Klarna Bank AB is a company which provides both credit and non-credit payment solutions to approximately 90 million consumers and more than 200,000 merchants in 17 countries through a variety of financial services, such as direct payment, various forms of "try first and pay later" services and payment through installments, as well as account information services. In order to provide these services, Klarna needs to process large amounts of personal data. The Swedish DPA (IMY) initially examined Klarna's privacy policy, and noted that there was a lack of clarity regarding many aspects, and therefore decided to launch an ex officio investigation to determine Klarna's compliance with the provisions on clear information and communication to data subjects. During the investigation, Klarna continuously changed the information provided on how the company handled personal data. IMY's decision concerns the information as it stood from 17 March to 26 June 2020.


During the inspection procedure, the IP established that the controller was carrying out video surveillance at a bar. An outdoor camera recorded the entrance and the outdoor terrace. The first indoor camera captured the server rooms and the bar counter and the right side of the building. The second indoor camera captured the server rooms and the left side of the facility.


facts_Garante per la protezione dei dati personali (Italy) - 9677521

The dentist, Dr. Marini, required that patients fill out a medical history questionnaire before receiving dental services at his office. The questionnaire asked about previous, existing or suspected infectious diseases (e.g. tuberculosis, hepatitis, HIV). The complainant, a prospective patient, indicated that he was positive for an HIV infection. The dentist subsequently refused to give him dental treatment, claiming that the complainant’s HIV infection would prevent him from “averting a possible contagion of staff and other patients.”
Italian national law (Law of June 5 1990, n. 135) holds that specific precautions to prevent contagion should be taken for each individual patient, such that patients with HIV infections can access dental services. Meanwhile, Article 5 GDPR provides that personal data must be processed in a lawful and transparent manner, relevant and limited to what is necessary with respect to the purposes for which they are processed (the principles of "lawfulness, fairness, transparency" and “data minimization”). In combination, this means that patient history on infectious diseases can only be used to provide a better plan of medical treatment.


The controller was a press organisation/public service broadcaster. The data subject filed a complaint with the Belgian DPA on 18 June 2018 because the controller’s live service for web streaming was only accessible on Belgian territory, and only for data subjects who would provide their personal data (such as email address, Facebook - or Google accounts). The data subject also complained that it was not possible to connect to the live service if he disabled cookies and trackers of third-party companies on the controller’s website.
The investigation service of the DPA (the investigation service) started an investigation into the controller. In its report, the investigation service reported the following findings:
Finding 1: The investigation service determined that the processing of registration data was based on legitimate interest, while the processing of data related to personalisation (profiling) was based on legitimate interest and/or consent. However, the investigation service considered that because the controller was likely an ‘autonomous public undertaking’ (Article 5 LTD (Data protection act)), legitimate interest could not be used as a legal basis. According to the investigation service, legitimate interest of the controller could not be used for processing carried out by public authorities in the performance of their tasks (Article 6(1) GDPR). Moreover, legitimate interest as a legal basis requires a balancing of the interests involved and the controller did not prove that such a balancing exercise was conducted. Finally, the DPA held that the controller could not switch from consent to legitimate interest as a legal basis for the processing of data for personalisation purposes.
Finding 2, 3 and 4: Regarding the processing for advertising profiling and the possibility of objecting, the controller's management contract allowed the controller to use 'content recommendation algorithms. However, the definition of ‘content recommendation algorithms' did not include advertising, according to the investigation service. Because of this lacking definition, the investigation service questioned compliance with Article 5(1)(b) GDPR). Additionally, the provisions of Articles 12(2), 21 and 25 GDPR did not appear to be satisfied because the data subject could not refuse advertising profiling at the time of registration. The controller also did not appear to allow easy opposition to this profiling after registration. Finally, the controller was supposed to update the purposes on the registration form to add the purpose of advertising profiling. However, the controller did not modify the registration form as of 9 January 2020, which resulted in a breach of Articles 12(1), 13 and 14 GDPR).
Finding 5 and 6: The investigation service also held that there was a difference between the mechanism of connection to the live service and registration to the platform of the controller using social networks (Facebook and Google). This difference lacked clarity and explanation, which was incompatible with Articles 12(1), 13 and 14 GDPR, according to the investigation service. Moreover, the mechanism used (under the guise of logging in using a Facebook account) was in fact the creation of a user account at the controller, using the data subject’s Facebook data. The data subject was not informed about the workings of this mechanism, which breached articles 5(1)(a), 5(1)(b) and 5(1)(c) GDPR as well as Articles 12(1), 13 and 14 GDPR.
However, in decision 168/2022, the Belgian DPA had agreed to a settlement with the same controller, regarding the use of cookies on it’s website, pursuant of Article 100(1)(4) WOG (Law establishing the DPA). This settlement extended to potential infringements of the law of 13 June 2005 (WEC – Wet Elektronische Communicatie) as well as potential infringements of the GDPR with regards to cookies, in the period from 25 May 2018 to 11 November 2020.


facts_Datatilsynet (Denmark) - 2018-7320-0166

Citizen submitted a request for erasure of his personal data to the jewellery company Pandora SA according to Article 17 GDPR. The company asked him to submit his passport or driving license before considering examining his request.

Dispute
On which condition can the controller ask for an ID proof in order to respond to a deletion request?


The DPA had previously issued a press release that touched upon the topic of introducing systems for measuring the temperature of workers or visitors. In the press release, the DPA concluded that companies and institutions are generally not entitled to measure the temperatures of employees or visitors and thus process their health personal data. This type of health data, the DPA held, belongs to Article 9 of the GDPR and cannot be processed without specific authorization.
The DPA then went on to also discuss the viability of using video cameras to record the working hours of employees.

Dispute
What temperature-check measures companies could introduce on a wide-scale basis. Whether video cameras can be used to record the working hours of employees.


facts_EWCA - Dawson-Damer v Taylor Wessing LLP

This case concerns a data subject access request (SAR) under the Data Protection Act (DPA) 1998. The data subjects were beneficiaries under a trust. The data controller was a firm of solicitors, holding trust money as trustees. Following the appointment of further trustees and transfer of trust money into a new trust for other discretionary beneficiaries, the data subjects challenged the validity of these appointments and served the data controller with a SAR under section 7(2) DPA 1998.
The data controller refused to make the disclosure, stating that the personal data was covered by Legal Professional Privilege (LPP), and therefore exempted from disclosure under Schedule 7 para. 10 DPA 1998. Furthermore, the data controller asserted that the supply of information required a disproportionate effort. The data subjects contended that many categories of personal data held by the data controller were not privileged and that, if any, the only privilege on which the data controller could rely was litigation privilege. The data subjects applied to the court for a declaration under section 7(9) DPA 1998 that the data controller had not complied with the request and to oblige the data controller to comply with the SAR. At trial, the court agreed with the data controller and refused to make such an order.
The appellate court had to determine:
 1. whether, taking a narrow view, the LLP exception is limited to documents subject only to legal professional privilege under English law;
 2. whether, if the narrow view is correct, any further search would involve "disproportionate effort" for the purposes of section 8(2) DPA 1998 so that the data controller is excused from doing so;
 3. whether the exercise of the court’s discretion under section 7(9) DPA 1998 can be refused because the data subject's real motive was to use the information in legal proceedings against the data controller.


facts_ANSPDCP (Romania) - Materiale Constructii Online SRL

A data subject filed a complained with the Romain DPA, because Materiale Constructii Online SRL (the controller) did not comply with his request to delete his account from the website www.depozit-online.ro.


facts_AZOP (Croatia) - Decision 04-05-2023

In December 2022, Croatian DPA received an anonymous complaint in which it was stated that a debt collection agency processed a large number of personal data of natural persons (debtors) without authorization. They also received a USB stick containing a database with personal data of debtors - first and last name, date of birth and personal identification number for a total of 77,317 natural persons who had outstanding debts to credit institutions, and which were purchased by the debt collection agency.
Following this complaint, the DPA launched an investigation and supervisory procedure.


facts_Datatilsynet (Denmark) - Gyldendal A/S

During an inspection visit to Gyldendal A/S (controller), the Danish DPA found that information about approximately 685,000 unsubscribed members of Gyldendal's book clubs was kept for longer than needed. The controller stored data in a so-called "passive database" and had no procedures or guidelines for deleting it. Some of this information was kept for longer than ten years.


In a domestic violence and child abuse case, the Minister for Legal Protection granted the father’s request to obtain a copy of the correspondence between the mother and the Council for the Protection of Childhood. Since there were several data subjects, the Minister asked the mother, in accordance with Article 4 GDPR, whether she objected to the inspection and surrender of the data and weighed up the interests involved. The mother objected, but the Minister for Legal Protection decided however that the father had the right to inspect or obtain a copy of the files, as the information contained in the files were already largely known to the father.
The District Court of The Hague dismissed the mother’s appeal against that decision, considering that the father, having authority over the children, was entitled under Article 15(1) GDPR to inspect the files. In the opinion of the Court, it did not appear that the provision of the documents to the father would adversely affect the rights and freedoms of the mother.

