This case was initiated when the DPA followed up on an earlier supervisory decision against Google. In the earlier decision, the DPA had ordered Google to remove certain search results relating to a handful of data subjects who had exercised their right to be forgotten under Article 17. Upon follow-up, the DPA found that Google had not fully complied with the previous supervisory decision in relation to two complaints from data subjects.
Additionally, Google routinely notifies webmasters when a search result has been removed from the search results list. This allows the website owner to republish the webpage in question at a different web address, which will then show up in a Google search. This effectively overrides the right to delist. Google considers that informing webmasters is necessary for purposes related to the fundamental right of search engine providers, webmasters and internet users to freedom of expression and information under Article 17(3).
The DPA issued a sanction fee because Google failed to comply with the two complaints and because it found that the practice of informing webmasters had no legal basis. Google appealed the decision to the Administrative Court of Stockholm (FiS).

Dispute
 1. Did Google process personal data in breach of the GDPR by not removing some search results relating to the two complaints without undue delay?
 2. Was Google's practice of routinely notifying webmasters of removed search results lawful under the GDPR?
 3. The sanction fee.


The controller, a bank, sent an incomplete response to the data subject's access request, prompting the data subject to file a complaint with the Spanish DPA.
Initially, the DPA held that the controller was not obliged to fulfill the data subject's access request because the data were documents relating to a contractual relationship between the two parties. The DPA had agreed with the controller, who argued that, for the data requested, the right of access (Article 15 GDPR) was overridden by more specific provisions in the Spanish law 16/2011, of June 24, on consumer credit contracts (LCCC).
However, the DPA issued a final decision in response to a "recurso de reposición" (an appeal to an administrative authority to reconsider its own decision) lodged by the data subject.
On appeal, the data subject argued that the LCCC did not control because the data at issue related to a contract that had already been concluded, not an ongoing contractual relationship. In support of their claim, the data subject pointed out that, while the LCCC has provisions specifically governing access to contractual documents prior to and during their validity, it does not mention documents relating to a concluded contract.


On 20 May 2021, the data subject (claimant) received a letter from the Dutch Inland Revenue, notifying him that he had been unlawfully registered in the Dutch Inland Revenue's (Belastingdienst) database - the Fraud Signalling Facility (FSV). The controller in this case was the minister of Finance, as the Dutch Inland Revenue is under the administration of the ministry of Finance
Overall, the use of this facility did not comply with the GDPR, as too many employees had access to the data and the data retention period was too long. Some individuals’ data was wrongly included and wrongly used. The controller attempted to rectify this by revoking tax employees' access to the FSV on 27 February 2020 and removing it as a point of use from the Tax Administration's implementation of (tax) legislation.
In a letter dated 25 June 2021, the data subject objected to the recording of his data in the FSV. In this letter, he made an access request under Article 15 GDPR, a data rectification request under Article 16 GDPR, and an erasure request under Article 17 GDPR.
The controller responded on 22 July 2021, partially responding to the access request (Article 15 GDPR), but refusing the requests made under Articles 16 and 17 GDPR. The data subject brought claims against the incomplete response to his data access request, and refusal of data rectification and erasure requests.


The controller, l’Institut du cerveau et de la moelle épinière (The Brain and Spinal Cord Institute), requested that the CNIL authorise their plans to undertake automated processing of personal data from national health databases to conduct a study on epilepsy. In pursuit of this they conducted a data protection impact assessment (DPIA) under Article 35 GDPR and consequently sought to consult with the CNIL, as necessitated by Article 36 GDPR.
The elements of the DPIA under scrutiny were the sources of the data used and the purpose of processing.
In relation to the sources of data used, in its DPIA, the controller outlined that it sought to use data from the National Health Database of patients who had been prescribed anti-epileptic drugs, patients who had been hospitalised or were receiving on-going care for epilepsy, and patients who had a long-term condition relating to epilepsy. In total, this consisted of the personal data of 1.5 million data subjects. The controller also sought to use data from the combined patient database from Paris hospitals, relating to patients who had received anti-epileptic treatment. In total, this consisted of the data of approximately 340,000 people.
In relation to the purpose of processing, the controller sought to rely on Article 5(1)(b) GDPR to justify further processing of the national health data. This provision establishes that further processing for purposes in the public interest or for scientific, historical, or statistical research is compatible with the principle of purpose limitation. The controller noted that their processing was for the purposes of quantifying the national demand and supply of care for patients with epilepsy, to identify and improve the pathways of case for people with epilepsy, and to quantify the cost of the disease for the national health service. The controller argued that these purposes were compatible with the principle of purpose limitation as the processing aimed to conduct scientific and statistical research for the public interest.


On 1 July 2016 the municipality put a piece of land with an unused shooting range up for sale for a symbolic amount of 1 EUR. The claimant was interested in buying it. To reuse the old shooting range, claimant was required to get an environmental permit from the municipality. The online form available on the sites of the Dutch municipalities, has two options for such permit applications: the complete form, which is available to competent authorities only, and the publicly available version of this form. The information that an applicant wants to keep private is removed from the publicly available version. More specifically, the publicly available version doesn’t contain the applicant’s social security number (BSN) and phone number. When submitting the digital application, an applicant is presented with the following choice: Do you give permission to make publicly available personal and address details of the applicant/notifier and, if applicable, the authorised representative? The claimant submitted his environmental permit application on 9 December 2016. He filled in his social security number, last name, initials, address, phone number and email. He consented to making his data publicly available. On 7 October 2017 and 7 December 2017 the municipality published a draft statement and draft decision, making them available on its site, on the Government Gazette (Staatscourant) and on www.ruimtelijkeplannen.nl. On 2 December 2018 a local journalist twitted about the fact that the municipality has published claimant’s data on its website, including the social security number and phone number. On the same day the claimant reported the data breach to the municipality under GDPR, telling the municipality to remove his data and mentioning non-material and material damages (for the costs involving increased house security). On 3 December 2018 the municipality has included the claimant’s environmental permission application as an agenda item in the council’s meeting and published the agenda on its site, including the claimant’s email, phone number and social security number. Social security and phone numbers were removed from the site on 4 December 2018. The municipality has admitted that personal data breach took place but asked the claimant to substantiate any material damage resulting from the municipality's actions, as it was not prepared to pay non-material damages. The claimant responded with a list of security measures that would be necessary to prevent burglary, blackmail and/or threats. On 10 April 2019, the municipality rejected the claims for material and non-material damages as not sufficiently substantiated.

Dispute
Should the claimant be awarded a (non-)material damage compensation from the municipality for the data breach?


Nordax (controller) is a Swedish bank. The bank entrusted a processor, Iper Direct AB (Iper), to manage its customers' address register. According to Nordax, this processor was the controller in all matters regarding this register and was also responsible for answering data subjects requests related to any processing of this register's personal data. Iper's task was to provide another processor of Nordax a selection of e-mail addresses, which were used by this second processor for direct marketing purposes on behalf of Nordax. The selection of addresses from Iper's address register was also carried out on behalf of Nordax and was based on selection criteria determined by Nordax.
It is not explicitly mentioned in this decision whether or not the data subject used to be a (former) customer of the controller. It is also not explicitly stated that the data subject received direct marketing e-mails from the controller. The latter is however most likely, looking at the objection of the data subject against direct marketing, which was eventually granted by the controller (will be further discussed below).
Round 1 (Access 1 and Erasure 1)
On 5 December 2018, the data subject filed an access request and an erasure request at Nordax, which were answered by the controller on 6 December 2018.
The access request inquired on all data relating to him and the way Nordax used it. The controller replied to the access request that it did not process and/or store the personal data of the data subject and was therefore unable to comply with the request. Rather, the controller informed the data subject of the fact that personal data was processed by its appointed processor, Iper, which was responsible for the address register of the bank and for managing data subject rights related to any processing regarding this register. Furthermore, Nordax also did not classify the request of the data subject as an access request at first, but as an objection to processing. Based on information in the data subject's e-mail, Nordax determined that the data subject's primary wish was to be blocked from the controller's direct marketing e-mails. In its reply, the controller only provided information on how the data subject could block himself from the direct marketing of the controller. In order to block the data subject from direct marketing, Nordax requested the data subject's name and address.
On the same day, 5 December 2018, the data subject also submitted an erasure request. The scope of the erasure request was not specified in this decision. In its reply to the erasure request, and along the lines of the answer to the access request, the controller stated that it did not store the data subject's personal data. It was therefore also not able to erase it, since it was stored in Iper's register.
Round 2 (Access 2, Erasure 2 and Objection 1)
Around two months later, on 11 February 2019, the data subject submitted new requests for erasure and access. This time, the data subject also specifically objected to the controller's direct marketing operations for the first time. The controller answered all off these requests on 12 February 2019.
In its reply to the access request, Nordax referred to its earlier reply of 6 December 2018 to the data subject's first access request. The same was true for the controller's response to the erasure request.
In its reply to the data subject's objection, the controller stated that the request for objection had now been granted and that the controller had taken measures to block the data subject from direct marketing. Besides the fact that Nordax did not specify what specific measures it had taken, this also turned out to be incorrect information. Nordax had not yet taken any measures to block the data subject from direct marketing. According to Nordax, this incorrect information was provided because of human error.
Round 3 (Objection 2)
Another four months later, on 9 July 2019, Nordax received another objection against the controller's marketing operation from the data subject.
In its reply to the second objection, the controller reiterated again how the data subject could block himself from the direct marketing operation of the controller, just like it did when answering the first access request (which it had mistaken for an objection). The controller also repeated its request for additional information from the data subject in order to block the data subject from its direct marketing. Strangely enough, the controller then blocked the data subject from its direct marketing without the requested information. The controller also did not inform the data subject that it had finally complied with his objection to processing.
Data subject files complaint
Even after three rounds of requests, Nordax had failed to comply with the data subject's requests for access and erasure, and did not inform the data subject that his objection to processing had been granted.
The data subject filed a complaint at the Norwegian DPA (date not disclosed), which transferred the complaint to the Swedish DPA, the supervisory authority in this decision. The concerned authorities were the DPA's of Norway, Denmark, Finland and Germany. In this complaint, the data subject stated that the controller did not respect his rights by not responding to his requests.
During the investigation of the DPA, Nordax already acknowledged that it was the controller in this case and that it should have complied with the data subject's request for access, by requesting the help of its processor, according to Article 28 GDPR.


