assess conditions that may, for example, lead to changes or reset previously selected settings. The controller's liability cannot lapse simply because the software provider had not adequately disclosed the extent of the update.
The Danish DPA therefore issued a serious reprimand.

Datatilsynet (Denmark) - 2021-442-13989


Ultimately, the Court rejected the controller's arguments and dismissed the appeal.
The Court first addressed whether, in a case where the controller carries out a processing activity that the data subject considers to be excessive and data has been already collected, the data minimisation principle from Article 5(1)(c) GDPR is directly enforceable, or whether the data subject must first exercise the right to the restriction of processing provided for in Article 18 GDPR.
As explained by the Court, Article 18(1) GDPR, in particular in paragraph (d), is linked to Article 21(1) GDPR, which guarantees the right to object to processing. Both rights are of a temporary nature and relate to a disputed deletion of personal data collected on the basis of Article 6(1) (e) or (f). At no point had the data subject sought the deletion of her personal data by the controller, so Articles 18 and Article 21 were not applicable.
The Court interpreted the controller as arguing for a procedural or enforceability prerequisite that would make the the competence of a DPA to launch an infringement procedure conditional on the exercise of a right by the data subject. Neither the GDPR nor the Spanish Data Protection Act (LOPDGDD) contain a provision that establishes such prerequisite, so the Court rejected the controller's argument.
Article 63 LOPDGDD differentiates between two different procedures for GDPR enforcement: procedures in which a data subject claims that their data protection rights have been violated and procedures that relate to an investigation of a GDPR violation. Hence, the exercise of data protection rights from Articles 15 to 22 GDPR is a different and independent procedure than investigation into a possible infringement of the GDPR or LOPDGDD. Consequently, a data subject may exercise their personal rights alternately or simultaneously to filing a complaint when they consider that a controller has acted contrary to the GDPR.
Regarding the controller's argument that the DPA failed to consider that the medical record in question was intended solely for the data subject, the Court explained that in this case the DPA did not find an infringement of the duty of confidentiality in Articles 5(1)(f) GDPR and Article 5(1) LOPDGDD. The circumstances alluded to by the controller were not relevant to an infringement of the principle of data minimisation.

TS - 1039/2022


The court dismissed the controller’s appeal. The only possible legal ground for the processing of personal data in this case is Article 6(1)(f) GDPR. But in this case the processing cannot be based on Article 6(1)(f) GDPR. The court held that cold calling might fall out of the scope of application of Article 6(1)(f) GDPR because Article 13(3) of the Directive 2002/58/EC (ePrivacy Directive) in conjunction with § 7(2)(1) German law against unfair competition (Gesetz gegen den unlauteren Wettbewerb - UWG) could be lex specialis. § 7(2)(1) UWG states that advertising by means of a telephone call made to a consumer without his or her prior express consent, or made to another market participant without at least the latter’s presumed consent constitutes an unacceptable nuisance to a market participant and is illegal.
However, the court’s decision does not depend on this question since the processing of personal data in this case also fails the balancing test under Article 6(1)(f) GDPR. This is due to the fact that the processing of phone numbers for cold calling purposes fails to match the criteria of § 7(2)(1) UWG which can be taken into consideration.
The court dismissed the controller’s argument that German competition law and the GDPR had different purposes and therefore, the DPA should not enforce competition law through the application of Data protection law. The court argued that an overall view would lead to the conclusion that it the cold calling was a uniform process in a way that the processing of personal data has the purpose of illegal cold calling. Therefore, the controller cannot argue that the DPA was not competent to enforce competition law.

VG Magdeburg - 1 A 217/22 MD


holding_Rb. Zeeland-West-Brabant - AWB- 20 9345

The court first considered the provisions on which the claim was based. The court found that the application was an access request based on Article 15 GDPR in conjunction with 7.3.10 of the Youth Act.
Secondly, the court considered whether it had jurisdiction to determine the matter. The court looked at the provisions of the General Administrative Law Act (AwB).
Article 1:3(1) of the AwB defines what an administrative decision is under Dutch administrative law: a written decision on an administrative body acting on the basis of a public law. Furthermore, Article 6:2(b) of the AwB stipulates that if an administrative body fails to respond to an individual's request in a timely manner, the request is deemed to be rejected so that the applicant can file an administrative appeal.
The court noted that Article 7.3.17 of the Youth Act was amended on January 1, 2015. This provision clarifies that private youth assistance providers are no longer considered administrative bodies. The court also referred to the already settled case law which also establishes the same thing.
The court therefore found that it did not have jurisdiction to decide the case. This was because the mother had brought an administrative claim against a non-administrative body. The court could not see that the alleged violations of the ECHR would lead to a different conclusion.
Finally, the court informed the mother that she could instead file her complaint as a civil dispute.