Dispute


The Swedish DPA assessed five complaints from data subjects who had requested removal of search results in accordance with Article 17(1) and 21 GDPR. All five requests had been denied on the ground that the contents of the web pages in question were inaccessible to Google due to paywalls, and that Google was therefore unable to assess whether the contents were no longer relevant or inaccurate.
After the complaints were filed, Google acted on the requests. Nevertheless, the Swedish DPA assessed Google's explanation for refusing the requests in the first place.


The controller is the website owner of EDICIONES CATÓLICOS Y VIDA PÚBLICA, S.L.U.
On 3 September, 2024, a data subject filed a complaint against the controller. According to the complaint, the controller used non-technical[1] and unnecessary cookies without the user's prior consent.
The controller argued that the website's cookie policy was in accordance with the current regulations. Furthermore, the controller claimed that consent could be managed and revoked through their website; for the technical cookies no consent was required.
The DPA started an investigation on 8 January 2025 and found that cookies were installed regardless of whether the user interacted with the website. Furthermore, cookies remained installed after users revoked or rejected all prior consent.


The Romanian Ombudsman forwarded to the Romanian DPA, several notifications. These notifications were mentioning that Salvati Romania Union Party (in Romanian: Partidul Salvati Romania - USR), the controller, published on its website personal data belonging to several data subjects. These data included the data subjects' degrees of disability.
Following such, the Romanian DPA started an investigation. It revealed that the data controller operator collected the personal data i.e. name, surname, personal numerical code (a unique 13 digits number assigned to Romanians and Romanian residents), address, identity card number, medical certificate number, degree of disability, from official documents of authorities and public institutions and later published them on the party's website, as part of a project.


The controller, Clearview Inc., provides facial recognition services. Among others, it offers a service called “Clearview for law-enforcement and public defenders”. This service allows governments and investigative authorities to search “by image” in a database of over 30 billion pictures. In this way, the user of the service can upload a picture of a data subject and find out which other photos of the database show the same data subject.
The controller had created the database by scraping images uploaded on the Internet, including the ones on social media platform. The controller did not set any limitations in terms of geographical location or nationality, so also personal data concerning EU/EEA data subjects (including Dutch ones).
Some data subjects noted that their picture was present in this database and, therefore, filed a complaint with the DPA. In addition, the DPA decided to open an ex officio investigation on this matter.


The controller operates a doctor search and evaluation platform. The data subject is a doctor for skin and venous diseases.
In December 2019, the data subject used the reporting function of the platform to request the deletion of a user's review pursuant to Article 17(1) GDPR. The controller did not remove the disputed review from the platform, but instead published the controller's request for deletion on the platform, arguing that there is a legitimate interest for the publication of this information under Article 6(1)(f) GDPR. The data subject objected to the publication and lodged a complaint with the Austrian Data Protection Authority (DSB).
The Austrian Data Protection Authority (DSB) disagreed with the controller's view. It stated that, generally, such evaluation platforms and the associated processing of personal data are covered by the right to freedom of expression in accordance with Article 10 ECHR and Article 11 CFR. It further reasoned that, usually, the added social value created by the evaluation platform or the interests of the broader public outweigh the interests of the data subject, so that the publication of comments by users of this platform can in principle be based on Article 6(1)(f) GDPR. The DSB, however, concluded that, since the data subject used the report function and not the comment function of the page, the use of the data was intended exclusively for the purpose of reporting and, therefore, the data subject did not reasonably have to expect the publication of the data. Consequently, the DSB found that the legitimate interests of the controller or the platform users (i.e. the patients) did not outweigh the legitimate interests of the controller and, therefore, the controller violated the data subject's right to deletion.
The controller appealed this decision.


facts_Rb. Midden-Nederland - C/16/530061 / KG ZA 21-617

The controller is Ziggo bv. The data subjects are customers of Ziggo.
Ziggo is the largest internet service provider in the Netherlands. Stichting BREIN is dedicated to claims against copyright infringements on behalf of its members. BREIN states that more than 200 e-books are made available to the public through an 'open directory' with an IP-address made available by Ziggo. BREIN demands Ziggo to send a warning to the user to which the IP-address belongs for said copyright infringement. Ziggo refuses to send such a message. Alternatively, BREIN wants Ziggo to provide NAW-data (name, address and residence) of the user of the IP-address. This will enable BREIN to send the letter independently. BREIN also demands all of the above for every customer of Ziggo that infringes on the copyright of its members through an open directory in the future.
BREIN states that the copyright infringement in question is established. In addition, BREIN states that Ziggo does not need a permit from the Dutch DPA nor a DPIA for these actions. Ziggo disputes these notions.


facts_Garante per la protezione dei dati personali (Italy) - 9815931

The Royal Palace Hotel is owned by Luxury Flats s.r.l. (the controller). An employee (the data subject) from the Royal Palace Hotel in Rome filed a complaint against the controller for the use of a biometric device aimed at recording the employees’ attendance at work. This tool had the ability to register the start and end of the employees’ workday by scanning their fingerprints.
Following the complaint, the DPA opened an investigation into the case. On 10 August 2020, the DPA gave the controller the opportunity to provide feedback, followed by two other inquiries on 5 January 2020 and 29 April 2021. The controller did not respond to any of them. Therefore, the DPA delegated the case to the Special Unit for the Protection of Privacy and Technological Fraud of the Italian finance police to acquire the requested information and to notify the controller of the initiation of sanctioning proceedings pursuant to Article 166(5) of the Personal Data Protection Code (Codice in materia di protezione dei dati personali).
During the visit from the Special Unit, the controller declared that it "did not understand the meaning of the DPA's emails regarding the investigation" and "was not aware that it had to respond to these inquiries." The controller stated that the device had not been used since January or February 2020 since it did not work properly. It could not recall where the device was, nor could it provide documentation on the model of the device.


The controller is Michael Page International, a company based in the United Kingdom, and the parent company of the PageGroup business group. It is an employment agency and operates under various brands, including “Michael Page”. It has subsidiaries in many European countries, with the Dutch subsidiary being the Michael Page entity International - Nederland B.V. The data subject, who is a Dutch citizen that had created an account and had uploaded her CV on the web portal of the controller, submitted an access request on 28 September 2018. The controller, however, requested the data subject's ID to verify the identity of the data subject. Since the data subject found this request to be excessive, she lodged a complaint with the Dutch DPA (AP).
After the AP contacted the Dutch subsidiary, the subsidiary explained that, although the corporate group's headquarters are located in the United Kingdom, the legal department (compliance team, responsible for managing access requests exercised by data subjects) is located in Barcelona, Spain. Hence, according to the Spanish DPA (AEPD), this establishment is the main establishment by the definition of Article 4(16) GDPR, and therefore declared its competency to act as the lead supervisory authority under Article 56(1) GDPR.
The AEPD then investigated the controller's procedure of dealing with access requests and concluded that these procedures complied with the GDPR. Hence, the DPA considered that there were no indications of infringement and that no further action was necessary. After sharing this draft decision with the other interested DPA's (see more info in comment), the Portuguese DPA (CNPD) and The Berlin DPA (BInBDI) opposed this conclusion after reviewing the contents of the Draft Resolution as interested authorities. They considered that there were multiple violations (Articles 12, 5(1)(c), 25, and 32 GDPR) because, in order to make access to data subjects' personal data feasible, additional information should only be requested in case of doubts about the identity of the interested party.
The AEPD then reconsidered their initial decision.


In September and October 2018, four articles were published in the print edition of the newspaper "24h", owned by Breikot Management Ltd., (the controller). In these articles, the names and photographs of five persons, and a reference to the conviction of one of them were published. A complaint was made to the DPA by the persons concerned on 17 October 2018.
Following the complaint, the DPA issued an initial decision, in which it found violations of Articles 5(1)(c) and 6 GDPR and Article 29(1) of Law 125(I)/2018.
Concerning the violation of Article 29(1) of Law 125(I)/2018, the DPA took into account the public interest and the principle of data minimisation, and found that for the purposes of public interest the mentioning of the names of the complainants and the conviction of one of them outweighed the interests, fundamental rights and freedoms of the complainants. The publication was excessive in relation to the purpose pursued, in violation of Article 29(1) of Law 125(I)/2018. Article 85 GDPR mandates member states to legislate for the reconciliation of data protection and journalistic freedom. Law 125(I)/2018 does this through Article 29(1), which provides that:
"29(1) The processing of personal data or special categories of personal data or personal data relating to criminal convictions and offenses, which is carried out for journalistic or academic purposes or for purposes of artistic or literary expression, is permitted, provided that those purposes are proportionate to the aim pursued and respect the essence of the rights as set out in the Charter of Fundamental Rights of the European Union and in the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), which was ratified by the ratifying law on the European Convention for the Protection of Fundamental Rights and in Part II of the Constitution."
Moreover, the Cypriot DPA found that the publication of the photographs of three (3) of the five (5) complainants in three (3) of the four (4) publications exceeded the principle of data minimisation in violation of Article 5(1)(c) GDPR, and the controller had no legal basis for the processing as required by Article 6 GDPR.
As a result of the violations, The DPA imposed a fine of €3,000 on the controller. This decision was appealed by the controller before the Administrative Court on 24 January 2019. The Administrative Court upheld the DPA's Decision in regard to the infringements found, but annulled the administrative fine imposed. The Administrative Court requested that the DPA review the amount of the fine.