facts_Rb. Gelderland - C/05/404834 / HA ZA 22-245

The controller advises and guides companies on matters such as brand positioning, corporate identity, business models and revenue models. The data subject had a business that facilitates spaces for retreats, trainings and workshops. The controller believed that the data subject wrongfully failed to pay its invoice, and it claimed payment of the invoice, among other things. The data subject disputed this and refused to pay the additional invoices. Therefore, the controller took the matter to court.
To substantiate their defence, the data subject requested the Court to order the controller to provide digital copies of all recordings it made of conversations and (Zoom) video conferences between them, pursuant to article 843a of the Code of Civil Procedure (CCP) and/or Article 15 GDPR. The data subject stated that during the Zoom-calls, they were notified by an on-screen notification at the beginning of the call that it would be recorded.


The decision is the consequence of a complaint submitted by another Spanish citizen stating that the defendant has installed a video surveillance system allegedly pointing to the common swimming pool of the housing association; such complaint included pictures proving that the video surveillance system was installed.

Dispute
The defendant did not answer to any AEPD investigation requests, so the AEPD started the corresponding sanction procedure. The AEPD highlighted that private individuals can install video surveillance systems as long as they comply with the corresponding information obligations, but they shall preferably record their own domicile, avoiding to intimidate adjacent neighbours, and never recording freely the whole public road (such activity is reserved for the Spanish law enforcement agents).


The data subject has requested access to their personal data under Article 15 GDPR. The controller (Arbeitsmarktservice Österreich) did not fulfill the request at first. Later – during the administrative proceeding – the controller, however, did. Thereupon, the DSB (Austria) informally closed the proceeding. The data subject objected to the termination of the proceedings on the grounds that the answer to their request was too late and was insufficient. The DSB maintained its decision arguing that the data subject has no right to have a past violation of the GDPR determined and that the assertion of insufficiency is be regarded as a new submission under § 13(8) AVG since it changes the substance of the matter.


A woman, acting as a third party, received documentation about authorisations for medical clinic tests by an insurance company. Those tests belonged to other data subjects that the woman did not know and to whom she had no link. It occurred on numerous occasions, and it was sent via email. The woman reported the situation to the insurance company every time she received such an email but they answered by redirecting her complaints to other offices within the company. Hence, the issue was not resolved, and the woman kept receiving more emails. The documents included the authorisation number, the data of the insured (name, surname, number of insurance policy) and the type of medical tests.


The data subject was a third-country national employed in Slovenia under a resident and work permit. In March 2024, he moved to Cyprus where he held a valid residence permit until 2026. After this move, the data subject’s Slovenian employer withdrew their application for renewal of his Slovenian work permit. In response, the Slovenian authorities recorded a removal order and entry ban against the individual in the Schengen Information System (SIS II).
Following an access request, the data subject sought the deletion of this information from the SIS II under Article 17 GDPR, as he had legally left Slovenia and held a residence permit in another EU Member State. The Police (the data controller) refused this request, arguing that the information could only be deleted if he could prove he had left Slovenia within a 10 day period following the issuing the recording of the removal order.
The data subject then complained to the IP (Slovenian DPA), arguing that his request for erasure of the information should have been actioned as he held a residence permit in Cyprus. During the course of the IP’s investigation, the Police argued that as Cyprus was not a Schengen member, they were not obliged under Regulation (EU) 2018/1861 (The Schengen Information Regulation) to consult with Cyprus to verify the data subject’s claims.


The data subject submitted a complaint against the data controller, a legal entity representing the community of residents, for sharing with all members of the community a document with individualized heating consumption. Since the information would identify the number of each house, it was considered that the document held personal data. The Spanish DPA, then, proposed an agreement with the data controller for the payment of a reduced amount of the foreseen fine, considering the likelihood of the data breach.


facts_ICO (UK) - Birmingham Children's Trust Community Interest Company

The Birmingham Children's Trust Community Interest Company (BCTCIC) is an organisation owned by Birmingham City Council that works independently to deliver services to the council. This case is related to the Child Protection and Review (CP&R) department which provides services to support families in the Birmingham area focused on making a positive difference to their lives. The employees of BCTCIC (CP&R) are primarily trained social workers and the department regularly processes both personal data relating to children and criminal offence data.
On 10 November 2022, a personal data breach occurred involving inappropriate information related to a data subject being included in a Child Protection Plan (CP Plan). The information was contained in a summary statement of a meeting between BCTCIC and West Midlands Police, the full statement was copied verbatim into the CP Plan which was then approved and sent to a family by the CP&R department.
The CP Plan was received and read by the recipient subsequently resulting in inappropriate access to both sensitive criminal data, specifically criminal allegations and the personal identifiers of an individual under the age of 18.


facts_Datatilsynet (Denmark) - 2021-442-13989

In August 2021, the University of Southern Denmark (Syddansk Universitet) reported a personal data breach to the Danish DPA. The University uses an HR system where employees are assigned to roles so that they can access applications. Due to an update of the system, the role management was reset completely, so that all 7011 employees of the university had access to more than 400 applications for a period of 14 days. These applications contained personal data such as name, social security number and health data of the applicants. Normally only about 400 employees have access to this kind of information. The university had not performed an adequate testing of the software update before it was implemented. It claimed that they had no knowledge that the update would make a change in the role management.
The university also did not keep access logs, so that it was not able to see whether unauthorised employees accessed the data in that time period or not.


The data subject submitted a complaint to the Basque DPA following the inclusion of unrelated sensitive medical data (her gender reassignment) in a report about her injured foot. After investigating, the DPA issued a warning to the controller, Osakidetza-Servicio Vasco de Salud, for violating the principle of data minimisation Article 5(1)(c).
The controller appealed the decision to the Administrative Court No. 2 of Vitoria-Gasteiz, which upheld the appeal. The DPA then appealed that court's decision to the Administrative Chamber of the High Court of Justice of the Basque Country, which upheld the DPA's appeal. Finally, the controller appealed the High Court's decision to the Spanish Supreme Court.
Before the Supreme Court, the controller argued that, in light of the fact that the personal data had been lawfully collected, the data subject was required to exercise her right of restriction of processing Article 18 GDPR before she could file a complaint with the DPA. As a secondary point, the controller argued that the DPA disregarded relevant circumstances, namely that the medical records were intended only for the data subject.


The controller runs a web portal that connects operators of holiday homes to potential guests by allowing the operators to place ads on the portal. To acquire new operators to present their holiday homes the controller advertises their service via phone. They were using the services of a call centre in Kosovo for this purpose. Call centre staff members would search for phone numbers of landlords and operators of hotels and holiday homes and called them. They presented the portal to them and tried to close a contract about a cost free test entry or a “premium entry” on the portal. During the call, the call centre staff asked for data related to the customer and their accommodation. Subsequently, the controller provided the new client with information and a confirmation via e-mail. Persons who said they did not want to be contacted anymore were blacklisted.
Following 20 data protection complaints, the Saxony-Anhalt DPA (Landesbeauftragter für den Datenschutz Sachsen-Anhalt) got to know about the business practices of the controller and, in particular, that a client will receive more calls after opting for the cost-free test ad on the portal. The DPA then conducted an official hearing of the controller.
After the hearing, the Saxony-Anhalt DPA ordered the controller under Article 58(2)(f) GDPR to refrain from the processing of phone numbers and other personal data for the purpose of advertisement if these phone numbers are related to an identifiable natural person. This order included an exception for cases in which the person had either consented to the processing of their data or concrete facts indicate that the person had a factual interest in an advertisement entry on the controller’s page and is awaiting the call or at least would react positively to the call.
Furthermore, it ordered the controller under Article 58(2)(g) GDPR to delete all personal data that could not be processed anymore under the aforementioned order.
In addition, the DPA ordered the controller under Article 58(1)(a) GDPR to demonstrate to the DPA the compliance with the orders by showing which measures were taken.
In case of non-compliance the DPA threatened an administrative fine.
The controller appealed this order before the Administrative Court Magdeburg (Verwaltungsgericht Magdeburg – VG Magdeburg).


facts_Rb. Zeeland-West-Brabant - AWB- 20 9345

In September 2020, a mother requested copies of the youth files of three of her children from a private foundation that provides assistance under the Dutch Youth Act (Jeuwgdwet). About six weeks later, in October, she sent the foundation a letter stating that it had failed to respond to her request within the statutory time limit and demanding financial compensation.
In early November 2020, the mother filed an administrative appeal regarding the foundation's failure to respond to her request. In the request, she referred to the Dutch General Administrative Law Act (Algemene wet bestuursrecht, AwB), the European Convention on Human Rights (ECHR), the Dutch Youth Act (Juegdwet), the GDPR and the former Dutch Data Protection Act (Wbp), which was in force before the GDPR.


