facts_Rb. Amsterdam - C/13/693399 / HA RK 20-337

Whenever a consumer in the Netherlands obtains credit, the debt must be registered in a central register of the foundation Bureau Krediet Registratie (BKR).
The case at hand involved a person with whom the bank, Rabobank, had made a special agreement. He was to pay part of a loan and was forgiven the repayment of a remaining part of the loan. After he had paid the amount agreed with the bank, Rabobank nevertheless reported him to the BKR register with a special code. This prevented him from taking out new loans, even though he was in a good financial situation. For this reason, he took the matter to court.
The claimant had two mortgages on two homes with his ex-partner. Following the couple's divorce, they were forced to sell both houses. After the houses had been sold in 2015 and 2016, a residual debt of €119,979 remained. The partners were jointly responsible for the full repayment of the debt.
Almost immediately after the sale of the first home, the applicant voluntarily started repaying the remaining debt at the rate of €500 per month. In November 2015, the applicant's 7 monthly repayments totalled €3500. In February 2017, Rabobank sent a letter to the applicant. The bank had calculated that the applicant could repay €1486 per month, but that this would not enable him to repay the entire debt within 5 years. The bank offered him alternative payment models; if he accepted the special arrangement, he would not have to repay the entire remaining debt.
The applicant and the bank agreed that the applicant would pay €1388.89 per month for 36 months (€50,000 in total) and that the bank would pay €62,015.83. It was also agreed that the €3500 that the applicant had already paid would be deducted from the amount that the applicant owed. The applicant fully complied with the payment plan and repaid the debt between September 2017 and May 2020.
On 29 May 2020, Rabobank registered the applicant in the BKR's Central Credit Information System with a special code of 3. This code indicates that a previous loan had been written off by €250 or more. The code would be visible for 5 years and would disappear after 29 May 2025.
The applicant objected to the registration with code 3 as early as 8 May 2020. On 5 June, Rabobank gave a negative response to the objection and stated that it was non-negotiable that it would report the applicant with special code 3.
The applicant filed a new objection on September 4, 2020, arguing that there were new facts that needed to be considered. However, Rabobank again rejected the objection and gave reasons for its decision. Rabobank wrote that it had looked at the new information and weighed the various interests. Nevertheless, it concluded that the applicant was not eligible for a deletion of his Code 3.
The applicant made a request to the district court of Amsterdam to force Rabobank to comply with his request.

Dispute

Was the case admissible?
Rabobank held that the application for the order should be dismissed. Rabobank referred to Article 35(2) of the Dutch Act implementing the GDPR (UAVG), which provides that an interested party (i.e. data subject) who disagrees with a decision of a non-administrative body in response to a person exercising their rights under Articles 15-22 GDPR may file a civil dispute application within six weeks for a court to grant or reject the application.
However, the time limit does not apply if the non-administrative body responds later than 6 weeks. In the present case, Rabobank stated that the applicant's first request was made on 12 December 2019 and that it responded only one day later. Thereafter, the applicant had submitted identical applications several times. Rabobank argued that it cannot be the intention of Article 35(2) of the GDPR Implementation Act (UAVG) that a data subject can circumvent the six-week period by submitting several identical requests if no new facts or circumstances have been brought forward.
The applicant, on the other hand, believed that his most recent petition, filed on September 4, 2020, rather than the one filed on May 8, 2020, should govern the deadline. This was because Code 3 was added to the registry after he filed the objection in May 2020. In addition, the applicant believed that his desire to be able to lease a car was a new circumstance that warranted a new assessment.

The BKR Registration
The applicant sought an injunction to cause Rabobank or BKR to remove Code 3. The applicant also requested that the injunction be accompanied by the threat of a penalty payment of €1,000 per day, up to a total of €30,000 for non-compliance, commencing 3 days after service of the injunction.
The applicant claimed that the Code 3 registration was unlawful. He argued that the repayment agreement, which the applicant had complied with, had the effect of releasing him from any further liability for the unpaid loan. In addition, the claimant objected that he had not been informed that code 3 had been assigned to him.
Additionally, the applicant claimed that Rabobank was wrong not to remove the special code. He claimed that he had a good payment history and that the bank never had any problems with his repayment. He claimed that the remaining debt was due to a special, unique situation that he had to sell his house after a divorce.
Further, he claimed that the code prevented him from getting a new mortgage on his home and from leasing a business vehicle even though he had a good financial situation. The applicant stated the consequences of keeping the code on him was disproportional to the origins of why he had a Code 3 put on him.


The complainant requested to stop receiving promotional emails by the company. The promotional emails didn't stop even after he followed all the directions on the company's website and even after he submitted a request of erasure of his personal data held by the company, for which he received a confirmation email stating that all his data we deleted by the company's servers. The company stated that due to technical errors and duplicate registration of the data subject's email address, the process of the deletion of the complainant's data was not successful.
The personal data processed by the company were recorded electronically in a database referred to as the ‘Master Database'. All changes to personal data, such as deletions from email lists or requests submitted by data subjects are initially entered in the Master Database, and are then integrated/ copied into the individual databases that connect to the Main Database through a synchronization process which takes place automatically on a daily basis. One of these such databases linked to the Main Database is also the Email Database.
Due to a technical error in the computer systems, there was a double registration of the email address of the complainant in the Email Database. This double entry error was detected and corrected immediately so as not to be repeated in the future. However, the duplicate address file remained in the E-mail Database, with the result while the first address file was deleted, the address file remained in the E-mail Database. Thus, when the complainants requested deletion from the E-mail Database using the delete / unsubscribe link, the request was recorded successfully in the Master Data Sheet, but the synchronization process failed to replace / delete the duplicate entry of the email address of the complainant in the E-mail Database. This is the reason why the complainant continued to receive emails about jobs offered by the company.


The data subject alleged a violation of Article 5 GDPR by the complainant and brought his complaint to the Data Protection Authority (Datenschutzbehörde - DSB). They claimed that the president of the complainant had discussed his person in confidential telephone calls with various offices. According to him, the information discussed was suitable to portray him negatively.
The complainant argued that the oral discussion at a general meeting was not subject to the material scope of Article 2 GDPR. Furthermore, it argued, that even in case of the application of the GDPR, Article 5 hat not been violated.
The DSB decided in favour of the data subject.


On 22 May 2023, a data subject filed a complaint with the AEPD against Motorsport Network España (the controller). The complaint alleged that the controller’s webpage used a ‘pay or okay’ scheme in its cookie banner, requiring data subjects to either consent to cookies and use the page or free, or to subscribe for a fee in order to reject any cookies.
In its investigation, the AEPD noted that upon entering the webpage for the first time, the controller utilised non-technical cookies, which require consent under the ePrivacy Directive, without the prior consent of the user.
After the cookies were already applied, the controller prompted data subjects with a cookie banner that provided two options in its first layers. First, the user could accept the cookies and use the webpage for free. In this case, the webpage continued to use the same cookies that it had utilised prior to the consent being prompted or given. Second, the user could select a box marked ‘Demonstrate the Options’, which brought users to a second banner that showed all cookie use marked as ‘off’ except for analytics cookies, which were marked as ‘on’. Additional details about each type of cookie could be obtained, but only in English. If a data subject wished to reject all of the cookies by clicking the ‘Confirm my preferences’ button (without manually adjusting any of the settings, including the default ‘on’ setting for analytics cookies), the webpage would continue using the cookies that it utilised prior to requesting consent. A new pop-up would then appear prompting data subjects to either become subscribers for a monthly fee and access the webpage without advertising, or to accept all of the cookies.
The AEPD also considered the options for users to withdraw consent. The controller provided such options in a ‘Manage Preferences’ link at the bottom of the webpage. Therein, data subjects could access the cookie control panel and manually switch each cookie from ‘on’ to ‘off’. Nonetheless, when they hit confirm preferences, they were faced with the same option to either accept all cookies or to begin a paid subscription.
On 18 December 2023, the AEPD initiated sanctioning proceedings against the controller.


facts_ANSPDCP (Romania) - Fine against Dante International SA (eMAG) - no 3

The controller, Dante International SA, owns the biggest online retailer in Romania (eMAG) and has websites available in three different languages: Romanian, Hungarian, and Bulgarian.
The controller received three different data subject requests regarding their Hungarian website:
Firstly, an account deletion: the request was sent to the controller's generic email address. In response, the controller asked the data subject to send their request dated and signed on paper and then scanned or photographed via email.
Secondly, data erasure: the data subject sent their request to 3 different email addresses and via an online contact form. However, all of the requests were automatically rejected as a third party email security provider considered them as coming from an unsafe domain.
Thirdly, data rectification: a data subject requested to have their email address updated. Even if their request was initially confirmed by the controller, the data subject still received communications to its former email address.
The three data subjects filed complaints with the Hungarian Data Protection Authority which referred them to the Romanian Authority in its quality of lead supervisory authority according to Article 60 GDPR.