The case is part of a broader dispute between a company and some of its employees. During a meeting between the managers of the company and the employees, one of the employees (the controller) recorded the ongoing conversation, without the managers being aware of this.
Some years later, another employee used this recording during a labour trial as evidence.
Therefore, the managers (the data subjects in this case) filed a complaint with the Italian DPA (Garante per la protezione dei dati personali).
The DPA rejected this complaint, arguing that the processing at hand had the only purpose of proving the employee's statements during the trial.
The data subjects appealed the DPA's decision before the Court of Venice (Tribunale di Venezia). Contrary to the DPA, the court upheld the data subjects' claims, ruling that the processing was unlawful and fining the controller €5,000. The court gave the following reasons:
 1. when the recording was made, there was no defence needs but only some "organisational problems" in the company;
 2. the trial in which the recording was used took place years later;
 3. the household exemption provided for by Article 2(2)(c) GDPR does not apply.
The controller appealed this decision before the Italian Supreme Court (Corte di cassazione).


facts_AZOP (Croatia) - Decision 04-07-2022

The tenants (the controller) of a residential building in Zagreb installed surveillance cameras that captured the co-owned space as well as the public surface. A data subject complained about this fact to the Croatian DPA which in turn started an investigation and asked the controller for submissions. The controller argued that the CCTV system had been bought online, installed and maintained by the controller. The owner also added that only two persons had access to the cameras and no video recording or storage had ever taken place. During the investigation, the DPA determined that the cameras indeed partially monitored the public space of the city of Zagreb.


The bank – the controller- notified its client that his account had been closed. The bank did not provide any reasons for the termination of the contract. The client –the data subject- asked for clarification and submitted a subject access request to the controller. The controller provided only for a “limited extract of personal data in English”. The representative of the data subject considered that the controller failed to comply with its obligations under GDPR and submitted a complaint before the DPA. The data subject’s representative claimed that the controller did not provide for an exhaustive copy of their personal data. The controller claimed that it should not be subject to the obligations set out in Articles 15 and 17 to 21 GDPR due to domestic legal obligations. Indeed, it claimed it would be contrary to the Money Laundering and Terrorist Financial Prevention Act to disclose complaint’s personal data to their representative.

Dispute
Is the access right exercised before credit institutions limited by the Money Laundering and Terrorist Financial Prevention Act?


On an unspecified date, a logistics firm (controller) notified the Romanian DPA of two data breaches in line with Article 33 GDPR. Following the notifications, the DPA launched an investigation which concluded that the security breaches were caused by the theft of a bookshelf containing the files of 12 employees. The theft allowed unauthorised third parties access the personal data contained therein. The breach occurred on 3 June 2021 and included data concerning contact information, academic and professional training, employment details, information on tax deductions and dependents, and employees' health status. The DPA concluded the investigation in December 2022.


facts_Persónuvernd (Island) - Case no. 2021101963

The data subject is an individual whose personal data was shared through a news article. As the news article was findable by a search query through Google's search engine, Google LLC being the controller, the data subject requested the controller to remove the search result from its database pursuant the data subject's right to be forgotten (Article 17 GDPR). Google denied the request, justifying it by the fact that the news article concerns the data subject's employment in a public setting, which is relevant for the public interest.
Following Google's response, the data subject submitted a complaint to the Icelandic DPA.


On the 11th of October 2024, an individual found a box in a bin outside of the playing field of Club Rapido de Bouzas (the controller) on a public road. The box contained hundreds of documents detailing the ID numbers, names and surnames, addresses and photographs of their players (who were minors). In total, 1,444 cards identifying data subjects by name and photograph were found in the box.
The club had a “cleaning day” and claimed that this box was disposed of in the field in error.
The individual (a father of one of the players) reported the matter to the police, and subsequently filed a complaint with the AEPD (Spanish DPA).
On December 19th 2024, the DPA initiated their investigation.


facts_Garante per la protezione dei dati personali (Italy) - 9524194

A 10 year old person taking part in the “blackout challenge” died.
The “blackout challenge” is an internet phenomenon in which participants film themselves in an autoerotic asphyxiation. This practice is one of the most dangerous and extreme practices of BDSM. Becuase of the carotid sinus reflex, cardiac arrest can occur in certain cases.

Dispute
Are the age verification measures used by TikTok sufficient?


facts_Garante per la protezione dei dati personali (Italy) - 10095836

The data subject, a patient, filed a complaint against her plastic surgeon, the controller. The controller published, without authorisation, photographs depicting her during an aesthetic surgery on Instagram. The images showed her recognizable face before (wearing a surgical cap) and after the procedure, with controller's logo displayed on his personal page.
The data subject stated that she had not given any consent for the sharing of the photographs, which had been taken for internal use only. Informed by a friend about the publication, she took legal action to request the removal of the images and compensation for damages.
In the context of this separate civil procedure, the controller explained that he requested the removal of all patient images from his social media profiles years earlier. He further clarified that the issue arose because the patient had signed consent forms with another colleague at the clinic, without specific authorization for the publication of the images.
Although he did not admit any wrongdoing, the doctor resolved the separate legal through a settlement agreement, providing financial compensation.


On 13 February 2023, the DPA imposed a fine of € 200,000 EUR to Ida Tallina Central Hospital (‘controller’) for the unlawful disclosure of health data within the meaning of Article 9(1) GDPR. A member of the management board threw them into an open bin outside of the hospital and open to public access. With this conduct, the controller violated the requirements of Article 32(1)(b) GDPR to ensure the confidentiality of the services processing personal data. Pursuant to Article 62 PDPA, the controller committed a misdemeanour. The decision of the DPA was appealed by the controller.
On 31 August 2023, the Harju County Court (‘first instance court’) annulled the decision of the DPA and ruled that the controller could not be punished for committing a misdemeanour because of the principle of derivative liability applied. According to this principle:
1) a legal person, such as a hospital, can only be liable for an offence if the conduct of its body, member, manager, or competent representative met all the elements of a tort or delict, and
2) if the act was committed in the interests of the legal person.
In this case, the violation was attributed to a member of the management board, but the misconduct did not meet all the legal elements of the offense to be done in the interest of the hospital. Since this was not the case, the hospital could not be held liable for the alleged infringement.
On 21 December 2023, an appeal against the decision of the first instance court was filed by an out of court proceeding by the data subject which sought the annulment of the above decision.
The controller argued in the appeal proceeding that the misdemeanour proceedings should be terminated as the offence is time-barred according to 29(1)(5) Code of Misdemeanour Procedure (‘VTMS’).


PLATAFORMA CABANILLAS SA (a logistics company, the controller) requested documentation from a data subject before a job interview in July 2023. This included the data subject’s criminal record, civil status and number of children. The data subject presented a complaint to the DPA the same month.
The controller argued that requesting these documents at that stage of the selection process was carried out in the interest of the data subject. The goal was to verify if the candidate met the legal requirements of the job position, and avoid situations in which a candidate progressed to a later stage to find out that they did not meet the necessary legal requirements. Furthermore, requiring this information was not discriminatory, as the controller is under legal obligation to verify the possible criminal records a person may have for a minimum of five years.
In June 2024, the controller changed its candidate selection process, requesting the documentation on criminal records and civil status once the contract was signed. In the case of having a criminal record, the controller implemented a separate process of verifying if the candidate was suitable for specific security related job positions.


The controller (defendant) is the biggest logistics and postal service provider in Austria. Its main business activities include the transport of letters, advertising mail, print media, and parcels. Furthermore, the defendant also conducts business as an address publisher under § 151 Austrian Trade Regulation Act (Gewerbeordnung 1994 - GewO) and sells personal data for third-party marketing purposes.
On 14.01.2019 the data subject (claimant) sent an access request under Article 15 GDPR to the controller on which the controller replied to on 14.02.2019. Besides data such as name and phone number the controller stated to process certain "marketing classifications" under § 151(6) GewO. These "marketing classifications" are calculated based on a a variety of socio-demographic circumstances (e.g. age, place of residence, level of education) and express a statistic probability of the data subject belonging to a certain demographic group (e.g. "do-it-yourselfer", "night owl", "person with affinity for investments").
The data subject was not content with the controller's reply and filed a lawsuit for the provision of access under Article 15 and erasure under Article 17 GDPR in connection with Article 21 GDPR. Furthermore, the data subject requested a declaratory judgment that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR in the case of further access requests by the data subject.
The first instance court (Regional Court Wels - LG Wels) rejected the lawsuit, holding that the controller had already fulfilled the data subject's requests. Following an appeal by the data subject, the second instance court (Higher Regional Court Linz - OLG Linz) partially overturned this decision and held that the data subject had indeed a legal interest in the claimed declaratory judgment. Consequently, it held that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR in the case of further access requests by the data subject

