A data subject made an access request with the Dutch Tax Administration (the controller). The controller decided to deny the request. The data subject raised several objections against this decision, but the controller declared it unfounded. The data subject appealed this decision.
The Court considered the appeal grounded and ordered the controller to fulfill the access request. Following this first decision, the controller answered the request with a general indication of the personal data it processed and for what purpose (information usually available in privacy policies). It also provided the data subject with their most commonly processed personal data. Last, the controller generally referred to Article 13(4), Article 14(5) and Article 23 GDPR for possible non-disclosure.
The data subject found the answer incomplete and lodged a further appeal to the Court.
In an attempt to explain why some information had not been included in the response, the controller argued that the response was based on what it could find on its general system. The other IT systems had not been searched, because there were too many and this would therefore constitute a disproportionate burden.


The appellant is a civil servant at the municipality of Leiden. He does not want the municipality to share his personal data with third parties because he fears he would lose control over his data. The municipality of Leiden outsources its HR administration to Service71; Service71 uses YouForce as the HRM tool which is offered by RAET B.V. On 15 January 2018 the municipality denied appellant’s request to delete his performance reports and assessments from YouForce. Appellant has also objected to the processing of his data by the company Mindtree in India. In the appealed decision the Court of First Instance of the Hague considered that the municipality had compelling and legitimate grounds for the data processing, which override the interests of the appellant. The Court found no evidence that the appellant’s personal data was processed in India by the employees of Mindtree.

Dispute
The appellant argues that: 1. The Court failed to recognize that his request should also be considered as an access request because it was not possible for him to make sure that the data processing in question was lawful. 2. The municipality has no legal basis for sharing his data with Service71 and RAET B.V. and that the data processing itself is excessive. 3. Personal data of employees, including the appellant, can be accessed by the company Mindtree in India.


The decision is the consequence of a complaint submitted by a Spanish citizen (the claimant) stating that the defendant has charged him five invoices of a third person, and that, despite the fact that he is not a client of the defendant and he has contacted the defendant to solve this situation, it did not offer any kind of solution.

Dispute
The defendant answered the first requirements of the AEPD stating that (i) the claimant had been informed on the steps to follow in order to solve the situation, (ii) in the end, the invoices were not paid by the claimant, and (iii) that the banking information on the invoices was provided by a bank, so there was no breach of the lawfulness principle. The AEPD started the corresponding sanction procedure.


facts_Gerechtshof Amsterdam - 200.251.466/01

The complainant asked his bank (ING Bank N.V.) to remove his data from the BKR registration (office for credit) under Article 21 GDPR. The bank did not answer to the request. The data subject brought a complaint before the Court of First Instance. The Court of First Instance found the complaint inadmissible and the complainant appealed the decision.


The data subject had brought a complaint to the Austrian DPA against the controller, a political party.
The data subject detailed that he had visited the controller’s website and noticed that Google reCaptcha was being used on the website even though the data subject had deactivated Google reCaptcha. After the data subject had deactivated all cookies and functions such as Google reCaptcha, he clicked on the “become a member” page on the website, which showed the transfer of 615 packages of information from and to Google. The data subject declared that he had not agreed to the data transfer and that he wasn’t adequately informed that his IP address and the connected data would be transferred to Google. Therefore, Google would have knowledge of which party the data subject wanted to become a member of.
The controller told the DPA that the information on the data subject’s membership sign-up remained entirely confidential and could not be accessed by others. The controller saw itself responsible for the content of the website while the design was carried out by an external person. Further, users had the option to reject cookies through the cookie banner. If cookies were rejected then no storage nor data transfer took place.
The data subject added on the 20 April 2023, that after the complaint with the DPA, the controller continued the practice. Google Fonts was automatically downloaded and users were only informed of this in the privacy policy after the download had been completed.
The DPA found that the data subject’s right to privacy had been infringed upon through implementing Google reCaptcha and processing the data subject’s IP address, certain unique identifiers and browser data. The cookie “_GRECAPTCHA” was held not to be of technological necessity and therefore required the data subject’s explicit consent. Therefore, none of the legal basis under Article 6(1) GDPR applied.
The controller appealed this decision to the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). It argued that the DPA had not analysed with which browser and operating system the data subject had accessed the website.


facts_Rb. Amsterdam - C/13/692003/HA RK 20-302

The challenge was brought by four Uber drivers, each of whom had received a separate message from Uber stating that their Uber Driver account had been deactivated because Uber had determined that they had violated the applicable contractual terms and conditions of Uber by being guilty of fraud. According to the applicants, Uber's decision was taken completely automatically without meaningful human intervention. The decision led to the immediate termination of the agreement between Uber and the applicants and to loss of income.
Additionally, according to the applicants Uber violated the principle of transparency by not informing them about the underlying logic, the importance and the expected consequences of the processing for them, not informing them of the type of fraud they are accused of and by not informing them that their accounts would be blocked in the event of fraud. In addition, Uber failed to explain the grounds for the decision in intelligible words.
Uber argued that it did not deactivate the accounts of the drivers solely on the basis of automated decision-making. The controller demonstrated that the decision to deactivate the account of one of the applicants was a result of an investigation which included actions taken by an Uber employee such as carrying out a personal conversation with the driver about consequences of the fraud, followed by a written confirmation. According to Uber, after a fraud signal the driver's access to the Driver app is automatically temporarily blocked until the driver has contacted an Uber employee. Access to the Driver app is reactivated as soon as the driver has made contact.

Dispute
Does automated termination of contract by Uber fulfil scope of automated decision making under Artcle 22 GDPR? Did Uber violate the transparency principle by failing to inform the applicants about the consequences of the procedure?


facts_Datatilsynet (Denmark) - 2020-442-8862

The controller is the Capital Region of Denmark (an administrative region). It operates a platform, the “Health Platform”, which is used by the Danish Health and Medicines Authority (the Authority). This platform has integrated the central database of the Authority, which holds all data on the prescriptions and medicine purchases of all Danish citizens. Both on 10 August 2020 and 8 July 2021, data breaches occurred because the Health Platform was initially updated, and affected the integrated database.
The code changes of the first update caused the database to incorrectly display the number of prescriptions patients were to receive, which led to unintended double subscriptions, affecting 2,310 data subjects. Although the controller became aware of the coding error, it did not immediately inform the Authority. The second data breach affected another 1,149 patients. Hence, in total, the two data breaches concerned sensitive personal data (health data) of 4,459 data subjects.


On 19 August 2021, a data subject (the Complainant) reported illegal dumping to the competent municipal services. An official report identifying four suspects was drafted by the competent police force. This official report, including its non-anonymised annexes, was then submitted to the competent authority (the Authority) in the framework of a municipal administrative sanction procedure (Gemeentelijke Administratieve Sanctie or 'GAS' procedure). The fine, including its non-anonymised annexes, was then passed on from the Authority to the four suspects. As a result, the four suspects were informed about the identity of the Complainant.
On 16 September 2021, the Complainant was approached by one of the four suspects; the latter confronted her about her initial complaint on the illegal dumping. Because of this, the Complainant realised that her identity had been revealed by the Authority to the four suspects in the context of the GAS procedure. On 20 September 2021, the Complainant therefore filed a complaint with the Belgian DPA against the Authority, on the ground that the latter had unlawfully disclosed her personal data to the four suspects without her consent within the framework of the GAS procedure.


The Luxembourg DPA ("Commission Nationale pour la Protection des Données - CNPD") launched an investigation on a group of companies with a subsidiary based in Luxembourg (the controller).
The group of companies had appointed a single DPO (the group's DPO) under Article 37(2) GDPR to handle all data protection matters and had appointed a lawyer as the local contact point in Luxembourg to assist the group's DPO. Article 37(2) GDPR allows for the possibility to appoint one DPO for a group of undertakings. The controller had also established a GDPR Board, a committee dedicated to data protection in Luxembourg. The DPO however was not a member of the GDPR Board and was only informed of the subjects discussed there through the minutes of the GDPR Board and through the questions raised by the local contact point during these meetings. The group's DPO did not seat in Luxembourg and was involved mostly indirectly, through the local contact point, in data protection-related matters of the Luxembourg entity. During the course of the investigation, the controller did appoint its own DPO, that started on 1 October 2020.
The DPA found that even if the Group's DPO was participating in numerous meetings at a group level and regularly organised meetings with its local points of contact, this was not sufficient to demonstrate the direct, formal and permanent involvement of the DPO in Luxembourg. Therefore, the DPA found that the controller did not sufficiently involve the DPO with data protection matters violating Article 38(1) GDPR and Article 39 GDPR. It further found that the controller did not provided its DPO with the necessary resources and power, violating Article 38(2) GDPR. Thus, the DPA fined the controller €18,000.
The controller appealed this decision at the Administrative Court of the Grand Duchy of Luxembourg ("Tribunal administratif du Grand-Duché de Luxembourg - TADM"), seeking annulment of the decision. The controller argued that the DPA used their power excessively in finding violations of Article 38(1) and (2) and Article 39 GDPR. Moreover, the controller argued that the French DPA ("CNIL") had investigated its parent company and the other entities located in France and did not find any violations or made any comments regarding the appointment of the group’s DPO. The controller also argued that the fine amount was disproportionate.