facts_Datatilsynet (Denmark) - 2019-431-0048

In October 2019, the Danish DPA (Datatilsynet) was notified by a number of municipalities regarding the system "Schultz Expose", operated by the company JH Schultz Information A/S. The purpose of the system is to provide management information to the job centers in the municipalities, which on the basis of the information can make decisions concerning the municipality's operations on a database basis.
During a system update, a security component that was supposed to ensure that only the relevant information was available to users with access to the system was temporarily disabled. As the update - due to a process that could not be completed - did not proceed as expected, the security component was not reactivated as scheduled.
As a result of the error, it was possible for unauthorized employees in the municipalities to access employment-related information about approx. 1,5 million citizens from other municipalities.
The company has stated that access to the system occurred through a login with personal certificates, and that access to the system is logged. Thus, the processor was able to establish that three named employees in three municipalities accessed the system during the period when the security component was deactivated. Furthermore, in two of the three cases, data sets were retrieved containing information about citizens who did not belong to the municipality in question.
Types of personal data unlawfully accessed:
  * gender, age and citizenship
  * information about unemployment benefits, job clarification and similar, as well as corresponding target groups (unemployment benefit recipient, cash benefit recipient, etc.)
  * job status: fully/partially unemployed
  * work type: flex jobs, company internships, ordinary jobs, etc.
  * place of work: the individual companies or organizations that are responsible for a given activity/job
  * number of calls, type and time
  * number of absences, exemptions and durations of these in connection with activities


An online course teacher of foreign languages in a private school filed a complaint against the Greek DPA (Hellenic Data Protection Authority - HDPA), because the school's director was constantly monitoring her lessons by attending and intervening in the Zoom calls where the sessions were taking place.
The teacher stated that the employer’s presence in her online lessons via Zoom made it difficult for her to express herself and to perform, and that she felt that her freedom of speech and her status as a teacher were being infringed. The teacher also claimed that not only had she not consented to this monitoring, but in fact had expressly objected to it on numerous occasions. Furthermore, the teacher claimed that she was never was informed by employer of the type of personal data collected in the process of monitoring her lessons, the purpose of the processing in question, who had access to those data, and her right of access to the data concerning her. Finally, she claimed that the purposes of continuous monitoring relied on by the employer, namely to ensure the quality of the courses, the actual attendance of pupils, and the technical functioning of the platform, could have been achieved by less intrusive means, and that therefore the principle of proportionality was not respected in the contested processing.
The employer on the other hand, justified the continuous monitoring of the online course in order to ensure the satisfaction of the school's customers (in particular the parents of the underage pupils), and for reasons regarding the technical functionality of the courses. The employer also stated that the monitoring activity did not include any recording of the sessions. Additionally, the employer stated that the employee was aware of the Privacy Policy related to the tutorials, and that the consent form provided to all employees for the monitoring of the lessons was not signed due to the employee’s own negligence.


The controller is an employer who allegedly surveilled its employees work phones and work email accounts from January until March 2021. The DSB (Austrian Data Protection Authority) heard of this conduct in media reports and initiated an ex officio investigation into the matter on 31 March 2021. On 29 July 2021 the DSB adopted an administrative act in which it declared the processing of the controller unlawful.
The controller initiated court proceedings against the act claiming that its conduct was lawful and that the DSB - neither under national law nor under the GDPR - had the power to declare the processing unlawful. It argued that Article 58(2) GDPR does not provide a DPA with such a power, because "declaring the unlawfulness" is not listed there. Moreover, § 24 DSG (Austrian Data Protection Act) which provides the DPA with the power to make such a declaration only applies to proceedings which were initiated by a complaint and not by the DSB itself.


Controller Google and data subject is a plastic surgeon who had been conditionally suspended in 2016 for a lack of aftercare after an operation. Because Google then displayed search results that linked to articles about the data subject and their conditional suspension, the data subject requested Google to delete the search results pursuant to Article 17 GDPR. After Google rejected this request, the data subject brought the issue before Court, which upheld data subject’s claim. After Google appealed to this judgement, however, the Court of Appeal annulled the Court of First Instance’s judgement. According to the Court of Appeal, the right to freedom of expression and freedom of information of Google and of third parties, namely information providers and the general public, outweighed the right to privacy and personal data protection of the data subject.
The data subject, however, argued that their request must be assessed on the basis of Article 10 GDPR. Moreover, the data subject also stated that they were wrongly ordered to pay the costs of the proceedings in both instances. According to the data subject, it follows from Article 47 of the Charter of Fundamental Rights and Article 79 GDPR, that they should not be ordered to pay those costs if their challenge is unsuccessful. Hence, the data subject then appealed in cassation to the Supreme Court of the Netherlands.


The client of a financial institution lodged a complaint before the Spanish DPA (AEPD) due to the delivery of a mail for commercial purposes, even though he had expressly rejected the delivery of commercial communications and promotional offers.

Dispute
Are the electronic communication sent by a financial entity to its clients to be considered as necessary for contract fulfilment or do they have commercial purposes (and thus would breach the principle of Article 21(1) of the Spanish Information Society Services Act (LSSI) regarding the delivery of electronic commercial communications to data subjects without prior authorization)?


In 2018, the data subject secured a loan from ING bank (the controller). Following this, several unauthorized activities occurred on his checking account, and the controller subsequently placed registrations with respect to the data subject in the Dutch Central Credit Information System (CKI). These registrations contained payment behaviour data, among other things the fact that for a certain period, the data subject was unable to fulfill their payment obligations set out with the controller. The data subject objected the CKI registrations on the basis of Article 21 GDPR, explaining that it had an impact on a loan he was taking out for a new house. The controller denied the request and further considered it as inadmissible under national provisions.


In December 2019, the Norwegian DPA (Datatilsynet) was contacted by the National Criminal Investigation Service regarding a tip they had received about a webcam livestreame from a town's city centre, and consequently launched an investigation.
The company (Dragefossen AS, the controller) had installed a camera on the roof of the building they were located in. The camera rotated 360 degrees in the span of two minutes, but due to the setup, only about 270 degrees was in practice captured. A public road, the parking lot and entrance to several shops, a liquor store, bank, the town hall and several other buildings were recorded.
Footage was then livestreamed to their YouTube channel, which had 1090 subscribers on 26 May 2020 and 1530 subscribers on 1 October 2020. The DPA noted that they did not know how many in total had viewed the livestream, which had started on 19 August 2019, but that a prior livestream sent on 28 January 2019 had received 13,000 views during 140 days.
Recordings were saved on a dedicated server for 14 days before deleted, and had been shared with the police on several occasions in relation to events in the city centre.
The controller had informed about the webcam on their Facebook page and claimed that it was setup as a service to the town's inhabitants. They claimed that due to the low quality and distance of the recording, number plates or faces would not be recognisable.


On May 2021, Dansk Retursystem sent to the data subject an advertising letter advertising products from X. Lebensversicherung AG. As a result, the data subject demanded information from the controller and the deletion of his data.
The controller replied that it had received the data from the company AD from Switzerland and processed it on behalf of X. Lebensversicherung AG for marketing purposes on the basis of Article 6(1)(f) GDPR, without transmitting the data to the data subject himself.
The data subject claimed for non-material damages pursuant to Article 82 GDPR in the amount of EUR 3,000.00, as well as pre-trial legal costs, for violation of Article 6(1)(f) GDPR, affirming that he did not consent to such processing of his personal data and there was no customer relationship with the defendant or its business partners.
The Court dismissed the claim, recognizing that advertising can be a legitimate interest within the controller's business. Also, the data subject's interests do not outweigh the interests of the controller. In addition, they highlighted that having a customer relationship before the direct advertising it is not a requirement.
Unsatisfied, the data subject appealed, requesting a compensation for his non-material damage in the amount of €3,000.00 and the reimbursement of the appeal in the amount of €603.93.


facts_Persónuvernd (Island) - 2020122992

In December 2020, the DPA received a complaint by the complainant that their authorisation had been invoked by Netgíró ehf. (the controller) due to credit rating information given by Creditinfo Lánstrausts without prior to informing the claimant i.e. data subject of data transmission.
The data subject argued that to gain access to Creditinfo's information about themself, they had to agree to the company's use of certain additional information from its debt position system when calculating their credit rating. Additionally, Creditinfo allegedly used incorrect information from the debt position system in the calculation, as the IL fund communicated information to the system about the complainant's debt to the fund even though they had already paid the debt in question.
Netgíró ehf. have been prohibited from using information about Creditinfo's credit rating, which has been incorrectly calculated, and that the company is obliged to notify the borrower (this case the complainant) in advance when it intends to cancel the borrower's authorization due to changes in Creditinfo's credit rating.
The defendants in this case argued that the data subject had in fact been notified and reminded that they can withdraw their consent at any point and that Creditinfo was considered a processor in the debt position system.


The controller run some websites that make use of Google tools. When users interacted with such tools their personal data were transferred to the US, allegedly in violation of the GDPR. The data subject visited some of these websites via web crawling and claimed damages for data protection violations. The controller considered the data subject's request unfounded and brought an action for injunctive relief before the Regional Court of Baden-Baden. The controller asked the court to order the data subject to refrain from further warnings and requests, as the data subject had no right to compensation under the GDPR.


