The data subject applied for legal aid for court proceedings. The application for legal aid and the data subject’s objection as well as the decision of the district court to grant legal aid were submitted to the lawyer of the other party in the proceedings, who forwarded these documents, including the declaration of assets, to their client. Subsequently, these documents were forwarded by the other party in the proceedings to a third party.
On 6 April 2023, the data subject lodged a complaint with the Austrian DPA (“Datenschutzbehörde – DSB”) against the other party for forwarding the documents to a third party. The DPA held that the forwarding of the application for legal aid, including the declaration of assets, violated the principle of data minimisation pursuant to Article 5(1)(c) GDPR.
The other party appealed this decision at the Federal Administrative Court (“Bundesverwaltungsgericht - BVwG”). The court upheld the appeal and annulled the DPA’s decision. The court held that the DPA failed to question the third party, to whom the application for legal aid including the declaration of assets had been forwarded to, whether they had already been aware of the transmitted data beforehand. As the DPA had not made any findings on this question, the court could also not establish facts necessary for a decision on this matter. Therefore, the case should be referred back to the DPA to complete the facts of the case quickly and in a cost-saving manner.
The DPA appealed this decision at the Supreme Administrative Court (“Verwaltungsgerichtshof - VwGH”) and argued that it cannot be inferred from the wording of Article 57(1)(f) GDPR that the DPA is obliged to investigate beyond "to the extent appropriate". In the present case, it could not be said that the "appropriate extent" of the investigation was not reached. Moreover, there was also a lack of case law from the Administrative Court on Article 57(1)(f) GDPR. The annulment of the DPA’s decision by the Federal Administrative Court was therefore unjustified.


CNIL issued a fine of € 50 million against Google in CNIL - SAN-2019-001 after two complaints filed by noyb and La Quadrature du Net on the basis of lack of transparency of the privacy policy and the lack of valid legal basis to process the data. Google appealed the decision of the CNIL on several grounds, including the lack of competence of the CNIL since Google would have its main establishment in Ireland.

Dispute


In May 2018, a data subject, respresented by noyb - European Centre for Digital Rights, filed a complaint with the Austrian DPA. The latter referred the case to the Irish DPC as lead supervisory authority under Article 56 GDPR and a cooperation procedure under Article 60 GDPR was initiated.
On 11 January 2023, the DSB transmitted to the data subject the final decision by the DPC in accordance with Article 60(7) GDPR and informed her that the EDPB’s binding decision under Article 65(1)(a) GDPR would be published thereafter. Two days later, on 13 January 2023, the DSB transmitted the binding decision of the EDPB of 5 December 2022 to the data subject. The DSB informed the data subject that the parts of the original complaint that were not addressed by the DPC's decision are still pending before the DPC.
On 7 February 2023, the data subject filed an appeal with the BVwG, claiming that the transmission of the DPC’s decision by the DSB should be considered a partially dismissing or rejection decision within the meaning of Article 60(9) GDPR. Since the DPC and the EDPB failed to address some of the points raised in the complaint, the communications of the DSB, together with the decision of the DPC could not be interpreted as a positive decision in accordance with Article 60(7). In the complainant's view, the communication by the DSB therefore constitutes an official decisions within the meaning of section 58 et seqq. of the Austrian General Law on Administrative Procedures (Allgemeines Verwaltungsverfahrensgesetz, AVG).
In its submissions, the DSB argued that Article 60(7) GDPR applied in this case and the DPC would still be handling the case.


On 28 March 2019, the complainant submitted a DSAR to the Directorate of Legal Affairs of the Ministry of Foreign Affairs (The Directorate). The complainant has previously received an email from the Repatriation and Departure Service (DT&V), containing data about the claimant. According the DT&V, that data originated from the Directorate.
On 29 April 2019, the Directorate rejected the complainant’s request of access to his personal data. On 17 September 2019, complainant’s objection to this decision was rejected as unfounded.
The complainant appeals against this decision.

Dispute
The Directorate claims that the complainant’s DSAR cannot be granted because the Ministry is not controller of the affected personal data: the identity investigation in question was ordered by the Repatriation and Departure Service (DT&V).
In addition, after rejecting the complainant’s objection, the Directorate claimed that the complainant was abusing his rights. The Directorate pointed out that complainant has submitted access requests to both DT&V and the Directorate, and that he wanted to use this data in other process, so access to personal data was not the end goal of the request.


facts_Datatilsynet (Denmark) - 2020-431-0061 (Helsingor decision no. 3)

This is the Danish DPA's third decision in the case relating to Helsingor municipality's processing of personal data in primary and lower secondary school. Helsingor municipality, the controller, has been using Google Chromebooks and Workspace for Education in violation of several GDPR requirements, as detailed in the first decision of September 2021 and the second decision of 14 July 2022.
Following the second decision, the municipality submitted over 1,700 pages to the DPA to substantiate and justify their processing, including a data protection impact assessment (DPIA). The municipality agreed with the DPA that there was indeed a high risk to the data subjects using Google Workspace, but claimed to have identified and managed all relevant risks. Finally, the municipality assessed that Google acts solely as a processor, not as a controller.


facts_Tietosuojavaltuutetun toimisto (Finland) - 4680/182/18

The Finnish DPA had asked the controller (OP-Henkivakuutus Oy, a life insurance company) to explain on which legal basis and for what purpose it processed data subjects' health data requested from the health care. The controller was also asked to explain how it processed personal data before the execution of an insurance contract.
In response to the request, the controller clarified that the processing was based on Section 6(1)(1) of the Finnish Data Protection Act, according to which insurance institutions may, despite the general prohibition in Article 9(1) GDPR, process the health data of the insured party and the claimant, which is necessary to determine the liability of the insurance institution. The controller considered that it had the right to process health data at all stages of the life insurance customer relationship: when applying for insurance, during the insurance period and after an insured event has occurred.
The controller also stated that it requested all data subjects applying for life insurance for their consent to that the controller may, if necessary, request health data from health care units in order to process the insurance application and possible compensation case, and to ensure the accuracy of the health data. The controller considered it necessary that the consent given by data subjects was valid for the entire duration of the insurance contract.
The controller claimed that a situation where the data subject withdraws their consent or does not give it in the first place, but the controller must still issue life insurance and keep it valid, is impossible. In the controller's view, the data subject could have terminated the insurance at any time if they did not want the controller to receive their health data from the health care.


The data subject owns an apartment in an apartment complex. The Association of (home) Owners (hereafter: VvE), of which the data subject is a member, decided to replace the old surveillance cameras with new ones. According to the data subject, the new surveillance system led to an invasion of her privacy. She also stated that the new cameras could process biometrical data (which is sensitive data, Article 9(1) GDPR).
The VvE argued that the purpose of the camera surveillance is to protect the property of the common parts as well as the flats. They added that incidents of burglary and damage had occurred in the past, and that these new cameras are an appropriate security measure. Then, the VvE stated that this measure is not disproportionate since the cameras do not show the public road and do not process more data than is necessary. Moreover, the VvE claimed that protecting the property of the VvE and its residents cannot be achieved in any other way.
Lastly, the VvE argued that their legitimate interest (Article 6(1)(f) GDPR) outweighed the data subject's interest of privacy since data subject is only filmed when she is in common areas, the VvE has built in sufficient safeguards (technical and organisational), and people passing by are notified of the surveillance via a sign.
The data subject filed a complaint with the AP (Dutch DPA) and, after the DPA rejected the complaint, brought the action before court.


facts_Garante per la protezione dei dati personali (Italy) - 9853406

From 20 September 2022 onwards, five days before the Italian general elections, Meta Platforms Ireland Limited (Meta), the controller, launched a campaign specifically aimed at Italian adults, for the stated purposes of encouraging voting, providing information on the election, and combatting election interference. Specifically, Meta prepared electoral reminders on its Facebook and Instagram services, which redirected users to the website of the Ministry of the Interior where they could find “reliable information about the elections”. These features were available through the Election Day Information (EDI) function on the Facebook service, and by clicking on election day “stickers” (which can be added to shared photos and videos) through the Instagram service.
The Italian DPA considered it necessary to acquire further information regarding these activities and, by a letter dated 21 September 2022, sent a list of questions to Meta. In particular, this letter sought to ascertain: the nature and modalities of data processing in relation to the reminders and ‘stickers’, as well as the storage period of the data collected; the agreement allegedly in place with the Ministry of the Interior to redirect users to its website; any relevant corporate and community policies; any agreement with independent fact-checking organisations and the data exchanged with them; the manner in which the processing involved (in particular that which reveals political opinions) had been brought to the data subjects’ attention and the legal basis for such processing; and, finally, the measures put in place to ensure that these features would only be brought to the attention of those over 18 years old.
Meta responded to the DPA on 22 September 2022, via a letter which did not contain much of the information requested and did not alleviate many of the concerns raised. As a result, on 23 September 2022, the DPA called upon Meta to temporarily suspend the aforementioned processing activity. Late in the evening on 23 September 2022, Meta sent a letter in which it stated its intention not to pause the initiatives in question. Meta provided some additional information, in a non-exhaustive manner, which was still not enough for the DPA to alleviate its concerns. In fact, the information provided by Meta, in some respects, compounded these concerns further; in particular, by stating that the data would be aggregated within 90 days and could be shared with “third parties such as research partners, academia, governmental partners or electoral committees”.
Furthermore, in its responses to the Italian DPA, Meta stated that the development of the EDI function takes into account the recommendations made by the Irish DPA (DPC), which is the lead data protection authority of Meta, as this is the jurisdiction in which Meta has its main establishment in the EU (Article 56(1) GDPR). In particular, Meta asserted that the product was developed “following a broad consultation on the product characteristics and the relevant transparency safeguards”. Responding to this argument, the Italian DPA notes that the issues they have raised are linked to substantive issues (legal basis of processing, purpose limitation, nature of the data processed, data sharing, storage period and data retention). As such, despite the fundamental importance of transparency obligations, these concerns are not addressed exclusively by a focus on transparency.
By means of the voluntary mutual assistance procedure pursuant to Article 61 GDPR, The Italian DPA asked the DPC to: share information on the EDI functionality as a matter of urgency and to clarify whether, as stated by the controller, that functionality had received any form of approval by the DPC; and to consider, as a matter of utmost urgency, the adoption of corrective measures, including a temporary limitation on the processing prior to the holding of the elections in Italy. The Italian DPA rasied serious concerns regarding the assesment of the substantive issues by the DPC, and the feedback they received during this process. Therefore, they considered it necessary to adopt further measures in order to resolve this issue.