The data subject requested the controller to erase his e-mail address, because he kept receiving unwanted marketing e-mails from the controller. The nature of the controller was not specified in this decision.
The data subject requested the controller to remove his e-mail address from its address list. The controller stated it was not able to do so because this e-mail address was not included in the controller's list in the first place. The controller asked the data subject if he maybe had another e-mail address, that was coupled to the one the data subject was using currently. This coupling of e-mail addresses could potentially explain the situation. When an e-mail was received by this 'middle man' email-address, it would be forwarded to the data subject's current e-mail address. That could be the reason why the data subject was receiving e-mails on his current e-mail address, despite the fact it was not registered by the controller.
The data subject stated that he could not answer this question of the controller because the controller used the 'BCC' feature for sending its marketing e-mails, which made it impossible for the recipient of an e-mail to see other recipients of the same e-mail. It was therefore not possible for the data subject to verify if another of his e-mail addresses was included in the controller's list of recipients. The data subject kept receiving direct marketing messages after this exchange with the controller on his current e-mail address.
The data subject filed a complaint at the Belgian DPA at 6 January 2023, because the controller could not comply with his erasure request.


facts_Tietosuojavaltuutetun toimisto (Finland) - 1150/161/2021

The psychotherapy firm 'Vastaamo Oy's' (hereafter, the Firm) experienced two data breaches in November 2018 and March 2019, where its patient records were hacked by a third party (the attacker). During an investigation conducted by the Finnish DPA, it was found that the Firm had become aware of (at least) the latter data breach at the time it happened.
The breaches were not reported to the Finnish DPA until late September 2020, shortly after the Firm had been subject to blackmail by the attacker. The following months, at least 15,000 patients were also blackmailed. In particular, the attacker tried to obtain monetary advantages from them by threatening to publish their personal patients records, and around 300 records were actually leaked online on the Tor network.
Following this affair, the Firm suffered financially and was ultimately declared bankrupt by the District Court of Helsinki in February 2021.


facts_Garante per la protezione dei dati personali (Italy) - 9771545

On 29 September 2020, the Italian DPA received a complaint from a former commercial agent for Palumbo Superyacht Ancona s.r.l. The data subject is the former commercial agent. The controller is Palumbo Superyacht Ancona.
On 23 June 20, the controller inhibited the data subject from using her work email address without any notice. She was not allowed to retrieve any information from the account beforehand. The data subject's requests for access to the account were ignored by the controller.
The controller stated that the contract with the data subject was terminated over the disclosure of confidential information and that out of court proceedings over said disclosure were ongoing. The controller claimed that the data subject's email account was kept active to investigate the alleged breach of confidentiality, and to store information for later use in the proceedings. The controller argued that the processing was in compliance with the principles of necessity and data minimization, as it neither used the account themselves nor allowed third parties access. The controller also stated that it made itself available to discuss ways for the data subject to access his account and retrieve his personal data, ensuring that she could not alter the information present.
The DPA found that the controller did not provide the data subject with sufficient information on their policies regarding work emails. Furthermore, the DPA found that the controller was unable to prove compliance with the information duties under Article 13 GDPR, as the information allegedly provided to the data subject lacked the requirements laid down in said Article, and the relevant documentation was not signed by the data subject. The DPA further noted that email accounts are not a suitable tool to store data for later use as evidence in proceedings.


The data subject complained to the DPA that it was impossible to purchase an airline ticket from the controller's website without accepting cookies and consenting to receive advertisements. The controller, Vueling Airlines S.A., had a box in its checkout procedure indicating consent to receive ads, but, contrary to the data subject's complaint, it was possible to purchase a ticket without checking the box.
The controller's cookie policy allowed users to revoke consent to non-essential cookies by unchecking two pre-ticked boxes, one for "performance cookies" and one for "targeted cookies." However, some third-party cookies were incorrectly categorized as essential, so even when users unchecked the relevant boxes or clicked "reject all," non-essential cookies remained.


The appellant, in connection with a dispute with her son's former school, has requested the Dutch Minister of Education, Culture and Science to inspect her and her son's file. The Minister has partially granted the request for access, but wrongly did not grant access to the personal policy views of civil servants.
Following a decision of the Council of State, the Minister amended its order and granted the appellant access to more documents, including to the personal policy views of civil servants, subject to the removal of the personal data of third parties.
The appellant appealed, arguing that the Minister has not provided all the documents covered by her request and has therefore failed to comply adequately with the Council of State’s first ruling. Also, according to the appellant, the Minister has glossed over more than just personal data in the documents submitted.

Dispute
Has the Minister provided all personal data covered by the access request of the data subject?


A social media encourages both existing users and new joiners to invite their friends to join the platform via a "invite a friend" option. The Litigation Chamber examined the legal grounds for the "invite a friend" system. The user gave the provider access to his or her list of contacts, so that a message could be sent to those contacts to join the social media platform or, if they were already members of the social media platform, to become part of that user's network of friends on the platform.


facts_Garante per la protezione dei dati personali (Italy) - 9932951

On 17 February 2023 the complainant brought a case to the Italian DPA claiming a violation of her data protection right concerning the dissemination by an Italian newspaper on 23 January 2023 of an article containing a picture of a holographic will of an actress. According to the complainant, the will clearly showed the name, date, place of birth, address and title of witness assumed by the complainant.
The complainant further asserted to have requested RCS Mediagroup S.p.a (the data controller) to exercise her rights provided for from Article 15 GDPR to Article 22 GDPR but did not receive feedback. On 2 March 2023, the Italian DPA requested the data controller to respond to the complainant’s requests and to state whether they would comply with them.
On 21 March 2023, the data controller declared that the will is a public deed which can be accessed by anyone with an interest and that the information of the witnesses is an integral part of that public deed. Hence, the public nature of the will deprived it of any confidentiality, and the photograph of the page of the will and the publication of the complainant’s personal data took place lawfully.
To which the complainant responded that Article 6 of the Deontological Rules, which states that the disclosure of news of major public or social interest is not contrary to respect for the private sphere when the information is indispensable, does not apply and that the data controller should have refrained from disseminating the data of the complainant.
Following this, the DPA issued a statement of the commencement of proceedings.


The complainant was subjected to multiple credit ratings by Innovation Norway*, despite having no customer relationship or any other affiliation with the latter. Nine credit ratings were conducted by one single employee, and it's unclear why the employee had the need to conduct these. One credit rating was conducted by a different employee, however this was due to a misunderstanding when investigating the other credit ratings.
When contacted by the DPA, Innovation Norway admitted they had no legal basis for this processing. They had routines for how to manage credit ratings, however this was found to be too generic, outdated and not adhered to. Innovation Norway had decided not to notify the DPA of the personal data breach, as they didn't consider the incident to have triggered this requirement as per Article 33 GDPR.
* Innovation Norway is state-owned and the Norwegian government's instrument for innovation and development of Norwegian enterprises and industry. Their programs and services are aimed at stimulating entrepreneurship in Norway. Conducting credit scoring of individuals and companies are common practice and not an issue in itself. The issue here was the misuse of credit scoring by one employee.

Dispute
 1. Did Innovation Norway have a legal basis for conducting credit rating(s) of the complainant?
 2. Did Innovation Norway have sufficient internal controls for conducting credit ratings?
 3. Should Innovation Norway have report the personal data breaches to the DPA, cf. Article 33(1)?


A data subject asked the University of London to have access to the names of the examiners who assessed the PhD thesis of President Tsai Ing-wen, the President of the Republic of China, and the date on which the thesis was assessed.
From his point of view, this information would be useful to validate the legitimacy of President Tsai’s thesis. He was concerned that the thesis was not filed with the LSE’s library until 2019 and that the filed copy appeared to be a 'draft document' and casted doubt on the thesis’ validity. Therefore his request should be accepted for a broad public interest.
The University of London confirmed the validity of the President Tsai’s thesis and provided a link to the copy of the thesis in question, however it didn't grant the access to the personal data requested to the individual under section 40(2) of the FOIA.