A data subject made an appeal to the Federal Administrative Court concerning a decision of the Austria Data Protection authority. The authority had dismissed the data subject`s complaint about a violation of the right to rectification as unfounded. The data subject had applied for the correction of data in a legal notice (Bescheid), which was in connection with investigative actions relating to the data subject's claims for compensation under the Police Powers Compensation Act (PolBEG).


facts_Garante per la protezione dei dati personali (Italy) - 9867661

In 2014, two Italian media outlets - "Il Sole 24 Ore" and "Società Editoriale il Fatto" (the controllers) - published online two articles regarding a judicial dispute where the data subject was involved. The data subject's name appeared in the publications and thus it became a keyword for searches on external search engines.
Months later, the competent Italian court found that the data subject was in no meaningful relationship with the facts at issue in the judicial proceeding. After the judgment, the data subject contacted the two publishers asking for the erasure of the articles from their online pages because the information violated the data subject's right to be forgotten under Article 17 GDPR. The data subject considered the publications outdated and deceptive.
Nevertheless, instead of erasing the articles, the controllers updated them by including the final judicial decision.


facts_Datatilsynet (Denmark) - Decision of 2 December 2022

A company (the controller) had informed a number of its customers via e-mail that a former employee (the data subject) had committed criminal offences during their employment period and, as a result, had been dismissed. The data subject then issued a complaint with the Danish DPA alleging that the controller had passed on said information to a number of the company's customers without any due reason.


The controller is the Municipal Executive of Bladel (an administrative body). The data subject is a dog trader (and her partner).
In 2013, the police started an investigation to combat malicious dog trading. The data subjects were included in a report that was drawn up regarding this investigation. The investigation resulted in an enforcement action in 2016. The data subjects started administrative and civil proceedings on the (lawfulness of the) enforcement action.
In March 2018, the data subjects submitted a request for erasure at the controller, concerning their personal data laid down in said report. The controller denied this request by decision of October 2018. The data subjects appealed this decision up until the Administrative Division of the Council of State. The Division found that the controller's decision lacked substantive reasoning and ordered it to issue a new one.
The controller denied the data subjects request again by decision of November 2020. It held that retention of the personal data was necessary pursuant to Article 17(3)(e) AVG, to substantiate it's defense in the civil proceedings started by the data subjects.
The data subject appealed this decision, stating that the controller cannot invoke the exception of Article 17(3)(e). She argued that the Article specifically refers to the establishment, exercise or substantiation of a legal claim, however it does not include the defense against one.


The data subject was called on the phone by his employer ("controller") during their regular leave. The controller used the data from the geolocation system installed in the company car because the data subject did not answer their phone calls for 3 times. The controller declared that they were concerned for the employee's health due to a previous accident.
The data subject lodged a complaint with the Hellenic DPA ("HDPA") considering that this processing was illegal and that he was not given clear information regarding the use of this geolocation data.
The controller argued that the use of the car had been granted to the data subject for meeting official needs and only within working hours. The controller brought to the attention of the DPA the actions it took after the incident was reported, in order to exclude any possible future misuse of the tracking systems in question. These actions included the installation of new geolocation systems, with the ability to be disabled by users, the designation of a responsible operator, the updating of the user instructions and the drafting of new installation and operation notification documents.


The data subjects made an access request to the controller, an association for persons with autism spectrum disorders ‘H Ασπίδα του Δαυίδ’, regarding personal data of their minor child who was being treated there. They specifically asked for CCTV footage from the controller’s premises on certain dates, in order to find out how certain marks on their child's head and hands were caused.
The controller did not reply to the data subjects’ access request.
The data subject’ lodged a complaint before the DPA against the controller's failure to satisfy their access request. They also claimed that the controller unlawfully transferred their child’s health data to a third company for external evaluation of the child's existing intervention program, without their prior notification and consent.
The controller claimed that it could not provide the CCTV footage because some of its employees appear on it, which refused the disclosure of the footage to the data subjects. Therefore, it must respect its employees privacy rights. The controller also insisted that in any case the recordings were automatically deleted from the system after 48 hours. Regarding the transfers of personal data, it responded that the data subjects should address the matter to the third company.
The DPA informed the controller that unless it demonstrated that in the specific case the rights or freedoms of its employees concerned were in fact affected, it had to satisfy the right of access by providing data subjects with the requested parts of the footage.
The controller still refused to comply with the DPA’s instructions.


facts_ANSPDCP (Romania) - Fine against Condor SA

A data subject filed a claim before the Romanian DPA (ANSPDCP) against Condor SA, a parachute and military flight equipment manufacturer, claiming that it had disclosed the personal data (including data on salaries) of its current and former employees to an unauthorised person.


Due to a bankruptcy the data subject was represented by a bankruptcy trustee. The bankruptcy was lifted on 7 July 2022, ending the trustee’s authorization to represent the data subject. However, on 19 July 2022, an employee of a Dutch bank, ABN AMRO Bank (the controller), shared the data subject’s personal data with the former bankruptcy trustee of the data subject on the phone.
The data subject lodged a complaint with the Dutch DPA (“Autoriteit Persoonsgegevens) for an unreported data breach by the controller (i.e. sharing his personal data with his former bankruptcy trustee).
The controller admitted to the DPA that the bankruptcy trustee of the data subject should only have been informed that they were no longer appointed due to the discharge from bankruptcy of the data subject, and that therefore information of the data subject would not be shared anymore with them.
The DPA interpreted the data subject's complaint as not directly referring to the data breach, but to the unlawful processing of sensitive personal data. To determine whether unlawful processing took place, further investigation would have been required. However, in this case, the DPA refrained from conducting further investigation.
The DPA explained why it was not investigating the data subject’s complaint, referring to the criteria on their website. On their website the DPA states that to be efficient and effective, they have to make choices and therefore use the following criteria to determine whether the complaint qualifies for further investigation: the complaint is about a violation that is still ongoing, has a broader societal interest, there are no other proceedings pending, the complaint is specifically about a GDPR issue, and the subject of the complaint has not previously been investigated by the DPA.
Taking into account the data subject's complaint, the DPA held that the alleged violation did not last long and the phone call took place quite some time ago. There was also no broader social significance and only the data subject was affected and the subject of the complaint did not fall within any of the DPA’s central themes of 2024. Lastly, the DPA held that the dispute between the data subject and the former bankruptcy trustee was not primarily a GDPR violation.
The data subject appealed the DPA’s decision to not further investigate at the District Court of The Hague (“Rechtbank Den Haag”).
The DPA argued that further investigation was not needed to establish wrongdoing. The controller’s sharing of the data subject’s personal data with the former bankruptcy trustee was unlawful. However, the DPA stated that the controller acknowledged the violation and mistakenly did not report the breach to the data subject.


The data subject claims that the Community/condominium, to which he belongs, has posted on a bulletin board, located in a common area (at the entrance of the doorway next to the elevator), a judgement in which his personal data (name, address and information about the judicial process) appears.
Exposure of the document allegedly took place since May 17, 2021 without, at the date of the complaint (July 26, 2021) having being deleted or anonymized despite the clear warning on the document itself for non-dissemination to non-interested parties without prior dissociation of personal data: "it will be contrary to the Law to disseminate non-anonymized Judicial documents that have not been anonymized".
Additionally, on November 24, 2017 the data subject had already filed a complaint against the Community before the AEPD for facts of identical nature. This was processed under procedure A/00001/2018 with a warning result (R/00601/2018) for infringement and a requirement to remove the information improperly exposed.
The Community alleged that on October 13, 2021 it proceeded with the withdrawal of the document exhibited on the notice board.


A data subject (the Complainant) requested a search engine provider to erase one or more links to web pages where his name was appearing. The search engine provider rejected the erasure request of the Complainant. The Complainant therefore filed a complaint with the Belgian DPA, but then decided to withdraw his complaint before the Belgian DPA had come to any conclusion.


facts_UODO (Poland) - ZSZZS.440.768.2018

Primary school in school Gdańsk processed special categories of personal data (biometric data) of 680 children when they used the school canteen after receiving their parents' consent. The solution has been in place since 1 April 2015. The parents get informed via the canteen's website. Children whose parents have consented get their meals with priority. Two people, the system administrator and the authorising officer, have access to the database. The server is protected against unauthorized access with a password.

Dispute


facts_ANSPDCP (Romania) - Fine against Kaufland Romania SCS

A data subject made an access request asking to receive a copy of the video recordings from when they visited a Kaufland supermarket.
Kaufland refused to offer all the existent footage that included the data subject, arguing that disclosing such material would affect the rights and freedoms of the other individuals who were also captured in that video footage.


On 20 May 2021, a Spanish natural person (the data subject), filed a complaint to the AEPD because of the video surveillance system installed by its neighbour (the controller). The surveillance system of the controller entailed a set of four cameras that, according to the data subject, covered part of the public road and went beyond what could be considered adequate for the surveillance of the property. Accordingly, this would constitute a breach of Article 5(1)(c) GDPR.


On 13th November 2018, the French DPA (CNIL) carried out an inspection at the Brico Privé's premises, a DIY company, to inspect the company's data retention periods, the information it provides to data subjects, its compliance with requests for the deletion of personal data, data security, and compliance with the obligation to obtain data subject consent to receive commercial prospecting by e-mail.
In order to complete its investigations, the CNIL carried out an online inspection of all processing accessible from the bricoprive.com domain on 6 February 2020.
On 13 January 2021, as the company indicated that changes had been made to the methods of depositing cookies, a delegation from the CNIL carried out a new investigation of any processing accessible from the bricoprive.com domain in order to update the findings made on 6 February 2020.


facts_Garante per la protezione dei dati personali (Italy) - 9746047

The Municipal Police of the Municipality of Florence informed the Italian DPA that Private club Ruian had video surveillance system in place with two external cameras oriented towards the sidewalk and street in front of the club, lacking an appropriate information sign.