A data subject underwent psychiatrist examination within a court proceeding. The court assigned that task to Netherlands Institute for Forensic Psychiatry and Psychology (Nederlands Instituut voor Forensische Psychiatrie en Psychologie). During the examination, the Institute created the final report and additional documents, including the feedback report, which was not shared with the court. The feedback report contained, inter alia, the notes and comments of doctors performing patient's examination.
The data subject filed an access request in reference to the feedback report with the Minister of Legal Protection. The Minister excluded the application of the GDPR and didn’t disclosed the data.
The appeal proceedings, initiated by the data subject resulted in the dismissal of the Minister’s decision. The District Court of First Instance of Gelderland (Rechtbank Gelderland) examining the appeal found the GDPR applied to the case. However, the access request didn’t cover the personal data within the meaning of the GDPR.
The data subject lodged an appeal with the Dutch Council of State (Raad van State; the Supreme Administrative Court).


facts_AZOP (Croatia) - Decision 04-22-2024 (gambling websites)

Two controllers that offered gambling and betting activities online included cookie banners on their websites. The banners did not distinguish different purposes for processing, making a single request for consent. The controllers' privacy policies also lacked information about the legal basis for processing, the types of cookies used, the purpose of each cookie and the cookie storage periods. In addition, one of the controllers processed personal data prior to obtaining data subjects' consent.


The controller is a telecommunications company. The data subject and the controller entered into a mobile phone contract. During the conclusion of the contract the controller provided the data subject with an information sheet that included information about the transfer of personal data to the Schufa, a credit rating agency.
Following the closure of the contract, the controller transmitted personal data of the data subject to Schufa, such as the fact that a contract was formed, name, date of birth, address, date of the contract closure, and the contract identifier. The data subject had not explicitly consented to this transfer.
In a press release made public on 19 October 2023, Schufa informed the public that it was going to delete information transferred by telecommunication companies by the 20 October 2023. Schufa noted that the Conference of the German Data Protection Agencies (Datenschutzkonferenz der Länder) was of the opinion that the transfer and processing of so called positive data (i.e. data without connection to a payment default or another violation of the contract by the data subject) required the consent of the data subject. Data concerning the conclusion of a contract would constitute such positive data.
With his lawsuit, the data subject claimed, inter alia, non-material damages and a declaratory judgement that all future damages arising from the alleged GDPR infringement have to be borne by the controller. This declaratory judgement concerning damages is a standard in German law due to statutory limitation that would otherwise prevent the person claiming damages from bringing any claims after a period of three years (such as for long-term consequences of a car accident).


facts_Tietosuojavaltuutetun toimisto (Finland) - 6629/163/21

The Finnish DPA was notified that a healthcare provider (the controller) charged a fee for handing over copies of magnetic resonance images (MRI) when data subjects requested access to their personal data in accordance with Article 15 GDPR.
The DPA had asked the controller to explain how it facilitated the exercise of data subject rights under Article 15 GDPR in situations where a data subject would request their MRIs without explicitly referring to their right under the GDPR.
In response to the request, the controller clarified that it provided the MRIs free of charge when a patient made an access request in accordance with Article 15 GDPR. The controller also stated that it provided patients with medical records once a year free of charge when they invoked the right of access under the GDPR. However, the controller considered that when a patient requested a recording of their MRI examination directly from the MRI scanning, the right of access was not invoked, and the recording was chargeable.
The controller also stated that in its price list, it was mentioned that the provision of material related to the right of access would be free of charge if the request was made using an access request form or from the controller's registry office and that in other cases, a fee was charged for the request. It added that when the patient requested access to their personal data, the controller did not separately ask whether it was a request regarding the right of access under the GDPR.


The IAB Europe's Transparency & Consent Framework ('TCF') set up by the Interactive Advertising Bureau Europe ('IAB Europe') facilitates the capture of website users' response to Consent Management Platforms ('CMPs'), namely whether they consented to the collection and sharing of their personal data, or objected to various types of processing based on the legitimate interests of ad tech vendors.
Users' responses are coded and stored in a “T[ransparency and] C[onsent] string”, which are shared with the organisations participating in the OpenRTB system (the most widely used protocol for “Real-Time Bidding”) so that they know to what the user has consented/objected. The CMP also places a cookie (euconsent-v2) on the user’s device. When combined, the TC string and the euconsent-v2 cookie can be linked to the IP address of the user, therefore making the author of the preferences identifiable. The TCF plays a pivotal role in the architecture of the OpenRTB system, as it is the expression of users’ preferences regarding potential vendors and various processing purposes, including the offering of tailor-made advertisement.
Since 2019, the Belgian DPA received a series of complaints about the Transparency & Consent Framework ('TCF'). The complaints related to (i) the conformity of the TCF with the principles of legality, appropriateness, transparency, purpose limitation, storage restriction and security, as well as to accountability, and (ii) the responsibility of IAB Europe and other actors involved. Four of the nine total "identical or very similar" complaints were filed directly with the Belgian DPA, the rest with other DPAs which passed them on through the IMI system. They were considered by the Litigation Chamber of the DPA as its administrative dispute resolution body (Article 32 Belgian Data Protection Act)


A plaintiff servant who worked for the defendant sued to get his ability to work reinstated, as allowed by German law (Section 46 BBG). The lawsuit was most likely against the German government, but the court decision (which hasn't been made public yet) didn't clarify this.
The dispute centered on whether certain documents should be removed from the man's personnel file and other police records. These documents included disciplinary files, a statement about a "reactivation review," and related information. Both the plaintiff and the defendant disagreed with the initial court ruling issued by the Administrative Court of Regensburg (judgment of January 25, 2023) and appealed.
The plaintiff wanted more documents deleted, while the defendant appealed to keep the "reactivation review" statement.


facts_ANSPDCP (Romania) - Fine against Enel Energie Muntenia SA

A customer of Enel Energie Muntenia S.A. (controller) received an email from the controller addressed to another customer (data subject). The email contained files including the data subject's personal information. The customer that received the email filed a complaint with the DPA about this incident, which started an investigation.
The controller didn't explain why one of its employees accidently replied to the wrong customer. Additionally, it didn't demonstrate any corrective measures to stop further unauthorized access or disclosure and did not provide evidence of notification of this incident to the DPA.


facts_Datatilsynet (Denmark) - 2020-441-4364

On 3 January 2020 the Copenhagen Zoo reported a breach of personal data security to the Danish DPA. A software engineer informed the Zoo that via a self-developed script he acquired access to annual cardholders' log-in information (username and associated password). In turn, it was possible to gain unauthorized access to card numbers, names, addresses and e-mails of approx. 140,000 annual cardholders registered.
The Zoo was unable to say how many of data subjects were affected and for how long. It stated that the engineer gained access to the data but did not use it. Following the analysis of web page views, the Zoo concluded that it was unlikely that annual cardholders data were exposed to unauthorized parties.
The Zoo partially notified the data breach to data subjects on 3 January 2020 via e-mail and website. However, it did not inform data subjects about the likely consequences of the breach or an approximate indication of the period during which the breach lasted. Subsequently, the Danish DPA found out that the communication had not reached all of the annual cardholders registered.
After the breach of personal data security, the Zoo introduced a new log-in feature: (1) "i'm not a robot" feature and (2) a feature that blocks log-in for one hour after three erroneous log-in attempts. All annual card holders were forced to change their password.

Dispute
Did the Copenhagen Zoo establish an appropriate level of security for the login page for annual cardholders? Did the Zoo properly assess the risks that the breach posed to the data subjects' rights? How should communication of a personal data breach be delivered to the data subject? How the controller should communicate the risks posed to the data subjects' rights?


facts_Datatilsynet (Denmark) - 2020-431-0061 (Helsingor decision no. 4)

This is the Danish DPA's fourth decision in the case relating to Helsingor municipality's processing of personal data in primary and lower secondary school. Helsingor municipality, the controller, has been using Google Chromebooks and Workspace for Education in violation of several GDPR requirements, as detailed in the first decision of September 2021, the second decision of 14 July 2022 and the third decision of 18 August 2022.
Following the third decision, the municipality submitted more documentation and also requested a consultation with the DPA as per Article 36 GDPR.