Dispute
The ICO had to determine whether the Council had correctly withheld information on the basis of section 40(2)of the FOIA.
First, the ICO had to assess if the requested information constituted personal data.
Secondly, the ICO needed to analyse if the information to disclose would contravene the Data Protection principles established by the Art. 5 of GDPR.
In particular, as far as the Art. 5 is concerned, the ICO needed to assess if the request was lawful on the basis of a 'legitimate interest' of the individual and, therefore, verify if the criteria of legitimate interest assessment were met.


facts_Datatilsynet (Norway) - 21/03823-45

Following receipt of anonymous tips, the Datatilsynet (Norwegian DPA) launched an investigation into Telenor ASA’s (data controller) compliance with the DPO requirements in Articles 37-39 GDPR. As part of the investigation, a site visit was conducted, as well as interviews with executives and employees of the controller.
During the investigation, the controller noted that they had terminated their DPO as they did not believe they met the criteria for requiring one under Article 37(1) GDPR. The DPA requested documentation detailing this assessment but the controller did not provide it. After the investigation was launched, a temporary DPO was appointed.
The investigation also showed that contact details of the DPO were not available on the controller’s website, but only on the internal intranet, accessible only by employees.
The investigation revealed an incomplete Record of Processing Activity (ROPA) and an absence of evidence of involvement of the DPO in issues relating to data protection. The investigation found that the evidence showed involvement by the DPO as only consisting of meetings between the DPO and certain heads of function across the organisation, and that these meetings only began more recently, after the commencement of the investigation. The investigation concluded that outside of this meeting, the DPO was involved on a case-by-case basis with data protection matters.
The investigation revealed that the DPO’s role was split 50/50 between the DPO duties and work as an associate lawyer. The controller claimed that in practice, most of the DPO’s working hours were spent on DPO work. The controller, however, was unable to produce any documentation to demonstrate this. The investigation showed that there was a “major backlog” of data protection related tasks in 2021. It was also shown that the (then) DPO had raised concerns in 2021 about the resources available, requesting 100% full time equivalent (FTE) allocation to the handling of data protection matters until the bottleneck was resolved.
The investigation also examined whether the appointed DPO was independent in the exercise of their functions. The controller’s Group Privacy Manual stated that the DPO should be “independent” in their function. The job description of the DPO/Associate attorney role was also inspected. Although the roles of the DPO and associate attorney were stated separately, while acting in the attorney role, the position holder was expected to “inform and provide legal advice in alignment with other attorneys”. It was also revealed the position holder had one email, used for both aspects of their role, with the job title in the signature being “Associate Lawyer and Data Protection Officer (DPO)”. It was also revealed that the budget for data-protection related expenses was allocated on a “case-by-case” basis, and that the DPO needed to seek approval from their line manager to extend the budget. Finally, the investigation revealed that all DPOs in the wider Group held shares in the company and that there were no internal rules to prevent conflicts of interest.


On the 26 April 2023, the data subject filed a complaint with the AEPD for receiving postal advertising material despite having exercised their right to object to this.
The data subject had sent a letter to the controller on the 27 February 2023, requesting that his personal data exclusively be used to manage his credit card.
On the 7 March 2023, the controller responded to the data subject confirming the receipt of the request stating that in accordance with Article 21 and 18 GDPR, the controller has begun to give effect to the request. However, on the 23 April 2023, the data subject received advertising related to the granting of a loan contrary to his request.
Following the data subject’s complaint, the AEPD requested information from the controller.
On the 6 July 2023, the controller confirmed that the data subject had received another advertisement in the post after having objected to this form of processing of his personal data.
The controller argued that a human error of an employee caused the violation. The employee responsible for manually unticking the boxes relevant to the processing had failed to untick three boxes which is why the advertisement reached the data subject. It argued that the mistake had then been corrected on the 9 June 2023 and that therefore the violation had been remedied.
Further, the controller argued that a processor was responsible for the violation and therefore requested the dismissal of the proceedings.


The data subject received an order confirmation by e-mail from a company called "Healy" (controller). The data subject informed the controller by e-mail that it had used an incorrect e-mail address. She also informed the controller about her suspicion that an actual customer of the controller had used her e-mail address to place an order. The controller did not respond to this.
After that, the data subject also received shipping confirmations with personal data of the actual customer who had placed the order, as well as the controller newsletters. In addition, the data subject also received information in German concerning a credit balance, as well as the password and username of the actual customer. As would become clear later, this situation was the result of a faulty process with regard to the controller's database. In this database, there was a customer with the same name as the data subject. When the responsible employee of the controller manually entered the e-mail address to send the shipping confirmations to, he confused the data subject's email with the one of the customer who had actually placed the order.
On 28 June 2021 and 6 July 2021, the data subject requested the controller by e-mail to delete her e-mail address. Instead of addressing the DPO of the controller, the data subject sent her requests to the controller's customer service. At first, the controller did not comply with the data subject's request for erasure because it's customer service department was of the opinion that the e-mail address was still required to process an open order. The customer service later transferred the complaint to the legal department after 'a delay'. It is not clear from the decision how long this delay was. After this, the data subject received instructions from the controller to log into her (non-existent) customer account, and fill in a form there.
On 4 August 2021, The controller deleted the data subject's e-mail after it finally became aware of the situation. On 23 September 2021, The data subject received an email with apologies from the controller. On an unspecified date, the data subject filed a complaint at the DPA. On 22 February 2022, the DPA asked the controller to comment on the present case. On 6 April 2022, the controller confirmed it had sent e-mails to the data subject and provided its explanation regarding the faulty process with its database. (see second paragraph).


A data subject complained around cookies and similar technologies used in connection to audiovisual material on the website of the Court of Justice of the European Union (CJEU), as well as websites displaying the Court's branding that the Court linked to (two firms, Companywebcast and Connectedviews, to host a conference recording), claiming that they did not correctly inform the user or obtain required consent before data processing or storage of information on a terminal device.

Dispute
The complaint was decided under the data protection regime applying to EU institutions, rather than the GDPR (Regulation (EU) 2018/1725). The dispute concerned:
- did the laying of cookies by the CJEU violate Article 37 of the Regulation, implementing the requirements of the e-Privacy Directive?
- did the laying of cookies and the lack of transparent information on a third party website, with CJEU branding, linked to by the CJEU to provide it with services, breach the transparency (art 14) and consent (art 7) requirements of Regulation (EU) 2018/1725?
- were the conditions for consent met by the CJEU?


In a former decision adopted within the so-called 'light procedure', the Belgian DPA ordered a company to stop the processing of the personal data of a complainant who had objected to the sending of direct marketing emails several times.
The provider did not comply with the order and the litigation chamber decided to open the case to adopt a decision on the merits ("décision au fond").
None of the parties sent their submissions, despite the fact that they were invited to do so.


A data subject filed a complaint before the Spanish DPA (AEPD) against a real state company, that had allegedly not provided the information required by Article 13 GDPR when they formalized the first payment for an apartment, for which the data subject had provided personal data.


facts_AZOP (Croatia) - Decision 29-11-2021

The DPA received a complaint regarding a violation of the protection of personal data of X (the data subject). In this regard, the data subject stated that the company in question (the data controller) asked her for a copy of her personal document - identity card when updating her personal data in accordance with special regulations.
As evidence of her allegations, the data subject submitted to the DPA the controller's response, information on the processing of personal data, and the email correspondence between the data subject and the data controller.
In this specific case, the "Prevention of Money Laundering and Financing of Terrorism Act (Zakon o sprečavanju pranja novca i financiranja terorizma - ZSPNIFT)" applies, which prescribes measures, actions, and procedures that oblige entities and competent state bodies to prevent and detect money laundering and terrorist financing.
Article 15 ZSPNIFT mandates customer due diligence, including identity verification via reliable sources, collecting data on the purpose and nature of business relationships, ongoing transaction monitoring to ensure consistency with the customer's profile and risk assessment, verifying the source of funds if needed, and maintaining up-to-date documentation.
Furthermore, Article 79 ZSPNIFT requires that collected documentation include records used to verify the customer’s identity, such as copies of official personal documents or extracts from relevant registers.
The data subject was contacted via letter and telephone to update his personal data and submit a copy of her ID card, as required by ZSPNIFT. The data controller provided the applicant with the choice of how to submit the ID card copy, as evidenced by a letter dated 16 July 2021. The data controller, justified the collection and processing of personal data, including the ID card copy, as necessary to fulfill its legal obligation to verify customer identity under the Act.


In July 2021, the data subject lost his ID card. A third party went to his bank with the ID card and withdrew all the money available in the account, a total of €9,400, without his authorization or consent. The withdrawal was made in person at the local bank branch. The withdrawal also required the signature of the third party. The third party was able to withdraw the money despite their signature not corresponding to the signature on the data subject's ID card.


The Norwegian DPA (Datatilsynet) received a complaint from a data subject who had been credit rated by a private investigation company, whom had informed in their privacy notice that they should be viewed as the controller as per the GDPR, for any such processing of the personal data of third parties.
The controller had been hired by the data subject's former partner. She claimed to have a financial claim against the data subject. He disputed this and also claimed he did not have any funds to pay for such a claim, regardless. Consequently, the controller conducted a credit rating of the data subject, to validate his claims.
Following the data subject's complaint, the DPA launched an investigation.


The controller is an elementary school. The data subjects are pupils of the controller. Under the Bavarian Ordinance on Measures for the Prevention of Infection (16. Bayerische Infektionsschutzmaßnahmenverordnung – 16. BayIfSMV) , the controller required the the data subjects to show Covid-19 test certificates before being allowed to in-person classes. Moreover, pupils were obliged to wear face masks in school if they could not provide an exemption certificate by a doctor. The controller stored the certificates for 14 days, as prescribed by the Ordinance.
On 31 January 2022, the data subjects requested the controller to delete the stored test certificates and stop further collecting them, which was rejected by the controller. Consequently, the data subjects filed an application for interim relief with the Administrative Court of München (Verwaltungsgericht München - VG München) on 10 February 2022 to order the school to stop storing and collecting the test and mask exemption certificates. In its statement of defense, the controller explained that it does not retain any certificates of the data subjects anymore, because it had filed a criminal complaint against the parents of the data subjects with the prosecutor's office on 7 February 2022 because of the suspicion of forgery of documents and had transmitted all the certificates as evidence in the course of the criminal complaint. The data subjects did not contest this statement of the controller.