Dispute
In the course of the procedures before the LG Wels, the OLG Linz and the Austrian Supreme Court (Oberster Gerichtshof - OGH), several legal questions arose:
  * Can a data subject file a lawsuit under Article 79 GDPR in cases of an alleged violation of Article 15 GDPR or can such violation only be subject to a complaint before a DPA under Article 77 GDPR?
  * Do "marketing classifications" under § 151(6) GewO qualify as personal data under Article 4(1) GDPR although they only express a statistic probability?
  * Does the data subject have a legal interest - as required under § 228 Austrian Civil Procedure Code (Zivilprozessordnung - ZPO) - in a declaratory judgment that the controller is under the legal obligation to provide access under Article 15 GDPR in the case of further access requests by the data subject?


facts_Garante per la protezione dei dati personali (Italy) - 9780409

Several data subjects randomly searched for their names on the Google Search engine and found out their contact details and names on the website www.inelenco.com. They never knew about the existence of their data on the website and never gave any consent for their publication.
Thus, the Italian DPA received many requests, reports and complaints relating to the unauthorized publication of personal data on this website. Moreover, the data subjects tried several times and for several months to request the erasure of their data without any success. Additionally, it contained incorrect data relating to one of the data subjects concerned. Finally, there was no information on the website that enabled the identification of the controller or its owner.
Firstly, the DPA conducted a preliminary investigation through the hosting provider – to find out who the controller and owner were – which reported that the service was in use by Mr. Fabio Giovanni Petta who was the sole proprietor and data controller of the website. Secondly, on 14 May 2020, the DPA asked the controller to provide clarifications to which the controller replied with a laconic answer, on 26 May 2020, by merely stating that there was a “delete data” link on each page from which one could access a form to be used to enter the number to be deleted, obtaining automatic removal within 72 hours. The controller requested to receive copies of the applications received to verify the date and IP address of the (alleged) registrations.
On 1 September 2020, the DPA forwarded by email, copies of six instances requesting appropriate feedback within 20 days of receipt to the controller. The controller did not respond. On 2 April 2021, the DPA initiated the proceedings for the adoption of corrective measures and sanctions due to the presence of various profiles of unlawfulness found in the processing. The controller did not respond either. Therefore, the DPA had to request the Special Privacy Unit of the Italian Finance Police to provide for the notification of the outstanding acts which was served on 20 December 2021.
On 12 January 2022, the controller gave some information about the functioning of his website. Moreover, he stated that all data was automatically deleted from the system after the data subjects had requested it, but the controller did not provide any documents proving this statement.
After the objection and even after the company's defensive observations, complaints continued to reach the DPA complaining about the presence of personal data on the www.inelenco.com website without the knowledge of the persons concerned. Moreover, despite repeated requests for deletion made through the link on the website, the data continued to be published. Finally, on 4 May 2022, the website still did not contain any information about the data controller and how to exercise rights.


SEUR was charged with picking up an Amazon return package from the data subject on 29 August 2022. The data subject requested pickup at its address, but Amazon erroneously indicated an incorrect address. On the same day, the data subject requested that Amazon modify the address. However, on 6 September 2022, the data subject learned that an mailperson from SEUR had left a note on a mailbox at a different address than the one requested, within view of any neighbor or visitor, stating their personal data including their name, address and phone number.
On 12 September 2022, the data subject filed a complaint with the Spanish DPA (AEPD). It filed a complaint against SEUR, but by then, SEUR had been absorbed by GEOPOST ESPAÑA, S.L. (the controller) in a merger; thus, the AEPD considered GEOPOST the controller and applied the proceedings to it. The controller stated that the incident had occurred as a result of human error: a mailperson had gone to what they believed to be the data subject's home to pick up the package, but that the data subject was not there, so the mailperson left a note taped to their mailbox. The controller stated that it has data protection materials for its employees and noted that the controller's delivery manual instructs that deliveries and pickups be made to the consignee and, in the even of their absence, a notice of absence should be left under the door, in the door wedge or in the mailbox. It also stated that it makes over 50 million deliveries a year, and that human error is not habitual but is inevitably impossible to completely avoid.


In September 2021, the Hungarian DPA initiated an ex officio investigation against Budapest Bank Zrt. (hereinafter the Bank) related to the use of Artificial Intelligence (AI) software applied to the audio recordings of customer service telephone conversations between May 2018 and the start of the investigation.
According to the Bank, the software used speech signal processing based on AI to identify periods of silence, different voices talking at the same time, key words, and emotional elements (such as voice speed, volume and pitch) within the recorded sound files in order to identify customer dissatisfaction. Once the software had made an automated decision to identify calls according to these criteria, a Bank employee then listened to the recordings, and made call-backs to customers in order to handle and attempt to resolve any customer dissatisfaction issues.
The Bank stated that its legal basis for this processing was based on legitimate interest, and its purpose was to conduct call quality control, to prevent complaints and customer churn, as well as to increase efficiency.
The Bank stated that customers were informed at the beginning of the calls that they were being recorded, but admitted that they did not inform them that the AI software would be used to analyse the calls, since detailed information in this regard would make the introduction to the calls too long, outlasting many of the simple queries made by customers when calling the Bank. The Bank also claimed that the system did not store any identifiable personal data, or perform automated decision-making in order to create personal profiles.
Additionally, in a Data Protection Impact Assessment carried out by the Bank, the Data Protection Officer stated that: “The purpose of the processing is lawful on the basis of the rights of the data subjects and the business interests of the Bank, there is no direct or indirect legal prohibition. The processing is high-risk for several reasons, in particular the novelty of the technology used, as the audio recordings are analysed and findings are made automatically by artificial intelligence. The aggregate data is suitable for profiling or scoring for both sets of data subjects [customers and employees], and although no automated decision making is involved, the data processing may have legal effects on the data subjects. The high risk is mitigated by the controller through measures identified in the impact assessment, such as human decision-making at the end of automated processing. The exercise of data subjects' rights is ensured in accordance with standard practice.”


facts_Garante per la protezione dei dati personali (Italy) - 9556625

Following some reports, the Italian DPA ascertained that the MISE uploaded on its website a list of more than 5,000 managers containing their personal data, including name, tax code, e-mail address, CV, mobile phone and, in some cases, ID and health card. All this data was freely visible and downloadable. The MISE published that list to help SMEs in booking advice from experienced business professionals on the technological and digital processes to manage vouchers provided in compliance with the 2019 Budget Law.
The DPA has also found that the MISE did not appoint a DPO by May 25, 2018, as required for all public bodies according to art. 37 GDPR.


The claimant's personal data was written on a notification document posted on a public notice board. The notification document was posted by the defendant (the neighbourhood community) as a call for the claimant to attend a General Assembly meeting. The notification document included the claimant's name and an outstanding debt of €286,81 in his name.
The defendant claimed that notifying via the public notice board was standard practice since 2014 as well as notifying through a more direct means of communication (such as ordinary mail or 'burofax'). The defendant claimed that it had not notified the defendant via a more direct means of communication as this notification would not have arrived on time.

Dispute
Is posting a data subject's name and outstanding debt on a public notice board in breach of Article 5(1)(f) GDPR?


facts_CNPD (Luxembourg) - Délibération n° 3018

Rocketreach sells access to personal data on EU data subjects, allegedly without any legal basis.

Dispute
1. Deleting the data subject's information when all he solely asked for was access.
2. Did not answer requests to enquire about the Legal basis of processing.
3. Has not selected an EU Representative
4. Mass Processing of European Data Subjects


On 1 April 2020, the media reported an alleged personal data breach suffered by C-PLANET, wherein a database containing the personal data of Maltese voters had been exposed.
The media reported that the political opinions of 335,000 voters has been exposed.
The Maltese DPA (IDPC) opened an ex officio investigation, and noyb filed a complaint on behalf of several Maltese citizens on 12 November 2020.


A data subject filed an access request with a transport company regarding the results of a selection process for a job. The data subject did not agree with the outcome of the process and wanted to access the videos of one of the driving tests.
Since the controller did not answer, the data subject filed a complaint with the Spanish DPA (AEPD). Towards the DPA, the controller claimed that they would not give away videos since the cameras were set to only recorded the outside of the vehicles, thereby recording third persons such as passengers.
The data subject compared the case to the access to written answers of an exam already decided by previous judgements. Therefore an access to the driving test videos may have the same result, especially since it would be possible to blur or pixel images of third parties concerned.