Following a general check carried on all Luxembourg municipalities in the summer of 2022, the Luxembourg DPA decided to open an investigation on the Municipal Administration of Leudelange (the controller).
Specifically, the controller aimed to evaluate the controller’s conformity with its obligation to appoint a DPO and whether it communicated the DPO's contact details to the DPA, as provided by Article 37(1)(a) GDPR and Article 37(7) GDPR.


facts_ANSPDCP (Romania) - Valoris Center S.R.L.

The controller is a bank that, inter alia, provides internet banking services. The processor is Valoris Center S.R.L., a company that provides call center services on behalf of the bank. In their communication with a customer of the bank, an employee of Valoris had, by mistake, attached an excel file containing personal data of the controller’s customers who used the internet banking service. Hence, pursuant to Article 33 GDPR, the controller notified the Romanian DPA of a personal data breach.
In the course of the investigation, the DPA found that this breach led to the unauthorised disclosure and access to personal data. The excel file contained e-mail addresses, user names, user ID’s, telephone numbers, customer names, customer codes, customer PIN’s, of the bank’s customers. In total, 11,169 natural persons were affected by the incident.


The decision is the consequence of a sanction procedure started by the AEPD against the defendant due to a complaint submitted by a Spanish citizen stating that, since 2015, the defendant (i) not only has used the phone number of the claimant to train its employees, but also (ii) it has unauthorizedly accessed his/her client profile and (iii) has sent him/her a big amount of SMS and even made 534 phone calls from number 1002. The claimant attached the SMS and phone calls as evidence of his/her claim.

Dispute
The defendant answered to the AEPD investigation requests stating that, in June 2020, it sent an email to the claimant informing that new measures have been taken in order to block the calling phone number (1002); it also stated that it has checked the detail of the SMS provided by the claimant as an evidence and, although some measures have been already taken in order to avoid such situation, those measures have been strengthened. The defendant also declared that it has included technical measures in order to prevent commercial agents and any business area to manually call the claimant; between such measures, the defendant included an information message ("This phone number is related to a real client, so any unlawful use is forbidden"). The AEPD started the corresponding sanction procedure.


The Council of Mayor and Aldermen of Uithoorn (which exercises the executive power of the municipal government) rejected the request of appellant to erase his personal data. He attached a certified copy of his passport to this request, but it was deemed insufficient to establish the applicant's identity properly and irrefutably. The Council of Mayor and Aldermen of Uithoorn requested the appellant to visit the town hall in person. Subsequently, the appellant requested that a DigiD link be e-mailed to enable him to identify himself, but such identification via DigiD was not yet possible at the municipality.
By decision of 10 February 2020, the District Court of Amsterdam dismissed the appellant’s appeal against that decision as unfounded. The Court ruled that the Council of Mayor and Aldermen of Uithoorn could reasonably request the appellant to come and identify himself personally at the town hall, in order to prevent fraud. Such requirement was not deemed disproportionate, considering the irreversibility of the erasure of data and the importance of proper identification in this respect.
The appellant lodged an appeal against this decision.

Dispute
Does the presentation of a copy of a passport provide sufficient information to verify the data subject's identity?


The French DPA had received a complaint on 28 May 2018 regarding the lawfulness of processing by Amazon Europe Core ('Provider' or 'The company'). The French DPA had forwarded this complaint to the Luxembourg DPA under the 'one stop shop' mechanism of Article 56 GDPR. The luxembourg DPA started an investigation regarding Amazon's use of cookies and its compliance with the GDPR and the ePrivacy directive. However, the French DPA started its own investigation into Amazon's compliance with Article 82 of the French Data protection act, a national implementation of Article 5(3) of the ePrivacy directive. (directive 2002/58/EC). This investigation regarding Article 82 had resulted in decision SAN-2020-013. In this decision, the French DPA fined Amazon €35,000,000 for the failure to obtain prior consent and the failure to inform users of their rights with regards to the processing of their data, which was mandatory under Article 82 of the Data Protection Act. The DPA found that when a user visited the "Amazon.fr" site, a large number of cookies with advertising purposes were automatically placed on the data subjects computer. Because this type of cookie was not essential to the service provided by the controller, the DPA considered that the controller had not complied with the obligation to obtain the consent of Internet users before depositing the cookies.
Amazon appealed this decision at the Conseil d'Etat, the French Supreme Administrative Court, and requested its annulment. Amazon also asked the Conseil to refer several questions to the CJEU for a preliminary ruling.
Among other arguments, Amazon claimed that the French DPA had made an incorrect interpretation of the law regarding its competence and had disregarded its competence by imposing the contested sanction. The controller also stated that the involvement of the French DPA, when the Luxembourg DPA was already involved, constituted a violation of Article 50 of the Charter of Fundamental Rights. According to this article, the same person may not be prosecuted more than once for the same acts.


facts_Rb. Zeeland-West-Brabant - 10072897 AZ VERZ 22-61

Chetu Inc (the controller) is a Florida based company that has a branch in the Netherlands. It develops, produces and publishes software and provides consultancy and support for information technology. The data subject worked for the controller since 14 January 2019. The data subject signed a statement stating that his employment was “at-will employment”, meaning that the company may terminate the employment relationship without cause or previous notice, at any time.
On 23 August 2022, the data subject received an e-mail from the controller announcing his attendance for the Corrective Action Program (CAP)-virtual classroom where he had to be logged in during the entire work day, to share his screen and leave his camera on. On 25 August 2022 the data subject responded, stating he was uncomfortable being monitored 9 hours a day by camera, and that it was an invasion of his privacy, as he already has his activities on his laptop and his screen being monitored. After two more warnings for the data subject to his camera on, the controller sent an e-mail the same evening, stating that the data subject’s employment is terminated with the reason being: “Refusal to work, Insubordination.”.


facts_DPC (Ireland) - WhatsApp Ireland Limited - IN-18-12-2

This DPC decision is the result of an own-volition inquiry pursuant to section 110 Data Protection Act 2018. It was prompted by various complaints sent by individual data subjects as well as a mutual assistance request from the German Federal Data Protection Authority concerning WhatsApp’s transparency obligations following the entry into force of the GDPR in May 2018.
The inquiry focused on:
 1. WhatsApp’s transparency obligations in the context of non-users under Articles 14 and 12(1) GDPR
 2. WhatsApp’s transparency obligations in the context of users under Articles 13 and 12(1) GDPR.
 3. WhatsApp’s transparency obligations in the context of its relationship with other Facebook Companies and any sharing of user data in the context of that relationship.
Following an investigation lasting from December 2018 to December 2020, the DPC submitted a composite draft decision to other DPAs in accordance with Article 60 GDPR. On 24 December 2020, it referred the objections to the EDPB, as required by the Article 65(1)(a) dispute resolution mechanism. The EDPB then adopted its binding Article 65 GDPR decision on July 28 2021.
Consequently, the DPC amended its draft to take into account the EDPB’s determination of the various objections from the other DPAs which it deemed to be “relevant and reasoned” for the purpose of Article 4(24) of the GDPR. Notably, it required the DPC to find that WhatsApp failed to comply with the key principle of transparency set out in Article 5(1)(a) GDPR, a matter it had not originally assessed.


In 2010, the data subject had been subject to insolvency proceedings. In 2012, he was ordered to repay 70% of his open debts and managed to fulfil this payment plan by mid-March 2018. The competent court consequently accepted his request to remove information on the insolvency from the public insolvency register (Insolvenzdatei).
This publicly available information of the data subject's insolvency had also been stored in the database of the credit reference agency KSV 1870 Information GmbH. The data subject is also the sole managing director of a limited company. The database entry on his insolvency has also been linked with the data stored on this company.
The data subject requested the erasure of the data on his insolvency under Article 17 and 21 GDPR, stating that he has paid back his debts in line with the payment plan and that data on his insolvency are no longer published in the insolvency register.
After KSV 1870 Information GmbH refused to delete the data, the data subject lodged a complaint with the Austrian DPA (Datenschutzbehörde - DSB). The DSB rejected the complaint and the data subject filed an appeal with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG).

Dispute
Is a credit reference agency such as KSV 1870 Information GmbH allowed to store data on the insoleveny of an individual beyond the availability of that data in the official insolveny register? If so, for how long?


Facts pertaining to the case
The Austrian Postal Service (Österreichische Post AG) had been selling data on natural person's party "affinity for a political party" to their customers. In light of broad media coverage on this topic the Austrian Data Protection Authority (Datenschutzbehörde - DSB) started an ex-officio investigation against the Austrian Postal Service. The DSB investigated i.a the records of processing activities and the data protection impact assessment of the Austrian Postal Service. Further, it investigated records that must be maintained under § 151 Trade Regulations Act (Gewerbeordnung 1994 - GewO).

