Due to formal reasons, the Spanish Data Protection Authority (AEPD) decided to admit a claim against Asturias Healthcare System (the controller) for not satisfying a data subject's access request to medical records of data subject’s deceased mother, but without any economic fine nor warning, because, during the AEPD's investigation process, such right of access was finally fulfilled by the public administration.

Dispute
Might be a request of access considered as duly fulfilled by the controller when it was not attended in due time and proper course?


facts_Rb. Midden-Nederland - C/16/526196/ HA RK / 21-01

The applicant’s marriage to Ms D was converted into a registered partnership, after which the applicant and Ms D entered into a covenant for the termination of the registered partnership and a partial dissolution of the matrimonial community of property. The community of property was successfully dissolved in 2004.
In the abovementioned covenant, the applicant and Ms D had agreed to continue their joined ownership of the life insurance policy. In particular, there was first an obligation to share the value with each other upon payment and second Ms D had the obligation to reimburse the applicant annually for the subscription of the insurance.
A dispute arose in relation to ASR’s compliance with the GDPR obligations. Hence, the applicant will be referred to as the data subject and ASR will be referred to as data controller.
In particular, the data controller informed the data subject of the personal data kept on him by the data controller. However, the data subject believed that this information was inaccurate and incomplete. Therefore, the data subject initiated several procedures against the data controller.
The first four requests concern the right to inspection. Precisely, a request for full access of the data subject’s data kept by the data controller, based on article 15 GDPR. Moreover, a request for an overview of the contacts the data controller had with third parties, as well as a list of documents added to the data subject’s file on request of third parties. Finally, the data subject requested a copy of the complete file of his documents from either 2004 or 2016 onwards.
With his final three requests, the data subject asked the court to order the data controller to handle the agreement with the data subject in accordance with the GDPR, to delete all personal data of the data subject after proper termination of the agreement and to order a payment of the material and immaterial damages suffered by the improper implementation of the GDPR.


On 2 May 2019, the Swedish DPA received a complaint from a relative of the data subject according to which Gnosjö's Social Affairs Committee (Socialutskott) processes personal data of a resident at one of the municipality's LSS homes (housing with special services for adults), through CCTV cameras. The Social Affairs Committee placed the CCTV cameras to increase the security of the resident, as the resident has demonstrated serious self-harming behaviour.

Dispute
The complainant claimed that the Social Affairs Committee should have stated that CCTV camera surveillance takes place and ask the consent from the resident's family or guardian.


facts_ICO (UK) - Nottinghamshire County Council

Nottinghamshire County Council is the data controller. It has a service called Council Assessment Service (CAS), which prepares Child and Family Assessments (CFA). CFA is prepared by social workers and looks into the well-being of children where there are concerns regarding the capacity of their parents or caregivers to take proper care.
The data subjects are the users of CAS and the children whose well-being is assessed.
A social worker who had prepared the CFA sent out an unredacted copy of the assessment report of two children to their mother and her two ex-partners, each father of one of the children. The assessment report contained sensitive personal data, which should have been redacted from the copies sent to the ex-partners of the mother. Before sending, the assessment report was required to be signed off by the manager, who also did not look into the same, resulting in the distribution of unredacted copies.
Before this incident, 16 incidents of unredacted information being shared had occurred at Nottinghamshire County Council.


facts_RvS (Netherlands) - 202001625/1/A3

This matter concerns an appeal to the Administrative Jurisdiction Division of the Council of State in which the data subject stated that his right to privacy was violated by the fact that he could only purchase a bus ticket by card (as opposed to cash payment). He previously raised a request to the AP (the DPA) to take action against Connexxion Openbaar Vervoer N.V. for the decision to abolish cash payments, through application of the GDPR. This request was denied and underlies the current appeal.
On appeal, the data subject argued that “the court erred in finding that the processing of personal data is necessary for the performance of a contract” in that:
1. The data subject did not enter into an agreement with Connexxion “of his own free will” and that consent for the processing of his personal data was not given freely and unambiguously as Connexxion has a monopoly on which public transport users depend. He argued that the General Conditions for City and Regional Transport 2015 are insufficient to serve as a legal basis within the meaning of Article 6(1)(b) GDPR.
2. The purpose of the data processing is not well-defined, explicit and justified.
3. The effect on safety of banning cash payments is not clear as this measure is one of a group consisting of 23 measures.


The Dutch DPA (the Autoriteit Persoonsgegevens, or 'AP') imposed an order subject to a periodic penalty payment on the municipality of Arnhem ('the Municipality'). The Municipality had infringed the then applicable Personal Data Protection Act (Wet bescherming persoonsgegevens or 'Wbp') by storing and retaining the personal data of individuals who disposed their waste in underground containers on the card readers attached to the containers. The order required the Municipality to open all underground containers without the use of a card, and to delete all personal data already stored and retained no later than 1 October 2017.
On 14 March 2019, the AP decided to lift the order subject to penalty payments imposed on the Municipality at the request of the Municipality. The Municipality wanted the underground containers to be accessible only to residents and businesses of the Municipality, and therefore wanted to open a new waste card system. With the new system, residents are given a card with an internal chip code which is linked to their residential address. When the card is held in front of the card reader, the chip code is processed and compared to a whitelist of chip codes. To do this, the chip code is stored on the card reader's volatile memory. It is then converted almost instantly into a generic 9999 number, and removed from the whitelist when the container is closed. The AP could not foresee any violation of the GDPR by this new system, namely because data may be processed on the basis of Article 6(1)(e) GDPR, which states that a controller may process personal data which is lawful and necessary for the performance of a task carried out in the public interest.
In a decision of 16 July 2019, the AP dismissed an objection made by an appellant against the decision to lift the order as unfounded as unfounded. In a judgment of 5 September 2019, the District Court of Gelderland ('the District Court') declared an appeal lodged by the appellant against the decision as unfounded.
In the present case, the appellant appealed the judgment by the District Court. They argued that the District Court erred in finding that the processing of personal data can be based on Article 6(1)(c) GDPR. In particular, the appellant argued that pursuant to Article 6(3) GDPR, a public interest task under Article 6(1)(c) GDPR must be established by Union law or Member State law in a formal sense, and must satisfy criteria set out in Article 8(2) of the European Convention on Human Rights ('ECHR'). The appellant also stated that in this case, the necessity for processing has not been demonstrated because the question of whether the waste card system is necessary for the performance of a duty under the Dutch Environmental Management Act was not adequately addressed. The District Court should have examined whether the duty could also be fulfilled without the processing of personal data. By not doing so, the District Court applied a test that was too light. The appellant requested that the AP take effective enforcement against any processing of personal data of residents in Arnhem without their consent, including when they deposit their household waste.


The decision is the consequence of a complaint submitted by a Spanish citizen stating that the defendant has installed a video surveillance system allegedly pointing to a parking area without the consent of the owner of such area. The complaint included pictures proving that the video surveillance system was installed. The claimant was the landlord of the defendant.

Dispute
The defendant answered to the AEPD investigation requests stating that:
(i) it has installed the corresponding information poster,
(ii) it has installed six cameras in order to ensure the safety of its establishment,
(iii) the cameras pointing to the parking are only recording heavy equipment, and, considering that the property is leased and that the defendant and the claimant do not have a good relationship, the defendant understands that this complaint is a pressure measure by the lessor, and
(iv) the defendant is planning to leave the property before May 2020. The AEPD started the corresponding sanction procedure; after that, the defendant submitted the corresponding pleadings document, in which it declared that it has left the property and uninstalled all the cameras, attaching pictures of the same as a proof. As a result of its investigation, the AEPD considered that the claimant had a video surveillance system with an excessive orientation to an area out of its property, and without due cause: two of the six cameras were directly recording not only the entrance, but also the sidewalk and nearby road; in order to ensure the safety of the establishment it was not necessary to record such a big area.


facts_High Court - McShane v Data Protection Commission (2025) IEHC 191

The data subject was a fire prevention officer working for the Irish Health Service Executive (HSE) and was provided with a work phone to be used for work purposes.
In May 2021, the HSE suffered a significant data breach and ransomware attack which compromised a large number of HSE computers and devices, including the data subject’s work phone.
In June 2021, the data subject noticed that his personal email account and personal cryptocurrency account, both of which he had accessed on his work phone, had been compromised. Cryptocurrency to the value of €1,400 had been stolen.
After being left unsatisfied with the HSE’s response to a complaint he had filed in relation to the incident, the data subject complained to the DPC on 15 December 2021.
In an email to the data subject about the issues he raised, the DPC noted that the HSE was not the data controller in respect of the data subject’s non-work-related personal data which was on the work phone as the device was only supposed to be used for work purposes. It was found that there was “no basis” upon which the HSE could be considered the data controller when the personal data (personal email and cryptocurrency account) was stored on the device without the HSE’s knowledge or agreement.
On 15 August 2022, the data subject sought a judicial review before the High Court of the DPC’s decision.
The data subject claimed that the work-related data comprised “personal data” under Article 4(1) GDPR, that the HSE was the data controller in respect of it in accordance with Article 4(7) GDPR, and that the DPC had erred in their findings in respect of their decision. This, according to the data subject, rendered their decision “unreasonable” in accordance with the test laid out in Meadows v Minister for Justice, Equality and Law Reform [2010] 2 I.R. 70. This decision established some criteria for which an administrative decision can be judicially reviewed in Ireland. The data subject also claimed that the DPC had failed in their obligation to investigate the breach of the GDPR which he complained about. The applicant thus sought an order annulling the DPC’s decision.
The DPC opposed the application for judicial review, submitting that the breach considered in the data subject’s complaint to the DPC related solely to the non-work-related personal data present on the device for which the DPC found that the HSE was not the data controller. The decision did not, according to the DPC, consider the work-related personal data on the device. The DPC also noted that the rejection of the complaint amounted to a legally binding decision in accordance with s. 150(12) of the Data Protection Act 2018, and as such, the data subject should have sought a statutory appeal in lieu of a judicial review.