Ayuntamiento de Arroyomolinos was found lacking a Data Protection Officer (DPO).
The defendant has since adopted corrective measures. A DPO has been appointed pursuant to a service contract from 28.09.2020.

Dispute
Was the municipality Ayuntamiento de Arroyomolinos under the obligation to appoint a DPO?


A data subject returned a product to a store, Novates Alimentacion Madrid (controller), and was refunded too much money.
Upon visiting the store again, the data subject was shown CCTV footage of the incident by a staff member of her previous interaction at the checkout. The staff member showed the data subject a recording of this footage taken on her personal mobile phone and sent it to the data subject via WhatsApp.
In the video, other customers are visible, and the recording includes the voice of a staff member who remarks “that’s where the failure was”.
On 26 April 2024, the data subject filed a complaint with the AEPD (Spanish DPA).


The controller was a rail service that contracted with third-party security services to guard its facilities. Occasionally, when disagreements arose between customers of the rail service and the third-party security guards, customers would request the identification data of the security guards involved.
The controller's DPO requested guidance from the Catalan DPA (Autoritat Catalana de Protecció de Dades - APDCAT), asking the following questions:
 1. Would it be lawful processing to provide a customer the identifcation data of a third-party security guard without the guard's consent?
 2. What would be the legal basis for such processing under Article 6 GDPR?
 3. If any, what data could be provided?
 4. If a customer is provided a security guard's identification data, should that guard be informed?


A Home Owners' Association released a debtors list, that was shown publicly in the building's hall, where address details, name and surname of the claimant could be found.

Dispute
Is a Home Owners' Association allowed to publish such data?


facts_Datatilsynet (Denmark) - 2021-442-13805

On 12 July 2021, the Danish Customs and Tax Administration (CTA) reported a personal data breach to the Danish DPA (Datatilsynet). The CTA had sent a letter containing the personal data (of someone else) in the form of identification data, financial information and social security number, to the wrong recipient. The CTA knew already on 8 July that a breach had possibly occured, because the incorrect recipient made them aware. After the CTA's internal investigation, they concluded on 9 July that a personal data breach had indeed happened.
From the report to the DPA, the CTA stated that the affected data subject was informed on 10 July. Because of the information they had provided, the DPA closed the matter on 23 July.
However, on 20 August the DPA received a follow-up from the CTA, stating that they had not, in fact, informed the affected data subject on 10 July, as the initially reported, but on 18 August. The CTA explained that their late follow-up was due to the vacation period.
Because of the new information, the DPA decided to reopen the case.


facts_Tietosuojavaltuutetun toimisto (Finland) - 4431/161/21

The Finnish DPA was notified that the Finnish Motor Insurers' Centre (the controller) had requested unnecessary patient information from healthcare providers in order to settle claims. The DPA then asked the controller to explain how it processed patient information disclosed by healthcare providers for the purposes of settling claims.
In response to the request, the controller clarified that, according to Section 82 of the Finnish Motor Liability Insurance Act, it has the right, notwithstanding the obligation of confidentiality or other restrictions on access to information, to obtain statements made by healthcare providers and other information concerning the patients' medical records, health status, ability to work, treatment and rehabilitation.
The controller stated that it was impossible to process the claim without the claimants' medical records. The controller processed the patients' healthcare appointment data to determine whether the healthcare provider had charged for visits that were not related to the examination or treatment of injuries sustained in a traffic accident.
The controller emphasised that it followed the principle of data minimisation and that the patients’ healthcare appointment data were not requested unnecessarily. The controller also noted that it had to request a large amount of information in case the healthcare providers had omitted information necessary for claims handling.


facts_Rb. Oost-Brabant - ECLI:NL:RBZWB:2023:7274

The data subject owned a mobile home, which was permanently pitched at a campsite. Between 31 March 2021 and 4 November 2021, the Municipality of Oisterwijk's tax authority charged the data subject for municipal taxes of sewerage and commuter tax.
The data subject objected to the taxes through the Municipality's objection procedure. The data subject founded his objection on GDPR grounds and made the following claims: (i) he made an Article 15 GDPR access request, (ii) claimed that the taxes were invalid as they were calculated through automated means, and invoked his right not to be subject to automated decision-making under Article 22 GDPR, and (iii) made an erasure request under Article 17 GDPR.
On 22 March 2022, the Municipality responded to the data subject's objection and provided him with a copy of his data held by them, in the context of the calculation of the commuter and sewerage tax charges. The Municipality rejected the data subject's Articles 17 and 22 GDPR requests.
The data subject objected to the Municipality's response and appealed it to the Court of East Brabant.


facts_Rb. Midden-Nederland - C/16/502323 / HA RK 20-122

NWO-I (Netherlands Foundation of Scientific Research Institutes) rejected the applicant’s subject access request. More specifically, the applicant wanted to see what personal data was sent to his former employer by email and examine the related documents.

Dispute
NWO-I is of the opinion that the access request is formulated too broadly and must be rejected. Moreover, NMO-I claims that it has checked its personnel files and that these do not contain any personal data of the applicant.


A data subject complained that Alpha Bank (the controller) provided the complainant's wife with information about the maintenance of a credit card in his name, as well as printed receipts of all transactions he had made in the previous 3-4 months, without informing him. This resulted in in the significant disruption of the family peace and the relationship of the complainant with his wife.
The Authority invited the controller to provide information, specifying in particular:
At the same time, the Bank was requested to submit its relevant policies and to clarify whether the provisions therein were complied with and whether the alleged were treated as a data breach incident, in accordance with Articles 33-34 of the GDPR.
The Bank launched an internal investigation and confirmed the committal of the violation, which it attributed to an error of an employee of its local branch. The investigation concluded that employee acted without intention to deceive. This was because:
Regarding the management of the breach, based on Articles 33-34 of the GDPR, the Bank claimed that the incident was treated as a personal data breach, all relevant procedures for recording and handling it were followed, the responsible employee was referred to the Disciplinary Board and severely punished with a disciplinary dismissal penalty of one (1) month. No notification was made to the Authority under Article 33 GDPR, because it concerned only one subject and the controller thought that there was no possibility that it would affect the rights and freedoms of the subject himself or of other natural persons. While no notification was made to the data subject pursuant to Article 34 GDPR, the controller did not consider this necessary as the data subject had been the one to inform the controller about the incident.


facts_Datatilsynet (Denmark) - 2018-32-0232

A citizen requested the deletion of their personal data into the Copenhagen Civil Registration System (CPR).
The personal data have been deleted from the CPR, but the city deletion system results in a new subscription of the citizen’s personal data in the CPR each time deletion requests are made. The consequence is that Copenhagen included the claimant’s personal data in the CPR, even though the person did not live in Copenhaguen for years and had already asked for the deletion of the personal data registered.
Therefore, the Datatilsynet received a complaint regarding the continuous subscription of citizen's personal data into the Copenhagen CPR.

Dispute
Is the new subscription of personal data upon deletion request adequate, relevant and necessary for the performance of the citizen data collection service?