GIE INFOGREFFE (controller) has a website which allows consultation of legal information on companies. This website also provides the possibility to order certain documents. In its "Confidentiality Charter" on its website, the controller made a distinction between two kinds of users: "members" and "subscribers". "Members" were users who could order a selected paid service on the website, for which they needed an account. "Subscribers" were users who had subscribed to an annual subscription of the website.
A data subject filed a complaint at the DPA stating that he was able to get a password on the phone only by telling his name. The data subject also complained that the website stored user passwords in plain text. The DPA started an investigation into the website of the controller.
On its website, the controller had stated in the "Confidentiality Charter" that the personal data of members and subscribers were kept for 36 months after the last order from a customer requesting service or documents. The DPA found in its investigation that no procedure for the automatic deletion of personal data was used by the controller and that personal data was kept for excessive periods of time in relation to the respective purpose and the own policy set by the controller. The controller admitted that personal data had been kept for longer than 36 months but stated that for purposes such as 'collection operations', it would be justified for certain data to be stored for a longer period of time.
With regard to the manual anonymization of personal data upon requests of users, the controller admitted that 25% of accounts were kept for more than 36 months after the last order, formality or invoice, without being anonymized. The was also no automatic anonymization procedure implemented by the controller.


facts_Garante per la protezione dei dati personali (Italy) - 9761383

A data subject filed a complaint with the Italian DPA (Garante per la Protezione dei Dati Personali - Garante) against the Regional Agency for the Protection of the Environment of Abruzzo (hereinafter “the Agency”). The data subject stated that he had previously been an employee at the Agency, and that a resolution by its Director which contained his personal data had been published on its website. The resolution was related to the approval of a trade union conciliation report, and it contained references to events connected with a criminal proceeding involving the data subject, for which he had been eventually acquitted. The data subject claimed that the document had been made public without any anonymisation and with indexing on search engines.
In its defense, the Agency claimed that the resolution should be considered as part of a contractual obligation between the Agency and the data subject, and that therefore, the processing was carried out on the basis of Article 6(1)(b) GDPR, as well as to fulfill a legal obligation pursuant to Article 6(1)(c) GDPR related to public entities’ transparency requirements. Moreover, the Agency claimed the data subject himself had already made information related to the criminal proceedings public himself, and that this information had been disclosed by the press and still traceable on the internet. Additionally, the Agency argued that since no reference was made within the resolution to the specific crimes which the data subject had been charged with, nor was any conviction mentioned therein because the data subject had been acquitted, the Agency was not subject to a challenge under Article 10 GDPR since no personal data related to criminal offenses or convictions had been disclosed. Lastly, the Agency also stated that, at the data subject’s request, it had taken the resolution off its website for external access, and had taken all precautions to make sure it was no longer indexed on search engines.


The decision is the consequence of a complaint submitted by a Spanish citizen, according to which the AEPD required the defendant to provide certain information.

Dispute
The defendant did not answer to any AEPD investigation requests nor provided the required information, so the AEPD started the corresponding sanction procedure.


A data subject received direct marketing in e-mail from the controller Komplett Bank ASA despite of having previously objected to such processing pursuant to Article 21(3) GDPR.
The controller's privacy statement and on-line customer portal suggested the lawful basis used for the direct marketing was «Consent» pursuant to Article 6(1)(a) GDPR. The data subject had at no point given consent for processing of his personal information for direct marketing purposes.
Communication between the data subject and the controller's data privacy officer eventually revealed that the controller was using another lawful basis for this processing, specifically «Necessary for the performance of a contract» pursuant to Article 6(1)(b) GDPR.
The contract in question regarded a credit card service bundled with a non-optional customer benefit / loyalty program. While the customer benefit program part of the contract did contain a clause stating the controller would send direct marketing to its customers, the data subject considered that such marketing activity could not be considered objectively necessary for the performance of the contract.
The responses from the controller's data privacy officer to the data subject's requests for information did on multiple occasions exceed the maximum time limit of 30 days pursuant to Article 12(3) GDPR.


The NGO noyb filed a complaint with the CNIL related to the following practice: Google is conditioning the use of a phone running Android to the acceptance of Google’s terms and conditions and privacy policy, making the device unusable otherwise.
The NGO la Quadrature du Net (LQDN) filed a complaint with the CNIL about Google's lack of lawful basis to process personal data for targeted advertising purposes.
The CNIL decided to gather the two complaints and decide on them in a single decision, following an extensive investigation.
Google's main arguments were that the complaints are inadmissible and there was a violation of the company's right to a fair trial (art. 6 ECHR), in particular because of the language used (French) and the imparted time to respond.

Dispute
Does the Google's acceptance system for terms and conditions and privacy policy are in line with the transparency and information obligations?
Is there a legal basis for the processing?
Is the case admissible? Is the company's right to a fair trial violated?


facts_Garante per la protezione dei dati personali (Italy) - 10095791

The Region of Molise (the controller) used an information system to handle electronic health records and make them available to citizens. The controller relied on a number of processors and sub-processors, including IT services company Engineering Ingegneria Informatica S.p.a., the developer of the system (the sub-processor).
Data processing agreements were in place between controllers, processors, and sub-processors. These agreements included provisions on security measures for processing personal data. In particular, the agreement between the controller and Società Molise Dati S.p.a. (the processor) provided for the limitation of account privileges on a need-to-know basis.
A user logged into the records system with his patient-level account. He was then able to access files of other patients by changing the url address of the page. He accessed personal data such as personal details and addresses as well as medical records and other sensitive, health-related data.
The user informed the controller of the vulnerability. The vulnerability was immediately addressed by limiting access privileges for patient-level accounts. At the request of the controller, the processor assessed the software for similar vulnerabilities.
The controller notified the Italian authority of the data breach. Based on system logs, the controller found that only seven files were accessed without authorization.
The controller held that the breach did not result in a high risk for the data subjects and decided not to inform them of the breach. In this regard, the controller considered that the user who breached the data, reported the vulnerability himself and intended no harm to the data subjects. The authority did not challenge this view.


facts_Datatilsynet (Denmark) - Civilstyrelsen indstilles til bøde

The Civil Affairs Agency (controller) is a part of the Danish Ministry of Justice. Its mission is to guarantee the basic principles of the rule of law by, for instance, offering compensation to victims of criminal offenses and supporting access to justice. The nature of its work involves processing large volumes of sensitive and confidential information regarding the parties in the proceedings.
The Agency returned a USB flash drive with more than 800 pages of personal information to a representative of a data subject. However, the flash drive was later lost under undisclosed circumstances. Notably, the USB flash drive was not encrypted, and the Agency did not have any guidelines for its caseworkers regarding the handling of removable storage devices and portable media.
Furthermore, the Agency learned about the data breach on 26 August 2020 but did not report it to the supervisory authority as required under Article 33(1) GDPR. Eventually, the data subject's representative complained to the Danish DPA about the controller's way of handling personal data.


The data subject was a former employee of the controller and worked with them until 2021. In August 2023 the data subject noticed that the controller published her photo in a recruitment campaign on the controller's website and social media. The data subject had never consented to this and was working with one of the controller's competitors at that time.
On 31 August 2023, the data subject requested the controller to erase all her images on the website and social media and not use them again in the future. The controller responded that arrangements were being taken regarding the use of people's photos after their departure from the company. Therefore, the controller refused to delete the images, but informed the data subject that new photographs would be made to prevent situations like this.
On 6 November 2023 the data subject filed a complaint with the Belgian DPA ("APD").


The data subject exercised its right to be forgotten on 19 June 2022, but the controller didn’t provide an answer. On 8 August 2022, the data subject filed a complaint at the Belgium DPA for the lack of an answer to the request.


This decision is the final result of an inquiry launched in April 2019 after Meta Platforms Ireland Limited (MPIL) notified the DPC of the personal data breach. MPIL notified the DPC that it had inadvertently stored passwords of social media users in plaintext on its internal systems without cryptographic protection or encryption.
The DPC press release shows that passwords were not made available to external parties.
The DPC had submitted a draft decision under Article 60 GDPR to the other Concerned Supervisory Authorities across the EU/EEA in June 2024 and no objections were raised by the other authorities.


facts_Tietosuojavaltuutetun toimisto (Finland) - 8979/162/21

The Finnish DPA was notified that the social and health authority of the city of Oulu (the controller) had required persons applying to become foster parents to request access to their personal data processed by the police and to provide this information to the controller.
The DPA had asked the controller to explain for what purpose it processed the personal data and why it required the data subjects to provide this information.
In response to the request, the controller clarified that the information received from the police was required in the process of approving applicants as foster parents. The controller had to ensure that the conditions at the foster home were safe and stable and that the children placed in foster care received better care than at home. The controller claimed that the information about, among other things, domestic violence and disruptive behaviour was necessary because it hindered working as a foster parent.
The controller stated that the police did not disclose the information based solely on the consent of the data subject. For this reason, it had become a practice to request the information directly from persons applying to become foster parents.


facts_Garante per la protezione dei dati personali (Italy) - 10077129

GEDI Gruppo Editoriale S.p.A., the parent company of the editorial group GEDI, the controller, concluded a contract with OpenAI, with the objective of “bringing Italian-language content from GEDI's portfolio of high-quality news agencies to OpenAI users", who "will have access to attributed quotes, contents and links to GEDI publications, including La Repubblica and La Stampa". This contract will last for three years and entails a remuneration that GEDI will receive upon sharing editorial content with OpenAI.
OpenAI in turn commits to use such content to allow users to do real-time research, and to have available a summary right away, comprising a hyperlink to such news.
A DPIA was conducted and transmitted to the Italian DPA stating that the data processing will happen on the basis of Article 6(1)(f) GDPR, namely the legitimate interest to exercise the profession of journalist in innovatively.


The data subject, citizen from a third country filed a complaint to the Hellenic DPA requesting his deletion from the List of Inadmissible Third Country Nationals. The data subject was sentenced to a prison sentence, a fine of ten thousand euros and the lifelong expulsion from the country for the acts of importation, transportation and possession of narcotic substances into Greek territory. Another Court decision accepted objections of the data subject regarding his judicial deportation and annulled this part of decision.


