Following noyb’s complaints, the Irish supervisory authority (DPC) issued decisions (IN-18-5-5 and IN-18-5-7) where it was found that Meta Platforms Ireland (Meta) could not rely on Article 6(1)(b) GDPR (contract) for its processing of personal data for behavioural advertising. In those decisions Meta was ordered to bring its processing operations in compliance with the GDPR, in accordance with the conclusion reached by the binding decisions 3/2022 and 4/2022 of the EDPB.
After the DPC decisions, Meta shifted its legal basis from Article 6(1)(b) GDPR (contract) to Article 6(1)(f) GDPR (legitimate interest) for most of its processing of personal data for behavioural advertising.
However, in a recent judgment C-252/21 Facebook Inc. and Others v Bundeskartellamt by the Court of Justice (hereinafter “Bundeskartellamt Judgment”), the Court of Justice essentially held that Meta could not rely on Article 6(1)(f) GDPR for personalised advertising.
Mutual assistance (Article 61 GDPR)
Following the DPC's decisions against Meta as well as the Bundeskartellamt Judgment, the Norwegian supervisory authority – in its role as a concerned supervisory authority (Article 4(22) GDPR) – raised its concerns and requested mutual assistance under Article 61(1) GDPR from the DPC as lead supervisory authority. The Norwegian supervisory authority requested the DPC the following:
  * Firstly, to issue a temporary ban on Meta regarding certain processing operations until Meta has provided adequate and sufficient commitments to ensure compliance with Articles 6(1) and, potentially, with the right to object under Article 21 GDPR. However, the DPC informed that it could not comply with that request.
  * Secondly, to share information on how would the DPC ensure that Meta complies with Article 6(1) GDPR. The DPC replied to the request, but the Norwegian authority viewed, essentially, that the DPC did not reply to the request adequately, and that the DPC did not provide any explanation on the reasons why is the DPC unable to provide the requested information.
Urgency procedure (Article 66 GDPR)
Following the aforementioned lack of assistance by the DPC, the Norwegian DPA initiated an urgency procedure according to Article 66 GDPR. The authority viewed that Meta’s shift towards legitimate interests was unlawful, and that essentially Meta shifted from one unlawful legal basis (contract) to another (legitimate interests). Thus, the authority argued that Meta had not brought its processing operations into compliance with Article 6(1) GDPR as the DPC's decisions had foreseen.
In this context, under Article 66(1) GDPR, a concerned supervisory authority – such as the Norwegian DPA – may, in exceptional circumstances (urgent need to act), immediately adopt provisional measures towards a controller on its own territory with a specified period of validity in accordance with Article 55(1) GDPR.
In the present case, the Norwegian supervisory authority considered that these conditions are met. The Norwegian authority viewed that Meta’s persistent state of non-compliance demanded immediate action to protect the rights and freedoms of data subjects. Additionally, the authority held that, since the DPC did not cooperate adequately (see two points above) - as it should have under Article 60 GDPR - Article 61(8) GDPR applied, which meant that the urgent need to act under Article 66(1) GDPR was presumed to be met and required an urgent binding decision by the EDPB pursuant to Article 66(2) GDPR.


facts_Tietosuojavaltuutetun toimisto (Finland) - 4300/182/2019

A data subject requested a copy of a criminal case from the Finnish Supreme Court under The Public Access to Information Act. According to the Act, a person requesting the information does not have to indicate their identity, so the archives would not keep information about the case's recipient. However, the court asked the data subject for a personal identity number and home address for a billing purpose. It explained that it does not keep a separate register of persons who requested documents. Still, the information is required for the billing system maintained by the State Financial and Human Resources Service Center (Palkeet).
Concerned that the defendant in the criminal case could later learn about persons receiving case materials and retaliate against them, the data subject asked the Finnish DPA to investigate it.
The DPA assessed first whether it is competent to supervise the processing when courts disclose personal data contained in criminal records. Secondly, it examined the legality of collecting and processing personal identity numbers for billing purposes. Thirdly, it evaluated the Supreme Court's approach to providing information on those who requested and received a copy of a document.