In June 2019, the complainant requested erasure of her personal data from the respondent's website, claiming that an article on that website contained wrong statements about her. After the respondent’s refusal to do so, the complainant lodged a complaint with the DSB.
The respondent argued that publishing the article on its website qualified as processing carried out for journalistic purposes under Article 85 GDPR and § 9(1) of the Austrian Data Protection Act (Datenschutzgesetz - DSG). Due to the derogations in § 9(1) DSG, the DSB would hence not be competent to handle the complaint.

Dispute
  * Is the DSB competent to handle the complaint or is the processing on the respondent's website subject to Article 85 GDPR and § 9(1) of the Austrian Data Protection Act?
  * Did the respondent violate the complaint's right to erasure under Article 17 GDPR?


The data subject requested Google LLC (the controller) to delete from its search engine specific Uniform Resource Locators (URLs) which linked to their personal data. The data subject claimed that their personal data was published without consent. However, the controller did not provide any reponse to the erasure request within the required time limit.
As a result, the data subject complained to the Spanish DPA. During the proceedings, the controller blocked the requested URLs, exceeding the one month time limit for responding to an access or erasure request.


In March 2020, the Swedish DPA Integritetsskyddsmyndigheten (IMY) fined Google €7,200,000 (SEK 75 million) for violating Article 17 GDPR (the right to erasure). In particular, the IMY considered that Google had violated the right to erasure in connection with two complaints from data subjects (Complaint No. 2 and Complaint No. 8 in the supervisory case), as well as because of its general practice of regularly informing webmasters when search results are being removed.
Google appealed that decision before the Stockholm Administrative Court (FiS). In December 2020, the FiS upheld that Google had breached the right to erasure with respect to Complaint No. 2, but found no such breach with respect to Complaint No. 8. In both cases, however, the FiS concluded that Google had acted contrary to data protection law because of its practice of notifying webmasters of deleted search results. The FiS further justified a reduction of the overall fine calculated by IMY for the breaches that were upheld.
Google further appealed the FiS decision before the Court of Appeal in Gothenburg. In the context of these appeal proceedings, IMY argued that Google had breached the right to erasure with respect to both Complaint No. 2 and Complaint No. 8, and had also acted contrary to data protection law because of its practice of notifying webmasters of removed search results. IMY wanted the overall fine to be set at €6,300,000 (SEK 66 million). In particular, the proposed fine of €6,300,000 included:
  * a fine of €96,639 (SEK 1 million) for not respecting the right to erasure with respect to Complaint No. 2;
  * a fine of €1,448,547 (SEK 15 million) for not respecting the right to erasure with respect to Complaint No. 8; and
  * a fine of € 4,800,000 (SEK 50 million) for the practice of regularly informing webmasters of deleted search results.


On 28 April 2021, a data subject filed a complaint with the Spanish DPA (AEPD) against the bank Banco Bilbao Vizcaya Argentaria, S.A. (BBVA). According to the complainant, the BBVA had called and sent him several messages about non-payments and appointments. The complainant had asked the bank to delete his data, but the bank replied that it could not do so because there was no customer on their records with the phone number listed in the complaint.
The AEPD requested information from BBVA about what had happened and the bank replied that the communications had been an internal error. BBVA alleged that it was testing the operation of a tool designed to send notifications to its customers, and that the messages received by the complainant were fictitious test notifications that BBVA believed it had sent to an idle phone number. In addition, the entity said it had taken appropriate security measures to correct the situation.


On 13/11/19 the AEPD received a written submission from the complainant in which it was stated the following: I periodically receive SMS messages on [my phone] from some service to which I have not subscribed, nor have I consented to any use of my data and it is also impossible to communicate my cancellation. The messages in dispute are attached to the written submission.
In view of these facts, the Subdirectorate General for Data Inspection proceeded to carry out actions for their clarification. The entity AIRE NETWORKS DEL MEDITERRÁNEO and the entity DIGITAL VIRGO ESPAÑA, S.A were contacted so that they could indicate the identification data and the ownership of the telephone lines from which the messages had been sent. DIGITAL VIRGO ESPAÑA, S.A sent written response, establishing that the owner of the line under investigation was BUBO MEDIA, S.L. by virtue of a contract for the provision of telecommunications services.
On 17/04/20, the entity BUBO MEDIA, S.L. sent to AEPD an e-mail indicating that the way that their customers know about their products and services is through a website and that the way that their costumers request their services is through a phone number. They also stated that the contracting of the services is not accompanied by a written contract and that the conditions of the service and the purposes of the use of the data are indicated in the aforementioned website. As regards for the provision of consent and the contractual relationship, they stated that the costumers are also aware of the contract conditions by the website and that the fact that the customer contacts them by making a phone call to show interest in their services constitutes a clear affirmative act. They made also reference to the fact that they consider that the provision of their consultancy services includes appropriate interaction with the user and that they have recently included the option to unsubscribe from commercial communications by means of a link that appears in the first confirmation sent to costumers.
By its side, the AEPD verified the information that appears in the "Privacy Policy" of the web, where it stands out; among other aspects, that the responsible of the processing is BUBO MEDIA and that the costumers can withdraw their consent given at any time using a mechanism devised for that purpose.

Dispute
Can BUBO MEDIA’S actions be regarded as unsolicited sending of commercial communications by SMS, without the offering of a mechanism to oppose the processing of personal for marketing purposes, prohibited by article 21.1 of the LSSI?
In this case, there was no dispute. BUBO MEDIA acknowledged that their actions were not in line with article 21.1 LSSI, recognized their responsibility and paid the fine in advance, thus mitigating the amount to be paid for such infringement.


On 28 September 2022, the local police force of the city of La Palma submitted a report to the Spanish DPA (Agencia Española de Protección de Datos – AEPD). The police had discovered 1,404 letters on an abandoned plot of land. The letters should have been delivered by Correo Inteligente Postal, here the controller. The letters had been sent off between February and May 2022.
On the 17 November 2022, the AEPD received another report from the police force of the Balearic islands showing that 5,354 letters were left in two different locations in the city of Palma. The police had been informed by a citizen who had sent an email to the city stating that they had found letters in the city’s river. The documentation provided by the police showed that most of the letters were closed and some had been tampered with.
After the AEPD alerted the controller of the reports, the controller stated that they had identified the responsible employees and had started disciplinary proceedings. Further, the controller stated that the letters found had not been opened and therefore the leaked data was limited to the names and addresses on the envelopes. It therefore concluded that there had been no risk to the rights and freedoms of the data subjects.
The AEPD initiated an ex-officio investigation on the 28 December 2022 assessing the measures implemented by the controller to track shipments and training provided to employees.


This decision follows from a previous decision of the French DPA (SAN 2021-023 of 31 December 2021), in which said DPA fined Google LLC €90,000,000 and Google Ireland Limited €60,000,000 for violating Article 82 of the French Data Protection Act. This Act transposes the ePrivacy Directive into domestic French law. Article 82 of the French Data Protection Act is the national equivalent to Article 5(3) of the ePrivacy Directive (2002/58/EC), which stipulates that the storing of user information or the gaining of access to information already stored, is only permitted on the condition that the user has already given their informed consent. The French DPA had fined Google LLC and Google Ireland Limited in decision SAN 2021-023 for failing to offer users a way of rejecting cookies. It ordered Google to bring its processing activities into compliance and imposed an additional periodic fine of €100,000 per day if Google failed to bring its processing activities into compliance within 3 months.
On 24 April 2022, Google sent the French DPA its proposed cookie amendments, which included a button titled "reject all." Between April and June 2022, Google sent further information to the French DPA, and on 5 August 2022, the French DPA re-investigated the matter to ensure that the updated cookie system was compliant. On 25 January 2023 the French DPA requested further information from Google on their system, which Google provided on 28 April 2023.


The Swedish DPA finalised an audit of Google’s handling of individuals’ right to have search result listings for searches that includes their name in 2017. In its decision, the DPA concluded that a number of search result listings should be removed and subsequently ordered Google to do so.
During the DPA’s follow-up audit in 2018, it was critical to the fact that Google did not properly remove two of the search result listings that the DPA had ordered them to remove back in 2017. In one of the cases, Google has done a too narrow interpretation of what web addresses need to be removed from the search result listing. In the second case, Google has failed to remove the search result listing without undue delay. Google claimed it had followed the order and that the handling of the delisting requests had been lawful.
Further, when Google removes a search result listing, it notifies the website to which the link is directed in a way that gives the site-owner knowledge of which webpage link was removed and who was behind the delisting request. This allows the site-owner to re-publish the webpage in question on another web address that will then be displayed in a Google search. The DPA criticised this practice, alleging it puts the right to delisting out of effect. However, Goggle claimed this practice has been in accordance with Article 6.1(f) GDPR.