Decisions by the Austrian Data Protection Authority
With its decision dated 22.01.2019, the DSB
 1. held that the Austrian Postal Service had processed personal data on the "affinity for a political party" without a legal basis, as these data qualify as special categories of personal data under Article 9(1) GDPR. Their processing would require the data subjects' explicit consent under Article 9(2)(a) GDPR and § 151(4) GewO,
 2. ordered the Austrian Postal Service to stop the processing of these data effective immediately and to erase such data within a period of two weeks (unless a derogation under Article 17(3) GDPR was applicable),
 3. held that the Austrian Postal Service had failed to carry out a data protection impact assessment prior to 25.05.2018,
 4. held that this data protection impact assessment was incorrect because it did not take into account that data on the "affinity for a political party" qualify as special categories of personal data,
 5. held that the records of processing activities maintained by the Austrian Postal Service was incorrect, because it did not take into account that data on the"affinity for a political party" qualify as special categories of personal data
 6. ordered the Austrian Postal Service to carry out a new, correct data protection impact assessment regarding the processing on data on the "affinity for a political party".

Appeal by the Austrian Postal Service
On 11.03.2019 the Austrian Postal Service filed an appeal against the DSB's decision with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG), claiming incorrect legal evaluation of the case by the DSB. The Austrian Postal Service argued
  * that data on the "affinity for a political party" do not qualify as personal data as they only express a probability.
  * these data could not be rectified under Article 16 GDPR and therefore would not qualify as personal data,
  * these data would qualify as "marketing information and classifications" under § 151(6) GewO which would not be considered as personal data by the Austrian legislator and
  * even if these data were to be qualified as personal data they would not qualify as special categories of personal data.

Dispute
  * Do data on a natural person's (presumed) "affinity for a political party" qualify as personal data under Article 4(1) GDPR?
  * If so, do they also qualify as special categories of personal data?
  * Did the Austrian Postal Service process these data unlawfully?
  * Did the Austrian Postal Service violate Article 30 GDPR by not considering data on the "affinity for a political party" as special categories of personal data?
  * Did the Austrian Postal Service violate Article 35 GPPR by not carrying out a data protection impact assessment prior to 25.05.2018 and by not considering data on the "affinity for a political party" as special categories of personal data?
  *


facts_Garante per la protezione dei dati personali (Italy) - 9938413

On 27 August 2020, the complainants, two spouses, brought a complaint to the Italian DPA regarding the publication on the website of an Italian Bar Association (data controller) about certain hearing postponements. According to the complainants, the website of the data controller presented information on hearings of criminal proceedings where the complainants appeared as defendants. This document, which was not anonymised, could also be found and downloaded following a search of their names through the Google search engine.
In a follow-up on 22 September 2020, the complainants provided updates on the matter, informing the DPA that although the document was removed from the website, it still remained indexed on Google and that other non-anonymised documents remained on the web. The complainants argued that the publication of such information had resulted in prejudice against them and damages. For example, they were denied from renting a property because the owner stated to not rent property to convicted criminals.
Following the complaint, the DPA requested the data controller for further information. The data controller issued a response saying that from a procedural point of view, as certain hearings are held in public, the publication of the relevant documents on the website was legitimate. Moreover, these documents were also always posted uncensored on the doors of the Courtrooms and on the notice boards of the Palace of Justice. They further clarified that the lack of information regarding the complainants’ place and date of birth and the tax code prevented their identification.
With regard to the request relating to the anonymisation of the documents in question, the controller stated that it had promptly taken action, when requested by the complainants, to remove the documents from their website. However, they could not take them down from the web portals of other bodies, such as that of the local Court.
Following the statement, the DPA began its proceeding.


The data subject submitted a complaint against a training academy (the controller) for unlawfully publishing their personal data on a website. The publication contained results of a selection process in which the data subject participated. Specifically, the document contained a list with names, last names, anonymised ID numbers and categories assigned to participants. The list allowed the identification of health data relating to disabilities.
In addition, the list corresponded with the provisional publication of results by the Galician Health Services (SERGAS), the authority competent for the examination and selection of candidates. Both lists were different, thus the controller made a re-work of the official list by selecting some candidates, grouping them by categories, breaking down their marks (studies, work experience, other activities) and assigning them a position according to their total score.
The Spanish DPA started a sanctioning proceeding against the controller due to an alleged violation of Article 6(1) GDPR for the lack of legal basis for processing of personal data, including special categories of personal data. Furthermore, the publication allegedly did not include the mandatory information regarding the origin of the data nor the right to object.
In response, the controller argued that the legal basis was legitimate interest since the academy offered training courses and the publication showed the participants, in a clear way, the position obtained. The controller stated that it was not processing carried out in the context of their usual activity since it was done only once, in relation with that specific selection process. Another argument was that the information had been made public by SERGAS and that candidates who participated in the public selection process expected their data to be published due to transparency obligations.


facts_NAIH (Hungary) - NAIH/2020/2729/15

A construction company had installed a video surveillance system on a construction site to protect the property and the physical integrity of employees. However, cameras partially captured a social room and activities of the employees. They had not been sufficiently informed about that while signing a contract, having knowledge only about the video system monitoring the property.

Dispute
Is a video surveillance system that partially captures activities of employees without their knowledge compliant with Article 5 GDPR?


Energy Suite is a company marketing "boiler, heating, insulation, glazing and other energy-saving grants to homes under government-funded schemes." Between 1 March and 13 November 2020, Energy Suite connected at least 1,246 calls to subscribers whose numbers were listed on the TPS (Telephone Preference Service Ltd) register. Three complaints were made against Energy Suit during this period as it called people who had not given their no-objection to receive marketing calls.
Before the ICO, Energy Suite claimed that it had purchased "details of 11,005 live, validated landlines and 88,995 live HLR-checked mobiles" from third parties, without conducting any in-house checks.


On December, 7 2020, the French DPA imposed a financial penalty of 60 Million euros fine against Google LLC and a 40 million euros against Google Ireland Limited in accordance with the General Data Protection Regulation (GDPR) and ePrivacy Directive, for lack of transparency, inadequate information and lack of valid consent regarding for violating the regulation on cookies while operating the website google.fr.
The sanction was accompanied by an order to comply with article 82 of the French Law on data protection (Law Informatique et Libertés), under three months on penalty of a €100000 fine per day of delay.
The companies appealed to the Conseil d’État in interim procedure against the CNIL's decision, arguing that the French DPA was not the competent authority because it was not the lead supervisory authority for Google LLC or Google Ireland Limited.

Dispute
Is the CNIL territorially competent to investigate and sanction a company for violating the information principle when depositing cookies if it is not the lead supervisory authority of the company? The CNIL considered that Google does have EU headquarters in Ireland, but that this Irish entity ‘did not have a decision making power’ in relation to the relevant cross-border data processing activities to which the complaints related. For that reason the CNIL decided that the One Stop Shop mechanism did not apply and that the CNIL, like any other European supervisory authority, was therefore competent to make a decision.


In this case an individual, the data subject, who had taken part in a phone call with a polling company, the controller, submitted an access request (Article 15 GDPR) to obtain a copy of the recorded conversation. The company did not respond to her request and, subsequently, she filed a complaint with the Greek DPA.
When asked to provide submissions to the DPA, the controller responded to the complaint by stating, firstly, that it is not a commercial sales company and therefore does not record conversations or collect personal data in any way. Secondly, they explained that they have a three-month period for which they keep personal data on their files and so, had there been any collection of the data as suggested, it would have been deleted. The company also speculated that the subject’s access request (submitted via email) probably ended up in a “pile of unwanted corporate correspondence”.


facts_Datatilsynet (Denmark) - 2019-431-0031

Controller is the Conservative People's Party. They had sent letters to a certain number of households in connection with an election campaign. The names and addresses of the recipients had been obtained from information that was publicly available, and information about voting habits in different areas had been gathered through statistical analyses. The letters, however, did not contain the information as listed in Article 14(1) and Article 14(2) GDPR. Instead, the controller had published an page on its website, on which they had provided this information.
After having been notified by multiple data subjects, the Danish DPA decided to investigate the Conservative People's Party's actions, and whether they were in accordance with the GDPR.


facts_CPDP (Bulgaria) - PSPN-01-243.2021

A journalist (Controller 1) published images of a data subject’s medical diploma and criminal record. Controller 1’s post claimed that the data subject’s diploma was not legitimate and that his convictions should be shared on Facebook. The documents contained personal data including the data subject’s names, PIN, date and place of birth, current address, parents’ names and father’s birth date.
On 3 October 2020, the data subject requested that Facebook remove the posts. The social network rejected the data subject’s requests to remove the post because the documents had not been provided by the data subject. The data subject subsequently filed a report with the district prosecutor’s office, which refused to initiate pre-trial proceedings. The data subject then filed a complaint with the Bulgarian DPA (CPDP).
Controller 1 stated that they had previously received reports of abuse and mistreatment by the data subject from medical patients in the community. It claimed that a doctor from the same clinic as the data subject (Controller 2) sent them the information and documents about the data subject.
In the course of its investigation, the CPDP verified that Controller 2 had provided Controller 1 with the information. It also confirmed with the National Register of the Bulgarian Medical Association that the data subject was a registered doctor legitimately graduated in general medicine.
Controller 1 argued that they had visual problems and as a result, did not realise the complete contents of the document or that the diploma contained personal data as their son, who is also their assistant, makes publications on Controller 1's behalf. They also argued that they had not actually posted the content for journalistic purposes and were merely sharing information they considered relevant to the public. The data subject rejected Controller 1's arguments, pointing out that they should have verified their claims with the Bulgarian Medical Association in any case. The data subject also argued that the publication's near 250 interactions made their data available to an unlimited number of people.