The DPA was asked by a hospital if it can provide an employee with data on which of its other employees are processing health data, as well as when and how they are processing such data.


As the Icelandic DPA receives complaints on media coverage of individuals on a regular basis, it has decided to issue an opinion on the relationship between freedom of expression of the media and the privacy of individuals. This new opinion comes as an update of previous opinions regarding privacy and the media issued in the context of older laws.


facts_ANSPDCP (Romania) - Vodafone România S.A. 3

The ANSPDCP conducted an investigation into Vodafone România S.A. and found that the controller could not demonstrate compliance and prove that it had fulfilled access and deletion requests.

Dispute
Did the controller facilitate and fulfill the rights of data subjects enshrined in Articles 12, 15, and 17 GDPR?


The controller, an employer, suspected that an employee had committed embezzlement and carried out an inspection of the employee’s mailbox. After discovering e-mail exchanges between the employee and another employee (the data subject), the controller also suspected that the data subject contributed to a possible embezzlement and accessed their mailbox as well.
Access to the data subject’s mailbox was carried out by the controller with the assistance of a third party and a data processor.
The inspection of the e-mails showed the data subject had breached their duty of loyalty in their employment by sharing insider information and other confidential information. The data subject was then dismissed.
On 12 July 2020, the data subject lodged a complaint at the Norwegian DPA (“Datatilsynet”). The data subject argued that the controller had no legal basis for conducting an inspection and disclosing their personal data.
The DPA found that the controller failed to comply with the accountability principle under Article 5(2) GDPR as the controller did not submit documentation of the legal basis for conducting the inspection of the data subject’s mailbox. The DPA held that the controller had a legitimate interest to inspect the data subject’s mailbox under Article 6(1) GDPR and Section 2 of the Norwegian E-mail Regulations (“e-postforskriften”). Under the E-mail Regulations, an employer has the right to access an employee’s mailbox in the event of "reasonable suspicion that the employee's use of a mailbox or other electronic equipment results in a serious breach of the obligations arising from the employment relationship or may provide grounds for termination or dismissal". However, the DPA found that the controller did not process the data subject’s personal data with sufficient transparency under Article 5(1)(a) GDPR and Article 14 GDPR, as the data subject was not informed about the processing. The DPA stated that the controller could have made a copy of the emails in advance before the inspection to safeguard their interests, so that the data subject could be notified of the inspection in advance. The DPA also found that the controller did not conduct the inspection in accordance with the data minimisation principle under Article 5(1)(c) GDPR. The search terms used were likely to generate more personal data than was necessary for the purpose of clarifying any unfair conduct. The DPA thus issued a reprimand against the controller under Article 58(2)(b) GDPR as the infringements affected a limited number of people and the violations of the accountability and transparency principle only affected the data subject and they were notified of the inspection shortly after it was carried out.
The data subject also filed a lawsuit with a district court, claiming that the termination was invalid and demanded compensation and redress. Both the district court and later the court of appeal concluded that the dismissal was valid and there were no grounds for compensation. However, they both held that the rules for access to employees' mailbox had been violated, so that there were grounds for compensation for damages under the Norwegian Personal Data Act. The controller was ordered to pay €1.741,50 (NOK 20,000) as compensation for damages.
The data subject appealed the DPA’s decision to the Norwegian Privacy Appeals Board (“Personvernnemnda”), stating that the DPA failed to impose a fine against the controller. Moreover, the data subject argued that the third party was a processor and therefore the DPA's assessment that a data processing agreement was not necessary was incorrect. The data subject also argued that the DPA did not take into account the controller’s breach of Article 30 GDPR when issuing a reprimand against the controller. The data subject argued that the records of processing activities was not handed over by the controller to the DPA until more than a year after access to the data subject’s email box had ended, violating Article 30 GDPR. The data subject also argued that the DPA’s handling of the case was biased and subjective and therefore failed to uphold its obligation to investigate and deal with all cases in full independence, regardless of a legally enforceable judgement related to the termination case against the controller.