Rb. Zeeland-West-Brabant - AWB- 20 9345


The court rejected the appeal.
The court explained that under Article 2(2)(d) GDPR the GDPR doesn’t apply to processing of personal data within criminal proceedings. The feedback report was drafted as a part of criminal proceedings against the data subject. The purpose of the feedback report was to monitor the quality of the final report, disclosed to the court. For the court, the feedback report served then as the prosecution the criminal proceedings.
Consequently, the GDPR, including Article 15, didn’t apply to the data subject’s request and the Minister was entitled to reject that request.

RvS - 202202762/1/A3


holding_AZOP (Croatia) - Decision 04-22-2024 (gambling websites)

The Croatian DPA (AZOP) found that the controllers lacked a legal basis for processing in violation of Article 6(1) GDPR and failed to inform data subjects pursuant to Article 13 GDPR. In addition, one of the controllers violated Article 5(1)(a) GDPR after it began processing data before obtaining consent from data subjects. The AZOP imposed fines of €15,000 and €20,000, respectively, on the controllers.
Where processing is based on consent and has multiple purposes, cookie banners must indicate the purposes in a clear and understandable manner. They also must clearly distinguish the purposes from each other. In this case, the controllers did not distinguish different purposes for processing in obtaining user consent. Such consent, the AZOP found, did not meet the GDPR's requirements. As a result, consent was not a valid legal basis in this case and the controllers violated Article 6(1) GDPR.
The AZOP also found that the controllers failed to properly inform data subjects of the processing pursuant to Article 13(1) and (2) GDPR. In particular, their privacy policies did not contain information about the legal basis for processing, types of cookies, purpose of each cookie or cookie storage period.
Finally, the AZOP also noted that one of the controllers was processing personal data from the moment that the data subject opened the webpage even though it had not yet obtained consent. It considered this a violation of the principle of lawfulness, fairness and transparency under Article 5(1)(a) GDPR.


The court held that the action for a declaratory judgement was inadmissible. The data subject failed to present the court with a sufficient legal interest which is needed for such a declaratory judgement under § 256 German Civil Process Order (Zivilprozessordnung – ZPO). In cases of declaratory judgements concerning future material damages the admissibility of such an action is depends on the probability of such a damage. The data subject needs to present the court with sufficient facts and bears the burden of proof.
Even when considering just the data subject’s claims, the court found that there was no plausible future damage.
Concerning the non-material damages, the lawsuit was dismissed. The criteria of Article 82(1) GDPR were not met. The court held that there was no GDPR infringement since the controller could rely on Article 6(1)(f) GDPR for the data transfer to Schufa.
The court admitted that in the German case law there is a controversy on the question whether the right to privacy and data protection of the data subject outweighs the controller’s claimed legitimate interests (fraud prevention, overborrowing, and credit risk prognosis). In similar cases, some other courts held that the rights and interests of the data subject took precedence over the controller's legitimate interests (see for example LG Stuttgart 27 O 60/24). The court in the present case, however, decided that the interests of the controller superseded.
The court held that also the data subject had an indirect interest in the transfer of their data since risk minimization for the controller had to result in lower prices for the consumer. Furthermore, the so called positive data (like the data about the conclusion of the contract) were less invasive than negative data (e. g. about customers failing to pay). Also, a lack of positive data can lead to a negative bias in the scoring of the controller. The data subject also failed to present the court with facts that the transfer of the personal data in this case had a negative effect on his score. These facts had to be taken into account in the weighing of the conflicting positions at hand.
Finally, the court stated that the constant fear of negative questions about his creditworthiness claimed by the data subject were not plausible because the transferred data are neutral.