facts_Garante per la protezione dei dati personali (Italy) - 9949453

Scionti Selezioni Superiori S.r.l. (the data controller) faced scrutiny following numerous complaints received by the Italian DPA in 2022. The complaints highlighted unauthorised phone calls promoting the "Caffè Scionti" brand, particularly targeting individuals registered in the Italian Public Opt-out Registry (RPO). The RPO is an Italian registry extended to all national phone numbers, which allows citizens to opt-out of unwanted telemarketing calls.
Following the DPA's request of 22 November 2022 for information, the controller explained that the unauthorised phone calls happened due to random typing errors. In this regard, it explained that its development and turnover are based on word-of-mouth marketing of customers, as well as by carrying out telephone promotional activities 'in manual mode', which it admitted to have an average of 8 to 12 errors of typing monthly.
In early 2023, the DPA received more complaints related to unsolicited phone calls by the controller. Thus, on 24 February 2023, the DPA requested the controller to provide more information for a complete evaluation of its processing activities.
The controller confirmed that the database at its disposal for marketing purposes contained data obtained from third parties who, in turn, had been advertising the Scionti brand. But it also complained that its brand had been used by third parties without any authorisation and that it was unable to register to the RPO as an operator and therefore keep track of the existing objections to telemarketing.


facts_ANSPDCP (Romania) - S.C. Marsorom S.R.L.

The DPA conducted the investigation after being notified that on the website in question, some personal data of the website's customers were visible. If customers placed an order on the website, some of their personal data could be accessed without authorisation.

Dispute
Did the website operator, in its role as data controller, take sufficient technical and organisational measures to protect the personal data of its customers? Furthermore, did the controller act in breach of the storage limitation principle?


facts_Rb. Rotterdam - C/10/583910/KG ZA 19-1062

The plaintiff asked from the Erasmus University Medical Centre Rotterdam (“EUMCR”) to provide her the DNA material of a person died in 2018 alleging that this person was her father. The deceased man had participated in a medical-scientific research at the EUMCR, prior to which he had filled in a “patient consent form”. According to this form, he expressed his wish that his body material would be treated confidentially. The EUMCR refused to provide the plaintiff the DNA material claiming that:
  * there is no legal basis under which it is obliged to provide this material,
  * the man’s wish had been expressed unambiguously, thus such a disclosure would contravene the GDPR and
  * it is bound by professional secrecy.

Dispute
The Court had to balance the plaintiff’s right to personality which includes her right to know her parents and the right of the deceased man and his family to privacy which is here protected by the EUMCR’s duty of confidentiality.


A user of the website of Iberia, an airline, lodged a complaint before the Spanish DPA (AEPD) saying that they had not been given an option to reject the cookies when using the website, and that they had been obliged to accept them to keep browsing.
During the investigation, the AEPD also found that cookies were placed before obtaining consent. Additionally, they found that the information about cookies was incomplete and misleading.


The data subject, a former employee of the controller, complained to the DPA against the controller’s practice of using scans of employees' faces to register entry and exit to the work place.
The data subject had advanced an access request under Article 15 GDPR, asking for specifications regarding the purpose and category of data processing. To the date of the complaint, they had received no answer to this request by the controller.
The DPA deemed it appropriate to start an investigation. The investigation revealed the following:
  * the data subject was an employee of the controller.
  * the controller received the data subject´s access request and confirmed that the procedure started. However, no further reply to the access request was given.
  * the controller replied via fax (to an address that was not present in the data subject´s request) which lacked both floor number and door. The reply only contained a generic reference to the type of data, not the actual data, without mentioning facial recognition or biometric data, daily records of working hours.
  * the data subject signed a consent form for the processing of their personal in the context of employment relationship. Moreover, under lawfulness, the payroll processing´s purpose is deemed to be the fulfillment of a legal obligation. The document does not contain any section to select affirmative consent, or to withhold it, nor any option to revoke consent, nor any invitation to consent, nor any invitation to accept a processing operation.
  * a representative of the controller forced the data subject to sign in at the entrance to work with a facial recognition device, not providing any alternative means.
  * the system used by the controller would use a 3D recognition system, and the biometric data would be subsequently stored in the software´s own database. Thus, the controller recorded the workers´ clocking in a database. Once identification has been made, information is sent to an access database confirming of the employee´s registration.
  * the controller used this facial recognition system until 29.05.2023.
  * the controller did not respond to the claims related to special categories of data, as per Article 9 GDPR, stating that it had already provided for a lot of information and that the data subject signed the consent form.


A citizen had to give his personal details, as well as his daughter’s personal details when filling the official form aimed at authorizing underage children travelling (“travel permit”) provided by the Directorate-General of the Spanish Civil Guard. While completing the travel permit with the personal data required, the citizen noticed that no information was given regarding the collection of personal data, and the purposes of the processing, or about the recipients. The citizen – the complainant – filed a complaint with the AEPD claiming the unlawfulness due to the lack of information concerning personal data required, under Article 13 GDPR.

Dispute
Does the travel permit form provide for the mandatory information, as foreseen by Article 13 GDPR?


facts_ANSPDCP (Romania) - fine to Enel Energie Muntenia SA

The energy company Enel Energie Muntenia SA was investigated after a notification sent by a customer to the DPA.


The DPA was notified of a data breach situation by an insurance brokerage company. The company played two roles in data processing. On the one hand, it was a data controller, and on the other hand, a processor acting for insurance companies.
The data breach involved emails containing identifying data being sent to the wrong recipients. The emails contained analyses of insurance needs and an insurance offer referencing name, surname, PESEL number, town, postal code and other information about the subject of insurance.
The insurance brokerage company, as the controller of the name and surname data, decided to report the breach of personal data protection to the Polish DPA. The company considered that the combination of this data, in conjunction with the data contained in the attached documents, could result in a breach resulting in a risk of infringement of an individual's rights or freedoms. The erroneously sent correspondence contained personal data contained in quotes and calculations from several insurance companies.
Investigation carried out by the Polish DPA revealed that in connection with the incident, several insurance companies, including data controllers, had notified them of the data breach. However, no such notification was received from Sopockie Towarzystwo Ubezpieczeń ERGO Hestia S.A (“Company”).
The Company had conducted an assessment of the risks to the rights and freedoms of individuals resulting from the breach, based on which it concluded that it was not obliged to report the data breach to the DPA or to inform data subjects of the data breach.


Between March 2022 and October 2022, the French DPA (“CNIL”) carried out on-site inspections of TAGADAMEDIA (“controller”), as well as online inspections of their website. The CNIL discovered that the controller collected data (first name, surname, date of birth, postal address, e-mail address, phone number) from prospects through forms when offering them to participate in competitions or product testing on its website.
The controller used two forms to do so: before 2017, the controller used a single-button form – below the fields allowing data subjects to enter their details, there was a single “I VALIDATE” button with a green background and an arrow. Above the button, a text in a much smaller font stated that by clicking on the button, the user accepted that the data collected would be used to send offers from the controller’s partners and hyperlinks provided access to the data protection policy. The end of the text indicated that if the data subject wished to continue without receiving offers from the company’s partners, they could click on a link in the text (“I click here”), allowing the data subject to accept, or refuse that their personal data be sent to the controller’s partners.
The second form implemented from 2017 until the notification of the sanction report in 2023 was a two-button form with an “I VALIDATE” button written in white on a red background and an “I REFUSE” button written in black on a grey background, in a font smaller than the first button. Above these buttons, a text written in a font much smaller than that used for the buttons specified that by clicking on the "I VALIDATE" button, the user accepted that the data collected would be used to send offers from the company's partners.
The CNIL initiated a sanctioning procedure against the controller on 22 June 2023. During this procedure, the controller proposed a new form composed of an “I ACCEPT” button and a “NEXT STEP” button, both written in white on a red background and having a text in a much smaller font specifying that by clicking on the “I ACCEPT” button, the data subject accepted that the data would be used to send them offers from the controller’s partners, whereas the “NEXT STEP” button allowed them to continue without receiving offers from partners.


facts_Datatilsynet (Denmark) - 2019-421-0028

The Datatilsynet conducted some investigations at Udbetaling Danmark focusing on the answers to access request and thus on the compliance with Articles 12 and 15 GDPR.


The President of the District Court (the controller) reported the loss of an unencrypted USB-Stick by a probation officer. This USB-Stick contained the personal data of 400 persons, subject to probation supervision. Besides names, dates of birth, addresses, data on convictions etc., the stick also contained sensitive data (health data).
The controller stated that he had implemented a system of rules to secure the protection of personal data (the Security Policy), updated the documentation constantly. To ensure the effectiveness of these measures, the controller provided stationary and e-learning trainings to all of the District Court's employees.
One of the rules forbade the use of private "information carriers" for processing business data. However, although users of USB-Sticks (like the probation officer) had the obligation to store the stick in a lockable work bag, measures like encryption and password protection of media, were not obligated. The user was, ultimately, responsible to implement appropriate safeguards for the storage on the USB-Stick. Lastly, although the controller claimed that the DPO conducted ad hoc checks, with additional system security evaluation by the IT department, he did not provide any evidence to the DPA that confirmed that such tests actually occurred.