Virtue Integrated Elder Care Ltd ("VIEC"), the controller, operates and manages five nursing homes in Dublin, Ireland. On 15 August 2020, VIEC became aware through a report to their IT helpdesk that one of the users of their internal systems was being blocked from sending emails. The controller subsequently discovered that the email address of one of its managers had been subject to a phishing attack, and that emails had been rerouted to a third party Gmail account.
On 19 August 2019, VIEC notified the Irish DPA (the DPC) of a personal data breach. Based on initial analysis of the breach notification and subsequent documentation provided during the breach handling process, the DPC considered that the matter concerned a possible “breach of security potentially leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed” by VIEC. As a result, the DPC commenced an investigation.
In a commencement letter, the DPC informed VIEC that their inquiry would examine whether or not the company discharged its obligations in connection with the subject matter of the personal data breach and determine whether or not any provision(s) of data protection law had been violated by VIEC in that context.
The scope of the inquiry was stated to include the following. Firstly, the steps taken by VIEC to comply with the principle of integrity and confidentiality pursuant to Article 5(1)(f) GDPR. Secondly, the technical and organisational measures taken to ensure security of processing pursuant to Article 32(1) GDPR. Thirdly, the ability of the controller to demonstrate ongoing confidentiality, integrity, availability of personal data pursuant to Article 32(1)(b) GDPR. Fourth, the process employed by VIEC for regularly testing the effectiveness of measures for ensuring appropriate security pursuant to Article 32(1)(d) GDPR. Fifth, and finally, the ability of VIEC to demonstrate that it had assessed the risk to processing special category information.
As part of the investigation the security provider for VIEC, ‘Ortus’, conducted a report which determined that the most likely root cause of the breach was that the credentials of a user account at one of the nursing homes were captured on a fake website. The link to that fake website was likely received in a phishing email. The original email that delivered the malicious link in question was not identified by the security provider. The email account was thereby accessed by an unauthorised third party, using the captured credentials. This resulted in unauthorised access to stored emails, and allowed the bad actor to set up email forwarding of all inbound emails to a third party email account. In addition, this issue had been ongoing since 18 July 2020.
The DPC prepared an Inquiry Issues Paper to document the relevant facts of the case, and invited submissions from VIEC, in particular regarding any inaccuracies and/or incomplete facts. Outlining the mitigating factors to be considered, VIEC explained that the assigned DPO was aware of the requirement to report the breach within 72 hours and that this timeline had become exhausted by the time the DPO became aware of the breach. The DPO hastily notified the DPC of the breach and supplemented this notification with additional information. The DPC noted this is an example of good practice on the part of a controller in this regard. In another proposed mitigating factor, VIEC submitted that password for the affected account was reset and a forced logout was performed.
The controller also confirmed, among other things, that 213 data subjects had their personal data compromised, and that 129 of these residents had special category data compromised; 117 of these individuals had health data compromised and 12 had biometric data compromised.
On 11 November 2022 the DPC provided a draft decision to VIEC, and the controller was invited to make further submissions on the proposed infringements. In its response to the draft decision, VIEC asserted that it considered the proposals too excessive, and made a range of submissions in support of their position. VIEC stressed the impact of the Covid-19 pandemic on its ability to implement data security provisions. In particular, they explained that senior managers were redirected to frontline roles, at a time of increased regularity of phishing attacks.


The Slovenian DPA received a complaint regarding the use of the complainant personal data for advertising purposes inside of a Facebook group. The DPA advised that the group administrator should first provide an appropriate legal basis for transferring the personal data to Facebook for advertising purposes and, second, for transferring personal data to the users of the SNS (Social Networking Service). In such a case, the group administrator will, together with Facebook, act as joint controller for the processing of personal data related to the ads.
For the legal basis of processing personal data in the Facebook group, the DPA advised that this is usually determined by the group rules (terms and conditions), which every group member accepts when joining the group.
Finally, the DPA reasoned that the ad in question, shown only in the Facebook group, was likely only meant for the group members and not for the general public. Publishing the ad inside of a Facebook group, although publicly, doesn't mean it will be read by all Facebook users, but likely only by the group members that are only interested in the content relevant for the group.

Dispute


A third party visited a shop of the defendant (a provider of cellphone services) to change their mobile phone subscription. This third party used the phone and sim card number of the complaint. During this process, the mobile phone number of the complaint was transferred to a third party so that the complaint could not use its mobile phone number. The SIM of complaint was deactivated for the complaint and the third party had the possibility to access personal conversation data as well as linked accounts (PayPal, WhatsApp, Facebook) for three days.

Dispute
If a third party has access to a phone number, does this classify as a critical data breach?


The controller engaged DEX Online Services to automate its membership administration, which contained personal data of the plaintiff. He also offered its members the opportunity to use the Yogibit app to gain access to their own data, so that they can, for example, deregister and register for lessons. On January 30, 2019, the plaintiff filed a complaint with the Dutch DPA against the controller. The DPA rejected the complaint by decision of 27 February 2019, because it found no obvious violation of the GDPR . Plaintiff has objected to this rejection.
According to the DPA, both the controller and DEX Online Services have complied with the claimant's request for removal within the meaning of Article 17 of the GDPR. The controller has a valid basis for the processing of the plaintiff's personal data and it has not been shown that his personal data has been processed in the YogiBit app.
In appeal, the plaintiff argues that the controller should have first explicitly requested permission from him before his personal data would be provided to DEX Online Services. According to the plaintiff, the defendant has forgotten to look at the definition of 'consent', as set out in Article 4 (11) of the GDPR . Additionally, it was not necessary for the controller to enable DEX Online Services for its student administration. According to the plaintiff, the controller could also have chosen to hire a secretary. In addition, the plaintiff stated that as a free EU citizen he has the right to choose whether he wants to go along with the choice of the controller for that third party.
Plaintiff argued that it was up to DEX Online Services to ascertain that the controller complied with the conditions set out in Article 6 of the GDPR . In his view, on the basis of Article 5(2) GDPR the controller has an accountability obligation and must be able to demonstrate compliance with Article 5, first paragraph, of the GDPR . The plaintiff argued that the decision did not provide evidence of such compliance. He stated that this also applied with regard to the entry of his personal data in the YogiBit app.

Dispute


The Spanish police notified the Spanish DPA (AEPD) that a private individual had placed security cameras facing public and private spaces in the surroundings of their property. The police report stated that they had warned the individual that the cameras should not be pointed in the direction of areas beyond their property, and that there was no sign posted with adequate information related to the functioning of these video cameras.
Despite the police’s warnings, the individual refused to redirect the cameras, or to place the appropriate sign with information required under GDPR. The AEPD therefore initiated proceedings in order to investigate the issue, and bring the individual into compliance with their obligations related to the use of security cameras under GDPR. The individual did not submit any allegations or proof to contradict the police report, and also ignored the AEPD’s request for information related to their compliance with GDPR on this matter.


Global One is a charity that aims to impove health, sanitation and agriculture. The Information Commissioner's Office received 539 complaints from individuals who received unsolicited text messages from Global One. These complaints occurred between April 30th, 2020 and May 22nd, 2020, when 573,000 marketing texts were sent overall. The texts did not offer individuals the opportunity to opt-out of further marketing.
Global One had entered into an agreement with a third party (X) that was to provide them with a marketing strategy. The third party (X) informed Global One that it would start an SMS campaign to gain donations. Global One says it assumed that this would be carried out using a marketing list that belonged to the third party (X). However, the third party (X) themselves commissioned another third party (Y) to deliver the test messaging campaign. The third party (Y) claimed that the list of contacts they compiled and used was compliant with relevant laws.
However, there was no evidence of consent being provided for such direct marketing messages. Global One nevertheless claimed to have undertaken due diligence, whilst the third party it contracted with (X) claimed that it only advised Global One of various other agencies who could do the marketing.


The Swedish DPA received complaints alleging that on January 20 2021, Indecap (the controller) sent an email message containing a file with personal data about, among other things, customers' finances to other customers.
The controller acknowledged the mistake and explained that the breach was due to human error. An employee had attached the incorrect Excel sheet by mistake because it was named similarly to the correct file. The incorrect file contained information about customers' name, social security number, bank, name of bank advisor, e-mail address, selected risk level, allocation to funds (limited to individual fund selection) and the last loaded value of the customers' holdings in these funds. The erroneous mailings involved the personal data of 52,364 data subjects and were received by a maximum of 2,813 individuals. The exact number of recipients could not be determined as Indecap's own investigations showed that the email has been stuck in the mail filter of many of the customers.
Indecap took various steps to mitigate the damage of the breach. It initiated a major incident investigation together with external experts to identify internal risks and create an internal action plan. They sent information to data subjects about the incident, implemented additional technical security security measures and held extra training sessions for employees. They also contacted the recipients who had received the email with personal data and asked them to delete the message and to confirm that the message had been deleted. Finally, Indecap filed a personal data breach notification to the Swedish DPA and also made a report to the Swedish Financial Supervisory Authority.