facts_Helsingin hallinto-oikeus (Finland) - 3620/2023

The controller (Lääkäriklinikka Estetic Oy, a medical clinic) had asked the Administrative Court of Helsinki (the Court) to overturn the €5,000 administrative fine imposed by the Finnish DPA and the DPA's decision, according to which the controller had not implemented the data subject's access request.
The controller filed the appeal claiming that it had already fulfilled the data subject's access request as far as it concerned the personal data it processed. The controller emphasised that it did not have access to the patient records of another company whose surgeon had treated the data subject at the controller's premises.
The controller argued that the DPA should have requested an explanation from the other company as well, because the data subject was not a patient of the controller, but a patient of the other company. The controller also stated that the DPA's actions had not been based on a sufficient and appropriate investigation.
The DPA emphasised that the data subject had received treatment from the controller at the controller's premises and that the controller had not informed the data subject that their patient records are in the possession of another company. The DPA also stated that the controller had not instructed the data subject to request their personal data from another company or otherwise informed the data subject about the matters related to the controllership of their personal data.


The controller is Scalable Capital, an online stockbroker. The data subject is a customer of the controller. The controller informed the data subject about a data breach which had occurred on 19 October 2020. A third party had accessed parts of the data subject's personal information, potentially including personal, tax and contact data and their IBAN.
The breach was conducted by using the credentials of CodeShip Inc., a "Software as a Service" company which the controller had contracted in the past. The contract was terminated in 2015. After the termination, the controller did not delete or change the credentials of CodeShip Inc. The third party obtained the credentials by means of a cyber attack against CodeShip Inc. The third party used CodeShip’s – still valid – credentials three times between April and October 2020 to gain access to the controller's database. Some of the data obtained was supposedly used for identity theft or for other fraudulent behaviour.
After the breach, the controller paid the data subject a one-year subscription to the identity protection service “meine SCHUFA Plus”.


Individual submitted a complaint on unsolicited political communications (email) he received by politician. The politician collected the complainant's contact details through his professional occupation for different purposes.

Dispute


On April 9 2019, the Icelandic DPA received a complaint from a Complainant regarding the processing of their personal information in connection with credit rating by Creditinfo Lánstrausti hf. (hereinafter, 'Creditinfo'). The registration of a complainant's defaults affects their credit rating for up to four years from registration.

Dispute
The Icelandic DPA had to decide whether Creditinfo could use information about the complainant's defaults within the four-year period.


On 20 October 2023, a data subject filed a complaint with the Spanish DPA (AEPD) against Banco Cetelem, S.A. (the controller). It claimed that the controller, which offered lending services, made numerous unsolicited charges on his bank account between July and September 2022.
The data subject filed numerous complaints against the controller as well as a police report concerning the charges. On 8 August 2022, the data subject requested the deletion of his account data from the controller’s systems, as well as the reimbursement of the amount expended due to the unduly charged bills. The data subject also reproached the controller for attributing his bank account to a third party without previously requesting the relevant certificate of bank ownership from the third party.
One year later, in September 2023, the controller again charged the data subject with a new bill from the controller. The data subject complained to the controller about the charge, but the controller once again made another charge in October 2023.
The controller claimed that the charges occurred as a result of human error during the initial transcription of the bank account. It informed the AEPD that the data subject’s bank account number had been erroneously attributed to a debtor’s contract and was subsequently stored this way in the controller’s database. It stated that it deleted the data subject’s account information from its database after the first claim the data subject filed, but that it then sold the debt to a third party company in June 2023 and that the contract still contained the incorrect account number.


facts_Datatilsynet - Datatilsynet - Arp-Hansen Hotel Group A/S indstilles til bøde

During an audit visit to Arp-Hansen Hotel Group A / S (hereinafter Arp-Hansen), the Danish DPA became aware of a number of systems contained a lot of personal data that should have been deleted in accordance with Arp-Hansen's own set deletion deadlines. The DPA also found customer profiles which should have been deleted several years earlier. In summation, about 500,000 profiles were found that should have been deleted.