LG Kiel - 13 O 220/23


holding_Tietosuojavaltuutetun toimisto (Finland) - 6629/163/21

On the basis of the information provided by the controller, the DPA stated that data subjects do not need to know how to invoke a specific provision of the GDPR in order to obtain their personal data free of charge under the right of access. Instead, the controller has an obligation to facilitate the exercise of the right of access and to inform the data subjects of the possibility of obtaining a copy of their personal data free of charge pursuant to Article 15 GDPR.
The DPA considered that the data subject cannot, therefore, be required to familiarise themselves with, for example, the price list in order to be able to submit an access request. Also, by default, the controller may not charge a fee for the provision of MRIs to the data subject directly from the MRI scanning.
On the basis of the information gathered, the DPA held that the controller had violated Article 12(2) GDPR by not facilitating the exercise of the right of access under Article 15 GDPR. As a result, the DPA issued a reprimand to the controller in accordance with Article 58(2)(b) GDPR. Pursuant to Article 58(2)(d) GDPR, the DPA also ordered the controller to bring its processing operations into compliance with the aforementioned provisions of the GDPR.


Language of the procedure
First, the DPA explained some background information on the language of the procedure. On 13 October 2020, the Litigation Chamber sent a letter to the parties informing them of the language of the procedure (French), and inviting them to present their written submissions. The parties contested this, which led to this judgment and this appeal of said judgment. Ultimately, whilst the DPA's correspondence with the parties was conducted in Dutch and the preliminary and final decisions of the Litigation Chamber were in Dutch, the parties were free to use the language of their choice.

RTB and TCF
Second, the DPA defined and described the Real-Time Bidding system as well as IAB Europe's Transparency & Consent Framework.
Regarding the former, the DPA defined and provided some schematic representations[1] (of) the processing operations that underpin Real-Time Bidding. It then listed some of the risks associated with these, including: "profiling and automated decision-making; large-scale processing (including special categories of personal data); innovative use or application of new technological or organisational solutions; matching or merging of datasets; analysis or prediction of behaviour, location or movements of natural persons; invisible processing of personal data." It explained these operations carried out within the framework of RTB "can create a significant risk to the rights and freedoms of individual", particularly due to the large ecosystem of companies involved.
Regarding the latter, it principally highlighted the differences and connections between the OpenRTB protocol developed by IAB Tech Lab (based in New York) and the TCF developed by IAB Europe, namely that "the main players [publishers, adtech vendors, CMPs] within the TCF correspond to a large extent to the parties participating in the OpenRTB".

Procedure
After providing the information above, the Belgian DPA explained every step of the administrative procedure (from p.15-62). Whilst this is interesting to better understand the different arguments put forward by the parties (including some peculiar ones, such as that "IAB Europe does not participate in the TCF nor does it act as a data controller") this summary focuses on the reasoning of the DPA. It will therefore not consider these procedural elements.

Reasoning

Processing of personal data in the context of the Transparency and Consent Framework
The Belgian DPA started its explanation of the reasoning behind its decision with an assessment of whether personal data was processed by IAB Europe within the context of the Transparency and Consent Framework.
First, it restated that the concept of personal data and the notion of processing are to be interpreted broadly in light of both the GDPR and the CJEU's interpretation or European data protection law more generally. It cited the Breyer and Nowak cases to demonstrate that as long as information can be linked to an identified or identifiable natural person, it should be considered personal data.
The complaints argued that the TC String "is a unique character string which is also written into a cookie as a unique identifier and is then stored on a user's device", and that IAB Europe collected additional information about users, including special categories of personal data (Article 9 GDPR). The respondent argued that the TC String does not contain any personal data, that it does not constitute a unique identifier, and that a link between "the preferences conceived in the TC String and the user will be established only" in the context of the OpenRTB, which is not covered by the Transparency & Consent Framework. The DPA disagreed with the respondent's argument, holding that storing "the preferences of users in a TC String do constitute personal data, as these preferences relate to a singled out, identifiable natural person."
Second, the complaints argued that "the generation of the TC String corresponds to the automated creation of a unique string of characters associated with a specific user, through which their data exchange preferences are captured by the intervention of a CMP connected to the TCF" and "that the storage of a TC String in a specific euconsent-v2 cookie, on a storage system chosen by the CMP or associated with the consensu.org internet domain managed by IAB Europe" both constitute processing of user preferences. The DPA agreed, and held that "the Transparency and Consent Framework inherently entails the collection, processing, storage and subsequent sharing of users' preferences with other parties, whether or not in combination with additional personal data in the context of the OpenRTB", which amounts to processing of personal data per Article 4(2) GDPR.