In April 2021, a data subject in Germany owning shares in the company Mowi ASA (controller) was notified by his bank that the controller had requested his personal data. After two unsuccessful attempts at getting information about this processing from the controller, the data subject lodged a complaint with the Norwegian DPA Datatilsynet, which initiated an investigation and contacted the controller.
The controller acknowledged that it had not responded to the data subject’s access request because the emails had ended up in the spam filter. It also confirmed that it did not provide information on the processing in question, directly to shareholders or in their privacy policy, but claimed it relied on the exceptions set out in Article 14(5)(a) and Article 14(5)(c) GDPR.


facts_Rb. Noord-Nederland - C/18/190912/HA RK 19-19

On 1 December 2006 plaintiff was arrested and charged of murdering an 8-year old boy. The first conviction was on 6 September 2007 and after multiple appeals on 22 may 2012 the final verdict was 11 years and 7 month prison followed by an involuntary commitment. The European Court of Human Rights rejected the application he made there. During the whole time, there was a lot of media coverage about this case and all proceedings. On 24 May 2015 the involuntary commitment started, and it has been extended with two years twice on 2 June 2017 and 29 May 2019. There was also media coverage about these extensions.
When searching using Google search for the name of plaintiff, a lot of search results are found with publications about the crime he committed and the legal proceedings afterwards. After a request, Google removed 100 search results, but denied to remove 82 other results. It explained that with: "It is Google's understanding that the information about your client on these URL's - with regard to all the circumstances of the case we are aware of - is still relevant in relation to the purposes of data processing, and therefore the reference to this document in our search results is justified by the public interest."

Dispute

Plaintiff
The search results include information about criminal convictions and background of the crime. Based on Article 10 GDPR data processing about criminal convictions is only allowed under the control of an official authority. Data processing would also be allowed if processing is authorised by Union or Member State law, but this does not apply. Based on this, Google may not process this data. Article 32 GDPR and Article 33 GDPR also cannot justify the processing.
Based on CJEU - C-131/12 Google Spain, Hoge Raad - 15/03380 and Article 17 GDPR a weighing of the interests should take place as defined in the Costeja ruling.
Applicant's right to privacy shall normally outweigh Google's economical interests.
In this case applicant's right to privacy shall prevail because information about a crime committed 12 years ago is not relevant any more. Every month, there are just 110 searches made about this case. Applicant is released from prison, and want to start a new life. This becomes impossible because of these search results. Applicant is not a public figure, but even if he is, the public does not need this particular information any more. There is no longer a discussion about the conviction of applicant.
The search results make it difficult for applicant to find a job. Employers use Google to find information about applicants. This causes him to limit the jobs he can find. The only relevant information could be the extension of the involuntary commitment, but the public discussion about problems related to involuntary commitment should not hurt him.
Not only the current list of URL's should be considered, but Google must also be forced to remove all future search results.

Defendant
Based on Article 17 GDPR and Article 21 GDPR it is only possible to request to delete specific search results, because a weighing of the interests must be made for every search result.
The right to be forgotten can only be based on Article 17 GDPR and/or Article 21 GDPR. In this case this does not apply.
Applicant bases his request on Article 10 GDPR. The goal of article 10 was never forbid search engines to process any special categories of personal data. Based on CJEU - C-136/17 - GC et al v. CNIL, a weighing of the interests must also be made for special categories of personal data. Article 17(3)(a) GDPR contains an exception to protect the freedom of expression and information which also applies to personal data relating to criminal convictions and offences. The balancing of interests is to his disadvantage. Applicant does not point to any wrong information found on the pages linked to in the search results. So the data processing by Google is correct. Because of the seriousness of the crime for which he was convicted, the extent to which that crime shocked society, the fact that his criminal trial has been subject of public debate in several instances and the fact that the criminal case has been reported by many media, it is logical and balanced that a large proportion of the search results relate to the crime committed.
There is a public interest in finding information about the crime committed by the applicant. The seriousness and severity of the crime committed by the applicant, as well as the subsequent investigations, indictments and convictions have resulted in almost all Dutch media and also some foreign media reporting about him. The murder of the victim has become an act of history. As opposed to "right to be forgotten" there is also a "right to remember". Applicant is a public figure. His fame is a direct and inevitable consequence of his own actions. Applicant wrongly claims that the public no longer has an interest in the contested information because there is no longer a public debate about his conviction and because the crime took place 12 years ago. However, the public has an interest in information about current and recent criminal cases, but also in information about known criminal cases that lie further in the past. Moreover, in 2017 and 2019, many more news items were published about the extension of the term of applicant's involuntary commitment. Applicant is still in a forensic position. In 2021, a new assessment will be made as to whether the term of applicant's involuntary commitment will be extended once again or whether applicant will be released. The developments in the criminal case of applicant are therefore still relevant and topical at this time. At the present state of affairs, it is difficult to see that applicant should be indemnified against any association on the internet with the criminal offence he has committed in the event of an unaccompanied leave of absence or an attempt to apply for a job. Against this background, the request by applicant to have the search results in his name removed is premature.


Several private companies challenges the guidelines of the CNIL on cookies on several grounds, including excess of powers.

Dispute


The controller is a private health insurance company. The data subject is a customer of the controller. The parties are in dispute about the validity of several increases to the insurance premiums. The data subject requested refund of overpaid premiums as well as information on all adjustments to the premiums in the form of notification letters sent to the data subject and supplements to the insurance policy to verify the lawfulness of the increases. The controller rejected both claims. Consequently, the data subject filed a lawsuit against the controller with the Regional Court of Essen (Landgericht Essen - LG Essen).


The complainant (hereinafter the "company") is a limited company under Austrian law conducting business as pharmacy wholesale. It was subject to an audit of the Bundesamt für Sicherheit im Gesundheitswesen (hereinafter "BASG"), the Austrian Federal Office for Safety in Health Care. In the course of this audit, the BASG processed personal data of the company.
The company lodged a complaint with the DSB, claiming that the BASG had violated the company's right to confidentiality of personal data pursuant to §1(1) DSG by unlawfully collecting, processing, disclosing and failing to delete the company's personal data ex officio.
The BASG contested the company's entitlement to lodge a complaint with the DSB, as the company was not a natural person.
Further, the BASG contested to have violated any data protection rights, mainly because under Austrian Law the BASG was under a legal obligation to process the data in connection with the audit.

Dispute
  * Does §1 DSG apply to legal persons?
  * If so, do the provisions of the DSG, which deal with the procedure before the DSB, also apply to legal persons?


FACUA - Asociación de Consumidores y Usuarios en Acción (FACUA) filed a complaint against Asociación de Afectados por las Asociaciones de Consumidores (ASOCAPAC). The complaint concerned ASOCAPAC's cookie banner.
The Spanish DPA (AEPD) identified the following proven facts. Firstly, the cookie banner on ASOCAPAC's website did not provide concise and intelligible information as it only mentions: "This website uses its own and third party cookies to offer you a better experience and service (...)". This undermines the clarity of the message.
The Spanish DPA also established that the cookie policy (in the second layer of the banner or on the Privacy Policy page) provided additional information on what cookies are and first and third party cookies are used for. However, there was no information on the identification and the time that they were active.
Additionally, the DPA found that there was no mechanism to reject all cookies.

Dispute
Is the lack of information and the lack of a possibility to "refuse all cookies" on a cookie banner a breach of Article 22(2) LSSI?


facts_RvS (Netherlands) - 202006082/1/A3

A data subject submitted an an access request to the Municipality of Leeuwaarden concerning information on the collection, processing, and storage of data by the chip card reader attached to the waste container at his home address.
The request included the following words:
"Yours faithfully but with kind regards,: [appellant name]: I AM Without Prejudice UCC 1-308 Beneficiary, Authorized Agent and Representative for the legal fiction [appellant name]"
In response, the Municipality asked the data subject to submit his request online and signed with his DigiD within 14 days, or to identify himself at the town hall with a valid identification document. DigiD is an identity management platform used by government agencies in the Netherlands. The Municipality explained that the request concerns personal data, which must not be provided to the wrong person, and it is therefore important to properly establish the data subject's identity. Indeed, Recital 64 GDPR states that the controller should take all reasonable steps to verify the identity of a data subject requesting access. And, following Article 12(6) GDPR, if there is reason to doubt the identity, additional information may be requested that is necessary to confirm the identity of the data subject.
When the data subject did not identify himself in the way it requested, the Municipality issued a decision stating it would not consider his request. The data subject lodged an objection to this decision, which the Municipality declared unfounded.
On 2 October 2020, the District Court of Northern Netherlands dismissed an appeal by the data subject regarding the Municipality's decision to reject his request. The data subject ('appellant') then appealed to the Council of State.
The appellant argued that the District Court erroneously ruled that the Municipality could reasonably doubt his identity and could therefore ask him to identify himself. In particular, this is because the Municipality had previously sent letters to him, which he had answered without further identification being necessary. It is unlikely that the data requested by him would not reach him along the same route. Further, in another procedure from 2018 against the Municipality about a municipal tax assessment, he signed his letters in the same way and that was no reason for the college to doubt his identity. In those proceedings, the Commission itself referred to data from the waste processor to demonstrate that waste had been presented. It is contradictory that the Board now refuses to provide such information to him.
The appellant also argued that the Municipality's request for him to submit his request digitally with DigiD or to visit the town hall to identify himself was a disproportionate way to establish his identity, partly because it concerns data from the waste processing of the residential address where only he lives. Lastly, in view of the non-sensitive nature of that data, the Commission could have sent the data to his address without any problem.