Dispute
The dispute concerned whether Google had followed the DPA’s order and sufficiently removed search links on request of data subjects or not.
It was also in dispute if Google’s practice to inform site-owners of the removal of search results had a legal basis.


“A” brought an executive action against “B”. After this, an enforcement proceeding was started with an order to impound two vehicles. However, it became clear that it was impossible to impound the vehicles. After this, the pursuing creditor requested the controller to provide information about the journeys of these vehicles in question since a specific date.
The controller is an entity responsible for collecting toll fees on highways with the use of an electronic system, thus monitoring the passage of vehicles at certain points installed on the road for this purpose. The controller is therefore able to register traffic and collects personal data from its clients. The controller is also responsible for the treatment of such data.
The controller stated that it couldn't supply information concerning toll records (date, time and place) because this was part of the the concept of protection of privacy. These toll records could only be shared with the consent of data subjects, the owners of the cars. After this, the pursuing creditor requested the lifting of professional confidentiality from the controller so the record of the journeys of the cars could be disclosed, whic could result in the cars being seized.


The complainant received a letter for a political campaign from candidate to the local elections. The candidates used the "list of seniors" held by the municipality. One of the candidates was working for the municipality, had access to the database at stake, and was subject to a disciplinary procedure after the use of the database was revealed. The candidate died after the complaint was filed. However, it could not be established that the other candidate had access to the database and would be the controller for the sending of the letters he signed.
was subject to a disciplinary measure by the municipality.


facts_Rb. Amsterdam - C/13/673049 / HA RK 19-338

A minor has been placed under supervision of the Amsterdam Centre for Youth and Family (Stichting Jeugdbescherming regio Amsterdam; the defendant). The mother (plaintiff) requests a copy of the complete file from the defendant containing her personal data. The defendant provides the requested data, but removes some phrases and didn’t provide internal notes.

Dispute
Are internal notes and correspondence containing personal data subject to article 15 GDPR?


facts_Datatilsynet (Denmark) - 2021-31-5085

The data subject previously served as a board member and a managing partner in two companies (controllers). After the sale of the companies, the acquiring entity initiated a civil lawsuit against, among others, the data subject. The dispute concerned alleged manipulation of accounting and thus overrated value of the acquired businesses.
On 16 February 2021, the data subject exercised their right under Article 15 GDPR and requested access to information about them from the controllers. The request related to information about the data subject's work and the ongoing legal proceedings.
First, the controllers extended the request processing time by two months because of the high volume and complexity of the requested information. Later, on 18 May 2021, the controllers provided the data subject with 66 documents relating to travel planning, practical matters related to the board meetings, know-your-customer (KYC) information, separate documents with e-mail logos and a few personal e-mails regarding dinner and sports. Unsatisfied with the response, the data subject complained to the DPA on the same day.


The decision is the consequence of a sanction procedure started by the AEPD against the defendant due to a complaint submitted by the Spanish company Neptunos Formación, S.L. (the claimant). The main points of the complaint include the following: (i) the defendant had published copyrighted material in its website without the consent, (ii) the website did not include information on the identity of the defendant, (iii) the claimant requested the erasure of all the content through the contact form, (iv) all personal data obtained from such contact form were transferred to a third company (Formación Universitaria, S.L.) which directly contacted the claimant, (v) the claimant requested again all the erasure of the data during that phone call, without result, (vi) the comments provided in the contact form were published on the website without the user's consent.

Dispute
The AEPD assessed the controller's compliance with the applicable legislation. The Authority focused on whether or not: (i) the privacy policy included information on the data controller; (ii) the data subject was given an effective way to exercise his/her GDPR rights (as the email address provided refused each email received); (iii) the website offered an option to provide a specific and separate consent for the different purposes; (iv) the first layer of the website included any banner on cookies or information on their use.


After multiple years as a member of a union the data subject decided to quit and sent the union a letter requesting termination of the membership and the deletion of personal data. Among other information the letter contained the membership number and the handwritten signature of the data subject.
The union immediately terminated the membership of the data subject. In terms of the erasure request, however, the union asked for a copy of the ID of the data subject in order to progress with the deletion. Although the name and membership number were known to the union, it could not verify that also the signature on the letter was from the data subject.
The union argued that although the data subject stated to be known to the union due to their long membership, the size of the union with over 1.2 million members and different administrative responsibilities did not constitute a personal relationship with the data subject. Moreover, the consequences of the data deletion would be severe compared to a resignation given that the data was necessary for a later re-entry in the union to continue the data subject’s membership. Therefore, and in accordance with Article 12(6) GDPR additional measures of identification were required.
The data subject refused to provide a copy of the ID seeing a contradiction in providing even more data to achieve its deletion. The data subject argued that sending a copy of the ID does not mean any higher degree of reliability or proof of identity since it could be stolen, forged or used by another person. According to the GDPR additional information may only be requested if there are reasonable doubts about the identity of the natural person which does not allow for routine identity checks in all data subjects' rights.


The GGK published personal data in the form of information obtained from land and property registers (including land register numbers) from 90 poviat starosties only on the basis of agreements concluded with them.

Dispute
Was the publishing of the land register numbers by the GGK on the GEOPORTAL2 (geoportal.gov.pl) lawful, in accordance with Articles 5(1)(a) and 6(1) GDPR?


On 23 September 2021, the French DPA (“CNIL”) carried out an inspection on Foriou’s premises (“controller”), in particular regarding the legal basis of the processing and the security measures taken. The controller was in the business of marketing and managing loyalty programs and cards. In order to promote its programs, until 2021, the controller carried out telephone canvassing campaigns using prospect files purchased with several data suppliers who collected the data via entry forms for online competitions. The personal data collected was the following: surname, first name, title, email address, date of birth and postal address.
During its investigations, the CNIL discovered that the data suppliers all had similar forms on their websites: there were fields which enabled the data subject to enter their contact details. Underneath these fields were a “Validate”, “I validate” or “I answer questions to apply” button. Above or below this button, a text specified that by clicking on it, the user declared that they read the data supplier’s data protection policy and accepts that the data collected would be used to send them offers from the company’s partners. Hyperlinks were provided to access the data protection policy as well as the list of partners concerned. However, the list did not mention the controller. At the end of the text it was specified that if the user wished to continue without receiving offers from the data supplier’s partners, they could click a link in the text (“click here”).
Therefore, data subjects could either click on the “Validate” button and accept that their data would be used to send them offers from the data supplier’s partners or on the “click here” link to continue without receiving these offers.
The controller also submitted 2 other forms in its observations. These forms contained “Validate my coordinates” and “Continue” buttons to validate participation in the game and transmit data to partners. The “click here” button remained unchanged and was still presented in the body of the text.
Regarding security measures, the CNIL found that the controller indicated that they would keep customer data for a period of 5 years from the date of the end of the contract in an active database with no intermediate archiving mechanism implemented.


The decision is the consequence of a sanction procedure started by the AEPD against the defendant due to a complaint submitted by a Spanish citizen stating that the defendant had sent him a message thanking the successful acquisition of a new phone line he did not recognize (as he is a client of another telecommunications company) and that such message also specified that the new phone had a period of stay. Additionally, the claimant specified that he later received a document by the defendant requesting him to pay a debt he did not recognize.

Dispute
The defendant answered to the AEPD investigation requests stating that it requested the payment of the phone services contracted online by the claimant, but it did not attach any evidence of his acceptance; afterwards, the defendant attached a copy of the alleged contract containing the personal data of the claimant, but with no evidence at all that he has signed nor accepted it in any manner. The AEPD started the corresponding sanction procedure.


Controller is the municipality of Eindhoven. The data subject found out that an email that they sent to the municipality on 15 January 2017 (in which they complained about their neighbours), had been forwarded and had ended up with their neighbours, without blacking out their email-address. Because they had not given consent for this, and the processing for personal data was not necessary to fulfil a public interest, the data subject requested the municipality to (1) rectify personal data mentioned in letters of 7 April 2016 and 14 November 2018, and (2) compensation for damages caused by forwarding their personal data without a legal basis.
After the municipality had rejected the request, the data subject brought the issue before court. The District Court of Oost-Brabant dismissed this appeal, after which the data subject appealed this judgement before the Council of State. On appeal, the data subject argued that (1) The municipality had exceeded the decision period of one month as per Article 12(3) GDPR for their request to rectify the personal data, (2) the municipality should have also rectified personal data in the letter of 14 November 2018, and (3) The District Court had wrongly considered that the data subject was not entitled to compensation.