Responsibility of IAB Europe for the processing operations within the Transparency and Consent Framework
Then, the Belgian DPA assessed whether IAB Europe can be held responsible for the processing operations within the Transparency and Consent Framework. IAB Europe argued it was neither a data controller nor jointly responsible for the processing of personal data collected by the participating organisations in the context of the TCF. The DPA disagreed because (i) the concept of a data controller must be interpreted broadly, and (ii) IAB Europe has a decisive influence on the purpose and means of the processing by imposing compulsory TCF parameters.
Indeed, it concluded that regardless of whether the defendant itself came into contact with the personal data, the participating parties (i.e. publishers and adtech vendors) would not be able to achieve the goals set by IAB Europe without the TCF. It therefore played a decisive role with regard to the collection, processing and dissemination of users' preferences, consents and objections. Further, it held that IAB Europe established "the purpose of the TC String, and in the broader sense of the processing of the TC String within the TCF as translated into the TCF Policies" and determined "the means of generating, storing and sharing the TC String by which the preferences, objections and consent of users are processed".
In particular, the DPA found IAB Europe to be a controller because it (i) defined how CMPs could collect the aforementioned data, (ii) developed the technical specifications of the API with which adtech vendors could access the preferences of the users, (iii) determined the storage location and method for both service-specific and globally scoped consent cookies, (iv) managed the lists of registered CMPs and adtech vendors, and (v) determined the way in which organisations participating in the TCF had to make these TC Strings available to it.

Joint controllership of publishers, CMPs and adtech vendors with regard to the means and purposes of the processing of personal data within the context of the TCF and of the OpenRTB
It continued its reasoning by assessing whether other data controllers implementing the TCF and relying on the OpenRTB protocol had "their own or shared responsibility for the personal data processing operations" they performed. It stated that the question "to be asked is whether the intended processing of personal data would be impossible without the participation of all parties, more specifically, whether the processing activities carried out by each party are inseparable and indivisible."
IAB Europe argued that the TCF and the OpenRTB system were completely independent from each other, as even without participating in the TCF, adtech vendors could freely process personal data within the context of the OpenRTB. The DPA disagreed, stating that it was "certain that the TCF was never intended to be a stand-alone, independent ecosystem." Thus, the DPA held that IAB Europe and the participating organisations were joint controllers because "the decisions translated by IAB Europe into the provisions of the TCF policies and technical specifications, on the one hand, and the means and purposes determined by the participating organisations in relation to the processing - whether or not in the context of OpenRTB - of users' personal data, on the other hand, [had to] be regarded as convergent decisions. IAB Europe provide[d] an ecosystem within which the consent, objections and preferences of users are collected and exchanged not for its own purposes or self-preservation, but to facilitate further processing by third parties (i.e. publishers and adtech vendors)."
Thus, the DPA held that IAB Europe and the participating CMPs, adtech vendors and publishers were joint controllers for the collection and subsequent dissemination of users' consent, objections and preferences, as well as for the related processing of their personal data. The responsibility of these organisations did not detract from IAB's own responsibility.
However, it specified that:
  * if CMPs apply TCF policies, IAB Europe is responsible for the essential means of processing and therefore jointly responsible;
  * if CMPs deviate from TCF policies, they are fully responsible per Article 28(10) GDPR
  * if CMPs follow publishers' instructions to decide which adtech vendors they share data with, publishers bear the main responsibility for this transfer - without prejudice to IAB Europe's responsibility