The controller provided remote psychic services via telephone, online chat or text message. On some of its websites, the controller offered personalised chats via telephone, online chat or text message. In order to promote their services, the controller and its partner sent marketing messages to existing and prospective customers via e-mail and text. Prospective customers contact details were obtained through a contact form on either of the two companies’ websites. The controller and its partner set up a shared database for their marketing purposes which on the 6 October 2022 included personal data of more than 1.5 million people.
On 15 November 2021, the French DPA (Commission Nationale de l’Informatique et des Libertés - CNIL) carried out an online check of five websites run by the controller or its partner. An on-site inspection was also carried out on 7 and 8 December 2021 at the premises of the two companies. The following details the findings of the investigation:
1) Data retention period proportionate to the purpose of processing under Article 5(1)(e) GDPR
The controller retained the data of its customers for a period of six years after the end of the commercial relationship.
2) Processing limited to necessary data under Article 5(1)(c) GDPR
The controller categorically recorded all telephone conversations with half of the conversations being deleted by the end of the day and the other half being stored for six years. The controller argued that this is necessary so that it would be able to respond to possible judicial investigations as well as for training and quality control purposes.
3) Prior consent to the processing of special category data under Article 9 GDPR
Through its partner's website, the controller gained access to data containing data subjects sex, date, time and city of birth, as well as their e-mail address, but also the sex and date of birth of their partner. During the remote consultations, a plethora of personal information may be disclosed by the customers. The controller argued that this sensitive data is not processed but simply recorded.
4) Processing for marketing purposes under Article L.34-5 of the French Post and Electronic Communications Code (Article L.34-5 Code des postes et des communication électroniques)
The notice included on the contact form did not list the controller by name, nor a list of all other third parties the data is shared with. While users could follow a link which provided some additional information, this link was located much further down on the form. Further, the information included in the link did not mention commercial advertising at all.
During the proceedings the controller changed the format of the contact form to include a very small unintelligible character attached to a word on the form. A click on this character then lead to a footnote which was not visible on the original form listing the controller as the provider of marketing messages.
The controller argued that it would be impossible to provide data subjects with a comprehensive list of recipients as this would breach contractual confidentiality clauses.


facts_Datatilsynet (Denmark) - 2019-812-0035

A prison officer had requested the Prison and Probation Service to get access to documents confirming that he as an employee had been involved in violent incidents. He later clarified that he wanted access to all documents that mentioned his name.
The Prison and Probation Service initially rejected the request on the grounds that, for technical reasons, it was not possible to report all the episodes in which the officer had participated and it was only possible to seek reports that the officer had written himself. Then, they claimed that searching all relevant documents that mentioned the complainant's name would be an excessive burden according to Article 12 (5) GDPR.
The prison officer then complained before the DPA about the Prison and Probation Service's refusal to grant access.


facts_Rb. Midden-Nederland - C/16/542054 / KG ZA 22-341

Data subjects were a group looking for paranormal activities. They visited a cemetery in the municipality of Amersfoort (controller) to conduct a séance, "looking for energies of the deceased". This happened with the permission of the director of the cemetery.
The parents of two children who were buried at the cemetery later found out about the séance and requested the data subjects' NAW-data (name, address and residence) from the municipality. They wanted to talk to them directly and possibly hold them liable for the damage they suffered as a result of the séance. The mother stated that it is absolutely not allowed to summon "spirits or devils" at graves in their Islamic culture. As a result of the séance, she claimed to have suffered serious psychological problems.
The data subjects did not want their personal data to be disclosed. They had received serious threats because of the incident and felt unsafe.
The municipality apologised for the events but stated that it was not obliged to disclose the personal data to the parents. It did offer to facilitate a conversation between the parties, during which the data subjects would remain anonymous, but the parents declined the offer. The parents were of the opinion that the municipality was acting unlawfully by not providing the personal data, so they brought the case before the court.


facts_Personvernnemnda (Norway) - 2021-03

This case is an appeal of the decision DT-20/02178 by the Norwegian DPA (Datatilsynet), in which it imposed a fine of NOK 400,000 (approx. €38,300).
The controller argued that the size of the administrative fine imposed, was too high and therefore appealed the decision with the DPA. The DPA reviewed their decision, but upheld it.
The case was therefore was submitted to the Privacy Appeals Board (Personvernnemnda) for consideration.


A data subject filed a complaint against Lia's Clothes (an online clothes store) stating that the website did not have an adequate privacy policy or cookie banner.
The Spanish DPA (AEPD) initiated an investigation, and determined that once data subjects were prompted to introduce their personal data, there was indeed no information provided related to the protection of personal data, or a link to a privacy policy.
The AEPD also verified that when entering the website, non-essential cookies such as Google Analytics are used, without an adequate banner informing data subjects about their use, the possibility to reject them, or consent to them in a differentiated granular manner.


facts_Tietosuojavaltuutetun toimisto (Finland) - 3831/161/21

The Finnish DPA had asked the controller (Kesko Oyj, Finland's largest retail chain) to explain how it processed and stored personal data in connection with its loyalty program.
In response to the request, the controller clarified that it processed basic customer information, such as the person's name and contact information, and purchasing behaviour data. Purchasing behaviour data indicates customers' detailed and product-specific purchase data. Depending on the situation, the information related to the customer was erased at the end of the customer relationship or anonymised no later than 25 months after the end of the customer relationship.
The controller also stated that it processes purchase data for business development, the provision of benefits and services, and the implementation and targeting of marketing. The controller emphasised that unjustifiably prohibiting or restricting the collection and processing of data that benefits the customer would undermine data-driven innovations and product development.


The data subject was a gym member at a fitness franchise (School Fitness), which allegedly acted as a joint controller together with the local gym. On 7 February 2021, the data subject filed a complaint through the controller’s website as they were unhappy about being filmed during fitness classes without consent.
In its reply, the controller asserted that the data subject had given consent by signing the membership contract. The contract contained a clause stating that by signing, the member authorised the company to use all images, photographs, videos, voice recordings, graphics, etc., in which they appeared.
On 9 May 2023, the data subject noticed that a phone was recording the class, despite their repeated objections to being filmed. The data subject believed that the contractual clause referred to in the email exchange was abusive and, on 30 May 2023, filed a complaint with the AEPD (Spanish DPA).
Upon receiving the claim from the DPA, the controller denied the allegations. It asserted that members who signed the contract expressly consented to being recorded and to the dissemination of the recorded material for promotional purposes. It also claimed that verbal consent was obtained during classes.
During the investigation, three main issues arose: first, whether the clause in the membership contract validly obtained consent for recording; second, whether the controller complied with the GDPR principles for processing images; and third, whether there was a properly formalised data processing agreement between the franchise and the local gym concerning the handling of images. Additionally, the data retention policy indicated that images would be kept indefinitely.


facts_Tietosuojavaltuutetun toimisto (Finland) - 2245/163/2019

The controller is X Oy, a provider of parking services. When paying at a payment machine, the customer could choose to receive a digital receipt, a paper receipt, or no receipt. If the customer wanted a digital receipt, they had to give their phone number, so the receipt would have been delivered via SMS. However, when the receipt-printer in a payment machine had a technical failure, the customer was left with the impression that their only option to receive a receipt, was via SMS. Although the customer could have also requested a paper receipt from the customer service, they were not informed of this option.
The data subject did not have the opportunity to receive a paper receipt (due to a technical failure) and filed a complaint with the Finnish DPA.


The plaintiff had used the defendant’s services, a nonprofit organization, for medical care. Afterwards, she received a communication from that same organization, informing her of the enrolment of its managing director on a regional electoral list. Upon receiving the communication, the plaintiff decided to exercise her rights as data subject, in order to obtain more detailed information on the data processing and gain access to the personal data being processed about her. (Art. 12, 15 GDPR). Getting no response from the data controller within the legal deadline (1 month), she also exercised her right to erasure (Art. 17 GDPR) arguing that the data processing could not have been lawful. Obtaining no response whatsoever from the defendant, she finally lodged a complaint with the data protection authority in accordance with Art. 77 GDPR.


The data subject submitted a data erasure request to Google LLC (the controller) on 8 September 2021, requesting the removal of thirty nine search results from the controller's search engine that were produced with her full name search. The results linked to pages where the data subject's name had been linked to a criminal conviction. As a relative of a public figure, the case generated public interest, and her sensitive data on her criminal situation was extensively published. The data subject stated that it was wrong for websites to publish sensitive data as she was not a public figure. To make sure that information related to her criminal conviction would not appear as a result of a search with her full name. The data subject made several requests to the controller to remove 39 URLs from search results. The data subject stated that the company's rejections based on public interest are not valid as no public interest allows the publishing of sensitive data. The subject also points out that in the absence of a relevant public prosecutor's order under Article 2 of Greek Law 2472/1997 allowing the publication of such data, the company must delete all relevant data from the results of its search engine.
The controller upheld that the requests for removal of URLs from (1–12) are related to business activities and refer to felonies allegedly committed by the data subject for which she was convicted. The links (13–14) concern unpaid wages and insurance issues that directly relate to her business activities and are not disputed for accuracy of information. The controller believed the reference to the public interest in the information was valid, and the data subject lacked grounds for the "right to be forgotten," thus they argued against deletion. Finally, the controller stated that for the content of the links (15–39), which do not refer to the data subject and also lead users to websites where content was not available. So the controller will remove links (15–39) from the list of search results that appear on the basis of her name.
The data subject argues that it is necessary to delete in total nine URLs (1-6, 11, 13, and 14) because they relate to her personal data related to criminal conviction, along with the fact that she is not a public figure. The data subject points out that the data controller must consider whether the data subject is still active in the same profession when evaluating, as she ceased her professional activities related to the case fifteen years ago. Despite this, the data controller failed to consider specific criteria outlined in the EDPB Guidelines 5/2019, emphasising the sensitive nature of the personal data requested for deletion. Additionally, the data subject pointed out that, according to the CJEU judgement, the right to privacy generally prevails over the public's interest in accessing information, unless the data subject plays a significant role in public life. Since data subjects had no such role in public life, this highlighted the controller's failure to demonstrate the necessity of retaining the information. However the controller held that a legitimate interest of the public to have access to the information is established.