The decision is the consequence of an investigation procedure started by the AEPD against the defendant due to a complaint submitted by a Spanish citizen stating that he/she had requested his/her right to be forgotten in relation to nine (9) URLs, but this right was not approved by the defendant.

Dispute
The defendant answered to the AEPD investigation requests stating that one (1) of the URLs had been duly erased, and during this procedure, another two (2) URLs were also erased, but it declared that the other six (6) had not been approved as they were referring to the professional life of the Spanish citizen, and not to his/her personal life. The defendant also added that such not-erased-information was related to the activity of the claimant as candidate for different public jobs, so erasing it would not be compliant with the legitimate public interests.


The plaintiff, a journalist, sought access to information in connection with the granting of "old-age compensation due to health problems" to former members of the Bundestag. He requested an anonymised or otherwise redacted overview of cases between 2000 and 2020 from the Bundestag, broken down by year and with information regarding whether they had been decided positively and negatively, as well as the number of cases since 2006 in which compensation had been paid out without their requirements being met. In addition, he requested an affirmation regarding the correctness and completeness of the information as well as access to all relevant administrative files.
The German Bundestag rejected the plaintiff's applications on the grounds that access to information was contrary to the protection of personal data. It was highly likely that the applicant would be able to identify the persons concerned. This resulted from the fact that only a relatively small number of MPs left the German Bundestag prematurely. Since the career of individual MPs could be easily traced (e.g. by means of an internet search) the information and the files could be attributed to a narrowly defined group of persons, even if the documents were redacted.
Insofar as the MPs were deceased, the disclosure would be contrary to the post-mortem right of personality. None of the persons concerned and none of the relatives of the deceased had declared their consent. The interest of the data subjects in secrecy outweighed the interest in information of the plaintiff, because the requested information was connected to the political mandate of the individuals concerned. In addition, it concerned sensitive health data.


In May 2019 the Inspection service of the GBA started an investigation into the Federal Public Service Mobility and Transportation. GBA wanted to know about the information portal NV Informex, its access to the national data-bank of vehicles and the fact that data from this data-bank was shared with insurance companies for the purposes of creating personalized price offers to its potential customers. The report of the Inspection service found the following violations: 1. Breach of the principles of purpose limitation (Article 5) and lawfulness (Article 6) of processing; 2. Breach of the responsibilities of a controller (Article 24), security of processing (Article 32) and violation of the obligation to notify supervisory authority of the personal data breach (Article 33); 3. Breach of the requirements for designation (Article 37) and position (Article 38) of data protection officer; 4. Breach of the obligation to cooperate with the supervisory authority (Article 31); 5. Breach of transparency (Article 12) and information provision (Article 13) obligations.

Dispute


This dispute was between a divorced father (the data subject) and the chief of police of Rotterdam (the controller). In 2020, the data subject found out that Veilig Thuis (an advice and reporting centre for domestic violence and child abuse) had registered two reports on him in their database. The first registration stated that he had committed domestic violence and that subsequently he was temporarily denied entrance to the home he had previously shared with his ex-wife. According to the data subject, these allegations were unfounded. According to the data subject, the second registration was also inaccurate since the report did not adequately state that his ex-wife had moved to a new place with their son, without informing him of the new location.
He requested to have the first report deleted, and the other rectified, but Veilig Thuis refused. The data subject then brought the issue before Court, which decided that Veilig Thuis did not have a substantial interest in retaining the personal data, and that it had to delete the first report and amend the second one. Because Veilig Thuis had received the information from the Rotterdam police, the data subject subsequently requested the police to delete the inaccurate personal data and rectify the reports. The police, however, claimed that the information was accurate, and refused to rectify their files on the data subject.
The data subject then brought the issue before the District Court of First Instance of Rotterdam (hereinafter the Court), basing his claim on Article 12 GDPR on transparent information, communication and modalities for the exercise of the rights of the data subject, and his right to obtain from the controller the rectification of inaccurate personal data pursuant to Article 16 GDPR.


The data subject filed a complaint against the controller - a credit ranking agency.
In the original procedure before the Austrian DPA, the data subject claimed that their rights resulting from Article 15(1)(h) GDPR were infringed as the controller did not sufficiently inform them about the logic and algorithm used for the processing of their personal data in the context of an automated decision about the data subject's creditworthiness.
The controller replied that the processing at issue was not 'automated decision-making' pursuant to Article 22 GDPR, but only 'light profiling' under Article 4(4) GDPR. Therefore, the controller claimed that Article 15(1)(h) GDPR did not apply in the first place. Moreover, the controller argued that the algorithm regulating profiling could not be disclosed, being part of business secrets of the company.
The Austrian DPA upheld the complaint and issued a decision against the controller, ordering the latter to provide access to the information requested by the data subject.
The controller appealed the decision with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG), stating that they provided the data subject with sufficient information.


facts_Rb. Gelderland - C/05/400739 / KG ZA 22-54

The controller is Stichting Bureau Krediet Registratie (BKR), which manages the credit information register (CKI). This register provides an overview of the creditworthiness of people since credit providers (banks etc.) can register (severe) debts of individuals. There were three registrations related to the data subject in the CKI, with special codes that indicated that there had been several payment arrears. In 2021, the data subject requested the BKR to have these registrations and/or these special codes erased, but the controller refused. The data subject then brought the issue before Court, which granted his claim and ordered BKR to erase the codes. The controller then appealed this decision.
After some initial hesitations, the controller removed the codes from the registrations, but added a new code “9 Dispute”. The data subject then requested the controller to remove this new code because he claimed that it also negatively affected his creditworthiness (even more than with the previous codes), but the controller refused and explained that this code had been added to explain that the removal of the special codes is still disputed in court (namely: the appeal).
After the data subject was refused credit from a credit provider because of this new special code, he brought the issue before court to have this code “9 Dispute” erased pursuant to Article 17(1)(d) GDPR, and to keep having this code erased.


The decision is the consequence of a complaint submitted by a Spanish citizen stating that the union representative of the defendant had openly published an electoral census list (which was exclusive of the union and contained personal data such as the ID numbers of all voters considered regular staff) in an open WhatsApp group (in which almost all the workers of the radiodiagnosis Madrid central unit are included).

Dispute
The defendant answered to the first AEPD investigation requests stating that: (i) it considered that the data publication was legally covered by the Spanish law on public workers elections, (ii) the publication was made during a legal elections process and due to the request of several members of the WhatsApp group (in which the claimant was included), as they had some difficulties to access the intranet of the union in which such data were already published. The defendant also answered to the subsequent evidence investigation requests by the AEPD stating that: (i) the resolution proposal is not doing an adequate balance of the right to union freedom and the right to the data protection, (ii) there is public interest and legitimate interest in the data processing made by the publication of such data, as it was in the interest of the workers, (iii) there has never been a lack of responsibility in the acts of the union representative, (iv) all the members at the WhatsApp group accessed such information voluntarily, including the claimant, as they are also included in such electoral census list, (v) the communication area claimed is less than other publication media used by the electoral census, (vi) the union is concerned about data protection, and so it contracted the corresponding law firm in order to ensure a full compliance of the regulation, (vii) the claimant avoided to use the reporting channels offered by the defendant. After the investigation process, the AEPD started the corresponding sanction procedure, and understood that: (i) the processing activity consisting of the publication of the personal data would only be legal if its covered by Article 6(1) GDPR, (ii) with basis on several other Spanish regulations, (such as the Worker's Statute, the Spanish law on public workers elections, the Spanish law on private workers elections) there is neither a legal basis to do such publication in the way it has been made, as it shall be made by the polling station at the notice board, (iii) the publication cannot be legally covered by the legitimate interest neither, as the specific personal data published by the union representative were excessive to the alleged purpose, (iv) regarding the balance over data protection right and union freedom right, the union was never obliged to do such publication, so it significantly surpassed the boundaries of Spanish labour law to that respect.
The AEPD started the corresponding sanction procedure.


The decision is the consequence of a complaint submitted by a Spanish citizen stating that the defendant had not complied with her right of access; such complaint included diverse documentation in order to prove it (i.e. she stopped receiving propaganda, but she did not receive an answer to her right of access).

Dispute
The defendant answered to the AEPD investigation request, stating that, before receiving the request for the right of access by the claimant, her email address had already been included in a Robinson list, but, due to a mistake, they had sent her an email without marketing content. It also stated that, since then, (i) it had reinforced the training of its staff in order to avoid new mistakes like that one, and that (ii) it had created a single email address only for data protection issues. Afterwards, the defendant finally answered the right of access, but the AEPD considered it not enough, so the defendant sent a second email to the claimant including (i) the origins of the email address, (ii) a declaration that the defendant did not process any other personal data of the claimant, and (iii) the defendant had not sent such personal data to third parties.