Breaches of the GDPR

Lawfulness and fairness of processing - Article 5(1)(a) and 6 GDPR
The DPA distinguished between two processing activities:
1. The registration of the consent signal, objections and users' preferences by means of the TC String
IAB Europe argued that because the TC String is not personal data, no basis for processing was required. The DPA disagreed, and held the processing should have been based on a lawful basis under Article 6 GDPR. Thus, the DPA assessed whether the processing could have been based on Articles 6(1)(a), (b) and (f) GDPR. It found that the first was de facto not applicable, the second prima facie not applicable, and that the company did not meet the third condition (the 'balancing test' between the interests of the controller and fundamental rights of the data subject) set out in C-13/16 / Rigas because no option whatsoever was offered to users to completely oppose the processing of their preferences in the context of the TCF, as the CMP will always generate a TC String before linking it to the user's unique User ID through a 'euconsent-v2' cookie placed on the data subject's end device - without informing them of this processing or their right to object to it. As such, the DPA held that IAB Europe's processing in the context of the TCF (of which it was the 'Managing Organisation') violated Article 6 GDPR by capturing the preferences of online users in a TC string without a legal basis.
2. Collection and dissemination of personal data in the context of the RTB
Then, the DPA first restated that the TCF aimed to capture users' consent or lack of objection to the legitimate interests of participating adtech vendors, two bases which relate to processing activities that take place under the RTB. It then nonetheless stated that Article 6 GDPR was violated because (i) the consent of the data subjects obtained through CMPs is not legally valid (ii) nor is the (pre)contractual necessity applicable, and (iii) that the legitimate interest does not meet the threefold test of the CJEU (as set out in C-13/16; C-708/18).
First, it held the consent of the data subjects obtained by the CMPs (via the TCF) is not valid in light of Article 7 GDPR. Indeed, the DPA found (amongst other things) that the proposed processing purposes were not sufficiently clearly described, and in some cases were even misleading. For example, the notion of 'measuring content performance' provided no insight into the scope of the processing, the nature of the personal data used, or how long the latter would be retained. Additionally, the user interface ('UI') failed to provide an overview of the categories of data collected and the identities of the data controllers to whom consent was given, making it impossible for data subjects to give sufficiently informed consent. As such, the DPA held that Article 6(1)(a) did not "constitute a valid legal basis for the processing and dissemination of personal data in the context of the OpenRTB, insofar as such consent was obtained in accordance with the TCF in its current format."
Second, it held that the legitimate interest of the participating organisations did not outweigh the protection of the fundamental rights and freedoms of the data subjects. To come to this conclusion, it assessed to "what extent the organisations participating both in the TCF and the OpenRTB (adtech vendors) [could] legitimately rely on Article 6(1)(f) GDPR for the predefined processing purposes that entail targeted advertising or profiling of the users, as opposed to non-marketing related purposes such as audience measurement and performance measurement." It first restated that an assessment of the necessary safeguards to prevent a disproportionate impact on data subjects needs to be performed jointly by all controllers involved in a processing activity and that both positive and negative consequences need to be considered when conducting this assessment. Then, the DPA in turn considered the:
  * Purpose test. It determined that the condition for specific lawful processing was not met, as it was not easy for users to assess to what extent the collection, dissemination and processing of their personal data were necessary for the intended purposes. Notably, the DPA nonetheless did not express an opinion on whether an economic interest can be regarded as a legitimate interest.
  * Necessity test. It determined the condition of necessity of processing was not met due to absence of measures that adequately demonstrated that no inappropriate personal data were being disseminated.
  * Balancing test. It determined that the interests pursued by the adtech vendors did not outweigh the fundamental freedoms and rights of the data subjects, and that "the legitimate interest of participating organizations [could not] be deemed an adequate legal ground for the processing activities occurring under the OpenRTB, based on users’ preferences and choices captured under the TCF."
As such, the DPA held that the processing of personal data under the OpenRTB on the basis of preferences captured in accordance with the current version of the TCF was incompatible with the GDPR, due to an inherent breach of the principles of lawfulness and fairness.

Duty of transparency towards data subjects - Article 12, 13 and 14 GDPR
The DPA then considered the complainants' claim that the OpenRTB ecosystem is so extensive that it is impossible for data subjects to give an informed consent to the processing of their personal data, or to object in an informed manner to the processing of their personal data on the basis of a legitimate interest. The defendants argued the TCF offers a solution to collect valid consent from users.
The DPA upheld the complainant's claim, and held that IAB Europe did not meet its transparency requirements under the GDPR because the manner in which information was provided under the TCF to data subjects was too generic, which is not compatible with the requirement that consent must be specific and informed in order to be valid. Further, the large number of adtech vendors that could receive the personal data of users was found to also not be compatible with the condition of a sufficiently informed consent, nor with the broader transparency duty set out in the GDPR.
As such, the DPA found the TCF did not comply with the obligations arising from the transparency principle, notably Articles 12, 13 and 14 GDPR.