The controller published a press article, which contained the data subject’s personal data, on their website.
On 13 July 2021, the data subject sent an erasure request to the controller. The request referred to the article concerned via a web link. The data subject received a confirmation of receipt on 4 September 2022, more than a year later. Then, no further response from the controller was received by the data subject. The data subject reiterated their request three times in January 2024 and made a mediation request to the DPA on 5 February 2024.
The controller argued that the request was already granted and that the link no longer led to the article. The DPA transmitted the answer to the data subject in April 2024 and closed the mediation process on 7 May 2024.
The data subject filed a complaint to the DPA on 23 May 2024 as the article remained available on the controller’s web site via another link.
During the procedure, the controller erased the article of its website and apologised for the inconvenience, pointing out a technical mistake. The data subject declared themselves satisfied with the controller’s declaration.


facts_Garante per la protezione dei dati personali (Italy) - 9756853

A data subject filed a complaint with the Italian DPA (Garante per la Protezione dei Dati Personali – Garante) due to the publication of his personal data on www.mondoshiatsu.com, a website which shows the contact details of various certified shiatsu massage practitioners. The data subject stated that he was automatically inserted into this portal after having attended an annual training course in this discipline in 2003. Due to the amount of time that had passed since then, and the fact that he never became an actual practitioner, he made numerous requests via telephone and email in order to delete his data, which were not responded.
The Garante initiated an investigation, and determined that the company responsible for the publication of the website was Arte del Vivere S.r.l. The Garante then made a request for information related to the company’s failure to respond to the data subject’s request for deletion of his personal data. The Garante was initially unable to notify this request, and had to employ the Finance Police in order to successfully do so. When the company eventually replied, its director stated that they were not the owners of the domain, and had delegated the maintenance of the website to a third party processor. However, the company argued that the website could not be updated because the processor no longer had the credentials to do so. The Garante noted that the contents of the website clearly attribute it to Arte del Vivere, and that as a beneficiary of this website, the company should have contractual or accounting documentation related to the web hosting service. The company was then eventually able to delete the entire website, which had not been updated since 2014, by reporting the issue to the website’s net service host.


Between 21 May and 14 June 2021, Argon Medical Devices, Inc. (the controller) experienced a cyber security incident. It was discovered on 14 June 2021 when the controller's US Senior Vice President of Human Resources noticed missing emails in his inbox.
Upon further investigation, the controller determined that it had been subject to a business email compromise, perpetrated through an internal platform by an unauthorized third party, most likely through a phishing email. Consequently, the Director of Global IT Security put in place several cyber security measures, which appear to have contained the incident on 14 June 2021.
On 15 June 2021, they reported the incident to the local FBI Cybercrime Unit in the US and commenced an internal investigation to determine the extent and nature of the incident.
On 19 July 2021 they realized that personal data such as salary and benefits of all of their (20) European employees, including one in Norway, had been affected, and proceeded to assess whether the incident was reportable under Article 33(1) GDPR.
On 24 September 2021, after concluding that the incident was indeed reportable, the controller hired a Norwegian law firm to notify the Norwegian DPA. Since the controller has several establishments in the EU/EEA, they also sent similar breach notifications to several other European supervisory authorities.
In this regard, they acknowledged that “Argon in the US [i.e., Argon Medical Devices, Inc.] is the data controller with respect to the personal data connected to this Incident”. They also stated that their "European head office resides in Switzerland, and only its Swiss establishment enjoys a power of direction and control over its other EU/EEA establishments. Therefore, Argon does not have a main establishment in the EU/EEA for the purposes of Article 4(16) GDPR."
Consequently, the DPA concluded that the cooperation mechanism and procedure set out in Article 56(1) GDPR and Article 60 GDPR did not apply in this case and, thus, pursuant to Article 55(1) GDPR, the DPA was competent to perform the tasks assigned to them and exercise the powers conferred on them by the GDPR in relation to the personal data breach notification. The controller did not dispute this in their written representations.
On 4 October 2021 the DPA sent the controller a request for further information and asked them to, in particular, clarify why they concluded that the incident was reportable only on 21 September 2021.
The controller held that they had acted "without undue delay, to notify the supervisory authorities within 72 hours". Their main claim was that it was necessary to investigate the incident in order to determine if it was reportable or not, which they were only able to conclude on 21 September 2021.
On 31 January 2022, the DPA sent the controller an advance notification of their intention to fine them NOK 2 500 000 for having violated Article 33(1) GDPR. Despite several exchanges where the controller continued to argue they had indeed sent the notification in time, the DPA upheld their conclusion and issued the final decision on 8 March 2023.
The controller then appealed the decision to the Norwegian Privacy Appeals Board, where it's currently pending.


Bonnier News AB (now Expressen Lifestyle), the controller, is a media company in Sweden. The Bonnier group processed their customers' data for, among other reasons, marketing purposes. They compiled profiles on their users and made these available to affiliated companies who then provided targeted advertisements for their own products and services through direct mail and telemarketing. They relied on legitimate interests under Article 6(1)(f) GDPR to do so.
At the time of the investigation,which followed a complaint from a data subject, there were 15 such affiliated companies, with the personal data being collected from users and website visitors being stored in two group-wide data bases from which it was then shared with the affiliate companies. One of these databases was a “behavioral data base”.
The personal data recorded in this database, by means of a cookie identifier, included the URL that the user visited, as well as its category and content type, information on the user’s device and their IP address, behavioral data in terms of time spent and the time the page was viewed and also whether the user logged into the website. In some instances, this data could be linked with the user’s data in the customer data base, resulting in a full behavior profile including the user’s age, gender, their car ownership and some variable based on the users’ residential area, such as their life phase, housing type and purchasing power.
During the course of the investigation, the controller argued that they are not joint controllers in respect of the personal data, and that after the affiliated companies access the data provided in the databases, that they alone are responsible for the legality of that processing.
The controller further argued that while the personal data in the customer database was personal data, the data in the behavioral database was comprised of anonymous data and as such was not personal data under Article 4(1) GDPR.
The controller stated that they rely on legitimate interest as a lawful basis for the profiling of their customers and users to provide personalised advertisements. The controller identified the legitimate interest as being the need to ensure relevant content and advertisements for their customers so that they can offer competitive services and have attractive advertising spaces. The controller also submitted that this interest outweighed the interest of their customers in the protection of their personal data. The controller claimed that such was the case as the customers could object to the profiling, that the customers already have a direct relationship with one (or more) of the affiliates, either from having purchased from their websites or having visited their website, that the processing was unlikely to adversely affect the data subject’s interests as their interaction with the affiliates was voluntary and, finally, that the processing is consistent with the reasonable expectations of the data subjects.


The data subject filed a lawsuit with the first instance court, the Regional Court of Cologne (“Landgerichts Köln”) seeking injunctive relief. The data subject further requested the court to order Google Ireland Limited (the controller) to erase search results that linked to an article which contained false information about the data subject and included a photograph of the data subject that infringed the data subject’s copyright. The article used the photograph to make allegations of the data subject. The photograph was taken by the data subject’s wife, who did not give the website the right to use the photograph for the mentioned article.
The first instance court agreed with Google Ireland's view that they are not the controller, but the US based Google Limited Liability Company (LLC), because they make the decisions about how to respond to a search query and how the relevant search results are displayed. Google LLC was also named as the controller in the privacy policy. Although Google Ireland Limited operates the Google search engine in Germany and other European countries, it had no influence on how the search results were generated. The court therefore dismissed the action for injunctive relief and request for erasure.
The data subject appealed the decision of the first instance court for failing to recognise that Google Ireland Limited is a controller under Article 4(7) GDPR. It further requested the court to erase the search results related to the article with inaccurate information of the data subject.


SOLOCAL MARKETING SERVICES (formerly known as PAGES JAUNES MARKETING SERVICES, referred to as the controller) is an advertising company that offers companies to carry out direct marketing campaigns on their behalf (by SMS or e-mail). The controller also transfers the data to the companies in order for them to carry out the direct marketing themselves. To do this, the controller purchases data subjects’ data from data brokers, who collect this data through websites’ entry forms for game contests or online product testing. According to the DPA’s findings, the forms are misleading as they make it significantly easier to consent to having their data being used for direct marketing than not.
The DPA carried out on site investigation in 2022, and informed the controller of its findings in July 2024. The controller argued that it should not be held liable for the way in which its partners collect consent, and that its contractual measures were sufficient to fulfill its obligations. The controller also argued that it could have not foreseen the DPA’s investigation because at the time of the investigation the DPA had not published recommendations specific to consent in the direct marketing sector.