SD IBERIAN PORTFOLIOS, S.A (the controller) bought a credit from a data subject’s bank. The bank was informed of the data subject's insolvency proceedings. Data relating to the data subject's debt was included at the controller's request in ASNEF (Spanish National Registry of Financial Statistics, a public credit registry). The data subject requested ASNEF in November 2022 to erase the data, and in response ASNEF deleted the data as a precautionary measure.
The data subject later filed an access request in 2023 and found out that the data was included in the ASNEF database again. The data was transferred despite the fact that said debt was exonerated following insolvency proceedings in 2021. The data subject requested the data to be deleted, and presented a complaint to the DPA in January 2023. In response, ASNEF temporarily removed the data for up to three months.
In this case, the controller has a contract with SERVDEBT ESPAÑA, S.L (the processor) to manage proceedings of the debts bought by the controller. The controller argued that the data subject never sent a confirmation of debt forgiveness, and that it should not be expected to consult the public registry (Registro Público Concursal) every time it acquires a new credit.
It is interesting to note that the controller is established in Luxembourg. However, the Luxembourgish DPA allowed the Spanish DPA to issue the decision, because the affected data subjects were in Spain (Article 56(2) GDPR and 56(5) GDPR). Furthermore, Article 77 GDPR allows the data subject to file a complaint to a supervisory authority of the Member State of their habitual residence. The DPA began the sanctioning proceedings against the controller in February 2025.


In an investigation of their own volition, the Data Protection Commission (Irish DPA) launched an inquiry into the lawfulness of TikTok’s (controller) transfers of personal data of EEA users to China. The inquiry also looked at TikTok’s compliance with their transparency requirements.
Throughout the investigation, TikTok maintained that they did not store EEA user data on their Chinese servers. In April 2025, TikTok corrected this and informed the DPC that due to an error, some EEA user data had in fact been stored on Chinese servers, but this was no longer the case.
During the investigation, TikTok claimed that transfers via remote access do not require a transfer mechanism as mandated under Article 46(1) GDPR. In an assessment of Chinese laws provided by TikTok to the DPC during the investigation, TikTok had themselves identified that the Chinese legal framework would preclude a finding of “essential equivalence”, as required, in addition to the adoption of appropriate safeguards and supplementary measures. In this assessment, TikTok made reference to the Chinese Anti-Terrorism Law, the Counter-Espionage Law, the Cybersecurity Law and the National Intelligence Law.
The investigation also revealed that TikTok’s October 2021 EEA privacy policy did not name the third countries, such as China, where personal data was transferred. Furthermore, the policy did not specify that personal data held by TikTok in Singapore and the United States could be accessed remotely by personnel in China.


A worker of a University filed a complaint against their employer with the Spanish DPA (AEPD). The data subject claimed that the controller had not answered a rectification request from Article 16 GDPR.
The data subject wanted the employer to rectify a productivity record deriving from the Pegasus application, alleging that the result was not adequate. This application took into account the degree of satisfaction of the users (foreseeably students). The worker alleged that the coefficients used by the formula that calculated the productivity were not disclosed, which led to a lack of transparency. Additionally, the worker alleged that the process was not objective, impartial and was discriminatory. The worker further argued that productivity must be considered personal data.


On 6 October 2023, an employee (data subject) in a shop lodged a complaint with the Belgian DPA against their employer. The employer (controller) had installed several surveillance cameras in their six shops.
In the complaint, the data subject alleged that the cameras were installed in such a way as to place employees under constant surveillance, contrary to the stated purpose of the cameras, which was to provide security in the event of theft or aggression.
The data subject claimed that they received regular comments from the security company in relation to their performance at work. In the complaint, the data subject submitted that the surveillance was in violation of Collective Labour Agreement (CLA) No. 68 (on the protection of workers' privacy with regard to camera surveillance in the workplace).


facts_Datatilsynet (Denmark) - 2022-441-12449

Salling Group (the controller) is Denmark's largest retail group which serves 11 million customers per week. In 2021, they implemented a system allowing customers to shop on its websites (namely Føtex, Bilka, Netto, Salling and Carl Junior) using the same username and password (Salling Group profile). The controller also established a monitoring tool to record incidents and events about customers' access to the websites. However, in May 2022, the controller found that the monitoring system's log file stored customers' usernames and unencrypted passwords for the website "hjem.foetex.dk" by mistake. As a result, 146 people employed by the controller had technical access to the data. If an unauthorised person used the login credentials, they could access the customer's name, address, email address, telephone number, masked card information and purchase history. The controller reported the breach to the DPA.


The electricity and gas company (controller) billed a data subject illegally, in absence of a valid contract for that.
On 14 February 2022, the data subject filed a complaint to the Spanish DPA. The data subject provided several invoices and transaction data from his bank account, which were related to a contract that he had not agreed to. The data subject also showed that he had complained about this issue to the controller several times.
On 18 April 2022, the controller acknowledged that there had been an internal error which had resulted in the unjustified contracting. The controller used a two-step system for contract-signings over the phone. The first step was informing data subjects on the phone about the nature of the service provided by the controller. The second step followed after data subjects accepted the conditions on the phone, after which the controller would send a contract to the data subject by SMS for a signature in order to give consent. According to the controller, the data subject had accepted the conditions, but did not sign the contract and did therefore also not consent to the contract. However, due to an internal synchronisation error at the side of the controller, it seemed that the data subject had signed the contract by SMS and had consented to the contract.


Between November 2019 and January 2021, the French DPA received 31 complaints relating to ‘cold’ calls, a form of sales solicitation by phone from businesses to customers who have never interacted with the business before, and issues with the complainants’ exercise of their rights by GROUPE CANAL+ (the company), which specialises in the publishing of channels and the distribution of pay-TV offerings. Five of these complaints have been upheld in the present proceedings. Specifically, two of the complainants claimed that their right to erasure had not been complied with, and a third complainant stated that his request for an objection to the processing had also been disregarded.
Thus, in January 2021, the DPA held an online inspection of the processing operations carried out by the company, and in March 2023, a rapporteur was appointed to examine the documents.
At the end of the investigation, on 11 May 2023, the company was sent a report detailing the breaches of Article 12 GDPR, Article 13 GDPR, Article 14 GDPR, Article 15 GDPR, Article 28 GDPR, Article 32 GDPR and Article 33 GDPR, as well as of Article L. 34-5 of the French Post and Electronic Communications Code (the CPCE). Following this, the company submitted additional observations, and on 14 September 2023, the rapporteur and the company presented oral observations to the DPA.


facts_Gerechtshof Amsterdam - 200.258.736/01

In the context of a litigation with his brother, the applicant requested access to a series of banking information to ABN AMRO, which refused to grant access to these data.


facts_Datatilsynet (Denmark) - 2020-31-4326

In January 2020, a complainant (a member of Jo:ga) contacted Sport Solution to inform them about possible security issues in relation to the registration and membership management system on Jo:ga's website and app. The complainant claimed that the company uses its members´ dates of birth as a permanent password to login to its website and app, and that the members cannot change it. Additionally, the complainant argued that the company had not implemented any access restrictions after several failed login attempts.
Sport Solution confirmed that Jo:ga was one of its customers but informed the complainant that the customer decides on its own which security measures should be implemented regarding registration and login. Sport Solution however informed that it would contact Jo:ga and notify them about the issue.
In August 2020, the complainant noticed that no improvement were made since January 2020 and filed a complaint with the Danish DPA.


facts_Persónuvernd (Iceland) - 2020112830

A student filed a complaint with the Icelandic DPA (Persónuvernd) against Reykjavík University regarding the online monitoring of an examination which was taken at home on Zoom due to the COVID19 pandemic. The student claimed that it had been forced to consent to the online monitoring, and that their objection to the monitoring had not been taken into account, that they had not received sufficient information regarding the processing and security of their personal data in this context (including if other students could record the session), and that it was possible that personal data related to their spouse’s remote health care consultation could have been filtered into the audio recordings.
The university, in their defense, stated that they had a legitimate interest to monitor the examination in order to ensure its integrity, and that the student had been given the option to take the exam in person, but that this option was declined. The University also clarified that the option for attendees to record the session was disables, and that audio-recordings only took place during the beginning of the session during the attendance roll call, and that afterwards during the actual exam, only video recordings were made, and students were told to turn off their microphones.


On March 27, 2018 the Data Subject filed a complaint on CNIL againt Euronext group, specifically addressing the handling of her personal data by the Irish Stock Exchange, her employer, a subsidiary of Euronext.
On March 28, 2022, the case was closed by CNIL because the Authority understood that the Irish Data Protection Authority is the one competente for addressing the issue, since the Data Subject employer, the Irish Stock Exchange, is a company located in Ireland. In addition, the Data subject and personal data processed was limited to this location.
Dissatisfied with this outcome, the Data Subject sought annulment of the CNIL's decision for abuse of power and requested that the CNIL be instructed to sanction the companies involved.


facts_ANSPDCP (Romania) - NTT Data Romania SA

Consulting and IT services company NTT Data Romania SA (the data controller) suffered a data breach due to a cyberattack. Personal data from a significant number of data subjects were unlawfully accessed. The data included names, signatures, addresses, contract information, identity documents, employment and financial data, and data about employees' health. The controller reported the breach to the Romanian DPA.