The parties asked the French Supreme Administrative Court (Conseil d’Etat) to suspend the centralisation and data processing of personal data relating to Covid-19 on the health data platform ‘Health Data Hub’ (data controller). The EU subsidiary of the American corporation Microsoft, established in Ireland, has access to personal data on the Hub as it licenses the software necessary to operate it (data processor). The data centre is located in the Netherlands.
The parties also asked the Court to request the French DPA (CNIL) to rule on the implication of the invalidation of the Privacy Shield agreement in relation to personal data processed in the Health Data Hub.
The parties highlighted that the condition of urgency was met. This is due to the urgent nature of the Covid-19 pandemic, the sensitive nature of the data centralised and processed in the Health Data Hub and the recent CJEU decision (“Schrems II” of the 16th July 2020).
Finally, they deemed that there was a serious violation of the right to privacy and to protection of personal data. This is due to the fact that the company in charge of the Health Data Hub’s technical aspects, Microsoft, is subject to US law. The risk that this posed to the above-mentioned rights were outlined in the Schrems II decision.

Dispute
Is the contract between the French Health Data Hub and Microsoft, as a company subject to US surveillance law, in violation of Article 44 to 49 GDPR following the Schrems II decision?


A data subject complained that 401 Athens General Military Hospital unlawfully processed personal data of people entering the hospital, collecting details from their ID and information about where exactly in the hospital they intend to go, time of entrance and exit.
The Military Hospital claimed that this information was necessary for the security of the hospital and that in any case, the DPA was not competent to deal with the case as it concerns data related to activities concerning national security.

Dispute


Controller is Scalable Capital, a financial services company via which customers can invest in shares etc. Data subject is a customer of this company. Upon registration, they provided numerous personal data to the controller inter alia a photo of their ID-card. On 19.10.2020, the controller informed the data subject of a data breach. Unauthorised third parties had acquired access to the following personal data of data subject: first- and last name, title, address, e-mail address, mobile phone number, place of birth, place and country of birth, nationality, marital status, tax residence and tax ID, IBAN, copy of identity card, portrait photo, which was taken in the Post-Ident procedure. Moreover, this data was accessed by these third parties on three separate instances in the period from April to October 2020. In total, these third parties had copied and stolen 389,000 records of 33,200 affected persons.
The attackers were able to access the whole IT system of controller because they had acquired the access information via controller’s former IT Service provider, CodeShip Inc. Although this service provider no longer provided IT services to controller since late 2015, the access data to controller’s system had never been changed. The stolen personal information was used to obtain loans, and was offered for sale on the Darknet.
Because data subject feared for identity theft and other fraud, they brought the action before Court and claimed compensation pursuant to Article 82(1) GDPR, because controller violated Article 32(1) GDPR.


The plaintiff lodged a complaint with the Belgian DPA after their former employer, the defendant, sent them the remaining money they were owed to an address obtained by consulting the national register for natural persons. The plaintiff argued that the defendant had not processed the data lawfully, since they had not consulted the register within its defined purposes.
To this the defendant replied that they were unsure of their former employees' address and thought that the national register could be consulted in any case, because they had access to it within the scope of their profession.

Dispute
Can the collection by a notary of personal data contained in the national register for natural persons be justified by the sole fact that within the scope of their work they can already access said register?


facts_Rb. Midden-Nederland - ECLI:NL:RBMNE:2023:6043

On 2 December 2022, the data subject made an access request to the University of Utrecht (the controller), under Article 15 GDPR. In the request, the data subject asked for 'all information about my [their] records'.
On 11 January 2023, the controller responded asking the data subject to clarify their request, as the original request was too general and not specific enough.
On 13 January 2023, the data subject replied, noting that they did not need to provide the controller with any more information.
On 10 February 2023, the controller set aside the data subject's request due to their lack of response and notified them thereof. The data subject subsequently brought a claim against the controller in the Central Netherlands District Court for the lack of response to their access request.


The CNIL received 16 complaints between 2018 and 2019 specifying that users were facing difficulties for deleting or rectifying their data on the annuairefrancais.fr website. The website hosts information about companies registered in France that are published on the SIRENE database - a public database managed by the National Institute for Statistics and Economic Studies (INSEE). The website annuairefrancais.fr offers the possibility of creating an account allowing users to get information about registered companies and to subscribe to commercial offers from these companies. After an initial inspection, the CNIL found that the processing was not compliant with the GDPR and issued a formal notice giving the company two months to bring its processing practices into compliance by implementing a clear policy regarding data deletion and rectification, establishing a record of processing activities and dealing with the data subjects' requests.


A data subject had submitted an access request to the Board of Public Prosecutor’s office seeking to obtain information about any personal data about him being processed by the Board. The Board, as a defendant, treated his request as a general access request under Article 15 GDPR and Article 39(i) Judicial and Criminal Records Act (Wet justitiële en strafvorderlijke gegevens - WJSG). Under Article 39(i) of the WJSG, data subjects have the right to request the Board to obtain confirmation as to whether criminal records about them is being processed and, if so, to obtain information about the processing thereof.
On 31 August 2022, the Board thus provided the data subject with two separate documents, one regarding the criminal records about him that were being processed under the WJSG and the other containing all other personal data about him being processed under the GDPR. The data subject, the plaintiff claimed that the response was incomplete. The defendant thus asked him to substantiate his request and the data subject answered that he wished to receive all data concerning him that was being processed. The defendant then added additional personal data and criminal records of the plaintiff that were found in its database.
Still unsatisfied with the response, the plaintiff appealed against the judgment.


facts_Garante per la protezione dei dati personali (Italy) - 10065894

The controller installed five video surveillance cameras on their external wall, with three of them functioning and recording an alley area where property ownership was disputed.
The cameras were capable of capturing the secondary doors and windows of neighboring houses. While the controller claimed exclusive ownership of the alley and argued that neighbors had illegally built doors and windows on the perimeter wall, they failed to adjust the cameras' angle after being notified by the DPA to do so.


facts_ANSPDCP (Romania) - Fine against Global Ports’s Services S.R.L.

The controller installed a GPS monitoring system in a company car. According to the controller, the purpose of this installation was the necessity of keeping track of the working time of employees. Data subjects were not informed about the existence of such a tracking device.
The data subject, an employee, filed a complaint with the DPA.


An employee (the data subject) had quit their job and was supposed to assist the employer (the controller) during the notice period. However, due to disagreements, the controller blocked the data subject's access to email and business systems and enabled automatic forwarding of emails to the general manager of the company.
The data subject objected to this processing, but the controller upheld it for several weeks and only stopped it when the general manager realized it could be problematic. The Norwegian DPA (Datatilsynet) launched an investigation after receiving both a notification from the controller, as well as a complaint from the data subject.
The controller explained to the DPA that they had enabled automatic forwarding of the emails because the data subject had refused to enable an out of office reply. They further argued that this was necessary to uphold customer relations and daily operations, and because they had discovered that the data subject had violated work duties a few months earlier.
The controller also claimed that the data subject had consented to the processing, however this was denied by the data subject and the controller was unable to document their assertion.


facts_DPC (Ireland) - Meta Platforms Ireland Limited (Instagram) - IN-18-5-7

In order to access Instagram, an online social network service operated in the EU by “Meta IE”, a user was required to provide certain information and accept a series of terms and conditions (the “Terms of Use”).
Under the GDPR, Instagram was obliged to have a lawful basis for the processing of personal data of its users. Article 6(1) GDPR details the lawful bases upon which such data can be processed. The company was also obliged to provide detailed information to users at the time their personal data was obtained in relation to, among others, the purposes of any data processing and the legal basis for such processing. To continue to access the Instagram platform, all users were required to accept the updated Terms of Use prior to 25 May 2018, the date the GDPR became applicable. Those existing users who were not willing to accept the new terms were advised of the option to delete their Instagram account.
A Belgian Instagram user, the “data subject” and “complainant”, filed a complaint against Meta IE, the controller. The complainant was represented by “noyb – European Centre for Digital Rights”, a privacy NGO based in Austria. The complainant alleged that Meta IE’s data processing practices on the Instagram platform amounted to “forced consent”, and constituted a violation of the GDPR. The complaint, originally filed with the Belgian DPA (APD), advanced a number of grounds upon which the consent of the data subject could not be considered “freely given”.
Firstly, there existed a clear imbalance of power between controller and data subject. This is likely to affect the voluntariness of the latter’s consent for the processing of personal data. The complaint alleges that, in this case, the controller undisputedly has a dominant market position in the area of social networking services and, in combination with the “lock in” and “network” effects, the data subject is left with no other realistic alternatives.
Secondly, the use of the Instagram service is conditional upon the data subject’s consent to collection of their data, when such data processing is not necessary for the provision of the service. Article 7(4) GDPR, which defines the conditions for consent, specifically states that “utmost account shall be taken of whether, inter alia, the performance of a contract… is conditional on consent to the processing that is not necessary for the performance of that contract”. As such, the “consent” upon which the controller seeks to rely is invalid.
Additionally, the complaint raises the issue of granularity, as the controller relies on an overall bundled consent to anything contained in the terms and the privacy policy. This represents an “all-or nothing” approach contrary to the requirement of the GDPR for “specific” consent to processing.
Finally, the controller shall enable the data subject to refuse consent without any detriment. However, in this case, the data subject faces significant disadvantage, as their account would be deleted – as a consequence of withdrawal – and they would lose a crucial form of social interaction.
The Belgian DPA (APD) referred the case to the Irish DPA (DPC) under article 56 GDPR, and in accordance with the procedure outlined in Article 60 GDPR.
In response to the complaint Meta IE submitted, among other points, that agreeing to the Terms of Use amounts to a contractual agreement and is not an act of consent for the purposes of Article 6(1)(a) GDPR. The company stated that it “does not in any way seek to ‘infer’ consent from a user to process personal data based on their agreement to the Terms of Use” (Para 41).
On 1 April 2022, the DPC shared its Draft Decision with the other Data Protection Authorities (DPAs) in accordance with Article 60(3) GDPR. Ten DPAs (AT, DE, ES, FI, FR, HU, IT, NL, NO, SE) raised objections, in accordance with Article 60(4) GDPR, to the Draft Decision. On 11 August 2022, the matter was referred to the European Data Protection Board (EDPB). The EDPB adopted a binding decision on 5 December 2022 and the DPC issued its Final Decision on 31 December 2022, published on 11 January 2023.