Accountability (Article 24 GDPR), data protection by design and by default (Article 25 GDPR), integrity and confidentiality (Article 5(1)(f) GDPR), as well as security of processing (Article 32 GDPR)
1. Principle of accountability and data protection by design and by default
The DPA first simply restated the data controllers' obligations under Articles 24 and 25 GDPR, without explaining at this point whether IAB Europe complied with them.
2. The outline of the security obligation
Then, the DPA noted "a lack of respect for the obligation to ensure the security of processing on the part of the defendant, which is part of the principle of accountability." It highlighted the importance of organisations meeting this obligation, and the fact that "[t]he absence of technical and organisational measures aiming to ensure the integrity of the TC String" was a serious offence given the very large number of TC Strings generated each day within the TCF.
Indeed, it explained this finding by describing the fact that IAB Europe offers the TCF to make OpenRTB compliant with the GDPR, meaning that it should (as the managing organisation) take "organisational and technical measures to ensure that participants at least comply with the TCF policies." However, it was theoretically possible for CMPs to falsify or modify consent signals that are meant to be validated by IAB Europe to generate a 'euconsent-v2' cookie and thus reproduce a "false consent" from users for all purposes and all adtech vendors - even if this would constitute a violation of the 'TCF Vendor Compliance Programme'. Additionally, the sanction regime provided for by this programme was found to be insufficiently dissuasive, as vendors could be allowed up to 4 breaches before being forced into compliance.
As such, the DPA found that because the company did not systematically monitor compliance with the TCF and the significant impact the aforementioned violations could have, it failed to comply with its security obligations and "must take not only organisational but also technically effective measures to ensure and demonstrate the integrity of the preferential signal transmitted by CMPs to adtech vendors."
On international data transfers
Finally, the DPA interestingly held that IAB Europe "should facilitate the due diligence incumbent on the publishers and CMPs, e.g. by requiring adtech vendors to indicate clearly whether they are located outside the EEA or whether they intend to transfer personal data outside the EEA through their data processors." It noted that "contrary to its obligation under the principles of accountability and of data protection by design and by default, IAB Europe did not foresee any mechanism to ensure that participating publishers and CMPs have put in place adequate mechanisms for potential international transfers of the TC String, as foreseen under Articles to 44 to 49 GDPR, both at the time of its creation and when transmitting the TC String to participating adtech vendors. The preamble of the TCF Policies merely indicates that the TCF 'is not 105 intended nor has it been designed to facilitate […] more strictly regulated processing activities, such as transferring personal data outside of the EU'." As such, the DPA held this failed to meet the requirements of Articles 24 and 25 GDPR.