HUBSIDE.STORE (“controller”) has stores in France, Belgium, Spain, Portugal and Italy. In France, the controller carried out canvassing campaigns by telephone and SMS from prospect files purchased from two main data brokers, in order to promote the products it sold. The French DPA (“CNIL”) carried out an inspection at the controller’s premises in order to verify compliance with the GDPR and French Data Protection Act.
During this inspection, the CNIL discovered that, regarding commercial prospecting by SMS, the controller carried out these operations using prospect files purchased from data suppliers. These data suppliers collected the data of the persons concerned via entry forms for online competitions, in order to enable their partners to use them in their commercial prospecting.
The CNIL indicated that the forms accessible on the websites of the data suppliers were similar: beneath the fields enabling the person to enter their contact details was a “VALIDATE”, “I VALIDATE” or “I ANSWER QUESTIONS TO APPLY” button. Above or below this button, a text specified that by clicking on the button, the data subject declares that they have read the controller’s privacy policy and accepts that the data collected will be used to send them offers from the company’s partners. Hyperlinks were provided to access the privacy policy and the list of partners concerned. At the end of the text, it specified that if the data subject wishes to continue without receiving offers from the controller’s partners, they can click on a link in the text (“click here”).
The CNIL also pointed out that the form contains a hypertext link to a nominative lust of partners and not to categories of partners. However, the list did not mention HUBSIDE.STORE.
The controller also provided the CNIL with recordings of canvassing calls that they sent to Belgium in order to promote its stores there. The CNIL found that during these calls, the data subjects were only informed that the call had been recorded and that they could register with Bloctel.
The CNIL issued a decision regarding the legal basis for the commercial prospecting by SMS, by telephone, concerning the information delivered to the data subjects, and finally regarding the security measures implemented by the controller.


The controller, Fortum Marketing and Sales Polska S.A. ("Fortum"), trades in electricity and gas fuel, including the sale of electricity and gas to end customers, both in the business sector and to households. Within the scope of its business activity, Fortum cooperates with the processor PIKA Spółka z o.o. ("PIKA"). PIKA provides Fortum with archive services, including digital archives. The parties are bound by a Data Processing Entrustment Agreement from 2018 and a Storage (Document Archive) Agreement with associated services from 2016.
Fortum notified the Polish DPA of a personal data protection breach. According to them, the data of 137,314 customers had been copied. The breach of confidentiality concerned a newly created database containing information on Fortum's customers as follows: name and surname, residential or residence address, PESEL number, type, series and number of an identity document, e-mail address, telephone number, number and address of access point and contract data (e.g. date and number of contract, type of fuel, meter number).
Fortum did not notify the data subjects of a data breach because, in its assessment, there was no high risk of a breach of the rights or freedoms of natural persons. Fortum presented the analysis results that finally established the number of persons to be notified of a personal data breach due to a high risk of infringement of rights or freedoms of natural persons. The explanations indicated that the data of 120,428 persons had been exposed, of which 95,711 persons should have been notified of the breach. The remaining numbers were business customers and deceased persons.
Findings made in the course of the proceedings indicated that PIKA, as a processor to which Fortum had entrusted the processing of personal data of the persons affected by the breach, was also involved in the data breach. PIKA explained that, in case of changes to the systems, the individual departments of its IT division are required to record any changes made to the systems in their internal project management support and control systems. However, when making changes to the system, actual personal data of the Controller's customers were used. The effectiveness of the security features applied was not verified before the changes to the system were submitted to Fortum to resolve the performance issue. The security functions were not tested during the works carried out. In 2020, the Polish DPA notified PIKA of its recognition as a party to the proceedings.


The investigation was initiated following a complaint which alleged that the controller disclosed the data subject’s personal data (controller’s customer) by posting an audio-video recording from its surveillance system on the controller’s social media pages. The investigation confirmed the allegations. An employee at BODY LINE SRL disseminated the data subject’s data on its social media pages by posting an audio-video recording of the data subject and posting the data subject’s nickname, which revealed the data subject’s the ethnic origin. The data subject made an erasure request under Article 17 GDPR but this was ignored.


facts_Rb. Midden-Nederland - UTR 20/2315

VoetbalTV, an initiative of the Royal Dutch Football Association (KNVB) and broadcasting company Talpa Network, is recording and broadcasting amateur football. The Dutch DPA fined VoetbalTV for processing personal data without a valid lawful basis. The Dutch DPA published guidance in which it states that a legitimate interest is only legitimate if it stems from a legal provision. Also, a purely commercial interest can never be a legitimate interest, according to the Dutch DPA. VoetbalTV appealed the decision.

Dispute
Does a legitimate interest (Article 6(1)(f) GDPR) need to stem from a legal provision and can a purely commercial interest result in a legitimate interest?


On 1 August 2023, the data subject received a phone call from the controller: a recruitment agency. On the same day, the complainant contacted the controller requesting to be deleted from their database and to not be contacted.
On 2 August 2023, the data subject received an email from an employee of the controller about new job opportunities, to which the data subject replied requesting to not be contacted again. On 4 September 2023, the data subject received another phone call from the controller and on 5 September 2023, the data subject received an email from the employee concerned confirming that their data had been erased.
After receiving another phone call from the controller on 15 September 2023, the data subject lodged a complaint with the Belgian DPA.


facts_Garante per la protezione dei dati personali (Italy) - 9856345

The controller in this the decision was Edison Energia, an Italian energy company. At a certain point, in the context of a marketing campaign, the controller started calling customers and prospective customers with the help of call centres. On 7, 8 and 9 February 2022, several data subjects filed complaints at the Italian DPA, all focused the above-mentioned marketing operation.
During the investigation of the DPA, it became clear that the controller was working with another company (Company XX) which provided the former with a contact list. However, some of the data subjects were also registered in a 'no call' list held by the controller itself. This, however, did not prevent the controller from contacting them. It would later become clear that this 'no call' list was ineffective. It was also not possible to correctly reconstruct the manner and timing when the consent from the data subjects was obtained and when it was ultimately revoked.
The DPA also investigated the consent asked by the controller itself when the data subject wanted to register at the controller's website or application. Such consent was not specific as it allowed processing for 4 different purposes, namely, marketing and profiling by Edison and by a third party that might receive the personal data.
In its privacy policy, the controller mentioned that it processed personal data for marketing and profiling purposes. However, during the investigation of the DPA, the controller provided contradictory evidence affirming that no profiling nor data sharing with third parties for marketing purposes would take place. This was an obvious information discrepancy.
The investigation service of the Italian DPA determined several GDPR violations after being provided access to the controllers' computer systems.


facts_ANSPDCP (Romania) - Sanction against Tensa Art Design SA

The concerned controller was an optician and merchant for glasses, sunglasses as well as contact lenses. As part of its business, the controller sent out commercial messages through its newsletter service.
The concerned data subject was one of the newsletter's recipients. Although its is not directly stated in the case, it is strongly suggested that the controller processed the data subject's data based on legitimate interest. The data subject objected to the processing, as foreseen by Article 21 GDPR, by clicking the unsubscribe button in the newsletter. Yet, the controller continued to send commercial communication to the data subject's email address in a frequent manner. Consequently, the data subject sent a complaint to the Romanian DPA, prompting the DPA to investigate the matter. The investigation confirmed the data subject's assertions.


Tuckers Solicitors (Tuckers) is a limited liability partnership of solicitors and is the data controller. On 24 August 2020, Tuckers became aware that its systems were hit by a ransomware attack. On 25 August 2020, Tuckers determined that the hit had resulted in a personal data breach. It notified the same to the UK DPA (ICO) on the same day and stated, “attack had resulted in the encryption of civil and criminal legal case bundles stored on an archive server. Backups were also encrypted by the attacker”. In total, “972,191 individual files were encrypted. Of these, 24,711 related to court bundles. Of the 24,711 court bundles, 60 were exfiltrated by the attacker” and published on the dark web. As per Tuckers, “the bundles included a comprehensive set of personal data, including medical files, witness statements, name and addresses of witnesses and victims, and the alleged crimes of the individuals.”
Tuckers notified 53 parties (out of the 60) whose bundles were released, as per Article 34 GDPR.
On 27 August 2020, Tuckers appointed a third-party investigator to provide a 'Cyber Security Incident Response Report'. The investigators could not find the source of the attack but found “evidence of a known system vulnerability” that could have been used to access Tucker’s networks and exploit them. Subsequently, the investigators released a patch, which Tucker incorporated in its systems in June 2020.
In September 2020, Tuckers informed the ICO that it had “moved its servers to a new environment and the business was now back to running as normal, albeit without the restoration of the data that had been compromised by the attacker.”


facts_ICO (UK) - Brazier Consulting Services Ltd

The UK DPA (the Information Commissioner's Office, 'ICO') initiated an investigation into Brazier Consulting Services ('BCS') following a significant number of complaints from individuals in relation to marketing calls about claims management and insurance services.


facts_Rb. Overijssel - 9965129 \ CV EXPL 22-2279

The data subject used to work for Eega (controller), a company that guides disabled people towards employment. After termination of the data subject's employment, her employer restricted her access to the laptop as it was still in the data subject's possession.
The controller filed a claim in interim relief proceedings demanding the return of the laptop. The data subject did not object to the laptop being returned. However she wanted to delete her personal data from the laptop first and invoked her right to privacy. The data subject filed a counterclaim to demand that she would be given the chance to erase her personal data from the laptop.
The controller did not consider this a reasonable demand because (1) the laptop was meant for work-related purposes only (so not for storing personal information). In addition, (2) access to the laptop would give the data subject unauthorised access to its confidential work environment. The controller thus also invoked its right to protection of privacy-sensitive information.