This decision concerns the use of a surveillance camera which partly pointed at the living space and garden of some neighbors (the data subjects). The controller stated that the purpose of the cameras was to protect its collection of high value motorcycles and that it had never been its intention to violate someone else's privacy. The data subjects filed separate complaints at the DPA which were combined in a single procedure. One of the data subjects also went to the police, which resulted in a police investigation at the controller’s place at 27 October 2022. The police came to several conclusions, amongst others the fact that the controller didn't register the purpose of the video surveilance before he placed the security camera. It was obligatory to register the purpose of camera surveilance to the police before the camera was placed. The police also found that the controller didn't notify the police about the placement of the surveillance camera, despite the fact that this was a legal obligation under national law (Article 7(2)(2) Camerawet). The DPA conducted an investigation into the controller. The investigations unit held that the controller violated Articles 5(1)(a), 5(1)(b), 5(1)(c), 5(2) and 24(1) GDPR. The investigations unit also held that the controller violated several local legislations, specifically Article 5 Camerawet, Article 3 Koninklijk Besluit 10 February 2008 and Articles 7, 8, 9 Camerabesluit.


In 2021, two data subjects requested the deletion of their personal data related to their Covid-19 vaccination records and Covid-19 personal data held at the National Institute of Public Health and the Environment. The controller, the Minister of Public Health, Welfare and Sport, provided them with two options to confirm their identity: by sending either a scan of their passport or by physically identifying themselves before the Ministry. The data subjects did not use either option and the controller subsequently rejected their requests.
The data subjects filed a complaint before the court of first instance. The court ruled that the minister was justified in dismissing the objections as unfounded. It ruled that the minister was entitled to disregard the requests on the ground that the identity of the persons concerned could not be established. Plus, while the Covid-19 measures were still in effect, deletion of the vaccination data would make it impossible for an individual to prove that they where vaccinated via the government application for Covid-19.
The data subjects appeal the decision of the court of first instance before the Council of State.
The data subjects argued that the identification options given by the minister were unreasonable since by sharing a copy of their passports they incurred many risks. Second, physical identification at the Ministry unreasonably burdens the data subject. Third, they proposed the alternative to be identified with the last three digits of their BSN, combined with telephone verification.


On 2 June 2021, the French DPA (“CNIL”) informed a French municipality (“the controller”) that they had not named a DPO. The municipality did not respond, therefore on 25 April 2022, the CNIL gave formal notice to the municipality to designate a DPO within four months of this notice. The controller neither replied to the DPA, nor complied with its requests.
The French DPA started a sanctioning procedure against the controller on 8 February 2023.


On 15 June 2023, the French DPA (CNIL) fined the online advertising company Criteo - the controller - €40,000,000. The DPA’s decision followed complaints lodged by the NGOs Privacy International and None of Your Business (noyb).
Criteo used a behavioural targeting approach that tracked data subjects’ online activities to display personalised advertising. By collecting browsing data through its tracking tool (the cookie "Criteo") Criteo analysed data subjects’ browsing habits to determine the most relevant ads for each data subject. Online advertising companies participated then in real-time bidding and displayed personalised ads if they won the bid.


In November 2019, the church tax office (controller) sent the data subjects questionnaires to provide information on the religious affiliation of their two minor children. In December 2019, the data subjects requested the controller to refrain from such requests. Nevertheless, the controller requested the data subjects to complete the forms again in January 2020. Consequently, in August 2020, the data subjects filed a complaint with the Berlin DPA (Berliner Beauftragte für Datenschutz und Informationssicherheit). They claimed that the questionnaire was unlawful under data protection law. The DPA dismissed the complaint, arguing mainly that it was not competent to decide on the matter because of the church's special competence. Furthermore it did not find a breach of data protection law. Before the court, the data subjects pursued their claim.


The judgement of the Court of Appeal of Milan was appealed following its confirmation of the ruling of the Court of First Instance, which had established the illegitimacy of the dismissal of a manager (the defendant) by Banca Widiba Spa (the applicant) on 8 May 2018.
The defendant was fired due to conduct of insubordination and breach of the duties of diligence and loyalty as well as of the general principles of fairness and good faith for having relations with competing businesses and for having avoided a preventive technical assessment, causing doubts over the genuineness of the illness underlying his many absences.
The Court of Appeal, agreeing with the Court of First Instance, ruled the illegitimacy of the first two disciplinary charges as they were the result of investigative monitoring of company e-mails and tailing, which did not ensure the proportionality and procedural guarantees against arbitrariness of the employer and lacked justification for such invasive monitoring, violating the right of the worker’s right to respect for his correspondence.
The applicant filed for an appeal against the decision to the Supreme Court of Cassation (Supreme Court).


facts_Raad van State - ECLI:NL:RVS:2023:4155

On 15 June 2019, the data subject made an access request under Article 15 GDPR to the Dutch Fiscal Intelligence and Investigation Service (FIOD). The FIOD is a government agency in the Netherlands responsible for investigating financial crimes, and is under the administration of the Ministry of Finance.
On 7 August 2019, the FIOD responded to the data subject, stating that no personal data which the GDPR applied to was being processed by them. Instead, the data subject’s data was processed under the Police Data Act, which offered no equivalent right of access as under the GDPR. The data subject challenged the FIOD’s response at a District Court.
In a judgment dated 22 November 2022, the District Court dismissed the data subject’s claims on the grounds that the FIOD’s activity’s fell under Article 2(1)(d) GDPR. This Article provides that the GDPR does not apply to the processing of personal data ‘by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’ Consequently, the data subject had no right of access as the GDPR did not apply to the FIOD’s processing activities.
The data subject appealed the District Court’s decision to the Council of State (Raad van State), the Netherlands’ highest administrative court.
On 11 October 2023, the Council of State heard the data subject’s appeal. In the appeal, the data subject submitted that the District Court had erred in its reading of Article 2(1)(d) GDPR and should not have interpreted the Article as applying to the FIOD, as the FIOD was under the administration of the Ministry of Finance and was not a police body. As a result, the data subject argued that their data held by the FIOD fell under the GDPR’s material scope, and thus, they had a right of access to the data.


The controller is media outlet De Tijd. The data subject had an electric scooter business that was acquired by another company in 2018.
The controller published an article about the data subject and his (previous) business, which is now in its online archives. The data subject asked the controller to anonymize the article. The controller refused.
On 23 March 2021, the data subject submitted a request for mediation to the DPA about the controller's refusal to honor their right to be forgotten. The data subject stated that the article had a negative connotation (even after a revision of inaccuracies at their request). Furthermore, the article would pop up when you searched their same on a search engine, which hurt their professional career.
The controller stated that it is not obligated to remove or anonymize the article, based on the freedom of expression and the integrity of media archives. As for the negative connotation, it followed that the way an article is written falls under editorial freedom. Moreover, the data subject actively sought out and profited from the media attention.


Controller is Stichting Veilig Thuis, a public organisation that deals with cases or suspicions of (suspected) domestic violence or child abuse. The data subject is a 11-year-old child that had been missing school several times. After Veilig Thuis received reports from the data subject’s school regarding truancy, it sent the mother an email, in which it stated (among other things) that “Veilig Thuis has made the agreement with the obligatory education officer that she will contact Veilig Thuis if the safety of the child is jeopardised again or continues to be so (e.g. when you do not accept the help that is offered)”. The mother did not agree with the wording and requested to rectify the dossier, pursuant to Article 16 GDPR, by removing the word “again”. Moreover, she requested to have the whole dossier erased, pursuant to Article 17 GDPR. Veilig Thuis rejected both requests, which led the mother to bring the matter before court.
The District Court of Zeeland-West-Brabant, however, rejected the appeal. Regarding the deletion request, it decided that it cannot be assumed that the interests of the child’s legal representative (the mother) and the child will always coincide. Moreover, it noted that Veilig Thuis had been involved with the family for some time, had concerns about the child’s school negligence. Thus, it found that Veilig Thuis had a reasonable chance to judge that the substantial interest of the child required that Veilig Thuis saved the data, and that this substantial interest of saving the data outweighed the interest of the mother to erase the data. Regarding the rectification request, the Court considered that the right to rectification is not meant to correct or remove impressions, opinions, research results and conclusions with which the person concerned does not agree. The District Court, however, did not order the mother to bear the cost of proceedings.
Both the mother and Veilig Thuis appealed this judgement: the mother on the grounds that the erasure request must be honoured, and Veilig Thuis on the grounds that they should not pay their own costs of proceeding since they won the case.