The data controller is an online casino-game provider. The data subject set up an account, deposited money and lost it on the website.
On 23rd May 2024, the data subject submitted (through his representative) an access request with the controller requesting access to their personal data, and specifically, all deposits and withdrawals and the stakes, wins and losses made on his account. The access request was made through the data subject’s representative, and included an electronically signed power of attorney and a copy of the data subject’s ID.
On 26th May 2024, the controller refused the applicant’s request, asking for a handwritten power of attorney signed by the plaintiff in ink.
The data subject did not respond to the controller’s response and filed the present action on 5th July 2024 with the Regional Court of Klagenfurt. The data subject sought that the controller be compelled to provide a digital copy of the data requested.
On August 1st 2024, the controller sent further communication to the data subject’s representative and, in light of having received notice of the claim filed, deemed there to be a legally valid power of attorney within the meaning of Section 8 RAO and provided the information requested by the data subject on 23rd May.
On 9th October, the data subject, having received the requested information, limited the scope of their filing to request only reimbursement of the costs incurred in the court proceeding. The trial court ruled that the controller could not rely on § 45 ZPO, an Austrian Civil Procedure provision which requires plaintiffs in a proceeding to bear the costs of such proceeding where the cause of action is not attributable to the action of the defendant and the defendant immediately acknowledges the claim in action. The controller had argued that this provision should apply as the power of attorney received in May 2024 was invalid.
The trial judge ordered the controller to reimburse the data subject for their legal costs, to the tune of €1559.60. The judge also held that the requesting of a power of attorney in ink by the controller violated their obligation under Article 12(2) GDPR to facilitate the data subject in making an access request. The court noted that no reasonable doubt as to the identity of the data subject could have been held by the controller as the data subject’s signatures on both their ID and the power of attorney were identical.
The controller appealed this decision to the Higher Regional Court, alleging incorrect legal assessment by the trial court, and requesting the controller be required to reimburse their legal costs of €1,170.35.


On 12 November 2018 Autoriteit Persoonsgegevens (Dutch DPA) rejected the applicant’s request for enforcement. On 12 June 2019 the DPA declared applicant’s objection invalid. On 4 February 2020 the court dismissed the applicant’s appeal. Applicant is now appealing this Court decision before the preliminary relief judge of the Council of State.

Dispute
Applicant is asking the preliminary relief judge to urgently order DPA to: a) Notify relevant transportation companies in the European Union that they can start an investigation into the decommissioning of the ATB system and request these companies to continue supporting the system; b) Investigate the historical and current facts behind the decommissioning; c) Prevent further decommissioning if the investigation shows that the ATB system is being dismantled; d) Report the outcome of the investigation for the Court to use in the main proceedings.
Dutch DPA is of the opinion that NS (Dutch public transportation company the applicant complained about) did not violate GDPR, so the enforcement is rejected. Moreover, according to the DPA, the applicant’s enforcement request only concerns cases where NS acts as a controller, which means it only applies to situations where NS sells its own tickets and not international tickets of other companies.


The complainant informed the AEPD on 2 July 2020 that he had been receiving e-mails from the website creation company "beiNNova" without him having any relationship with that company.
The complainant sent emails to unsubscribe to the newsletter and to stop the sending of unwanted mail but he did not receive a reply from the company and the sending of emails continued.
The AEPD initiated a sanctioning proceeding against "bieNNova" on 4 December 2020. Subsequently, the AEPD tried to contact the company and did not obtain any response or allegations.

Dispute
Is sending advertising emails without the consent of the recipient an infringement of Article 21 of the Spanish Information Society Services Act (LSSI) implementing the e-Privacy Directive?


facts_RvS (Netherlands) - 202004638/1/A3

The appellant is the owner of an arable farm ('the partnership'). The defendant is the Minister of Agriculture, Nature and Food Quality.
The Minister informed the partnership that its name, address details and so-called Chamber of Commerce number will be passed on to the Sector Organisation for Arable Farming and that the partnership can object to this on the basis of the GDPR. The Minister wished to provide this information from the partnership to the Sector Organisation for Arable Farming so that it could implement a 'Joint Research and Innovation Programme', as part of which agricultural companies are required to register and make financial contributions.
The partnership requested that its data not be passed on. They believed that the transfer of her data was contrary to the GDPR, because she did not consent to it. The information had originally been collected as part of an annual report about agricultural and technical data that is mandatory for the appellant's company. As part of that report, it explicitly denied permission to transfer data to "trade associations".
The court in this appeal had to determine whether the Minister may pass on this information about the partnership to the Sector Organisation for Arable Farming.


facts_Datatilsynet (Denmark) - 2021-31-5743

Elgiganten A/S, a consumer electronics retailer (the controller), took back the data subject's used TV. Returned TVs that had not been reset yet were usually placed inside the store in an area that only employees had access to. However, in this case, an employee of the controller placed the data subject's TV in the controller's warehouse due to lack of space and hectic situation in the store. The warehouse was subsequently bulglarised and the TV was stolen. As the TV had not been reset yet, the burglar(s) gained access to the data subject's personal data from the various streaming services to which the data subject was logged in, as well as the data subject's browsing history.
Before the burglary, the controller had carried out a risk assessment for theft of its products and concluded that the risk was high. Therefore, the warehouse was secured by a lock, a high wall, surveillance cameras and motion censors. However, the burglar gained access to the area by punching a hole in the high wall.


Following several compaints, the DPA launched an "ex officio" investigation. The controller (Client 1, Pitagorasz Oktatási Stúdió Kft) organises preparation courses for entry exams to secondary schools. It sent letters to students of different age (who are probably interested in applying for an entry exam), addressed to the students but mentioning that they are destined (also) to their caretakers. The addresses were received from the official government register, quoting as purpose market research. There is a law enabling this, but since 2019, this is not possible for direct marketing in respect of private individuals. The letters were sent after the registration to the courses was closed. Parents were informed about the source of the data at the bottom of the letters, and that the use of the data was terminated when the letter was forwarded. The information on the letter and in the legal basis could give the impression that this was an official communication and based on a legal obligation. The letter itself did not contain a market research questionnaire and could not be returned by mail. It hinted to an on line questionnaire which could be filled in. The privacy statement was not provided, it was only mentioned that it is available on the homepage of the controller (not a specific link to the statement itself). The information on the privacy statement mixed the processing of addresses used for sending the letters, the processing of registrations and of responses to the on line questionnaire. Different pieces of information (registration form, privacy statement etc.) contained differing information as to the legal basis of processing. The information given for consent was incomplete. The DPA acquired information from the provider of a mailing software and database used. It was established that this provider did not have access to the personal data, was neither controller, nor processor. The DPA investigated the database and found data of different groups of data subjects in it, including those who filled in the on line questionnaire, registrants and even lecturers. Not all data were collected on line, some were entered into the database manually. The fact of consent was not indicated at all data subjects whose data were processed based on consent. An assessment of interest was not conducted for the processing based on legitimate interest. Data of data subjects who meanwhile withdrew consent (were inactive) were not removed in time and were found in the database. Controller also enabled registrations to a newsletter and to send information about course organisation but did not separate the consent to these two different purposes.


facts_Rb. Midden-Nederland - AWB - 20 3811

The Sociale Verzekerinsbank (Social Security bank, hereafter SVB) sends personal data of all newly born children in the Netherlands to the 'toeslagen' (welfare benefits) department of the tax office in a 'start-message'. The start-messages are shared on the basis of an agreement between the SVB and the tax office. Data includes the BSN-number (a state-issued identity number), date of birth and country of residence of the child. The SVB has this data as it is responsible for paying out the general child allowance, to which all parents/caretakers are entitled. The tax office is responsible for paying out the 'kindgebonden budget' (child-related budget), an extra allowance for relatively low-income families. The data in the start-messages is used to quickly decide on applications for the child-related budget.
The claimant has a daughter born in 2016, whose personal data was shared by the SVB with the tax office in a start-message. The claimant's daughter does not qualify for the child-related budget.


On the one hand, the DPA has an obligation to openly and publicly available the decisions it adopts contributing to the transparency and facilitating their further use for the benefit of the public public interest and, on the other hand, the DPA's obligation to protect the personal data of natural persons who decisions, in accordance with the provisions of the GDPR.


facts_ANSPDCP (Romania) - Realmedia Network SA

Following informations received from the Internet, the Romanian DPA launched an ex officio investigation into Realmedia Network SA (the controller) for a possible data breach. The controller operates a real estate platform called imobiliare.ro, where agencies and individuals can advertise their properties.
The DPA's investigation revealed the unauthorized disclosure and access to the following personal data that was not supposed to be accessible: name, surname, telephone number, email address, postal address, personal numerical code, signature, copies of identity cards, including identification codes, function/quality, bank data, information included in land deed extracts/cadastral drafts, property titles and user profile image. 194,309 data subjects were impacted.


facts_Rb. Midden-Nederland - UTR 21/2729

The data subject used to be an employee at the municipality (controller) until 8 July 2008. On 6 May 2021, the data subject requested rectification of all changes made until this date in their files.