facts_Persónuvernd (Iceland) - Nr. 2020123144

In Iceland, the processing of personal data relating to the creditworthiness of individuals is regulated, among others, by Article 2 of Regulation no. 246/2001 as well as Article 15 of the Icelandic Data Protection Act no. 90/2018. In particular, companies willing to publish information relating to the creditworthiness of individuals must first obtain an operating license from the Icelandic DPA, which sets out specific terms for the processing of personal data for the purpose of credit scoring.
Such a license was delivered by the Icelandic DPA to the company Creditinfo on 29 December 2017. According to the terms of this operating license, Creditinfo had to, prior to the publication of any financial data relating to individuals, inform them by sending an information notice by letter. The operating license does not require such letters to be registered letters. The information notice is supposed to give to data subjects the opportunity to present objections (for example, if the data are inaccurate or incomplete, or if a settlement had been reached).
On 28 December 2020, the Icelandic DPA received a complaint from a data subject (hereinafter the Complainant) regarding the publication of information about him in the default register of Creditinfo. The Complainant claimed that he hadn't received any information prior to the publication of these data, and that, in spite of his erasure request, Creditinfo had refused to delete the concerned data.
Creditinfo, for its part, was arguing that a letter dated March 16, 2020, had been sent to the complainant, and provided evidence thereof to the Icelandic DPA. Credit info further specified than in case the individual does no longer live at the indicated address, the letter is normally returned, and the address is corrected by taking into account the data of the National Registry. In that case, however, Creditinfo informed the Icelandic DPA that the letter had not been returned.


facts_CNPD (Portugal) - Deliberação 2021/533

The Portuguese National Statistical Institute ("Instituto Nacional de Estatística") was undertaking the 2021 census by collecting data through forms on their own website "CENSOS 2021", and using various website security and content delivery services of Cloudflare, a service provider headquartered in the United States.
The Portuguese DPA ("Comissão Nacional de Proteção de Dados", CNPD) received various complaints from people, mainly that citizens were obliged to disclose their full name, but also that personal data was being sent to the United States, due to the use of Cloudflare as a service provider.
The DPA's investigation found that the Institute's use of Cloudflare as a content delivery network did not guarantee that personal data would be processed in the European Union or in other countries, some of which may not ensure the adequate level of protection of the personal data required by the GDPR, given Cloudflare's network extended to more than one hundred countries. Cloudflare's service uses anycast to route incoming traffic to the nearest data centre to the user, using IP addresses registered in the United States.
Although the algorithm that routes the traffic is supposed to chose the closest server possible to the origin of the request, it is not guaranteed that the data is not sent to other servers located in countries without such level of protection.
The DPA also noted that the census website used Cloudflare's own certificates to encrypt website traffic, rather than encryption using the Institute's own private and public keys. Accordingly, the security protocol used by Cloudflare deprives the Institute of control regarding the transfer. Such protocol is fully controlled by Cloudflare, which possess both the private and public key of the encryption.
At the time of the investigation, more than six million Portuguese citizens had completed the census, what amounts to more than half of the Portugal population. The 2021 national census was mandatory and included the collection and processing of special categories of personal data, including health and religious beliefs.


A package from Carrefour was to be delivered to the data subject's address. In case the data subject was not at home, they gave the permission to deliver their package to their neighbour. However, the package was delivered to someone else.
As the controller, Carrefour has a contract with a processor responsible for deliveries, Fourth Party Logistics SL. In this contract, it is established that the processor should notify the controller in case of contracting a subprocessor. Even though a subprocessor did the delivery, Carrefour was not notified of the existence of any subprocessor.
The processor (Fourth Party Logistics SL) explained that there were two subprocessors involved in the delivery, Envialiva World SL. and The Bee Logstics SL, however no contract between these parties was presented to the DPA. The processor Fourth Party Logistics SL did not comply with their contract with the controller and there were no formal agreements with the subprocessors.


facts_Datatilsynet (Denmark) - 2021-432-0056

Following the Danish DPA's (Datatilsynet) decisions (from September 2021 as well as July and August 2022) related to Helsingor municipality's processing of personal data using Google products and services, Aarhus municipality reassessed their risk assessment during August 2022. On 1 September, they sent the DPA a request for consultation as per Article 36 GDPR along with the relevant documentation, as they were using the same processing setup (Google, Google Chromebooks, Google Workspace for Education).


facts_Garante per la protezione dei dati personali (Italy) - 9542096

On 19 September 2019, the data subject requested Poliambulatorio Talenti S.r.l. to access his and his two minor daughters' personal data. On 23 October 2019 he filed a complaint with the Garante as he had not received a response from the polyclinic yet. On 18 November 2019, the DPA invited Poliambulatorio Talenti to comply with the request within 20 days. Two days later, the polyclinic replied to the data subject and apologized.
Following the polyclinic’s answer, the data subject complained to the Supervisory Authority that in the forms related to one of his daughters’ consent to the processing of personal data, and to receive reports from the clinic via email, there was the name of a male individual. The Garante hence asked Poliambulatorio Talenti for clarifications, in particular concerning the possibility of a data breach, and concerning the measures implemented to ensure the accuracy and confidentiality of personal data.
In response to the request for information, the healthcare facility clarified that the reason for the incorrect name entered in the system was due to the fact that the male individual shared the same surname as the mother of the complainant's minor daughters. The polyclinic also stated that there was no communication of the personal data of the complainant’s daughters to said male individual, or to anyone, since the data is kept only in paper form and is accessible only by authorised internal personnel.
In subsequent documentation sent to the Garante, Poliambulatorio Talenti argued that the delay in replying to the data subject was due to issues with the hardware system, and that the inaccuracy in the name entered in the system was caused by “a material mistake due to the decision to copy by hand the data of the minor's mother”. During a hearing, the clinic also asked the Garante to close the case, or apply the lowest possible fine.


KASPR runs a Chrome browser extension which allows users to get the business details of people whose LinkedIn profile they had visited. On the 28 July 2022, the French DPA (Commission nationale de l’informatique et des libertés – CNIL) carried out a compliance check with KASPR, the controller.
The investigation showed that approximately 160 million contacts were included in the controller’s database. These entries included the surname, first name, e-mail address, telephone number, LinkedIn profile URL or other social networks, employer, company, job title, skills, professional interest, career, date of hiring and end of post, training, place of work, source of data and date of collection.
Harvesting the data from LinkedIn and storage
On LinkedIn, users can choose between four different visibility options: 1 – Only visible to me, 2 – Anyone on LinkedIn, 3 – 1st degree connections and 4 – 1st and 2nd degree connections.
The controller collected the contacts details of LinkedIn users who had made their details visible to all (Option 2) as well as those whom had limited the visibility to 1st and 2nd degree connections (Options 3&4).
Providing information
Four years after the implementation of the KASPR tool, the controller notified data subjects by sending an email which informed them of the practice and gave the option to object to the processing by clicking on a link in the email. When data subjects filed access requests under Article 15 GDPR, the controller merely responded that their personal information was retrieved from publicly available sources.
The controller’s argument
The controller argued that the processing is based on its legitimate interest to facilitate connection between working professionals aligning with the intentions of data subjects active on LinkedIn. Further, it argued that identity verification should reasonably be expected by users of a professional networking service and that data was collected according to the selected options on LinkedIn.


The applicant asked Google to remove search results for his name, under the "right to be forgotten". Google decided not to take action on certain URLs. Two months later, the applicant submitted a new (repeated) request, which was rejected by Google for the same reasons. The applicant then lodged a complaint in front of the Dutch civil courts.
In Netherlands, the instigation of legal proceedings against a data controller on the basis of the GDPR has been further regulated by the "GDPR Implementation Act". According to Article 35(2) of this local law, data subjects who wish to challenge a data controller' decision on a request made on the basis of Articles 15 to 22 of the GDPR, shall lodge their petition in front of the civil courts within six weeks of receipt of the decision. According to the Dutch case law, exceeding this six-week period leads, in principle, to inadmissibility.
Consequently, Google was of the opinion that the applicant's petition was inadmissible as it was submitted later than six weeks after Google's first reply, and therefore not within the period prescribed by Article 35(2) of the GDPR Implementation Act.
On the contrary, the applicant was of the opinion that his second (repeated) request started a new time-limit. According to the applicant, neither the GDPR nor its Implementation Act limits the number of applications which may be submitted. In that regard, the applicant refers to the text of Article 21(1) of the GDPR, which states that requets for removal can be made "at any time".