At the end of 2021, the Hellenic DPA (HDPA) became aware of the Ministry of Migration and Asylum's (the controller) development and deployment of the "Centaurus" and "Hyperion" Programmes Closed Control Facility Centres for third country nationals on the Aegean islands (Lesvos, Chios, Samos, Leros and Kos). The HDPA also received requests for an investigation and opinion from the LIBE Committee of the European Parliament, as well as from civil society organisations, on the use of the systems in the asylum facilities.
The Centaurus project is reportedly an integrated digital system for the management of electronic and physical security around and within the facilities. The controller uses CCTV systems, artificial intelligence behavioral analytics (AI) algorithms and unmanned aerial vehicles to process images and personal data. The Hyperion programme is described as an integrated entry/exit control system, with the purpose of monitoring the entry and exit of the guests and certified members NGOs through the processing of personal data, in particular biometric data.
In response to the HDPA's request for explanations of the programmes and their data processing, the controller stated that the legal basis for the Centaurus project's video surveillance was the performance of a task carried out in the public interest or in the exercise of official authority pursuant to Article 6(1)(e) GDPR. It argued that prior alternative protection measures, such as fencing of the property and patrols, were not as effective as video surveillance in dealing with illegal activities. With regard to the use of drone surveillance, the controller stated that they are only used in cases of emergency, such as fire or unrest. It claimed that the retention period of Centaurus system data is 15 days unless an incident is detected, in which case it is kept for up to 1-3 months and that access to data subjects' data is restricted to authorised police users; if copies of footage need to be provided, persons are blurred so as to minimise data. Information was provided to data subjects with notifications and warning signs on CCTV systems. Further, anti-malware software, passwords, system maintenance and software-level security policies were cited as security measures.
In the case of the Hyperion programme, the controller seems to have argued that no biometric data was not used to identify data subjects, but nonetheless citing Article 6(1)(e) GDPR as the legal basis for such processing if it does occur. Where any processing of special categories of data (namely fingerprints and biometric data) occurred for identification purposes, the controller cited Article 9(2)(b), (c), (g) and (j) GDPR as its legal basis. In a later communication, it clarified that its primary legal basis in this regard was based on substantial public interest pursuant to Article 9(2)(g) GDPR. Regarding consent, data subjects entering the accommodation facility were prompted to fill out a personal data recording form which included a consent request. Finally, the controller noted that a partial Data Protection Impact Assessment was carried out for both the Centaurus and Hyperion programmes.
The controller also claimed that there was no processing of personal data by either programme that extracted special categories of data - as a result, it found that Article 9 GDPR did not apply.


The controller is a telecommunications company. The data subject and the controller entered into a mobile phone contract. During the conclusion of the contract the controller provided the data subject with an information sheet that included information about the transfer of personal data to the Schufa, a credit rating agency.
Subsequently, the controller transferred the name, the date of birth, the address, and information about the conclusion of the contract to Schufa.
Following his request, Schufa informed the data subject about the data forwarded by the controller.
In a press release made public on 19 October 2023, Schufa informed the public that it was going to delete information transferred by telecommunication companies by the 20 October 2023. Schufa noted that the Conference of the German Data Protection Agencies (Datenschutzkonferenz der Länder) was of the opinion that the transfer and processing of so called positive data (i.e. data without connection to a payment default or another violation of the contract by the data subject) required the consent of the data subject. Data concerning the conclusion of a contract would constitute such positive data.
With his lawsuit, the data subject claimed, inter alia, €4,000 in non-material damages.


facts_Tietosuojavaltuutetun toimisto (Finland) - 7587/163/20

On 28 September 2020, the data subject filed a complaint with the Finnish DPA against a bank (the controller) where they used to be a customer. On multiple occasions, the data subject had requested the controller to delete their data which was no longer necessary for processing after they ceased being a customer. However, the controller did not comply with the requests and did not provide the data subject with the required information under Articles 12(3) and 12(4) GDPR. When responding to the DPA, the controller explained that the violation happened because of a human error in the customer service department. The controller subsequently complied with the data subject's deletion request.


In 2019, a company enabled automatic forwarding of an employee's emails during a sick leave, because the employee had "failed to enable her out of office reply". The company admitted that they had breached §§2 and 3 of a national regulation concerning employers' access to employees' inboxes and other electronically stored material, that they had no legal basis as per Article 6(1)(f) GDPR and that they had failed to inform the employee as per Article 13 and the national regulation.
They argued, however, that because the employee had failed to enable her out of office reply, they had legitimate grounds to enable automatic forwarding of her emails. Despite objections from the employee, the company continued to forward her emails, as long as she didn't herself enable the out of office reply. In the end, the company did this on her behalf, but only after having monitored her emails for five weeks.


facts_Tietosuojavaltuutetun toimisto (Finland) - 9707/152/19

A data subject requested their psychotherapist (data controller) to give access to their patient documents multiple times between 2017 and 2019, both personally and through a third party who had a letter of attorney signed by the data subject. The data controller received these requests but did not respond to them. Therefore, on 16 December 2019 the data subjecy filed a complaint with the Finnish DPA.
The Finnish DPA requested a statement from the data controller on 11 February 2020, which the controller failed to provide in time. The DPA then asked for a statement again on 23 March 2021 and, this time, received a response. In the statement, the data controller acknowledged that the data subject had submitted a request under Article 15 GDPR. The data controller also recognised that it had not fulfilled the data subject's right to access and that it would implement it on 24 March 2021.
However, according to the data subject, the data controller exercised their right under Article 15 GDPR only in April 2021, but not within the deadline set by the GDPR, even though the third party assisting the data subject provided guidance to the controller about how to comply with the GDPR requirements and informed it of the urgency of enforcing the right. The data subject further showed that previously, on 20 July 2018, the data controller informed the data subject that it had decided to grant access to the requested information. However, this did not happen.
The data subject claimed to have suffered damage as a result of the delays in obtaining the requested information; it affected the legal actions he had initiated and had financial impacts since the data subject had to use a third party to request personal data from the data controller.
In response, the data controller stated that the request of the data subject was first submitted in a formally incorrect manner, and subsequently, correctly. Secondly, it noted that the health of the data subject contributed to the controller's decision not to exercise the right under Article 15 GDPR within the time limit, and acknowledged that exceptional circumstances had influenced its actions, due to a decrease in turnover and denied deriving any financial benefit from not fulfilling GDPR requirements.
Thus, the DPA decided to assess whether the data controller implemented the data subject's right to access in accordance with Article 12(3) GDPR and Article 12(4) GDPR.


The data subject took part in a three day seminar organised by the controller in January 2020. The controller sent the data subject a document listing the participants of the seminar, noting who wanted to arrive a day earlier and indicating the room categories booked and whether breakfast had been booked.
On 22 January 2020, the data subject requested access under Article 15 GDPR, including information about the controller’s authorisation to store data, the time, recipient and purpose of the forwarding of data and the purposes for processing.
On 15 February 2020, the data subject lodged a complaint with the Bavarian DPA (“Bayerischen Landesamtes für Datenschutzaufsicht”) for the misuse of personal data of participants in a seminar by sending out the participants list and failure to provide information about the use of the data subject’s personal data. The data subject explained that in addition to the names, the list of seminar participants sent by the controller also showed the room category booked, from which conclusions could be drawn about the financial situation of the participants.
On 6 March 2020, the DPA requested the controller to provide the data subject with the information under Article 15 GDPR.
On 12 March 2020, the controller replied, stating that they deleted the data subject’s personal data and only saved the email address, which was needed for the seminar and would be deleted afterwards. The controller further stated that sending out the list of participants to the data subject was an oversight and would not happen again.
On 24 March 2020, the DPA sent the data subject a final notification that they requested the controller again to provide information. No other supervisory measures under Article 58(2) GDPR were needed according to the DPA and the case was considered closed.
The DPA informed the data subject it was welcome to contact the DPA again if it did not receive the information from the controller within four weeks, which the data subject did after the deadline. The DPA then replied that since the controller stated that it had deleted the data subject’s personal data, the controller also complied with the access request as there was no information on the data subject anymore. Therefore, the matter had definitely been closed.
The data subject filed a lawsuit against the DPA at the Administrative Court of Ansbach (“Bayerisches Verwaltungsgericht Ansbach”), requesting the court to order the DPA to take a corrective measure against the controller under Article 58(2) GDPR.
The data subject objected against the closure of the case, arguing that the controller must still have the data subject’s personal data as they would need to keep contract documents for the tax office. Even if the personal data was deleted, the controller should not be able to disregard data protection, knowingly "misuse" data and subsequently delete everything and then no longer be obliged to provide information. The data subject had clearly requested information about all personal data concerning them and its purposes.
The DPA argued that the data subject is not entitled to the DPA adopting a supervisory measure and that this is at the DPA’s discretion. Such an entitlement can only be considered if the violation was of sufficient severity. However, the DPA found no serious breach of data protection in this case, but only that no information was provided by the controller.


facts_ANSPDCP (Romania) - Fine against a Property Owners Association

A data subject filed a complaint against a property owners association from the Municipality of Iasi after it disclosed their personal data. While the DPA conducted the investigation, the association did not cooperate in providing the requested information.


The Department of Education (the DfE) was requested to provide the entire audio recording of a Professional Conduct Panel hearing into a case against five teachers - so called Trojan Horse affair. (This involved investigations into the alleged infiltration of Islamist extremists into the education sector in Birmingham. These hearings investigate whether there has been unacceptable professional misconduct by these five teachers) The hearing took place in public and was recorded by the National College for Teaching and Leadership (NCTL). The panel’s decision was announced on the government’s website.
The complainant argued with the DfE that the audio files contain important information not found elsewhere such as how statements were spoken including intonation and emotion. He further argues that this is essential for public scrutiny and transparency in this case.
The request was refused by the DfE under section 40(2) (personal information), 31(2) (law enforcement) and 14 (vexatious request) of the FOIA.
- Section 40 of the FOIA provides exemptions from the right to information if it is personal data as defined in the DPA.
-Section 14 states that the public authorities do not have to comply with vexatious requests.
The complainant filed a complaint against the DfE with the ICO about the way his request for information had been handled by the DfE.