Deutsche Bank S.p.A. asked a customer to provide his sensitive data in order to sign a contract for a bank account. The customer initially accepted the clause included in the contract, but then he withdrew his consent. As a result, the bank interrupted the service.

Dispute
The Court had to assess whether this sensitive data was necessary for the Bank in order to conclude a contract for a bank account.


The decision is the consequence of a complaint submitted by a Civil Guard local office (the claimant) stating that the data controller had sent a Whatsapp message to a third party including personal data (name, surname, ID number) of three people (a mother and her children, probably underage) without their knowledge nor their consent. The complaint includes a copy of such message and a certification by the Civil Guard (although the mobile number of the sender is not identified).
The data controller did not answer to any AEPD investigation requests, so the AEPD started the corresponding sanction procedure.

Dispute
...


facts_Garante per la protezione dei dati personali (Italy) - 10068155

The data subject is an employee of the Municipality of Verona (the controller). Via email, the data subject requested the controller to provide him with a new FFP2 mask and mentioned his health conditions in this message.
When a municipal officer replied to the email, they cc'd the email account of the controller's warehouse. This email address was shared among 6 other employees. In this response, the officer mentioned the fact that the data subject suffered from certain illnesses and referenced to the Italian law regulating disability benefits (Law 104/1992 - Legge 104/1992), implying that the data subject was entitled to them.
Believing that sharing this data with other employees of the controller was unlawful, the data subject filed a complaint with the DPA.
The controller argued that it had referenced to the Law 104 only in a generic way, not specifically stating that it applied to the data subject. Moreover, it pointed out that after realizing the mistake, its officer sent subsequent communications only to the data subject.


facts_Datatilsynet (Denmark) - 2021-41-0149

JP/Politikens Hus A/S (controller) is an operator of the news website, www.eb.dk. In 2021, the Danish DPA conducted an inspection into how the controller processed personal data of visitors on its website. During the check, the website had a cookie consent solution allowing the visitors to click on three different boxes: "Only necessary" (in a red box), "Customise settings" (in a grey box) and "Accept all" (in a green box).
From the "first layer" of the consent solution, it appeared that the controller processed personal data for statistical and marketing purposes. In the "second layer", which the visitor could access by clicking on "Customise settings", the visitor could select the processing for preferences, statistics and marketing.


The UK DPA, the Information Commissioner's Office (ICO), examined the monthly reports received from the Telephone Preference Service Ltd (TPS), which described complaints about Solarwave Limited’s unsolicited marketing calls. Between 2 January 2020 and 2 October 2020, Solarwave Limited made 73,217 unsolicited direct marketing calls, and 30 complaints were submitted in relation to those calls. The calls were made to subscribers who had registered with the TPS and who had not given their prior consent to receive calls.

Dispute
ICO examined whether Solarwave Limited contravened regulation 21 of the Privacy and Electronic Communications Regulations 2003 (PECR), according to which a company can make direct marketing calls to individuals who are registered with the TPS (for not less than 28 days) only if those individuals consented to receiving such calls. Further, ICO examined whether the conditions under section 55A Data Protection Act 1998 (DPA) for the imposition of a monetary penalty are met.


The controller is the biggest German credit rating agency “SCHUFA Holding AG”. The data subject is a consumer with a low credit score. In October 2020, an insolvency court discharged the data subject of a residual debt he had with a third party for the amount €45,000. The controller added the information about the discharge to its database. The entry contained the information that a discharge of residual debt had been granted, the date of the decision and its case number.
In February 2021, the data subject objected to the processing and requested the controller to erase the entry altogether. The controller rejected the request by referring to the "Rules of conduct for the review and deletion periods of personal data by the German credit agencies" ("Verhaltensregeln für die Prüf- und Löschfristen von personenbezogenen Daten durch die deutschen Wirtschaftsauskunfteien") ("Rules of Conduct"), under which the information will be deleted only after three years have passed. The Rules of Conduct are a code of conduct within the meaning of Article 40(5) GDPR which was approved by the Hesse DPA (Hessischer Beauftragter für Datenschutz und Informationsfreiheit).
Consequently, the data subject filed a lawsuit against the controller before the Regional Court Cologne (Landgericht Köln - LG Köln) requesting that the court orders the controller to delete the entry. He argued that the entry makes it impossible for him to find a new and bigger apartment to start a family with his partner, to obtain a property loan for a new apartment, to open up a new bank account, to conclude a new mobile phone or power supply contract or to get a new job as a salesman.
From the time the controller included the information in its database until the end of the court proceedings, no customer of the controller requested information about the data subject.


facts_Commissioner (Cyprus) - 11.17.001.010.064

The Cyprus electricity authority (controller) intended to place a power line on the data subject's land. The controller sent the data subject a consent form for the placement of this power line. However, an employee of the controller delivered the consent form, which contained personal data, to the neighbour of data subject. The data subject filed a complaint at the Cyprus DPA (DPA) on 11 April 2022.
The controller also submitted a notice of the violation of this incident to the DPA. The controller stated that the employee had realised his mistake and had apologised. The controller acknowledged the violation, apologised for it and stated that this violation was committed out of negligence and human error, and not out of malice. The controller had previously organised periodic briefings and GDPR related training sessions for its staff (not attended by the employee in question). However, the controller also acknowledged the need for further training for its staff and had already planned further training sessions. The controller also confirmed that it had not set out specific procedures and measures which described how its staff would conduct service and also admitted that the deliverance of the consent form to the neighbour was contrary to Article 31 of the Electricity Law (KEF.170), which stated that the consent form can only delivered to the owner of the land, in this case the data subject.


The Spanish DPA (AEPD) received a complaint from a data subject living close to a building owned by the Spanish Ministry of Defence. Such building had cameras recording its outside perimeter, that included private parking spots from homes more than five meters apart.
The data subject alleged that, as they owned one of those homes, they were recorded by the cameras every time they moved around their home, so any security workers of the building could know what time they left and entered the house, recording their vehicle, including its licence plate, and themselves while doing it.
The Ministry of Defence acknowledged that, even if there were informing banners about the cameras, some made reference to the former data protection act, and that the angles of some cameras should be adjusted. Those cameras showed part of an avenue, including private homes, and part of the facade of some buildings, showing the inside of the homes through them. They also alleged that the images could only be watched in certain cases authorized by law. Also, that the legal basis for the recording was Article 6(1)(e), given the fact that the surroundings of the building were classified as military-home-zone, and they had authorization to proceed in such a way.


The data subject had health problems arising from conflicts in the workplace in the City Council of Zaragoza (the controller). The Prevention and Occupational Safety Service of the City Council of Zaragoza, issued a medical report recommending that she contact the Health Monitoring Unit to assess an adaptation or change of job. The Health Surveillance Unit issued a decision to adapt the tasks of her post along with an attached document containing the data subject's medical report. This e-mail was sent without a seal or indication marking the information as confidential. This was different to standard procedure for confidential e-mails at the City Council of Zaragoza, who usually use nominal corporate e-mail accounts and an Internal Communications Service (SIC).
When the AEPD began its sanctioning procedures, the controller sent a letter to the DPA admitting a personal data breach. However, they made the point that it was an isolated event. Additionally, they claimed adequate security measures had been taken because only "authorised personell" are permitted to open emails. Nonetheless, this does not mean that the email access was limited as anyone within the City Council could have opened it.


On 1 December 2022, the data subject requested the controller to erase his personal data under Article 17(1) GDPR. In order to do so, he followed the instructions provided in the controller's privacy policy. However, the controller did not acknowledge receipt, not even after the data subject sent a reminder on 19 December 2022. On the 28 December 2022, almost a month after the data subject had submitted his erasure request, the controller sent him a promotional e-mail. The data subject filed a complaint at the Belgian DPA on 3 January 2023 for the lack of a response by the controller.


The data subject submitted a request to the Minister for Legal Protection (now: the State Secretary for Justice and Security) to erase the files of her two sons held by the controller, the Child Protection Council (RvdK), pursuant to Article 17 GDPR. The files contained documents regarding the termination of her parental rights to both her children.
On 15 September 2021, the Minister rejected the erasure request, arguing that the records should be retained under the Dutch Archives Act, and on 14 February 2022, he rejected the objection lodged against it.
The data subject filed an appeal before the court of first instance against the decision of the Minister.
By judgment dated 22 December 2022, the court dismissed it as unfounded. It held that the processing of the data subject’s children’s personal data was necessary for the fulfillment of a statutory processing obligation pursuant to Article 17(3)(b) GDPR.
The data subject filed an appeal before the highest administrative court (Council of State-Raad van State). She argued that since the custody termination order for her youngest son had been lifted the files must be deleted because their content was incorrect and therefore unlawful. She further argued that the measure of custody termination for the eldest son should also be lifted because it was based on the unlawful RvdK files.