The data subject is a retired employee of the municipality of Innsbruck. According to the data subject, the municipality had unlawfully disclosed the data subject's data in the course of a court procedure, inter alia by sharing them with an attorney which represented the municipality. The data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB).
The municipality argued before the DSB that the disclosure of the data subject's data to the attorney had been necessary for the exercise of legal claims and therefore for the purposes of the legitimate interests under Article 6(1)(f) GDPR. The data subject was heard on this statement and filed a submission, arguing that Article 6(1)(f) GDPR does not apply on the municipality as it qualifies as a public authority. The DSB invited the municipality to submit a statement on this reply. The municipality filed a statement (mostly repeating their previous arguments) which was in turn again provided to the data subject who issued yet another submission (also mostly repeating their arguments).
In September 2019, the DSB issued its decision, rejecting the complaint. In essence, the DSB (for unknown reasons) did not assess the case under Article 6 and 9 GDPR but held that the disclosure of data under § 1 Austrian Data Protection Act (DSG) was lawful. In particular, Austrian law allowed for parties to be represented by an attorney, which included the sharing of personal data. The data subject filed an appeal with the Federal Administrative Court (Bundesverwaltungsgericht - BVwG).


facts_ANSPDCP (Romania) - Briza Land SRL

A data subject filed a complaint against a real estate agency (Briza Land SRL) for not adequately granting their request to exercise their right of access under Article 15 GDPR. The controller did not communicate to the data subject the information requested regarding the processing of their personal data, in particular, the totality of personal data processed, the source of this data, as well as the recipients of the data.


In the fall of 2020, the Norwegian Parliament (Stortinget) had a personal data breach related to employees' email accounts, discovered after an employee had been contacted by their bank about an attempt of misuse of their payment card abroad. The Parliament discovered that the perpetrators had downloaded various data, including personal data information about their bank accounts, birth dates and health-related data.
The Parliament had not enabled two-factor authentication in their email system, despite having identified the lack of such as a "high risk" in their risk analysis of March 2020. They had also identified a lack of security culture, low competency and little focus on data protection as very high risks.
When the DPA reviewed the risk analysis in May 2021, two-factor authentication was still not fully implemented. In their notification of a decision, the DPA noted that the Parliament's administration, represented by the Secretary General, was grossly negligent.


On 23 March 2023, an employee of the controller consulted an extract of the data subject's personal data stored in the Belgian National Register, which refers to the information processing system that records, memorizes and communicates information relating to the identification of Belgian citizens.
After that, the data subjectfiled an access request with the controller, requesting clarification into who accessed their data and for what purpose. Due to not receiving any response regarding the access request, the data subject filed a complaint with the Belgian DPA on 14 June 2023.
On 7 August 2023, the controller replied to the access request, acknowledging that it consulted the National Register records of the data subject and that the processing was performed by a professional with specific authorization. However, due to professional secrecy, the controller could not disclose the professional's identity or assess whether the consultation complied with legal and ethical obligations.


A data subject filed a complaint with the Spanish DPA (AEPD) against a City Council, alleging that they had published a document with data related a public grant, that included their own personal data.
The Council alleged that they were, following their bylaw, obliged to publish such data so the rest of the participants in the grant procedure were able to contrast the data. However, they declared that they were willing to change the bylaw if the AEPD determined that such processing was unlawful.


On 9 July 2019, a data subject ("complainant") submitted a complaint to the AEPD stating that the products contracted with Vodafone España ("defendant") were not delivered in the name of the data subject, but in the name of a third party. The complainant updated the complaint on 13 September 2019 advising that they contacted Data Protection Officer of Vodafone via email requesting them to restore the accuracy of their data. However, no response was received to this request.
Subsequently, the complainant was contacted by Vodafone and was advised that the issue had been corrected and that the products purchased had been put in their name. However, in September 2019, the complainant contacted the Vodafone's customer service and was addressed in the name of the third party.
The complainant also advised that on 11 September 2019, the Municipal Consumer Information Office (“OMIC”) informed them that they had a response to their complaint, and it turned out that Vodafone had responded with the complaint resolution of another customer as well as provided supporting evidence in the name of the third party.
Based on the evidence provided by the complainant, the AEPD decided to initiate an investigation into the matter and was able to confirm that:
 1. The defendant was aware of this incident since 03/07/2019 when the data subject complaint about the accuracy of their data.
 2. The incident was caused by an error in their system due to a system migration.
 3. The incident had been resolved on 15/07/2019 when a crossover of information in Vodafone’s system had occurred and Vodafone deactivated the third party who appeared to be named on the client ID associated with the complainant. Vodafone provided proof to have resolved the incident on 15/07/2019 and that the complainant's records are currently in the correct name. Vodafone confirmed that it had not disclosed the complainant's personal data to any third party.
 4. In relation to the response provided to the OMIC, Vodafone confirmed that due to a human error during the complaint response process they had provided the OMIC with the correspondence intended for another individual. Vodafone clarified that the information about the complainant was not shared with an unauthorised third party.

Dispute
Were the actions of the defendant a violation of the principles relating to the processing of personal data contained in Articles 5(d) and 5(f) of the GDPR?


facts_ANSPDCP (Romania) - Warning issued to Bucharest Municipality (District 4)

The Romanian DPA (ANSPDCP) received a complaint regarding the violation of the GDPR by the General Directorate of 4th District Local Police regarding the personal data processed using portable audio-video surveillance means. The "BADGE" surveillance portable device was used by the staff of the Local Police in missions and activities carried out in the field.

Dispute
Does the controller processed the personal data using the "BADGE" surveillance portable device (which processes image and voice) according to Article 5(1)(a) GDPR and Article 6(1) GDPR?


The Association of Icelandic Municipalities published the opinion of the Parliamentary Ombudsman on its website. However, the opinion contained the name and personal information of the complainant, and was online for several weeks, and was only taken down when the complainant contacted an employee of the Association. The Association responded that the information was published online unintentionally, and that they had not reported the breach to the Icelandic DPA because they did not believe the publication of the opinion would lead to a risk to the complainant's rights and freedoms.

Dispute
Did the Association have a responsibility to report the breach to the DPA? Was there a lawful basis for the processing (i.e. the publication of the opinion) under Article 6(1)GDPR?


Individual submitted a complaint on unsolicited political communications (SMS) he received by politician to whom he had no previous connection/relation.

Dispute
Is unsolicited communication via SMS of a politician to whom the recipient never had contact legal?


The complainant saw his right of access violated, since video recordings of therapy sessions had not been sent to him. The DPA dismissed the complaint as unfounded. Consequently, the complainant filed an appeal against this decision.


A water meter with a radio module is installed at the claimant's home (data subject) by a municipal water supplier (defendant, controller). The data subject believes that the installation of the radio water meter violates their fundamental right to data protection, as the device allows conclusions to be drawn about individual water use, which constitutes personal data. At their request, the controller switched off the radio module, for which the controller imposed the costs on them in the form of an administrative fee notice. The data subject appealed the fee notice.


facts_Persónuvernd (Iceland) - Case no. 2021020294

The controller was a secondary school. The data subject had been a teacher at the school.
In November 2018, the data subject requested a meeting with her fellow teachers to discuss the case of another teacher (teacher C) who, according to her, had been bullied for years. The data subject defended teacher C and, among other things, requested that a psychologist was brought in to assess the situation. According to the school administrator, the data subject had been insulting and shown a lack of respect for her colleagues in view of the sensitive topic of discussion during the meeting. Following the incident, the administrator received emails from the data subject's fellow teachers concerning the improper behaviour of the data subject.
In February 2019, the controller was informed by the Ministry of Education about a complaint by the data subject, in which she argued that she had suffered mental abuse in the November 2018 meeting.
The same year, the school was required to rearrange its employment structure in the course of which the data subject and teacher C were dismissed. In November 2019, the school received a letter from the Parliamentary Ombudsman, requesting the school's opinion regarding the joint complaint of the data subject and teacher C, who argued that their dismissals had been illegal.
In 2021, the data subject sent a complaint to the Icelandic DPA. She argued that after she had sent her complaint to the Ministry, the school administer started collecting her personal data through her former colleagues and shared it with the Ministry. Both happened without her consent (see Article 6(1)(a) GDPR) and without informing her of the existence of the data (see Article 14 GDPR). The illegally processed personal data would be used against her in the proceedings in front of the Ministry and the Ombudsman.
The administer of the school denied having actively collected information about the data subject from other teachers. The existing information was sent by other teachers to the administrator as a reaction to the data subject's behaviour in the 2018 meeting. All emails containing personal data, to which the data subject's complain related, were dated between January and February 1, 2019. However, the Ministry did not inform the controller about the complaint procedure until February 11, 2019. The controller also argued that the personal data was created due to the administrator's work activities and was therefore not obtained from a third party. As a result, Articles 13 and 14 GDPR would not apply and the controller would be absolved of its information obligation to the data subject.