Dispute
The ICO had to determine whether the DfE has correctly withheld information within the scope of the request on the basis of section 14 of the FOIA or either of the exemptions at section 40(2) or 31(2) of the FOIA.
First, the ICO had to assess if the requested information imposes the burden upon the DfE.
Second, the ICO analyzes if the withheld information includes personal data and if the disclosure of that data will contravene the DP principles.


facts_Garante per la protezione dei dati personali (Italy) - 9815665

The municipality (the controller) published on its online Public Notice Board, as well in a press release, information about the data subject's dismissal from work. The publication contained a matriculation number, which made the data subject identifiable.
Subsequently, the data subject decided to file a complaint with the Italian DPA. The DPA initiated proceedings and requested more information from the controller.
The controller argued that the information had been put through pseudonymisation first and only employees knew how to decrypt it. Furthermore, the online Notice Board was not indexed in search engines. With regards to the press release, the controller argued that the text was anonymous and did not allow for the identification of the data subject.


Background
About a month after the "Schrems II ruling" by the CJEU (CJEU - C-311/18 - Schrems II) the NGO noyb filed 101 complaints regarding data transfers from EEA based websites to Google LLC and Facebook Inc. in the U.S (see here and here). In order to coordinate the work of all involved DPAs, the EDPB created a special task force.

Complaint
On 18.08.2020, a data subject (represented by noyb) filed a complaint with the DSB against both the website provider (in its role as data exporter) and Google LLC (in its role as data importer), arguing that both respondents violated Articles 44 et. seqq. GDPR in light of the "Schrems II" ruling by transferring their personal data to Google LLC. As Google LLC qualifies as "electronic communication service provider" under 50 U.S. Code § 1881(b)(4), it is subject to surveillance by U.S. intelligence services and can be ordered to disclose data of European citizens - such as the data subject - to them.
The complaint was filed against the Spanish Royal Academy (Real Academia Española, "RAE").
The controller alleged that it is a public law institution that uses Google Analytics tools solely and exclusively for fulfilling the general interest purposes that constitute its ultimate goal, which is to ensure the development, dissemination, proper use and update of the Spanish language; in order to achieve that, it is necessary to have access to statistical data related to the access and use of these instruments, and also to know its evolution and adaptation to the reality of the use of the language at any given moment (e.g. statistics related to the use of terms not included in the dictionary can allow a better knowledge of the evolution in the use of the language and the possible inclusion of such terms in the future).
Through the use of Google Analytics, the controller can know essential information related to the use of the language and its diffusion worldwide.
The controller also alleged that it only had access to aggregated data that did not allow for identification of users. The controller had no access to personal data whatsoever, nor IPs or any other information. Hence, no personal data was processed.
The controller also indicated that it had subscribed a contract with Google LLC (Conditions for the Processing of Data) and that therefore the RAE was a controller while Google was a processor.
Furthermore, the controller alleged that it had only used the most basic functionalities of Google Analytics, guaranteeing the minimization of the use of data, so only aggregated data was processed.
Only the following data was gathered:
 1. Identification of the geographic area (city and country) from which the user of the user accessed the website and statistics by country.
 2. Language.
 3. Source from which the visit originates.
 4. Statistical flow of visits to the Web Site.
 5. Statistical analysis of visits, offering percentages of recurrent or first access visits.
 6. Browser used for access.
 7. Type of mobile device used.
 8. Screen resolution of the device and its operating system.
Nor Google Signals nor Comparatives were activated.
On 08.09.2020, the AEPD verified that the code of the website included the creation and storage of Google Analytics cookies.
On 27.10.2021, the AEPD confirmed that such code was not on the website anymore.


In 2019, the Ministry of Interior, in implementation of a Greek legislation, introduced the ‘special foreign electoral registry’ (the Registry) for the facilitation of the exercise of electoral rights by voters outside the Greek Territory, containing voters personal data, including their email address.
On 1 March 2024 a Greek MEP associated with the Party used the personal email addresses that Greeks abroad had used for their registration in the special electoral list for Greeks abroad in the year 2023 through the web portal of the Ministry of Interior "apodimoi.gov.gr", to send them unsolicited political communication.
Between 1 March and 16 May 2024, the DPA (Hellenic Data Protection Authority-HDPA) received several complaints from Greeks living abroad against the MEP and the Ministry of Interior (the Ministry) for the unauthorised leakage of their email addresses to the MEP.
The DPA initiated investigations and discovered that in June 2023 the Ministry leaked that data from the Registry through the WhatsApp platform to some executives of the Party in governmental positions, amongst which, the General Secretary of Expatriates (the Secretary). The latter used some data from the Registry for statistical analysis of the results of the 2023 parliamentary elections for political conclusions. In January 2024, the MEP requested and received from the Secretariat of Expatriates the full register.
The DPA imposed a fine to the Party in the amount of €30,000 for violating Article 25(1) and Article 32 GDPR. It found that the technical and organisational measures taken by the Party, as a controller, did not include the activities of its secretariats and that the party executives did not sign a confidentiality agreement. Their privacy policy regarding the use of personal devices by its executives was incomplete and limited and left without supervision or guidance party executives and staff who were known to process personal data. Moreover, the DPA imposed a fine in the amount of €10,000 for the violation of Article 5(1)(a) and Article 6(1) GDPR, finding that the Secretary unlawfully used the data from the Registry on behalf of the party for demographic statistical analysis serving the purposes of the party. With the same decision the DPA also imposed a fine to the Secretary and to another Party executive for the unlawful processing of personal data.

The Party contested the decision of the DPA before the Supreme Administrative Court (Council of State – ΣτΕ).


facts_Datatilsynet (Denmark) - 2020-432-0047

In February 2020, the Danish DPA published a guide on the processing of personal data of website visitors. As a follow-up to this, and to focus on whether the rules in this area were complied with, the DPA decided in October 2020 to investigate the website www.naestved.dk, which is administered by the Næstved Municipality. The cookie banner on the website stated "The website uses cookies to improve your experience, assess the use of the individual elements of the website and to support the marketing of our services. By clicking on the website, you accept the website's use of cookies." Visitors could then choose between "OK" or "Show details".


A couple has installed a video surveillance system on their property. The couple's neighbors lodged a complaint because some of the cameras were placed in such a way that they were filming part of the public road as well as their private property, and had filmed the complainants while driving on the public road or entering private property of their own. The complainants asked that the video surveillance system would be taken down.
The complainants also opposed the further use of the recordings made by the video surveillance system, which were subsequently shared by the defendants with an expert in the context of another (environmental law) dispute between the defendants and the complainants.
The defendants took a photograph of the complainants with a smartphone, to establish an alleged breach of environmental law. The complainants also fought the making of such photograph and the further processing thereof.

Dispute
Is the processing of personal data included in photographs and camera images lawful under Article 6(1)(f) of the GDPR?


A claimant filed a complaint with the DPA to report several infringements of the GDPR coming from the Asturian Handball Federation. They alleged that the federation did not have a DPO, that they did not obtain valid consent from the children above 14 or their parents, nor they verified the legitimacy of such consent, that they were publishing photos of minors without such consent, that they did not inform about the data processed according to Article 13 GDPR and that they made reference in their privacy policy to the old Spanish Data Protection Act.
The Asturian Handball Federation alleged that they had two websites, one with domain .es and another with .com, and that they were coexisting due to an administrative error. The old one was not up-to-date, what is what caused the reference to the old Data Protection Act and the fact that they had non-updated forms for gathering data.
Additionally, the federation appointed a DPO during the course of these proceedings and amended their privacy policy to include everything that Article 13 requires.

Dispute
Did the Asturian Handball Federation incur in any violation of GDPR given these facts?


IP received a letter stating that an individual is an employer of a primary school where they would like to publish the minutes of the parent council online. The individual was interested in how it is with the publication of the names and surnames of teachers, together with their evaluation (praise, criticism). Also, should he enter in the record the full name, only the initials of the specific teacher, or perhaps only the subject he is teaching (to know who/what was being talked about)? The names of students, parents and attendance lists are not published.


The appellant in the present proceeding was an association which used an algorithmic system to objectively calculate the reputation rating of the natural and legal persons who created a profile (the data subjects) on their platform. The case stems from an investigation the Italian DPA had conducted on the appellant. At the end of the investigation, the Garante prohibited under Article 154(1)(d) of the Italian Privacy Code the mentioned data processing operations due to a breach of Articles 2, 3, 11, 23, 24 and 26 of the Code.
The DPA decision was appealed by the company and ended up before the Italian Supreme Court, for three reasons. First, the appellant claimed that the previous instance did not adhere to well-established Supreme Court case-law on consent. Second, it highlighted that the math scheme of the algorithm was already available in the EU Patent Registry and easily recognizable. Lastly, the violation and wrongful application of Article 41 of the Civil Code, Article 8(2) of the European Charter for Fundamental Rights, Articles 13, 23, 26 of the Italian Privacy Code, as applicable at the time of the facts, and Article 7(4) GDPR with regards to the protection of the principle of economic initiative.


facts_Commissioner (Cyprus) - Decision of 27 November 2023

On 30 March 2023, the Open University of Cyprus, the controller, notified a personal data breach to the Cypriot DPA (Commissioner for Personal Data Protection, DPC) in accordance with Article 33 GDPR. In addition to this, 11 complaints were filed with the DPC by data subjects stating that their data had been leaked following the incident.
Accordingly, the DPC started investigating the case and asserted that the leaked data related to students, alumni and other partners of the controller and it was cached on the controller's servers and generally processed by its employees.
In its submissions, the controller sent to the DPC a list of actions it intends to implement by 2026 in order to improve the security of its processing operations.