A data subject complained to the Persónuvernd that his personal data was published by another individual on the latter's Facebook page. The complainant also attached a screenshot with the complaint to the DPA, and the individual who had posted the information did not respond to the DPA's invitations to submit explanations regarding the complaint.
More specifically, the data published on the Facebook page included the complainant's address, which the complainant had previously removed from a telephone directory for security purposes. Furthermore, the defendant's Facebook page was open and accessible to all those who are registered on social media. If a URL that directly refers to the post in question and the documents that accompany it were used, they were also accessible to those who are not registered.

Dispute
Was the publishing of the information regarding the claimant lawful based on Article 9 of Act no. 90/2018 (the national implementation of Article 6 GDPR)?


facts_FG Berlin-Brandenburg - 16 K 2059/21

In 2020, the data subject requested access to data concerning him from the tax authority (the controller) after a tax audit had been carried out on his wife. The controller replied that the data processed in this context did not concern the data subject. In February 2021, the controller reported a data breach to the competent supervisory authority. In the course of the tax audit, the case handler had sent the data subject's mobile phone number to his wife's work email address via unencrypted email without his consent. Subsequently, the data subject filed a complaint with the German Federal Data Protection Authority (BfDI). In March 2021, the data subject filed an action for information. In particular, he desired information on all data about him stored by the controller since 1972, a copy of the data and the deletion of all data.


facts_ICO (UK) - Royal Mail Group Limited

Royal Mail is the British postal service and is the data controller. On 29 April 2021, Royal Mail submitted a written breach report to the UK DPA (ICO) that due to a technical error, its marketing actions might have sent emails to “215,202 parties who had expressed a desire to no longer receive marketing from [Royal Mail]”.
Royal Mail explained that it had a list of 245,850 potential recipients, out of which “30,648 had provided valid and existing consent to receive the direct marketing messages, with 215,202 being deemed to have opted out.” On 20 April 2021, at the time of transmission of the marketing email, Royal Mail had sent the email to 30,648 persons while putting 215,202 in a holding step of the campaign. However, on 27 April 2021, “due to an internal routing error, the 215,202 individuals who had been moved to the “holding step” were accidentally sent a “reminder email” which had been intended only for the 30,648 individuals who had been sent, but had not opened or engaged with, the initial email on 20 April 2021.”
The ICO opened an investigation and sought details about the volume of messages and an explanation of the routing error. Before the ICO, Royal Mail submitted the following:
It uses an automated system called Eloqua to send marketing emails. Royal Mail maintains a single master database of all individuals, i.e. those who have provided their consent to receive marketing emails and also those who have not consented to receive marketing emails. The single database is maintained to keep it updated as per the latest status of consent.
In a campaign, marketing emails are sent by Eloqua to those who have provided their consent. Individuals who have not given their consent are put at the end of the campaign, and the stage of sending them emails is bypassed. A reminder email is sent to persons who have given their consent but have not interacted with the original email.
In the present instance, 215,202 customers who were sent the reminder marketing email fell into two groups, “One group was made up of 91,736 customers who were registered with Royal Mail. This group had previously been presented with Royal Mail’s Fair Processing Notice at the point of registering, and subsequently opted out of marketing emails. The second group comprising the remaining 123,466 individuals were customers who had not registered for a Royal Mail account and had, at the time of using a Royal Mail service, checked out as a ‘guest’. These individuals were not asked about their marketing preferences and had not provided consent to receive future direct marketing.”
At the stage of sending reminder emails, details of persons who had not given their consent were fed to Eloqua due to a human error. Accordingly, persons who had not given their consent received the reminder email, even as they were not sent the original email. However, of “the 215,202 messages sent, the number delivered was “no more than 213,191”.”
Since the incident, Royal Mail has introduced several checks to minimize the risk of potential recurrence.
Royal Mail received six responses/complaints from subscribers who had received the unsolicited marketing email, in reply to which it apologized.


A Spanish Consumers and Users Organisation lodged a complaint with the Spanish DPA (AEPD) against MyHeritage, LTD, an online genealogy platform that offers a genetic testing service that analyses the user's DNA. The Spanish branch is part of a company based in Israel.
The complainant raised several issues:
  * International transfers of personal data outside the EEA to countries without adequate guarantees, as stipulated in Article 46 GDPR.
  * Processing of personal data without a clear legal basis, and lack of adequate information given to the data subject.
  * Processing of genetic personal data (DNA) that does not seem to comply with any of the exceptions contained in Article 9(2) GDPR.
  * Disclosure to other users of the personal data of third parties that are included in the genealogical trees.
  * Disclosure of personal data of users among which "DNA Matches" or "Smart Matches" (similarities between their DNA) are established.
  * Assignments to third parties for strange purposes (e.g. to protect their rights or the property of other users).
  * Doubtful sharing of information with "Genealogy partners".
  * Deficiencies in information and consent related to cookies.
  * Legitimization of "investigations" based on consent. Doubts about whether they really get consent, what this investigation really consists of, its purposes, as well as the information provided to the data subjects.
  * Doubts about the processing of data for commercial purposes (opposition to the sending of advertising communications and what legal basis is used to send these, clarifying whether cookies are their own or third-party cookies, which is not clear in the privacy policy).
  * Deficiencies in information about the processing activities.
  * The privacy policy does not clearly specify that one should send their genetic material and not that of another. This issue could refer to the security measures to prove that a person is sending you their genetic material and not that of another person.
  * Other deficiencies in the matter of information to users from Article 13 GDPR.
  * No doors are closed to possible assignments or sales under license of health information or DNA of users who are not Russian, Norwegian and Swedish.
  * Processing of minors' data between 13 years and the minimum age that each country establishes to provide consent without needing that of their parents or guardians.
  * Other deficiencies in the drafting of the policy (inconsistencies, duplicities, omissions, ambiguities, etc.)
  * Issues related to the exercise of rights.
  * Doubts about the storage period of data once deleted, and the scope of the deletion.
Hence, the AEPD launched a general investigation.


facts_ICO (UK) - Colour Car Sales Limited

Colour Car Sales Limited (CCSL) is a company acting as a credit intermediary for finance on used cars. It traded under serveral names, including 'immediatecarfinance.co.uk'; 'carfinancetoday.net'; 'achillesuk.com'; and 'taxifinancetoday.com'.
Between 2018 and 2019, the UK DPA (Information Commissioner's Office; ICO) received nearly 200 complaints over unsolicited electronic direct marketing text messages. The ICO started a preliminary investigation and contacted CCSL for further evidence. The letter sent was returned undelivered. The company director was then contacted who provided an alternative contact address.
CCSL confirmed it had sent over 3 million direct marketing messages between 2018 and 2019. CCSL claimed to have gathered consent through an application form with the following statement: "By starting an application you agree that immediatecarfinance may/will pass your details on to a third party lender or broker, and they may wish to contact you by phone, post, SMS or other electronic means". CCSL explained that an opt-out would be possible by calling the CCSL office.
The ICO investigated the privacy notice available and found that the privacy notice stated that marketing communication was only sent where there was consent of a "legitimate business interest"
Following initial cooperation, CCSL did not respond to the ICO any further.

Dispute
What classifies as valid consent to send direct marketing messages?


The controller is a municipality. The data subject owns property in the controller’s district. The data subject won a lawsuit against the controller, obliging it to connect the data subject’s property to the municipal drinking water supply. The judgement was limited to the supply needed for a single-family home. The controller complied with the judgement and connected the data subject’s property to its water supply system. It also installed an analogous water meter (not a smart meter) at the beginning of the water pipe to measure the consumption of the data subject’s property. The water meter is checked once a year by the municipality. The results are stored in the municipality’s software application which is hosted in an Austrian datacenter. The data is retained for thirty years to exercise or defend against possible legal claims.
Moreover, because multiple times in the past the data subject used vast amounts of water, exceeding the need of a single-family home by far, the municipality installed a system that measured the daily consumption of the data subject. At the beginning, the system worked as follows: An incremental encoder was installed on top of the water meter. This incremental encoder sent digital signals to a programmable logic controller (PLC) at the water supply facility of the controller every time water was used by the data subject. The programmable logic controller counted the signals and if the usage of the data subject exceeded the threshold of 950 liters per day, the PLC closed the solenoid valve of the pipe, cutting of the water supply to the data subject's property. The counter was automatically reset each day to zero. After five months the controller switched to a system where the water supply was not automatically shut off by the PLC but an employee was notified to check whether the alarm was accurate and, if yes, to shut off the water supply manually.
After the data subject learned about this conduct of the controller, she asked the controller for the information according to Articles 13 and 14 GDPR, objected to the processing pursuant to Article 21 GDPR and requested the restriction of the processing under Article 18 GDPR. The controller provided the data subject with the information according to Articles 13 and 14 GDPR but denied the request for restriction under Article 18 GDPR. As a consequence, the data subject lodged a complaint with the Austrian DPA (Datenschutzbehörde – DSB) asserting a violation of its rights under Articles 17, 18, 21 and 22 GDPR. The Austrian DPA rejected the complaint as unfounded which lead to the data subject initiating court proceedings.