Dispute
Should the applicant's complaint be declared inadmissible for not respecting the time limits as set out to in Article 12(5) of the GDPR and Article 35(2) of the Dutch GDPR Implementation Act?


A data subject filed a complaint with the DSB claiming a violation of his right to access under Article 15 GDPR. The DSB partially upheld the complaint of the data subject, ordering the controller, an address publisher and direct marketing company, to disclose to the data subject information about the target groups of personal data about him being processed for advertising purposes and the names of the recipients of such data as it failed to fully comply with the access request.
The controller then appealed the decision before the BVwG, claiming that it is not obliged to disclose such information. The BVwG started evaluating the case but then suspended the proceedings, pending the decision of the CJEU in case C-154/21 and issued only a partial decision on 17 May 2022 (BVwG - W214 2233132-1/13E) annulling parts of the DSB's decision.
In January 2023, the CJEU delivered its judgment in case C-154/21 and the BVwG continued the case in May 2023.


In the decision leading to the appeal, the Dutch Employee Insurance Agency, the controller, refused to grant the data subject access to an anonymous tip, which led to an investigation into their sickness (ZW) benefits.
The investigation revealed that the data subject had failed to comply with the duty to provide information, resulting in the recovery of €6,010 in unlawfully paid ZW benefits and a fine of €253.33. Following the request of their file, the data subject received all documents except the anonymous tip.
The controller argued that the data subject’s interests were not harmed by the tip, stating that it was the investigation, not the anonymous tip, which constituted the direct cause for the recovery and the fine. Article 7(6)(i) Dutch Access and correction rights regulation (Regeling inzage en correctierecht UWV 2018) (hereinafter: the Dutch Access and correction rights regulation), based on the GDPR, further allows for the controller to deny the data subject’s request to access where this is necessary and proportionate to protect the rights and freedoms of others.
The data subject claimed ongoing harassment by an anonymous tipster, involvement in the childcare benefits scandal, issues with national institutions, privacy violations by the controller, and finally, an intent to initiate civil proceedings against the tipster.
The controller responded by clarifying that the tipster wished to remain anonymous, constituting a situation where the general public interest in maintaining anonymity and ensuring continued reporting outweighs the personal interest of the data subject.


facts_LfD (Lower Saxony) - Fine EUR 900,000 against bank

A commercial bank (controller) used personal data of current and former customers (data subjects) to identify customers with an affinity for digital media usage, in order to address them more intensely through electronic communication channels for further commercial communication (advertisement).
A service provider analyzed digital usage behavior on behalf of the controller, including the total amount of app-store purchases, the usage frequency of bank statement printers as well as the total amount of transfers in online banking system (in comparison to the offline usage in their local branch offices). The results were compared and further enriched with data from a commercial credit reporting agency. Most customers were informed in advance, but no consent under Article 6(1)(a) GDPR was obtained.
The controller based the data analysis, data enrichment and the subsequent creation of customer profiles on legitimate interest as per Article 6(1)(f) GDPR.


In 2019, the data subject brought a complaint to the Czech Telecommunications Office regarding the billing of telephone calls from January 6 to February 5 2019. The company providing the publicly available electronic service network did not provide information on outgoing calls on 15 January (compared to other days in which calls were made), and did not provide information on incoming calls. The Czech Telecommunications Office upheld the data subject’s complaint. The case was appealed by the company to the District Court in Bruntál (January 2022) and the Regional Court in Ostrava (September 2022). Both Courts dismissed the appeals, and the case was brought to the Supreme Court on September 2023.
The company argued that retaining data on incoming calls for a specified period was not in the scope of the Czech Electronic Communications Act, and that the data processed was personal data covered by “special legislation” (the GDPR is not mentioned here, however, the Court then includes the GDPR and ePrivacy Directive in its reasoning).


The data subject filed a complaint with the Austrian Data Protection Authority (DSB) against the controller, requesting to be provided with recipients to whom the personal data had been shared under Article 15(1)(c) GDPR, rather than mere categories of recipients.
The controller refused, arguing that a controller has a right to choose whether to provide a data subject with information on actual data recipients or rather just categories thereof. Further, the controller argued that the disclosure of actual data recipients would reveal its trade secrets.
The DSB upheld the data subject's complaint and ordered the controller to provide the data subject with information on the actual data recipients. The controller filed an appeal against that decision with the Austrian Federal Administrative Court (BVwG), repeating its arguments brought forward before the DSB.


In April 2019, the data subject sent an request for erasure of data on several payment defaults and some address data to the credit reference agency (CRA) CRIF GmbH because the debts had all been cleared. The CRA refused the erasure, stating that the data was still relevant for the purposes of assessing the data subject's creditworthiness.
In June 2019, the data subject lodged a complaint with the Austrian DPA (Datenschutzbehörde - DSB), stating that all debts still stored in the CRA's data base have been cleared and that several debts only concerned insignificant amounts.
The DSB rejected the complaint regarding the data on payment defaults but ordered the CRA to delete data on an old address of the data subject. The DSB held that the data on the payment defaults concern a total amount of more than EUR 3,000 and that none of the debts has been cleared more than 5 years ago. Under case law by the BVwG (see BVwG - W211 2225136-1), CRAs are allowed to store data on payment defaults or insolvencies for a five-year period after the clearance of the debt.
The data subject filed an appeal against this decision by the DSB. In this appeal he/she also argued (for the first) time, that the CRA had also violated Article 14 GDPR because the data subject had never been informed about the processing of his/her data. Hence, the data must also be deleted under Article 17(1)(d) GDPR.

Dispute
Was the CRA allowed to still store data on payment defaults after the debts have been cleared? If so, for how long?
Does the failure to inform the data subject under Article 14 GDPR result in the general unlawfulness of the processing and the obligation for the controller to delete the data under Article 17(1)(d) GDPR?


A local political association has sent out election advertisements to the residents of the municipality for the local elections in 2018. For this purpose, the association used the electoral roll from 2012 and compared it with that of 2018.

Dispute


The controller offers services that allow a device user to remain identified even when browsing in incognito mode or using a VPN by assigning them a unique identifier. A demo on the controller’s website showed that a unique ID is assigned to each visitor of the website, which, when combined with the user’s location, allows to track, among other things, the number of visits.
The data subject sent an access request and indicated that he may decide to delete this data after receiving the access request.
Since contacting the controller, the data subject had been receiving marketing emails.
The data subject lodged a complaint with the Belgian DPA (“APD”). The complaint was twofold: on the one hand, the data subject criticized the services provided by the controller and considered that there was probably no legal basis for these processing operations. On the other hand, they challenged the controller’s failure to provide a positive response to their erasure request.
The data subject also indicated that other parties could potentially use the same technology in a way that does not comply with the GDPR.
The data subject attached a mail summary which shows an email exchange between the data subject and the controller, but the actual content of the email exchange was not shared with the APD.


facts_AP (The Netherlands) - Boete voor gemeente Voorschoten

The municipality of Voorschoten implemented a waste collection system using chipped containers and tokens to regulate household waste disposal. The system collected personal data, including addresses, container/token numbers, and timestamps of waste disposal. The municipality stored this data for extended periods (up to five years for tokens and indefinitely for containers).

At the end of 2018, the above-ground shared containers were replaced by underground containers to serve residents of high-rise buildings. Undergroung containers can only be opened with a token, which contains a chip with a unique number. It can be determined for each underground container which tokens have access to the container. A container can be opened five times a day, after which access to the container is denied. After the container has been opened with a token, the municipality stores data in a municipal IT system. This concerns token number, address details, date and time of the dumping, location details and type of waste. This data was stored for five years.
In March 2019, all grey residual waste containers were replaced by new containers with a chip for low-rise buildings. Each household (residential address) now has only one container. The garbage truck is equipped with a reader that can read the number of the chip. If it is recognised, the container is emptied. The municipality then stores data in an IT system of the municipality's collection service. This concerns the chip number, the associated address, date and time of emptying, location data of emptying and type of waste. The container cannot then be emptied again for two weeks because the garbage truck will not accept the container. This data remained in the IT system as long as the container was in use and the data was deleted from the system when the container was replaced.


Several companies in the Amazon group collected data about the behavior of visitors (the data subjects) on Amazon websites and used them to displaying interest-based advertising, under the legal basis of legitimate interest. The data were also disclosed to third parties in order to enable interest-based advertising on third-party websites.
In 2018 French non-profit La Quadrature du Net filed a complaint with the French data protection authority. La Quadrature du Net claimed, among other things, that Amazon could not rely on the legal basis of legitimate interest for collecting personal data for the purpose of providing interest-based advertising. La Quadrature du Net also claimed that Amazon failed to comply with the exercise of several rights of the data subjects.
Under the European cooperation mechanism, the Luxembourgish DPA was the lead supervisory authority to decide on the matter under Article 56 GDPR.
In an unpublished decision from 2021, the Luxembourgish DPA held that the data controller (an unnamed Amazon subsidiary referred to as "AA") unlawfully processed personal data for interest-based advertising, did not properly inform the data subjects about the processing of their data, failed to transparently inform the data subjects about the processing of their data, failed to respond to access requests as well as requests for erasure, and did not provide data subjects with an easy way to opt out of interest-based advertising. Overall, the controller violated Articles 6(1), 12, Article 13, 14, 15, 16, 17 and 21 GDPR.
The data controller filed an appeal with the Luxembourgish Administrative Court seeking the reversal, if not the annulment, of the decision. The appeal challenged many aspects of the Luxembourgish DPA’s decision.