A data subject made an objection request to marketing communications received from a fashion retailer (the controller). The controller indicated that it would comply with the request, but continued sending marketing communications to the data subject.
The data subject filed a complaint with the Romanian DPA which started an investigation on that matter.
The investigation revealed that, in order to exercise their right, the data subject had to submit a written, dated and signed request. Moreover, it revealed that the information notice did not cover the information on data recipients, retention terms or the right to lodge a complaint to the DPA.


In February 2021, the Norwegian Labour and Welfare Administration (NAV) notified the Norwegian DPA Datatilsynet about a personal data breach where they had published CVs without a legal basis. The DPA had also received 18 complaints from data subjects regarding the incident.
NAV, the controller, has since 2001 had online solutions for making job applicants' CVs available for logged-in employers. In February 2019, they launched a new online tool where job applicants could voluntarily register their CVs. The controller, however, also made these available to employers through a candidate search, by default, including CVs where the data subjects had not given their consent. In addition, the controller had required data subjects to publish their CV to receive certain social services and benefits.
In 2020, a data subject contacted NAV's Data Protection Officer about the processing and, consequently, the controller launched an internal review. They concluded that they lacked a legal basis as per Article 6(1) GDPR for publishing the CVs, as far back as 2001. The controller had assessed legal bases in national laws pertaining to them, but found that these could not be relied upon for this particular situation. The controller now also realised that they did not either have a legal basis for requiring data subjects to publish their CV like this to receive certain social services and benefits.
The CVs contained information about data subjects' name, place of residence, date of birth, telephone number, e-mail address, education, work and other relevant experience, courses, driver's licenses, access to vehicles, various approvals and certifications, language, stated competencies and job wishes. This information is subject to confidentiality as per national regulations applicable to the controller.
The controller informed the DPA that 535,900 CVs was part of the 2019 system and they estimated that the maximum number of affected data subjects was 1,8 million. When the controller realized the breach, they notified the DPA and tried to inform every affected data subject personally by email or letter, as well as via their website.


facts_AZOP (Croatia) - Decision 05-10-2023

The DPA received an anonymous petition stating that EOS Matrix had unauthorized processing of a large number of personal data (of debtors). A USB stick containing 181,641 personal data of natural persons in the structure of first and last name, date of birth and OIB, who had outstanding debts to initial creditors that were purchased by EOS Matrix based on the cession agreement. Likewise, in the petition, it was stated that the database also includes 294 natural persons who were minors at the time.


CARREFOUR BANQUE is a subsidiary owned 40% by BNP PARIBAS SA and 60% by CARREFOUR SA, the parent company of the CARREFOUR group. CARREFOUR BANQUE is a banking company whose main activities are consumer credit, portfolio management, insurance brokerage and investment services.
As part of its activities, the company publishes the website www.carrefour-banque.fr and markets a payment card for customers of the CARREFOUR group, which can be attached to the group's loyalty programme.
Having received several complaints against the CARREFOUR group, the CNIL carried out inspections between May and July 2019 at CARREFOUR FRANCE (retail sector) and CARREFOUR BANQUE (banking sector). On this occasion, the CNIL noted shortcomings in the processing of data on customers and potential users. The President of the CNIL therefore decided to initiate sanction proceedings against these companies.
Following an online inspection carried out by the CNIL on 5 July 2019, the rapporteur noted several breaches of the GDPR and the French Data Protection law (Loi informatique et libertés).

Dispute
In this case, the French data protection authority investigated several issues :
  * Does the transmission of data by CARREFOUR BANQUE to CARREFOUR France when joining the loyalty programme comply with the principle of fair and transparent processing contained in Article 5(1)(a) GDPR?
  * Is the information relating to personal data processing operations easily accessible within the meaning of Articles 12 and 13 GDPR?
  * Is the information provided to data subjects throughout the subscription process in compliance with the provisions of Article 13 GDPR?
  * Does placing 39 cookies on the data subjects' computer before any act of consent or refusal on its part violates the French data protection law, Article 82?


facts_Rb. Rotterdam - 9519423 \ CV EXPL 21-35975

The data subject had a car insurance and suffered an incident. They reported the incident to the insurance company, the controller.
The controller alleged that they provided incorrect information about the collision and considered the report as a fraud. It then registered the data subject in two databases: the CBV of the Dutch Association of Insurers (used by insurers to coordinate investigations and perform analyses) and the external referral register (used by financial institutions when assessing insurance applications and claims).
The data subjects sought to cancel both registrations, but the controller denied to do deregister them, so they filed an action before the Court.
The Court had to determine whether these registrations should be cancelled under the provisions of the GDPR, namely Articles 21(1), 17(1), and Article 6(1) (e) and (f).


facts_Garante per la protezione dei dati personali (Italy) - 9861289

Rovigo Hospital, the data controller, stored the data subject's medical records in another patient's folder and inadvertently disclosed their health data to the latter. Upon becoming aware of this, the data controller asked the third party to return the documents and adopted technical and organisational measures to prevent similar data breaches. The controller notified the DPA and the DPA opened an investigation. There was no dispute as to the facts.


The controller processed personal data without providing an easily accessible privacy policy. Furthermore, the privacy notice did not fully inform the users on their rights under the GDPR.

Dispute
Whether the privacy policy should be easy to find and what level of details it should include with regard to the user's rights.


facts_CNPD (Luxembourg) - Délibération n° 16FR/2022

On 14 February 2019, the Luxembourg DPA decided to open an investigation into the companies of Group A and particularly into Company A, a bank institution (controller). The purpose of this investigation was to verify the compliance with the GDPR of the controller's video surveillance and company's cars geolocation systems.
Surveillance cameras
The investigation showed that surveillance cameras were indeed in place. Cameras’ fields of view included safe rooms, meeting rooms, the reception desk, the cash desk, offices, a computer room and a room where employees take breaks. The head of the investigation considered this to be permanent surveillance of employees at their workplace, which could create psychological pressure. He described the surveillance as “disproportionate to the purpose” and an “excessive intrusion into the employees’ private sphere”. He added that employees had no way of escaping the surveillance.
After receiving the minutes of this visit, the Company wrote a letter in which it explained that distinction should be made between two types of locations filmed, depending on their economic and strategic sensitivity: the counters and the safe room on one hand, and other locations on the other. It also considered that employees were not filmed permanently since they could avoid the cameras' field of vision. The company also argued that the presence of certain cameras was justified in relation to the purpose.
For example, a camera positioned in the safe where one of the employees was stationed and where the company kept precious metals and physical securities. The company stressed that the room is locked for security reasons and that the camera made it possible to see if the employee was "feeling unwell". The company also explained that this is an ad hoc workstation, subject to patrols, which means that the employee working there was not filmed at all times.
Another example was given by the cameras placed upon the counters. The company explained that employees were only filmed from behind and that their hands, faces, private or professional equipment were not targeted. According to the company, the presence of these cameras was therefore necessary and proportionate to the aims pursued.
Finally, with regard to the surveillance of the public highway, the investigation showed, among other things, that buildings not belonging to the company were filmed. The company argued that this was necessary to effectively protect their building. The head of the investigation however considered this surveillance to be disproportionate.
Information on surveillance cameras
The investigation showed that data subjects were informed about the use of surveillance cameras by a pictogram and an old CNPD authorisation sticker at the entrance door and at a passageway closed to the public. According to the head of the investigation, this information was incomplete because it did not provide, among other things, the following elements: the retention period, the purposes of the processing, the right to rectification and erasure. The GDPR intranet section did not contain sufficient information either.
In its letter in response to the minutes of the visit, the company explained that the pictograms were the first step of a various steps information which included the GDPR intranet section and mandatory trainings on data privacy. The company also reported that it had initiated the replacement of the pictograms and would indicate the missing information in the future.
With regard to third parties, the agents noted that a sign was installed containing a camera image and the words "locals under video surveillance".) The company considered that informing third parties was not an absolute obligation under Article 13 (which states that it is not required when communication is impossible or would require disproportionate effort).
Geo-location system on company's cars
The investigation did not demonstrate the existence of such geo-location systems.


facts_Garante per la protezione dei dati personali (Italy) - 9872646

A working video surveillance camera was put up in a shop owned by Stefano Molena (controller). The camera was able to capture footage of the store's clients and employees (data subjects).
On February 2 2022, the Guard of Finance of Seregno (Guardia di Finaza di Seregno) performed an inspection at the controller's shop which resulted in a report that was transmitted to the Italian DPA (Garante).
On May 18 2022, the DPA notified the controller of the initiation of sanctioning proceedings. The controller stated that at the time of the inspection, the camera was not functioning and not connected to the contrtoller's computer system. The controller further stated that the camera was never made operational and had currently been removed.
On February 20 2023, the controller provided evidence that it had removed the camera and its monitor.