Additional alleged breaches of the GDPR
In this section, the Belgian DPA in turn (quickly) assessed a number of additional potential breaches of the GDPR.
Purpose limitation and data minimisation - Article 5(1)(b) and 5(1)(c) GDPR
The DPA held that because the complainants explicitly indicated that the scope of their allegations was limited to the processing operations within the TCF, and given the limited amount of data about a user that are stored in a TC String before being saved through a 'euconsent-v2' cookie, there was no violation of the principles of purpose limitation and data minimisation in the context of this framework.
Storage limitation - Article 5(1)(e) GDPR
The DPA held that there was insufficient evidence that the TC String and the associated storage of users' personal data were stored for an unauthorised period of time, meaning that no violation of Article 5(1)(e) GDPR could be established.
Integrity and confidentiality - Article 5(1)(f) GDPR
As explained above, the DPA held that the current version of the TCF offered insufficient safeguards to prevent the values included in a TC String from being modified in an unauthorised manner, with the result that the personal data of a data subject bundled in a bid request could be processed for the wrong purposes, in breach of the integrity principle, and/or might end up with the wrong adtech vendors or the ones rejected by the user, in breach of the confidentiality principle.
As such, it held that the current version of the TCF violates Article 5(1)(f) GDPR.
Processing of special categories of personal data - Article 9 GDPR
The DPA held that although its inspectors reported a lack of appropriate rules for the processing of special categories of personal data under the TCF, this observation was not be supported by any technical analysis showing that special categories of personal data were actually processed within the TCF. As such, IAB Europe did not violate Article 9 GDPR.
Exercise of data subject rights - Articles 15–22 GDPR
The DPA held that because the complainants limited the scope of their claims to the processing of their personal data by IAB Europe within the TCF, and the inspectors could not confirm that it was impossible for data subjects to exercise their DSARs, it was "not in a position to establish a violation of the Articles 15-22 GDPR."
Records of processing activities - Article 30 GDPR
The DPA first restated that its inspectors found that IAB Europe does not keep records of its processing activities, although it provided a summary of its processing activities over the course of the DPA's investigation. It then noted this summary contained no activity relating to the TCF (with the exception of member management, including administration of the TCF), but held the records should have at least included "access to users' consent signals, objections and preferences." Further, the company should have included its intention to monitor the compliance of the various CMPs and other adtech vendors in its records of processing activities.
As such, the DPA held that the company violated Article 30(1) GDPR, as it should have kept more detailed records of processing activities.
Data protection impact assessment - Article 35 GDPR
The DPA held that IAB Europe violated Article 35 GDPR by not carrying out a data protection impact assessment, which it should have according to Decision No. 01/2019 of the Belgian DPA in light of the large number of data subjects who come into contact with websites and applications implementing the TCF, as well as the growing number of organisations participating in the TCF, on the one hand, and the impact of the TCF on the large-scale processing of personal data in the context of RTB.
Designation of a Data Protection Officer - Article 37 GDPR
The DPA held that because the TCF must be regarded as a regular and systematic observation of identifiable users IAB Europe should have appointed a DPO, and that the failure to do so amounted to a violation of Article 37 GDPR.

Sanctions
In light of the above, the Belgian DPA ordered IAB Europe:
 1. To render the TCF compliant with the principles of lawfulness, fairness and transparency (Articles 5(1)(a) and 6 GDPR) by establishing a legal basis for the processing as well as the sharing of user preferences in the context of the TCF, in the form of a TC String and euconsent-v2 cookie placed on the users' devices for this purpose. It added that "any personal data collected so far by means of a TC String in the context of the globally scoped consents, which is no longer supported by IAB Europe, shall be deleted without undue delay by the defendant" and that it should prohibit the use legitimate interest as a legal ground for processing by the organisations participating in TCF in its current format.
 2. To render the TCF compliant with the transparency and information obligation (Articles 12, 13, and 14 of the GDPR), by requiring TCF-registered CMPs to take a harmonised and GDPR-compliant approach regarding the information to be provided to users through their interface. Namely, any information provided about the processing must be precise, concise and understandable in order to avoid users being surprised by subsequent processing of their personal data by parties other than the publishers or IAB Europe.
 3. To ensure compliance of the TCF with the principles of integrity and security, as well as data protection by design and by default (under Articles 5(1)(f) and 32 GDPR, and 25 GDPR) by creating effective technical and organisational monitoring measures to facilitate the exercise of data subject rights and to fix the possibility that signals are falsified; implementing a strict vetting process for organisations participating to the TCF; and prohibiting the "activati[on] of a default consent"
 4. To keep records of processing activities carried out in the framework of the TCF, and in particular relating to the 119 processing of users' preferences and consent in the form of a TC String and the placement of a cookie euconsent-v2 on their devices.
 5. To carry out a data protection impact assessment, covering both the processing activities under the TCF and the impact of these activities on subsequent processing under the OpenRTB.
 6. To designate a Data Protection Officer (DPO), responsible, inter alia, for ensuring the compliance of personal data processing activities in the context of the TCF, in accordance with Articles 37 to 39 of the GDPR.
The DPA set a deadline of 6 months (from the day an action plan is validated by the DPA) for these measures to be implemented.
Finally, it issued a fine of €250,000 against IAB Europe.

APD/GBA (Belgium) - 21/2022