The data subject filed a complaint with the Spanish Data Protection Agency (AEPD) against Blu Management Spain, S.L., a recruitment agency, alleging the unauthorized disclosure of her personal information. According to the complaint, the data subject had contacted the agency in May 2023 and participated in a phone interview. Subsequently, on July 27, 2021, she received several WhatsApp messages from a third party who claimed the interviewer at Blu Management had shared her name and phone number.
The data subject contacted the agency to inquire about the unauthorized disclosure and submitted both a data deletion request and a data access request. In response, the controller claimed to only possess the personal data included in her resume, such as identification details, academic history, and professional experience, and provided her with a copy. The controller also stated that it had deleted all personal data related to the data subject, including emails, messages, and other communications.
The data subject requested compensation, citing the controller's failure to adequately protect her personal information. The controller countered that the disclosure was made by an exchange student who had obtained the data during the interview conducted by one of the controller's employees, asserting that there had been no breach of its systems.


facts_ANSPDCP (Romania) - fine against AG-BROKER ASIGURARE S.R.L

AG-BROKER ASIGURARE S.R.L. (the controller) is an insurance agency that reported a data breach caused by a cyberattack. The attack affected a significant number of customers and a broad range of personal data (including names, birth certificates, email addresses, and phone numbers).


facts_Rb. Midden-Nederland - C/16/531572 / KG ZA 21-672

Stichting Brein is a foundation involved in collectively counteracting and preventing copyright infringements. Ziggo is one of the largest internet service providers (ISPs) in the Netherlands. In december 2020, Brein started the "FLU-warning campaign". The aim of this campaign was to send warning letters to holders of IP addresses of which Brein, using special software, had found that they had uploaded copyright infringing material via BitTorrent for at least two times in a span of four weeks.
Since Brein only had the IP address of these uploaders, and not their name and address details, it needed the cooperation of ISPs to link an IP address to name and address details. Ziggo, however, did not want to cooperate voluntarily. Hence, in this interim relief proceeding, Brein requested the Court to order Ziggo to forward Brein's warning letters to the relevant Ziggo customers.


A data subject submitted a complaint to the AEPD indicating that the website operator Chatwith.IO infringed GDPR by implementing dark patterns, specifically overloading and skipping when users try to object to the processing of their personal data by third parties. Users are prompted with a pop-up which contains a list of service providers, 1.522 in total, in which 338 of those have the selection box toggled on. If users want to object, they need to toggle off each box individually. The data subject submitted that there should be an option to object to ALL of the legitimate interests at once. Moreover, these selection boxes are shown in a light grey colour which can be easily confused with the white background of the website and it requires an additional visual effort on the parts of users to distinguish the options. Further, the data subject submitted that the legitimate interest of third parties is not explained in a manner that can be easily comprehended and found in the privacy policy unless they have to access to each of the third parties' privacy policies.


A hearing aid retailer (the first controller) used personal data for sending direct marketing papers to home addresses. The first controller obtained the data from a media company specialized in direct marketing (the second controller). In turn, the second controller obtained the data from a chain of commercial data brokers.
In 2022, one of the recipients of direct marketing (the data subject) contacted the second controller and requested both access to his personal data, and their erasure. The second controller forwarded the request to both the first controller and the data broker he received the data from. However, the second controller did not itself reply to the request.
In 2023 the data subject filed a complaint with the DPA. He claimed that both controllers violated the principle of lawfulness, by processing his data for direct marketing without a legal basis. He also complained that the second controller violated Articles 12 and 15 GDPR by failing to reply to his request.


On 22 October 2021, the controller, a producer of children's educational magazines, received an e-mail from the individual in charge of its web-portal. This individual stated that an external alleged researcher had managed to access the company's data as a result of a vulnerability in the website. The researcher provided a screenshot as proof with the names of the tables in the database but without providing proof of a data leak.
The controller carried out an internal investigation. It stated that this was a case of ethical hacking without malicious intent, since the researcher had notified the web-portal manager about the vulnerabilities. The database contained location information and contact details of data subjects. This data was originally collected through a registration form. Nearly 470,000 people were affected by the breach. The controller sent its affected data subjects an e-mail informing about access by an unauthorised third party to the database. One data subject filed a complaint with the Spanish DPA after receiving the e-mail.
The DPA started an investigation in the course of which the controller stated that it hired a security contractor to fix the issues. The controller also argued that its web-portal manager had fixed all the vulnerabilities that enabled the unauthorised access. It had also implemented security incident protocols and regular audits and had provided encryption for the stored data.


The Norwegian Public Service Pension Fund (SPK - Statens pensjonskasse) reported a personal data breach in September 2019. Between 2016-2019, they obtained a large amount of personal data from the Norwegian Tax Administration, much of which was not needed for their purpose. The data was meant to be used for correcting disbursed disability pensions. However, SPK lacked a filter to prevent receiving and storing unnecessary data, as well as organisational measures for deleting the superfluous data.
SPK themselves categorized the breach as serious, as it involved processing highly sensitive personal data about a vulnerable group of people (those receiving disability pensions). In total, about 44,000 people were affected by the breach, of which about 24,000 receiving disability pension.


A data subject submitted a complaint with the Hungarian DPA for the unlawful processing of their personal data and the personal data of their child, including special categories of data. The complaint was made regarding the recording and subsequent sharing of a private conversation between the defendant and the complainant, as well as an employee of a daycare attended by both of their respective children. The recording contained personal data, including sensitive information about the health of a minor. It was then shared by the controller within a Facebook group containing of all the parents whose children attend the daycare, as well as via e-mail with other parties. Upon questioning, the defendant admitted that they had no legal grounds for the collection or sharing of this data.


facts_EWHC (QB) - Damavand Media Ltd v DMA Media Ltd

The claimant, Mr. Farhadbahman through Damavand Media Ltd, entered into an employment agreement with the defendants, IITV.
Throughout the existence of the contract the claimant made various publications on social media which were not in line with IITV’s editorial guidelines. The claimant alleged that he was not subject to these editorial guidelines due to the nature and scope of his employment and the contractual terms related thereto. Approximately one year after the conclusion of said contract the defendant terminated the contract on the grounds of a material breach having been committed by the claimant for not following the editorial guidelines on approximately six occasions.
A third party who is a prominent voice on social media published internal correspondence (a “welcome email” exchange including various employees within IITV and undersigned by the claimant as the “creative director”) which showed the claimant’s involvement with the defendant. A leak was internally investigated but the investigation was inconclusive. The claimant alleged that this constituted a data breach as he had a reasonable expectation of privacy and that IITV could and should have prevented the leak. He relied on Article 5(1)(f) of the GDPR to support his argument that “his contact details and the content of the welcome note constituted personal data and IITV did not take appropriate technical and organisational measures to protect it against unauthorised leaks.”
The High Court was referred to Various Claimants v Wm Morrison Supermarkets plc for guidelines on the application of ‘ensures, appropriate security... using appropriate technical or organisational measures’ to test a leak. However, it found that “[t]he mere fact of disclosure or loss of information is not sufficient for there to be a breach. An organisation is not vicariously liable for deliberate leakage. So it is a question of ‘appropriate’ risk management in all the circumstances of the case.”


On 10 May 2019, the data subject consented to the processing of his personal data for the use of captured image in activities and interviews to be published in Gabinete de Neurociencias S.L.'s (the controller) social networks and websites to disseminate the sporting activities.
On 7 February 2023, the data subject exercised his right of objection and withdrew his consent for the use of his personal images, claiming that on 30 March 2023, his images still appeared in the claimed company social media.
The controller argued that they attempted to address the request appropriately and that technical and communication issues with Meta (the company behind the social networks used) prevented the timely deletion of the image. Despite their efforts, including multiple attempts to contact and requests for assistance from META, the corporate account in question could not be recovered or modified in time.
The Spanish DPA (AEPD) dismissed the complaint because the data controller did respond to the data subject’s request, complying with the applicable deadlines stipulated by GDPR. It found that the completeness of the request depends on META’s return.
The data subject filed an appeal. The data controller reiterated their documented attempts and efforts to delete the images and communicate with Meta, arguing that despite their efforts they faced issues in fully complying with the erasure request due to Meta's nonresponsiveness.


facts_Garante per la protezione dei dati personali (Italy) - 9751137

A data subject issued a complaint with the Italian DPA (Garante per la Protezione dei Dati Personali – Garante) against his previous employer Costampress S.p.A. (a manufacturer of aluminium components). The data subject alleged that once his employment relationship had been terminated, the company had failed to delete the company email assigned to him, and that he had not been granted access to the company laptop computer and the personal data contained in it.
The company responded to these allegations, stating that after the data subject’s dismissal, he had unilaterally proceeded to delete all the communications in his company email account. The company also explained that in order to protect its legitimate interest, it set up an automatic response system that would notify users of the deactivation of the complainant's mailbox, with an alternative email address to send messages relating to the activities carried out by the complainant within the company. According to the employer, this lasted for a month and a half, and then the email account itself was completely deactivated.
Furthermore, the company stated that once the relationship was terminated, the data subject’s company laptop was given to an expert IT consultant to carry out an inspection. This was based on a legitimate suspicion that the hard disk might contain elements that could be used to refute the authenticity of documents which were subject to a separate legal dispute between the claimant and the company in the a Specialised Business Section Court in Venice.
Additionally, during the preliminary phase of the proceedings, the Garante expressed concerns related to this data processing carried out on the data subject’s hard disk, due to an absence of specific company regulations regarding the handling of IT systems used by employees. The company addressed these concerns, noting that among the tasks entrusted to the complainant, one was precisely the drafting of these regulations, which were never fully completed during his tenure.