In June 2019, the defendant, the Dutch Tax Office ('Gemeenschappelijke belastingkantoor Lococensus-Tricijn', 'GBLT'), addressed a letter to the claimant. However, the destination of the letter was the claimant's old residential address. The claimant sent an email to the defendant, drawing attention to this error and emphasising that, as a result, his personal data had reached a third party. In its response, the defendant apologised, and proposed that the appropriate action would be to ask the third party to delete the relevant data and confirm this. The claimant indicated they were unable to respond to this proposal until certain ambiguities were resolved regarding the content of the leaked data.
In August 2019, the claimant sent another email to the defendant, in which he asked a number of questions regarding the provision of his email address by the defendant to a company called 'KCM Survey BV', as well as other third parties for customer research purposes. Among other things, the complainant stated that he had not given his consent for this transfer, and asked what the legal basis was for sharing his data with third parties, and which third parties his data was shared with.
The defendant responded stating that it considered processing for customer research purposes to be part of its statutory duties - more specifically, evaluating and ensuring the quality of the implementation of the Tax Act ('belastingwet') - and that therefore it does not consider it necessary to rely on the consent of data subjects. It did add, however, that it considered the claimant's communication as an objection to the processing of his email address for customer research purposes, and that it would no longer process the email for this purpose.
Several months later, on 16 February 2020, the claimant asked for more information about the initial data breach involving the letter, as it was still not clear to him which documents were leaked.
On 28 February 2020, by primary decision, the defendant provided the claimant with information regarding the personal data that had been transferred by the defendant to third parties, including both KCM Survey BV, and the initial third party that received the letter. In the decision, defendant once again confirmed that the claimant's email address had been processed by third parties for customer research, and indicated that the email address had been deleted on 23 August 2019, and was also no longer being processed by KCM survey BV.
The claimant objected to this decision on 2 April 2020. The defendant acknowledged receipt of the objection, and 18 August 2020, a hearing took place, at which the defendant confirmed the contested decision.
The claimant then appealed the primary decision in the present case before the District Court of Overijssel. Among other things, he: reiterated his objection to the processing of his email address with third parties for research purposes; argued that, in the primary decision, the defendant did not provide him with full access to the personal data concerning him that were provided to third parties; and sought compensation for the unlawful disclosure of personal data to third parties.


In the Republic of Slovenia, in addition to applying for vaccination with a personal physician, a comprehensive data collection on vaccination interest is conducted in parallel via the eGovernment portal, which is not an application for vaccination. Individuals receive completely vague and meager information when applying for the vaccination expression of interest via the eGovernment portal, and additional ambiguity is introduced by various diametrically opposed interpretations of individual speakers at press conferences of the Government of the Republic of Slovenia regarding the significance of this role.

Dispute


A data subject lodged a complaint with the Spanish DPA (AEPD) against Niantic, a software developer, regarding their interactive game "Pokemon Go".
Pokemon GO is a game in which users interact with the real world, so they share their location in order to walk the map. This include sharing their user data with others when they go to specific locations called "gyms", in which they play together with others. For that, a user needs to be at least at 500m from the site. Therefore, their real location is also known.
However, some users fake their real location, so they can access the gyms from further away. Therefore, the location of other users may be also shared not only with regular players but with players that are faking their location.
From this data, that can easily indicate where a person lives or works, malicious users could access this information and also infer the real identity of these subjects, what may lead to harassment or stalking. It is important to note that a big number of players of the game are minors, what increases the risk.
The complainant had asked Niantic to avoid sharing location data with users that were known to be faking their location.
Niantic stated that they have a security policy in place that tries to tackle that problem. Players who are detected to use these methods are warned with a three-strikes mechanism. They have other additional measures, such as information about the data that is shared, a recommendation not to provide your real name, the lack of a chat where users can directly interact, prohibitions on harassing and misuse, limited sharing of data, and different privacy options and information.


facts_Garante per la protezione dei dati personali (Italy) - 9771142

The Italian DPA launched an investigation into Uber B.V., with registered office in Amsterdam, and Uber Technologies Inc., with registered office in San Francisco, after the US parent company made public a data breach in 2017. The DPA found that the Dutch company Uber BV and the US company Uber Technologies were joint controllers, each responsible for violating the Italian Privacy Code (the Italian implementation of EU Directive 95/46/EC) against data subjects in Italy.
During their inspections carried out at Uber Italy srl, the DPA found several violations, including inadequate privacy notice, personal data processed without consent and failure to notify the DPA about the data breach.
The security incident, which occurred before the GDPR came into effect, involved the data of around 57 million data subjects worldwide, and had been sanctioned by the Dutch and British DPA on the basis of their respective national regulations. The personal data processed by Uber concerned personal and contact data (name, surname, telephone number, and e-mail), access credentials to the app, location data (those that appeared at the time of registration), and relations with other data subjects (sharing trips, introducing friends, profiling information).
The controllers had also, without having obtained valid consent, processed the data of approximately 1,379,000 data subjects by profiling them on the basis of the so-called 'fraud risk', assigning them a qualitative rating (e.g., 'low') and a numerical parameter (from 1 to 100). Finally, the controllers had not complied with the obligation to notify the DPA of the processing of personal data for geolocation purposes, as required by the legislation in force before the GDPR came into effect.


facts_Tietosuojavaltuutetun toimisto (Finland) - 7684/171/22

The Finnish Meteorological Institute (the controller) used Google Analytics and reCAPTCHA services including cookies on its website. Because Google is a US-based service provider, personal data of the controller’s website visitors, such as IP address and other information that could be used to identify a data subject, were transmitted to the United States through the use of the Google services in question.
Following a website user first contacting the controller on the issue, the controller filed a data breach notification with the Finnish DPA in September 2022. According to the controller, the data breach started on 1 January 2010, and the number of data subjects affected was estimated to be 330 000. As a result, the controller disabled the Google services in question from it’s website in September 2022.
Pursuant to Article 44 GDPR, transfers of personal data to a third country can only take place if the controller and processor comply with the conditions set out in Chapter V GDPR.


facts_ANSPDCP (Romania) - Natural Person

The Romanian DPA started an investigation after receiving a complaint against a natural person (the controller), who operated the website https://centralpoint.ro/afisare-bd-general/.
During its investigation, the DPA found that the controller had published the personal data of 383 data subject's on the website. This included their CNP (personal identification number), phone number, ID series and number, e-mail address, bank details (real estate purchases) and marital status.


The controller, a research institute active in the field of automated drive, applied for a data processing authorisation with the Austrian DPA. The controller wanted to test automated vehicles on public highways and needed to process a large amount of personal data – in particular, videos from both outside and inside the vehicles – to train their algorithm. The controller claimed that the identity of data subjects whose images were captured by the cameras was of no importance for the processing. However, the recording was essential to ensure that automated vehicles were safe for road users. The controller performed a DPIA according to Article 35 GDPR and held that risks could be sufficiently mitigated.


The data subject's father advanced a complaint before the DPA, even if the data subject was not underage. The complaint was against a municipality, the controller and related to the request of the controller to collect a total of eight fingerprints of the data subject when issuing a new ID card, even if Article 6(2) of Belgian Law of 19 July 1991, only requires one fingerprint.
The data subject alleges that, when inquiring about the amount of fingerprints taken, the controller did not disclose the legal basis for the mandatory processing of personal data of the data subject. At the moment of collection of the ID card, eight fingerprints were again scanned.
The controller puts forward that their legal basis is, as per Article 6(1)(c) GDPR, a legal obligation stemming from the Royal decree of 25 March 2003 on identity cards, which itself builds on the Article 6(2) of Belgian Law of 19 July 1991.


The Icelandic credit report agency "Lánstraust" is the data controller. The complainant had debts in the past which he paid. Therefore, he argues that the data controller is not authorized to use his payment history information when making a credit rating.

Dispute
Whether the data controller was lawfully processing payment history data of the complainant.


This decision is a reconsideration of decision APD/GBA - 31/2020 of the Dispute Resolution Chamber dated June 16, 2020, and implements the judgment of the Markets Court dated November 18, 2020, number 2020/AR/990.
The Markets Court approved appeal of Article 5(1)(a), Article 12(1), Article 13(1) and Article 13(2). The appeal for Article 5(1)(c), Article 6(1) and Article 8 GDPR was not approved. This partial annulment means the DPA must reassess and motivate its original fine of €2,000.

Dispute
Can a not for profit private educational institution be seen as a public body in Article 83(7) and article 221(2) of the Belgian Data Protection Law and thus be exempt from receiving an administrative fine?


facts_ICO (UK) - Advanced Computer Software Group Limited

Advanced Computer Software Group Ltd. (data processor) is a software company providing IT and software services to organisations including the NHS in England.
In August 2022, the processor suffered a cyber-attack whereby the threat actor obtained access to their internal systems. This was achieved through the provision of a correct username and password through a customer account, allowing the actor to disable the antivirus measures and obtain domain administrator privileges. The threat actor was able to gain access to 19GB of data. This caused widespread disruption to NHS services.
The processor had to take multiple systems offline in order to re-build them. In May 2023, the final data controller was reconnected.
The personal data of a total of 82,946 individuals was compromised, with some of the data relating to deceased individuals, leaving a total of 79,404 individual’s personal data having been exfiltrated. This number includes the special category data of 41,196 data subjects. The personal data was comprised of demographic and contact information, employment related information, medical and health related information, and other special category information including racial or ethnic origin and religious or philosophical beliefs.
Following report of the disruption to NHS services, the ICO (United Kingdom DPA) contacted the processor and launched their investigation.