The controller is Birthlink, a company providing after adoption services that maintains the adoption contact register for Scotland. This enables adopted people, birth parents, adoptive relatives and birth relatives to register their details with a view to being ‘linked’ and potentially being reunited. Birthlink maintained manual records stored in filing cabinets containing documents relating to an adopted person’s individual circumstances.
In April 2021, records containing sensitive personal data of about 4,800 individuals were destroyed without a clear approval from the board. Some of the files destroyed contained irreplaceable items.
In September 2023, following internal investigations, Birthlink notified the Data Protection Authority (Information Commissioner's Office- ICO) about the breach.


facts_CNPD (Portugal) - Deliberação 2022/140

The Portuguese DPA started an investigation into the Municipality of Setubal (controller) after a journalistic article from the newspaper Expresso was published titled 'Ukrainians welcomed in CDU Chamber by Pro-Putin Russians' ("Ucranianos recebidos em Câmara CDU por russos Pró-Putin").
This article contained anonymous accounts of Ukrainian refugees. According to the Article, Russian citizens were present in the same room where Ukrainian refugees' personal data was stored (such as copies of identification documents). These Russian citizens - allegedly part of an Eastern European Immigrants' Association (EDINSTVO), an organisation for the support of eastern European migrants - also asked the refugees questions about the whereabouts of their relatives and what they were doing in Ukraine. In total, two members of the EDINSTVO were integrated by the controller into the Setúbal Office of Ethnicities and Immigration (SEI) in order to provide assistance, counselling and help to the refugees. According to the author of the article, these Russian citizens were accused in the article of sharing this personal data with the Russian Government.
This all happened in the framework of a Municipal Refugee Helpline (LIMAR), which was created in March 2022. The controller was responsible for the processing done by this helpline. The Helpline used two rooms of the controller's building in order to offer their services, one for the customer service and the other for archiving. Both rooms were only accessible for members of the helpline.
The helpline used two forms in order to collect the data from refugees seeking attendance: an assistance form and telephone assistance form. Using these forms, personal data was collected by the controller. Among other things, the controller collected the name, address, date of birth, marital status, information on the support network (identifying the places and people they might stay with and their respective households) and information on the period they might stay with the people in that support network, in addition to describing the specific situation of each refugee. The assistance forms were handwritten and were stored in a filing cabinet. All collected personal data was later also put into an Excel file which was protected by password.
Additionally, forms were accompanied by a declaration of consent for processing. The controller asked refugees for consent to 'authorise that the data records collected may be shared with other services or entities for the purpose of to specific responses or to provide social support adjusted to the situation adjusted to the situation, with the guarantees of privacy and non-discrimination'. Furthermore, together with the assistance forms, refugees were also offered to sign up for Portuguese language courses, for which they needed to provide a copy of an identification document.
In this context, one of the Russian citizens, who acted as a translator, was on medical leave for some time. This translator was informally substituted by her husband. The translator had given her husband her login-credentials to access the helpline's systems. This change was not documented or formalised in any way. The husband, who was not a controller's employee, helped to collect and copy personal data and documents from various refugees and acted as a translator himself.


The complainant argued that he had received a communication from a debt recovery company claiming payments in relation to Xfera Móviles' services, although the claimant had not been a client of Xfera Móviles since September 2017.

Dispute


facts_Datatilsynet (Norway) - 20/03293 (decision 2)

In December 2020, the Norwegian DPA initiated an audit of the Directorate of Norwegian Correctional Service (DCS, the controller) regarding their processing of personal data. The DPA first requested an overview of such processing (equivalent to Article 30 GDPR) for purposes related to the Norwegian Execution of Sentences Act, details about the controller, the various processing activities in the correctional services, as well as a description of the roles and responsibilities internally. This lead to a first decision issued in August 2021.
As a second step of the audit, the DPA notified the controller in November 2021 about forthcoming physical inspections at various sites. The inspections were conducted on the basis of § 20 of the Norwegian Personal Data Act of 2018 (which also implements the GDPR in Norway) for their responsibilities as controller and internal controls for managing privacy and personal data protection in the organization.
During the audit, the controller created an instruction which placed the controller responsibilities for the whole organization, including underlying agencies, with them (the Directorate). However, after the DPA conducted inspections with the underlying agencies, they concluded that the instruction was not fully implemented everywhere.
Further, the DPA noted that the internal control system was insufficient and outdated, especially since the controller evidently registers few violations of routines and regulations, likely as a result of lack of training and lack of a personal data security culture in the organization.
The DPA also stated that complex and confusing regulations might have lead to the lack of compliance. The Norwegian Personal Data Act of 2018 and the GDPR do not apply to the processing of personal data related to sentencing, so the legislator continued the Norwegian Personal Data Act of 2000, with corresponding regulations. The legislator announced in 2018 a new law for the processing of inmates' personal data related to sentencing.


facts_Datatilsynet (Denmark) - 2020-431-0061 (Helsingor decision no. 2)

The Municipality of Helsingor used Chromebooks and Google Workspace (formerly G Suite for Education) in primary school education. The Municipality of Helsingor created Google accounts for students, giving them access to programs including Gmail and YouTube, without the parents' knowledge and consent. These accounts were needed to use Chromebooks on which the G-suite program package, a Google product specifically aimed at the education of children and young people, was installed.
When students used these programs with their school accounts, their names, school and class information were displayed on the platforms. Parents did not have the opportunity to correct or anonymise this information, as only the Municipality had access to user management panels.
The Municipality had not carried out a risk assessment for the processing in question. It also had not implemented technical or organisational measures to ensure a level of security appropriate to the risk relating to the use of social media using the created school accounts.
Consequently, in September 2021, the Danish DPA found violations of Articles 5(2), 5(1)(a), 32(1), (33)(1) and (35)(1) GDPR. It ordered the Municipality to bring its processing of personal data using Google Chromebooks and G Suite in line with the GDPR. This was to be done especially by conducting a risk assessment and, if the risk found was to be too high, an impact assessment. Additionally, the DPA issued a warning that the use of G Suite’s supplementary programs without carrying out an impact assessment would be contrary to the GDPR.
As a follow-up to the DPA’s decision, in November 2021, the Municipality submitted its risk assessment regarding the use of Google Chromebooks and G Suite for Education and further documentation to prove the legality of the processing activity. In addition, in December 2021, the Municipality submitted further information. The Danish DPA reviewed the Municipality's risk assessment and documentation and issued its decision in July 2022.


facts_Court of Appeal of Brussels - 2020/AR/1160 (First Interim Decision)

Proximus appeals the provisionally enforceable aspect of its appealed decision of the Belgian DPA.

Dispute
Is the decision of the Belgian DPA provisionally enforceable even though it is under appeal?


In May 2018 a pupil at a school in Bergen notified the ICT helpdesk of a folder he had found online, containing several files with usernames and passwords of over 35,000 users. However, the school management did not follow up on the notice.
In August, the pupil logged onto the learning management system as the school's principal and sent a message to several people. He expressed later that he did so because the school had failed to take his first notice seriously. When the school discovered this, it notified the police, who found out that the pupil sent the notification. He admitted he had simply guessed the principal's password.
The municipality failed to first notify the Norwegian DPA (Datatilsynet) of the breaches, who discovered these initially after being contacted by several media outlets (after the municipality sent out a press release the same day).
The DPA's investigation revealed that the school had failed to enable two-factor authentication, despite a campaign the DPA conducted in 2013-2014 in the education sector. At the time, the DPA instructed all municipalities in Norway to enable strong authentication on their learning management systems and other administrative systems. Thus, the DPA argues that it is beyond doubt that Bergen municipality was well aware of this security requirement.
Following this incident, the municipality reset all passwords and enabled two-factor authentication.


facts_Persónuvernd (Iceland) - 2021102040

The dispute concerns an issue where the research company Gallup (the controller) looks up data subjects' phone numbers on the online database www.ja.is and stores these in their internal database, to be able to call the data subjects and invite them to participate in surveys. A data subject lodged a complaint against this processing of their personal data, arguing that they never agreed to the processing, nor did the controller inform them about the processing and purposes for the processing.
The controller claimed that the processing of personal data in question was necessary because of their legitimate interests in ensuring sufficient research quality and participation rate, including allowing for all adult citizens to have an equal opportunity to respond to national registry surveys. Even without a database, the controller would have to research and call participants. Further, the controller stored personal data in a do-not-call list to avoid contacting data subjects again who had previously objected to this. The controller concluded that the disadvantages for the processing activities were minimal for the data subjects.