Asesoria Alpi Clua S.L., an audit company, mistakenly sent via email the personal data of one of their clients to a different client, the claimant, when this client asked for documentation concerning their own data.

Dispute
Did Asesoria Alpi Clua infringe the principle of confidentiality established by Article 5(1)(f) GDPR?
Was there a personal data breach?


The decision is the consequence of a sanction procedure started by the AEPD against the defendant due to a complaint submitted by a Spanish citizen stating that the defendant is the owner of three (3) websites that load a big number of cookies without offering the corresponding basic layer information to the user.

Dispute
The defendant answered to the AEPD investigation requests stating that: (i) at the date of the complaint (October 31st, 2019) it was performing a data protection adaption to the GDPR, and it had limited resources to do such; (ii) due to the controversial CJEU judgement C-673/17 dated October 1st, 2019, the defendant decided not to install a basic layer regarding cookies until the publication of any guides or recommendations by the AEPD; (iii) the majority of cookies loaded at the three websites were necessary cookies that did not process a large volume of data (never special data), and the defendant had not capitalized such data nor developed aggressive commercial campaigns (as the majority of its customers are companies) with them. In its written answer, the defendant also specified that, due to the complaint, it had installed the basic information layer and it has updated the second information layer, following, in both cases, the recommendations at the guide by the AEPD on the usage of cookies dated November 8th, 2019. The AEPD checked the three websites afterwards and it understood that they do not comply yet with the legislation, so it started the corresponding sanction procedure.


facts_AP (The Netherlands) - 10.12.2020 (Booking.com)

On 7 February 2019 Booking.com (Booking) submitted a data breach notification to the AP. An unknown person(s) gained access to the reservation system of Booking by pretending to be a Booking employee. About 40 accommodations in the United Arab Emirates Personal were affected. Personal data of guests from different EU and non-EU countries were exposed. Booking stated in the notification that they became aware of the breach on 10 January 2019, which triggered an AP investigation under Article 33(1) GDPR (obligation to notify the supervisory authority about a breach within 72 hours).
Booking maintains the reservation platform where the so called “Trip Providers” can offer accommodation, flights, car rentals and day trips to the users of Booking. These users have to give the contact-, reservation and payment data in order to complete the reservation. That information is then shared with the Trip Providers via Extranet, an online administration dashboard for reservations. Access to Extranet is secured: representatives of Trip Providers have to fill in a username, password and a “2FA pin code”.
This breach was a result of what is called by AP a social engineering attack: an unknown person contacted a Trip Provider by the phone and obtained a username, password and the “2FA pin code” necessary to access Extranet by pretending to be a Booking employee. Personal data of about 4109 guest got compromised, including first and last names, addresses, phone numbers, check-in and check-out dates, total price, price per night, reservation numbers, communication between hotels and guests, 283 credit card details with CVCs of about 97 of them.
Timeline on the breach.
19 December 2018 – social engineering phone call, start of the incident
9 January 2019 – 1st email to Booking from accommodation 1. A guest of that hotel had been approached by email sent from a Hotmail account by a “reservation employee”. The “employee” had asked for he guest’s birth date, which was necessary to complete the payment. The night rate was mentioned in the email, a PDF with the reservation details was attached to the email.
13 January 2019 – 2nd notification from the same accommodation: another guest got a phone call from “Booking”, asking for the credit card information and other personal data.
20 January 2019 – 3rd notification from accommodation 1, reporting another phone call to a guest, the caller had asked for the credit card details.
20 January 2019 – accommodation 2 reports multiple notifications from guests. All guests mention the attempts to get their credit card details, using hotel’s name, arrival/departure dates and other information.
31 January 2019 – Booking’s Security team gets involved.
4 February 2019 – Preliminary report of the security team, confirming the breach. Privacy teams gets involved, affected individuals get informed of the incident.
6 February 2019 – Privacy team qualifies the incident as a personal data breach that needs to be reported to the AP. 7 February 2019 – Breach is reported to the AP.
28 February 2019 – Final report of the Security team.

Dispute
Main disagreement between the AP and Booking was about exactly when Booking became aware of this breach, but other points were also outlined in the AP’s report.

Notification within 72 hours of “becoming aware”
Booking’s position is that it can take months to finish an incident investigation, so notifications within 3 days are not always possible. Furthermore, A29WP’s data breach guidelines say, according to Booking, that it can take time for controllers to investigate and properly report all connected incidents. So Booking is of the opinion that it reported the breach within 72 hours from becoming aware of it on 4 February 2019. AP did not share this logic. It pointed out that companies can report breaches in stages where all information is not available at the moment of the notification. Moreover, according to the AP, Booking became aware of the breach on 13 January 2019:
a) The email of 9 January should have given Booking a first serious suspicion that something was not right;
b) That first incident should have been brought to the attention of Booking’s Security team right away;
c) The email of 13th of January was the second signal. Accommodation stressed that that incident was similar to the previous one and that there must have been a breach at Booking. On 13 January 2019 Booking had reasonable certainty that a security incident affecting personal data had occurred. In addition, the AP pointed out that Booking’s own “Data Incident Response Policy” was clear: all suspected incidents needed to be reported to the Security team immediately. Which did not happen here until 31 January.

Controller
According to Booking, it is a controller of personal data in Booking platform, but Trip Providers have their own purposes for processing data in Extranet. AP concluded that Booking was the responsible controller in this case, considering that:
1) Booking’s Privacy statement outlines the data categories and purposes of processing.
2) Booking is responsible for the security measures on Extranet.
3) Booking submitted the data breach notification to AP.

Risks
Booking noted that it had taken measures to minimize the risks for the affected individuals. For example: in general, only contact information was affected with no email or reservation information being leaked; emails in Extranet were hashed and could not be extracted from the system; credit card data was stored according to the PCI DSS requirements; clients were informed about social engineering and other forms of possible fraud; immediate communication to the affected individuals; Booking also offered them a compensation of financial damage. AP is of the opinion that there is a risk to rights and freedoms of individuals when their personal data is seen by unauthorized individuals. In the present case the risks of financial loss and identity fraud have materialized. Financial damage compensation does not remove the risks themselves but only helps to minimize their consequences.
Trip Provider did not properly report the breach to Booking
Booking argued that the Trip Providers are obliged to report all security incidents via the so called “Partner portal” to the Security team directly, which was not the case here. AP rejected this argument: obligations under GDPR stand separated from private agreements between companies.

Employee policy breach
Booking argued the fact that an employee had breached an internal protocol by not reporting the suspected incident to the Security team, should not be held against Booking. Booking referred AP to a decision by a Hungarian DPA, according to Booking, supported this conclusion. AP disagreed: the case in question could not be applied to the current situation. In addition, AP’s reading of the conclusion of that decision differs from that of Booking.


facts_ICO - Enforcement Notice against Experian

The ICO autonomously started an investigation into the three major Credit Reference Agencies ('CRAs') in 2018 under the Data Protection Act 1998. The investigation was paused and then resumed after the new GDPR entered into force in order to ensure the violations were addressed under the modern data protection regime, rather than a historical legal position, given the importance and relevance of such processing activities.
The processing in question is on a very large scale (roughly 50 million people resident in the UK, with more than 500 attributes for each person).
Experian acquired this information from a variety of sources and it also include credit reference data, which could lead to unexpected and 'invisible' processing activities. Experian uses them to propose a variety of marketing-led products (eg. Mosaic and Channelview), which are sold to third parties to enable them more targeted and effective direct marketing to data subjects.
Having found several violations of the new Regulation, the Commissioner issued a Preliminary Enforcement notice on 17 April 2019 to Experian. Afterwards, Experian collaborated with the Authority and provided further details and documents in order to make the improvements requested. On 20 April 2020, a revised Enforcement Notice was proposed.

Dispute
The ICO had to determine whether all the information requested by art. 13 and 14 of the GDPR are clearly communicated to the data subjects involved in the processing activity carried out by Experian.
Then, the Authority needs to establish if the lawful grounds used by Experian and its suppliers are correct and understood by the data subjects involved.


Société Particulier à Particulier - Editions Neressis ("controller") provides individuals with a set of publications and services allowing them to conclude real estate transactions without intermediaries. The CNIL conducted an online investigation of their website, www.pap.fr, to verify the methods of informing people about their rights as data subjects, and whether the procedure for creating a user account was sufficiently secure and confidential.
The on-site investigation focused on the verification of the retention periods applied to user account data, the legality of data processor agreements in place and the technical and organizational measures to ensure the security of the data collected through the website.
During its investigations, the CNIL found that the controller defined a systematic retention period of ten years from the acceptance of an order on the website. The CNIL also discovered that the controller did not include the right to lodge a complaint with the DPA, the legal basis for each processing as well as the recipients and categories of recipients in their privacy policy.
The CNIL initiated a sanctioning procedure against the controller on 6 February 2023.