The legal basis of legitimate interest
The DPA held that the controller could not rely on the legal basis of legitimate interest to process personal data for the purpose of providing interest-based advertising. The controller challenged this finding in several ways.
During the procedure with DPA, the controller claimed that its processing of personal data was based not only on the controller’s own commercial interest but also on the interests of the wider community in a vital and growing Internet economy. The controller claimed that the DPA failed to take this broader interest into account in its assessment of legitimate interest.
Furthermore, the controller contested the DPA’s finding that the processing of personal data was not necessary to pursue the controller’s commercial interest.
Additionally, the controller claimed that the DPA failed to properly assess the balancing of legitimate interest. Specifically, the DPA did not take into account the limitations and safeguards put in place by the controller.
Finally, the controller claimed that it changed its interest-based practices and relied on consent “in almost all cases”.

The controller's transparency obligations
The DPA held that the data controller failed to properly inform data subjects about the processing of their data for interest-based advertising. In the DPA’s view, the privacy notices on the controller's websites lacked essential information, including:
- Information about the specific legitimate interest pursued and the balancing of that interest against the rights and freedoms of data subjects;
- the logic behind the processing of personal data and the consequences of the processing for the data subjects
- the categories of recipients of personal data
- the data retention periods
- the categories of personal data obtained by third parties
- the non-EEA countries to which the controller transferred personal data, and the non-EEA recipients of these data.
The DPA also held that the controller made the information unclear by dividing it between three distinct notices. Finally, the DPA held that one of these notices could lead data subjects to believe that their data were not processed and shared with third parties.
The controller contested all of the DPA's findings and claimed that its notices provided all the information required by the GDPR. The controller claimed that providing in-depth, item-by-item information on certain aspects of the data processing (the data retention times for each category of personal data collected, the categories of personal data collected from third parties, and the non-EEA jurisdictions and non-EEA recipients involved in the controller’s data transfers), would have made the information unclear. In the controller’s view, generic information on these topic was both sufficient under the GDPR, and more comprehensible for the data subjects. Likewise, the controller claimed that explicitly referring to legitimate interest as the legal basis for processing personal data, would have made the information unclear because the expression "legitimate interest" is not widely understood. Finally, with regards to data transfers, the controller claimed that the GDPR did not require it to provide information on every single non-EEA Country and recipient involved.

The right to object
In its original decision, the Luxembourgish DPA held that the data controller violated Article 21 GDPR by making it difficult for data subjects to opt out of interest-based advertising. This was the case because the controller offered different opt-outs for different forms of interest-based advertising. The data controller challenged this finding: it argued that offering granular choices is more respectful of the users’ wishes than offering a single, generalized opt-out.

Other data subject's rights
The Luxembourgish DPA’s decision held that the controller violated the GDPR by denying a data subject access to their data, by failing to allow data subjects to rectify their data, and by failing to comply with a request for erasure.
The controller challenged these findings. It claimed that interest-based advertising does not require the identification of the data subject and that the controller could not be required to identify the data subject under Article 11 GDPR. The controller also claimed that re-identification would have created privacy and security risks for all of the controller’s customers.


facts_ANSPDCP (Romania) - ING Bank N.V. Amsterdam – Bucharest Branch (2)

A controller's contractual partner received from a controller's processor, on two different dates, files containing outdated information in order to issue insurance policies. As result, 270 individuals were affected.

Dispute
Does processing personal data by violating the working procedure leads to a violation of the GDPR?


facts_Rb. Rotterdam - C/10/576091/HA RK 19-701

The plaintiff asked to the State to grant him access to procedural files in which he was involved against the State of the Netherlands concerning forgeries offence. The applicant claimed that the procedural files contained his personal data and evidences which could help him to prove his innocence in the aforementioned case and all the cases in which he would have been involved as party against the State. The State refused to grant him the access.

Dispute
The Court clarified the interplay between the right to inspection under the ePrivacy Directive and the right to access under the GDPR.


facts_Persónuvernd (Iceland) - Case no. 2021101926

The data subject's complaint concerned the display of search results in Google's search engine. The search results referred to articles which discussed the alleged bullying which took place at the complainant's workplace. Google LLC, the controller, denied the complainant's request to remove the search results on the basis that there was no indication that the press coverage were false. Moreover, Google LLC argued that the press coverage was still considered to serve the public interest since it was published a short time ago.
Although the exact circumstances are not further elaborated in the decision, the DPA acknowledge that the data subject had a role in public life.


The PERFORMECLIC Company's activity is the sending of commercial e-mails on behalf of advertisers. As such, the company holds a database of 20 million e-mail addresses that it has purchased from a third party company.
Following the report made by the SIGNAL SPAM association, the French DPA carried out an on-site inspection at the company's premises on 18 September 2019.

Dispute
  * Insofar as the operational activities of the company were implemented from Morocco, is the GDPR applicable and is the CNIL competent in this case?
  * How is the notion of "consent" to be understood in the context of email prospecting operations?
  * Is the processing of the telephone number in the context of prospection operations carried out solely by e-mail contrary to the principle of data minimisation provided for in Article 5(1)(e) GDPR?
  * Is the simple opening of a prospecting e-mail sufficient to characterise the prospect's interest in the products and services of the sender of the message, and thus to extend the retention period of this data?
  * Is the apposition of a standard mention at the bottom of a prospecting e-mail sufficient regarding the information standards provided for in Article 14 GDPR?


A loan and credit management Company (controller) was repeatedly contacting a data subject by telephone-call regarding the repayment of their alleged debt.
The data subject had already declared personal bankruptcy according to Article 8(2) Law Nr. 3869/2010 and the insolvency court had granted a discharge of the debt in question. After that, the attorney of the data subject filed an objection to the processing of their data according to Article 21 GDPR. The data subject requested the controller to cease contacting them regarding the alleged debt and to erase their personal data according to Article 17 GDPR.
The controller refused to respond to the request claiming that the data subject could not be identified with certainty, due to the data subject's ID number stated on the power of attorney not matching the one kept in the controller's record. The controller claimed that the data subject should first update their personal identification information by visiting a branch office in person.
Consequently, the data subject lodged a complaint with the DPA regarding the processing of their data. The controller stated before the DPA that the data processing was lawful according to Article 6(1)(b) GDPR, since the data subject was still obliged to repay the debt on a legal basis not covered by precedent created from the insolvency court's decision. Regarding the data subject's requests, the controller argued that the data subject acted in bad faith by refusing to update their identification information.


facts_Persónuvernd (Iceland) - 2020092288

In September 2020, the Icelandic DPA initiated an investigation on a digital gift card application provided by the Ministry of Industries and Innovation (the Ministry), and developed by the company YAY ehf (YAY). The aim of the application was to issue a digital gift certificate to all Icelanders over 18 years old in order to stimulate domestic tourism in the summer 2020 during the COVID-19 pandemic.
After the app was published on 18 June 2020, the DPA became aware that, in order to be able to use the digital gift card, the users of the application had to submit their personal data, such as, email address, phone number, age and gender. Moreover, the users were also required in some cases to give an access to their phones´ camera, microphone, GPS location, calendar, contact information as well as data on USB storage.
The DPA decided to open an investigation to assess whether the collection of users´ data and the acquisition of access rights to their mobile devices by the digital gift card application were in compliance with the GDPR and the Icelandic Act no. 90/2018 on data protection and the processing of personal data. In the context of this investigation, the Icelandic DPA found that the Ministry was the controller of the personal data and that YAY was a processor of the personal data.


Parents registered their son to play in junior football Summer Camp with Club Esportiu (controller). At the time of registration, the parents indicated on the form that they did not wish to consent for photographs to be taken of their son.
The club followed up with the parents, urging them to consent to the photographs being taken in order for the registration to continue. The club noted that in any event, they could not guarantee that their child would not appear in photographs taken.
The parents filed a complaint with the Catalan DPA (APDCAT) on June 19th 2024.
During the proceedings, the controller argued that they did not have facial recognition technology and could thus not guarantee that specific children did not appear in group photos taken during the camp. They also claimed that the photos taken were only for use in club publications and their social network pages, and that the complaint should be dismissed.


The Dutch Tax and Customs Administration kept a list to register indications of fraud, the Fraud Signaling Facility (FSV). The list contained over 270,000 entries and was maintained for more than six years. Characteristics such as nationality and appearance were often included as fraud risk factors in the FSV. People were often wrongly labeled as fraudsters, with far-reaching consequences. The Dutch DPA conducted a thorough investigation on the Tax and Customs Administration, finding several violations of the GDPR.


On 1st of August 2022, the data subject submitted a complaint against a neighbor since he had installed a video surveillance camera on his property facing the data subject’s property, more specifically at the swimming pool, without being authorized to do so.