On 22 August 2023, a data subject filed a complaint with the DPA against Silvanergia 2022, S.L. (the controller).
On 16 August 2023, an agent of the controller contacted the data subject, claiming to call on behalf of their energy provider, Bassols Energía, S.A. (Bassols), to update the electricity rate according to new government regulations. The agent asserted that they already possess the data subject’s data, requiring solely their confirmation by email. The referred data consisted of the data subject’s full name, ID number, address, Universal Supply Point Code number[1], and 12 digits of their bank account.
The controller sent an email to the data subject, reminding them of the pending signature to update the tariff. This contained a contract in the name of Bassols. The data subject refused to sign the contract once they noticed that the controller was not their electricity supply company, as they did not intend to enter into a new contract with the controller.
The controller contacted the data subject again to ask why they had not signed the contract. In response, the data subject asked the controller how it obtained their data, in order to exercise their right to erasure (Article 17 GDPR). The controller replied that the data was obtained by third-party firms, despite the data subject denying that they had provided any of their data to them. The data subject tried to contact the controller again but discovered that the e-mail address and phone number of the controller were listed as nonexistent. The data subject then contacted Bassols and requested the deletion of their personal data. Bassols claimed that it had been a victim of identity fraud committed by the controller, as the contract received via email by the data subject was in the name of Bassols.
During its investigations, the DPA found that Bassols was part of a business group, which includes an electricity marketing company named Bassols Energía Comercial SL (BEC). The DPA later identified the controller as the company that had contacted the data subject claiming to be their energy provider, as it was confirmed by the data subject's telecommunications provider. BEC explained to the DPA that it had previously contracted the controller for telemarketing services, in order for the controller to find new clients for BEC. The two companies no longer worked together because the controller had not signed the contract, which would establish it as a processor on behalf of BEC. In addition, BEC claimed that it did not provide the data subject's personal data; this is only done once the processor signs a confidentiality agreement. The DPA requested information from the controller on the sources of the data subject's personal data. The controller claimed the data was obtained through a supplier (anonymised by the DPA), however, was unable to provide evidence.
On 22 November 2023, the complaint was allowed to proceed.


facts_LAG Schleswig-Holstein - 6 Ta 49/22

The controller operated a care service where the data subject was employed. The controller filmed the data subject in their work environment and published a thirty-six second video on Youtube for promotional purposes. The data subject had previously given verbal consent to the filming but had not received any further information about the purpose of the filming or their rights.
Later, the data subject objected to the use of the video and claimed €6,000 in damages during proceedings before the labour court. The controller deactivated the video immediately afterwards. The parties involved reached an agreement and settled the dispute.
The data subject had applied for legal aid for claiming damages up to €6,000. The ArbG Kiel granted it up to the amount of €2,000. Thereupon, the data subject then appealed to the LAG Schleswig-Holstein for legal aid in the amount of €6,000.


A Twitter user notified the Belgian DPA (APD/GBA) of an email she had received from the Belgian National Railway (NMBS) about the "Hello Belgium Railway Pass", which is a ticket for Belgian residents providing them with a number of free train rides. After having reviewed the facts provided by the Twitter user, the DPA decided to initiate an investigation into the incident on its own motion. In its investigations, the DPA found that the email contained the general terms and conditions of the NMBS, instructions on how to use the railway pass correctly and Covid related information. However, the communication also included information of promotional nature and no unsubscribe button or link was provided. In the proceedings, the controller brought forward that the email was intended to remind the recipients to always ensure their safety when traveling and to remind them of the contractual conditions. It, therefore, considered the email as necessary for the performance of the contracts concluded with the ticket holders under Article 6(1)(b) GDPR.


Following an investigation in 2019-2020, the EDPS issued recommendations and the Commission modified the ILA. The EDPS investigated whether these modifications were sufficient to bring processing in compliance with data protection requirements and found infringements.
Data accessed by Microsoft include identity and contact data of users (when signing on to the service and when checking the licenses), data generated by the users while using the software and data generated by Microsoft based on the usage of the software.
The EDPS found that the processing presents significant risks as it monitors the behaviour of users, combines datasets and uses artificial intelligence. Reference date is the 12th May 2021, the date when the investigation was launched. Some measures were taken meanwhile by the Commission, which were taken into account in the recommendations issued.


facts_Datatilsynet (Denmark) - 2020-31-3354

The website first presented visitors with information about the processing activities, after which the visitor could press "Allow all cookies" or "Show details". There was no other button for users who wanted to refrain from giving consent, and the continued use of the website was interpreted by the controller as consenting to the marketing cookies.
The information provided by the website stated:
"This website uses cookies
We use cookies to personalize our content and ads, to show you social media features and to analyze our traffic. We also share information about your use of our website with our social media partners, advertising partners and analytics partners. Our partners may combine this data with other information that you have provided to them or that they have collected from your use of their services. You agree to our cookies if you continue to use our website.”
The website visitor then had the option to click on "Allow all cookies" or "Show details". If the visitor clicked "Show details", he/she was presented with information about which cookies www.golf.dk used. It appeared, among other things, that www.golf.dk used 13 cookies in relation to "Preferences", 29 cookies in relation to "Statistics", 218 cookies in relation to "Marketing" and 19 cookies which were "Unclassified".
From the perspective of the website operator, the consent was obtained before the commencement of the proceedings, and the privacy policy on the website stated how consent could be withdrawn.

Dispute
Did the cookie consent mechanism of the website gather valid consent in line with the GDPR?


A representative acting on behalf of Gveik AS conducted a credit rating on the complainant's sole proprietorship, despite the latter having no customer relationship or any other affiliation with either the representative or the company. The representative claimed that the credit rating was conducted by mistake and that they had tried to cancel it, unsuccessfully. The DPA noted that the credit rating seems to have been conducted due to "nosiness".
Gveik AS didn't have written routines for credit ratings, because these are only conducted for new customers and customers that "request many new services".

Dispute
Did Gveik AS have legal grounds for processing the personal data of the complainant for a credit scoring, as per Article 6(1)(f)? And did they have sufficient internal controls for the use of credit scoring in their business?


facts_Dublin Circuit Civil Court - 2023 IECC 11

The data subject took a civil claim against the controller, here the Child and Family Agency, for unlawfully disclosing her data. The controller had been in possession of sensitive data relating to childhood abuse suffered by the data subject.
The controller accepted that it had caused a data breach, which resulted in the data subject’s now deceased brother having access to the information. The brother had been the subject of the report of abuse made by the data subject to the controller. After the report had been disclosed to her brother, her other siblings and family members also found out about the incident.
The data subject reported that this caused her extreme distress and resulted in a lack of trust in the controller and further mental health problems.


The data subject purchased property from Rodali Gestión Inmobiliaria (controller), a real estate agency. She signed a contract to make a reservation of the property. This document included her personal data. The contract neither included a clause nor was the data subject otherwise informed on how her personal data would be processed. When the data subject discovered this, she filed a complaint with the DPA.
The DPA tried to notify the controller about both the complaint and the start of a sanctioning procedure for the alleged infringement of Article 13 GDPR, but was unsuccesful. The notifications were repeatedly rejected and returned.


facts_ANSPDCP (Romania) - Softehnica S.R.L

The DPA started an investigation against the IT company Softehnica S.R.L, the controller, after a data breach was notified pursuant to Article 33 GDPR.
The investigation by the DPA revealed that the controller´s IT infrastructure was accessed as a result of a ransomware attack.


The housing company set up a surveillance camera to film the door of a tenant who had been objected to harassment and disturbances for a long time. In the camera's recording area, another tenant’s door could be seen, as well as tenants walking in and out of the apartment house. The camera recording was without sound recording or real-time monitoring, and the recordings could only be accessed by five people within the company.

Dispute
Does the interest of camera surveillance to combat disturbances and harassment in an apartment building outweigh the right to the integrity of the tenants under Article 6(1)(f)?


Lillestrom municipality notified the Norwegian DPA about a personal data breach concerning a document they had published on their website, where they had forgotten to classify the appendices as exempt from public disclosure. The caseworker also failed to notice the error. The document then went through two additional manual quality controls without the error being detected and it was only discovered after a local journalist notified them.
The document contained information and personal data about a pupil, including name, birth date, name and address of their parents and their description of their child, description and assessment of the pupil's behaviour and educational challenges from both the school and other public authorities, as well as a concrete assessment of how much special needs tutoring the pupil needs, the pupil's own description of their well-being at home and at school, their tests and assessments and potential diagnoses like dyslexia or ADHD.
The document was available online for about two days and was accessed by four different IP addresses before the municipality managed to remove it.


facts_Tietosuojavaltuutetun toimisto (Finland) - 3116/163/20

On April 2020 an early childhood education unit (pre-school) sent an inquiry along with an informational letter regarding activities to prevent the spread of COVID-19. The families were asked to return the form, providing personal data (including the child's social security number) and stating whether they could arrange childcare at home during the pandemic.
A letter accompanying the inquiry form stated that handling personal data is based on consent and that the data subject gives consent by returning the form. In reality many parents were told that returning the questionnaire was mandatory.
The controller responded to the DPA's request for information, stating that returning the inquiry form was voluntary but strongly desirable. The information was needed to arrange activities during exceptional circumstances due to the COVID pandemic. The controller agreed that the voluntary nature of the inquiry could have been more clearly communicated. They also explained that employees had been given general guidelines for handling personal data, but not specific guidelines for this particular situation.
The controller identified Article 6(1)(c) GDPR (necessary for compliance with a legal obligation) as the legal basis for the processing of personal data in this case. Their statement asserted that they needed the information in order to arrange day care for children, accounting for the number of students learning from home, and to arrange lessons in small groups where possible. They also claimed that they required the information in order to refund families if a child was not attending the activities due to the pandemic. However, the controller agreed that a child's social security number was not a necessary piece of information, and that their age would have been enough to verify the identity of the child.


An individual repeatedly received emails containing Vodafone invoices belonging to a third party. They tried reaching out to the company by email and telephone to resolve this issue, but were never properly helped.
Thus, they filed a complaint to the Spanish DPA (AEPD), which informed Vodafone of the issue. The company assured the DPA it had both dealt with the problem and communicated the resolution to the complainant. The complainant nonetheless kept receiving invoices. The DPA communicated this to the company, which then provided evidence the complainant's email address had been deleted from its systems. It claimed the problem was caused by the customer (that the invoices were actually intended for) entering the complainant's email address instead of their own.