The subject matter of the complaint is whether the respondent violated the first and second complainants' right to confidentiality (under §1(1) DSG) by obtaining their "most personal" data - which the Austrian DPA understood to mean their address data, specifically title, name, date of birth and address - from the customer and prospect file systems of other address and direct marketing companies.[1]
The respondent argued that it had the commercial authority of an address publishing and direct marketing company, and therefore lawfully processed the complainant's personal data. They supported this claim by handing over declarations of the data providers to the Austrian DPA.


facts_Garante per la protezione dei dati personali (Italy) - 9870832

The Italian DPA after receiving complaint from Inder Kahlon on 24th February 2023 (Numero protocollo: 0033835) opened an investigation concerning ChatGPT, an AI service offered by the American company OpenAI. The investigation focused on three main areas.
First, the controller did not provide the data subjects whose personal data had been collected through the Internet with appropriate information about the processing.
Second, the DPA found that ChatGPT final outcome – its “answers” – despite based also on personal data and thus often containing personal data, did not always represent reality in an accurate way.
Finally, the investigation showed that OpenAI did not adopt any measure to check that users were above the minimum age requirement of 13 years.


A data subject filed a claim with the Spanish DPA (AEPD) against Baser Comercializadora de Referencia, S.A. (an electrical supply company) claiming that a third party had made changes to his electricity contract without his authorisation.
As evidence, the data subject offered an audio recording of a call made to the company, in which a woman states that she is the data subject’s sister. The woman also states that she is living in her brother’s house, and complains that she has been suffering power outages lately. The woman is informed that the electrical power output has been reduced online on the company’s website, from 1.8KW to 1.4KW. The woman proceeded to request that the company change the power supply back to 1.8KW.
According to their internal protocol, the company asked the woman to provide certain information related to the contract (name, surname, ID number, telephone number, and address) as security questions in order to change the electrical current supply back to 1.8KW.
In its defense, the company claimed that by answering these questions, the woman successfully overcame the security protocol, and was therefore considered by the company as effectively authorised to change the contract on the data subject's behalf.


In March 2023, LaLiga (data controller) issued a regulation to football clubs in Spain requiring the implementation of changes to how clubs allowed access to their stadiums. For ordinary ticket holders, patrons could either present their physical ticket and be given entry, or, provide an electronic ticket and use a fingerprint scanner. For access to the “animation stands”, reserved for the biggest fans of the home team, patrons had to subject to biometric identification through either fingerprinting or facial recognition, and provide consent to this processing at the point of entry, or be denied entry. The controller also offered to the clubs a system of access for implementing and complying with the updated access guidance.
On 4th November 2022, a fan filed a complaint against the controller with the AEPD.


The controller, Tensa Art Design SA, was an optician and merchant for glasses, sunglasses as well as contact lenses. As part of its business the controller was sending commercial messages.
A data subject, objected to receiving the commercial messages as foreseen by Article 21 GDPR, by unsubscribing from the newsletter service. Yet, the controller continued to send commercial communications to the data subject's phone number via SMS in a frequent manner. Consequently, the data subject filed a complaint with the Romanian DPA, prompting the DPA to investigate the matter.


XFERA MÓVILES, S.A. (also known as Yoigo, the controller) is a telecommunications company. On 15 April 2022, a data subject presented a complaint to the DPA. The data subject received several advertising calls related to the controller’s services despite being included in an Advertising Exclusion List (the Robinson List[1]). During its investigation, the DPA found no contractual relationship between the controller and the owners of the telephone lines from which the calls were made.
The DPA dismissed the case on 22 July 2022 on the basis that it had not found a violation of data protection laws. The data subject filed an internal appeal in August 2022. The DPA carried out an investigation and began a sanctioning procedure for an alleged violation of the principle of data accuracy (Article 5(1)(d) GDPR) in April 2024.
The DPA requested information from the controller on the holders of the phone lines that had called the data subject. After further investigation, the DPA found that the data provided by the controller was not accurate, as the ID documents did not match with information from the Tax Authority (and one of the IDs was proven to be false).
The controller argued that the calls came from prepaid accounts, and therefore it did not have the responsibility to identify them. According to the controller, it only had the obligation to retain data in accordance with obligations under national data retention laws. The controller also argued that the DPA had no competence, as the case related to national data retention laws[2] and not the GDPR. Finally, the controller argued that the DPA’s sanctioning procedure based on data inaccuracy was not related to the complaint regarding unwanted advertising calls.


The data subject wanted to enter into an energy supply contract with an energy supplier in 2020, but received a letter back on 1 October 2020 from the energy supplier that this was not possible due to an insufficient credit rating. This credit check was done by a credit reference agency (the controller).
On 7 October 2020, the data subject submitted an access request under Article 15 GDPR to the controller.
On 8 October 2020, the controller provided the data subject with the personal data it had of the data subject, including their name and address. It also stated that the energy supplier had made a credit inquiry to the controller about the data subject on 1 October 2020.
On 7 January 2021, the data subject requested the controller to properly comply with its obligation to provide access.
On 13 January 2021, the controller replied that there was no right to access under Article 15(1)(h) GDPR with regard to the calculation of credit scores and the parameters and methods that were used to calculate a risk value as those were seen as business secrets of the controller.
On 17 March 2021, the data subject lodged a complaint against the controller at the Austrian DPA (“Datenschutzbehörde -DSB“).
The controller argued in the proceeding that there was no automated decision-making within the meaning of Article 22 GDPR and that there was therefore no right of access under Article 15 GDPR. It furthermore argued that it calculated the credit score on the basis of the parameters “qualified payment defaults (debt collection entries, insolvency, etc.) age, and place of residence”. Regarding the data subject, the controller sent a “medium” credit score to the energy supplier. No negative payment history data was available in the controller’s system to determine the creditworthiness score of the data subject. The controller stated it collected data from publicly available sources, data from address publishers and information on payment experience provided by corporate customers and debt collection partners.
The DPA upheld the complaint and found that the controller violated Article 5(1)(a) GDPR, Article 13(2)(f) GDPR, Article 14(2)(g) GDPR. Article 15(1)(h) GDPR and Article 22 GDPR. The DPA further ordered the controller to comply with the access request of the data subject within eight weeks.
The controller appealed the DPA’s decision at the Federal Administrative Court (“Bundesverwaltungsgericht - BVwG“).


The Norwegian DPA (Datatilsynet) had issued a reprimand to a local missionary organization for what the DPA said was unlawful use of private camera surveillance footage (i.e. lacking legal grounds for processing under Article (6)(1)(f)). The Norwegian Privacy Appeals Board (Personvernrådet) overturned this decision, as they concluded that the missionary organization had indeed legal grounds as per Article (6)(1)(f) to process the personal data in question.
The case revolved around neighbours A and B, who had a conflict. B had installed camera surveillance on her property and some footage revealed A's seemingly harassing behaviour towards B. B shared this footage with C, a deputy member of the board of a local missionary organization, where A was a board member. C further involved D, the chairman of the organization. Based on the footage they'd viewed, C and D questioned if A was suited to be a member of the board. They presented the footage to A and her husband (whom A had requested to be there), and following some discussions, A withdrew from the board. A then submitted a complaint to the DPA, for what she felt was unjust and unlawful processing of her personal data in the surveillance footage.
The question here was consequently: did the missionary organization have legal grounds to process the footage, based on Article (6)(1)(f)?
The DPA held that they didn't, after their review of the three necessary elements of legitimate interest: 1) First, the DPA concluded the missionary organization had a legitimate interest to process the personal data. 2) Second, the DPA held, however, that the processing was *not* necessary to achieve this interest, and therefore, 3) the balancing test should go in favor of the data subject (in this case "A"). Thus, the DPA concluded that the conditions for relying on Article (6)(1)(f) was not fulfilled.
On the contrary, the Norwegian Privacy Appeals Board considered that the second condition of legitimate interest was indeed fulfilled, as it was deemed necessary to view the footage. In addition, they considered that there were little harm to A, as the footage was only viewed by C, D, A herself and her husband (on her request).

Dispute
Was the DPA's conclusion to reprimand the missionary organization for lack of legal grounds, correct?


LTH Holdings Limited is a telephone marketing company which sells a variety of products under various trading names.
Between May 2019 and May 2020 the ICO received a number of complaints from individuals about marketing calls from 'Serenity Funeral Plans,' (a trading name of LTH) which noted the rising cost of funeral plans. On 12 May 2020, the ICO sent an initial investigation letter to LTH setting out concerns and asking a number of questions regarding LTH's campaigns, with the complaints received to date attached.
LTHs response, as well as its further responses throughout the investigation, provided details of campaigns it had carried out, the source of data for those campaigns, the Calling Line Identifiers (CLIs) used for its calls, the scripts used by it as its various trading identities during the calls, and the connected call figures.
It transpired that the data that LTH used for its campaigns was provided by third-party data providers that compile data via multiple sources, i.e. online and paper catalogues, as well as 'internal sales/ internal data'. These third party data providers allegedly only provide data from sources whereby individuals have 'opted in' to be called. The ICO collected information on the 'opt in' mechanisms operated by each of the relevant third party data providers (which were unnamed).


A Norwegian hospital notified the DPA of three personal data breaches lasting between two and nine years.
The breaches found their origin in deficient internal systems upgrades, poorly managed access controls, routines not being followed, and lack of data deletion. The concerned personal data included names, social security numbers, health metrics data, sensitive health data (including information on substance abuse, or health data relating to children), and passwords stored in clear text in an unprotected server.
These breaches were discovered during an audit by the Norwegian Office of the Auditor General. A significant number of patients were affected (e.g. about 21,000 records containing sensitive health data in one breach alone). However, the hospital did not have a comprehensive log, making it impossible to fully determine the extent of each breach.