The plaintiff, an associate in a limited company, had decided with their co-associate to reduce their company's capital, for which a publication in the Belgian State Journal (Moniteur belge) is an obligation under the Belgian corporate law. The notary mandated by the associates to do the publication in their name not only informed about the reduction of capital but also mistakenly indicated the amount reimbursed to the associates as well as their personal bank account number. The plaintiff asked the notary to proceed to the erasure of these complementary and in their eyes unnecessary information. Following this, the notary requested that the Belgian federal public service (SPF, the defendant), responsible for the journal, erased the plaintiff's data of whom he acted on behalf of. The request was met with a refusal, the SPF mostly arguing that whatever the data published, since they were linked to publication required by the law, they could not be erased. After further exchanges and with the SPF still refusing to erase the concerned data, the plaintiff lodged a complaint with the Belgian DPA, mainly claiming that the SPF had no actual legal basis pursuant to Article 6 GDPR for processing the litigious data.

Dispute
Can a legal obligation under national law justify the processing of data that may be unnecessary for the intended purposes of the processing?


facts_AP (The Netherlands) - z2019-28837

The controller, Ambitious People Group (“APG”) is a recruitment agency. To match jobseekers with a suitable job, the controller asked for the name, address, email address, phone number, date of birth and CV of the jobseeker and stored this in a database. After finding a relevant vacancy, the controller would contact the jobseeker via e-mail. The controller operated under five different labels that each focus on a specific market: LMH, SAM, Four Life Sciences, Ardekay and Five Finance.
On 30 November 2018, the Dutch DPA ("Autoriteit Persoonsgegevens") received a complaint by three data subject against the controller for failing to comply with their requests for erasure. Even after multiple erasure requests, the three data subjects received e-mails from the controller with open vacancies.
Data subject 1 first requested erasure on 15 November 2018 and still received e-mails from the controller's label SAM with vacancies on 28 November 2018. Even after a second erasure request on 28 November 2018, data subject 1 still received an email with vacancies from the controller on 10 January 2019.
Data subject 2 received an email on 26 March 2018 from the controller's label LMH Engineering with a vacancy. Data subject 2 requested erasure on the same day. On 30 November 2018, data subject 2 still received an email from the controller. On the same day, data subject 2 requested erasure again. On 19 February 2019, data subject 2 still received an email with a vacancy from the controller.
Data subject 3 received an email on 17 October from the controller's label Five Finance with a vacancy. Data subject 3 requested erasure on the same day, also for the controller's label LMH Engineering. The controller replied on 19 October 2018 that this was a one-time non-recurring e-mail. Data subject 3 replied on the same day with another erasure request, which was confirmed by the controller on the day itself. However, data subject 3 still received an e-mail with a vacancy on 20 March 2019 and 1 August 2019 from the controller's label LMH Engineering.
The DPA started an investigation to review the possible violation by the controller and thereby send information requests to the controller. The controller confirmed that they erased the personal data of the three data subjects on 11 September 2019, and informed the data subjects the next day about this erasure via e-mail.
Furthermore, the controller explained to the DPA that individuals can request erasure via a designated email address provided in their privacy policy. The requests of the three data subjects were not made to their designated email address, but to the recruiters themselves who send the data subjects emails with vacancies. The controller has since then updated their internal procedure so that erasure requests send to recruiters are also forwarded to the designated email address that handles erasure requests.


Two data subjects held accounts with Caixabank (data controller). Data subject one held two accounts in their own name with their mother being an authorised account holder. Data subject one and two also shared a third account, with no other authorised account holder.
Due to an error in the controller’s systems, data subject one was prohibited from performing any actions on the third account via online banking without the signature of their mother (who was not an authorised account holder in respect of that account). Furthermore, data subject one’s mother was able to see card information relating to the third account.
In January 2021, the data subjects attempts to resolve the issue through the Controller’s customer service department to no avail.
In February 2021, the data subjects file a formal complaint with the controller. The controller’s legal representative offers a settlement of €150 in exchange for the withdrawal of the complaint, which the data subject rejects as the matter remains unsolved.
On 19th October 2023, the data subjects filed a complaint with the AEPD (Spanish DPA).


The appellant has a complicated credit history with the ING bank, which resulted in debts and outstanding payments. At some point her name was added to the Central Credit Information System of the Dutch Credit Registration Office. In 2017 the appellant paid all her debts, but the registration with the Credit Registration Office is to remain for the period of 5 years until 2022. In 2019 the appellant submitted the request for erasure which was rejected by ING. Subsequent Judgement of the Court of First Instance upheld this decision, which is now being contested by the appellant.

Dispute
The appellant requests the Court, among others, to order ING to remove the registration with the Credit Registration Office, limit its duration period or remove the registration temporarily until she gets another loan. The appellant claims that the necessity and proportionality balance assessment done by the Court of First Instance was wrong: for example, she can not get the mortgage she needs to improve her life. Her objection to processing follows from Article 21(1) GDPR. ING argues that Article 21(1) GDPR cannot be relied on in this case because it applies only to personal data processed under legitimate interest or public interest, but not under a legal obligation which is the case here.


A gas distribution company appealed the decision PS/00188/2019 of the Spanish DPA (AEPD) for considering that it was against the constitutional principle of non-retroactivity of the law, enshrined in Article 9(3) of the Spanish Constitution, as the the Spanish DPA fined the controller in accordance with the GDPR, and the alleged infringement had occurred in April 2018, before the GDPR came into effect. Therefore, GDPR should not had applied.


The Brussels South Charleroi Airport (the controller in that case) monitored passengers' temperature via thermal cameras between June and March 2021. All passengers with a temperature over 38°C detected by the camera had their temperature measured again manually by a medical service. Passengers suspected to be infected by COVID-19 were asked to leave the airport and were not allowed to board.
After having been alerted by the press, the Board of Directors asked the inspection service of the Belgian DPA to investigate the matter. The inspection service sent its report with the alleged violations to the litigation chamber.


On 20 December 2018, the data requested access to his personal data from his previous employer, the Minister of Finance. On 5 February 2019, he filed a complaint with the Dutch DPA (Autoriteit Persoonsgegevens) to take enforcement action against the Minister, because the Minister did not timely and fully comply with his access request. At the same time, he filed administrative appeal against the Minister’s failure to make a timely decision, and brought the issue before Court. On 9 April 2019, the Court acknowledged his claim and ordered the Minister to comply with the access request, which the Minister did on 1 May 2019.
On 8 January 2021, the DPA rejected the data subject’s complaint for enforcement against the Minister, for two reasons. First, because the Court had already ruled that the decision had not been made within due time, the DPA would not have to rule anymore whether or not the decision had been made timely. Second, regarding the question whether or not the request had been fully complied with, the DPA considered that this would require further investigation. However, the alleged infringement was not considered to be harmful enough, according to the DPA’s own "Policy Rules on Prioritising AP Complaints Investigation", and therefore did not handle the complaint.
According to the data subject, the Court’s judgement proves that the Minister violated the GDPR and the DPA therefore had to take enforcement action. Hence, he appealed to the DPA’s rejection of his complaint, before Court and claimed that the DPA should issue a fine against the Minister. Moreover, he requested to be compensated for immaterial damages.


Seventeen individuals submitted complaints before the Hellenic DPA (HDPA) against gas supplier company ZENITH (controller) for unlawful processing of personal data for purely marketing purposes. Zenith signed a contract with One Way Private Company (processor) which undertook the processing of the controller's customers' personal data for marketing purposes. The processor used an automated mechanism randomly selecting telephone numbers from a list of customer contact details in order to contact individuals for marketing purposes. Some customers had previously clearly waived their consent for the controller to have their contact details. The telephone numbers of these individuals were supposed to be precluded from this list. However, due to a mistake by one of the processor's employees, many of these customers were not excluded from the list and consequently received calls from the processor for marketing purposes.


The Norwegian DPA (Datatilsynet) investigated a complaint from a data subject who had been credit rated by a company they had no relationship with. The company admitted they had no cooperation, customer relationship or any form of connection with the data subject, but argued that the credit rating was a mistake. A project manager at the company had used Google to find the invoicing address to a new customer and then mixed up this person with the data subject when conducting the actual credit rating.
The company claimed that the DPA should not impose a fine, because they had not been registered with any prior violations.


Google LLC is a subsidiary owned wholly by Alphabet Inc. Google Ireland Limited ('GIL') "presents itself" as the headquarters for the Google group's operations in the EEA and Switzerland.
In March 2020 the French DPA (CNIL) carried out an online inspection of the website "google.fr" in the context of a previous procedure against Google LLC and GIL. The purpose of this inspection was to verify their compliance with the Loi 'Informatique et Libertés', and in particular with Article 82 thereof. This resulted in this decision, that Google appealed.
Following this decision, the CNIL received more complaints about the methods of refusing cookies from the website "google.fr". It therefore reopened the case and launched a new investigation.


The AEPD examined a complaint submitted against the political party VOX. The data controller had sent an email without blind copying, to the affiliates of the said political party. Following the filing of the complaint, the data controller acknowledged the facts and implemented the necessary security measures.

Dispute
Is the unintentionality and the adoption of measures to remedy the infringing conduct relevant for the fine reduction?