Dispute
Whether Arp-Hansen was in violation of the storage limitation principle under GDPR Article 5(1)(e)?


A third-party received several documents related to a contract with Vodaphone, containing the complainant's personal data. Thus, the complainant filed a complaint with the AEPD. Vodaphone claimed that a mistake has been made by on of its employee in good faith.

Dispute
Can a mistake made in good faith justify the sharing of personal data to a third-party?


The company EHR, dedicated to tourism and hotelier services, hired another company, Signallia, dedicated to software and computing services, to manage their data and servers. The data processing agreement between them stated that Signallia had to give back EHR all data and copies obtained or processed for them, as their relationship ends.
Accordingly, when EHR decided to move their servers to an internal place they instructed Signallia to return to them all their data. However, the processor did not follow the request and instead asked the controller to pay the debts they had with them. The controller argued that the processor had debt with them as well and that they had lodged a legal claim before the courts. The legal claim was targeted at getting back data, including those of the clients of their hotels.
Even though the processor communicated to the controller that they would handle over the data, a month after such communication no data was received. Therefore, the controller lodged a complaint with the Spanish DPA (AEPD). Again, the processor offered the controller to handle the data over in a 5TB hard disk, which they did not do, alleging organizational problems.
This behaviour caused huge losses to the controller, who could not access their servers and data during a long time.


The complainant asked a company to exercise his/her right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and to access these data in accordance with Article 15 GDPR.
The request did not receive the legally required response.
The claimant provided various documents relating to the complaint submitted to the Spanish DPA, which requested the company in question to inform the Agency of the actions taken to deal with the complaint submitted. There was also no response to this request.

Dispute
Can companies be sanctioned for not attending to a customer's claim to exercise his or her right of access to data?


facts_ANSPDCP (Romania) - Fine against S.C. Delivery Solutions S.A. (Sameday)

S.C. Delivery Solutions S.A. (processor), commonly known as "Sameday", is a courier company. Sameday is authorized by two companies (controllers) for the processing of personal data.
The DPA received complaints about the processor's database, as it was found for sale on a website (RaidForums). Following the complaint, the DPA started an investigation.
The database contained the personal data of 26,566 customers (name of the recipient, contact details, address of the recipient, parcel details, delivery status etc.). The website was later seized by FBI, Europol and other European national police agencies.


facts_ANSPDCP (Romania) - Fine against Asociația de Proprietari Aviației Park

The controller is a building owners association which mandated a security company to ensure security and protection of their buildings (processor). The data subjects were couriers accessing the building complex of the controller. The investigation of the ANSPDCP (Romania), which was initiated upon a complaint, revealed that the processor was collecting a big amount of personal data of the couriers on behalf of the controller. The processor was instructed by the controller to keep an access register of couriers entering the residential complex and note the following information there: name, surname, number of the ID card, destination, time of arrival, time of departure, observations. The DPA further found in its investigation that a video surveillance system was installed at the entrance of the building complex to monitor who is entering the complex and that the video footage captured by this surveillance system was stored longer than necessary.


The data subject took a case against a telecommunications provider, here the controller, for unlawfully disclosing their data. The controller transmitted the following data to a credit rating agency, namely SCHUFA Holding AG: name, address, date of birth, start and end date of the contract, contract number and a SCHUFA ID.
Upon the data subject’s request, SCHUFA informed him that information on the contract conclusion had been supplied to SCHUFA and that this information will be stored until the end of the contract. The data subject called on the controller to cease the data transfer and to pay damages, which the controller rejected.
The data subject stated that he didn’t know that the controller would share this information and that this transfer brought upon him feelings of loss of control and worry. The data subject claimed for a minimum of €5,000 in damages and a declaration on claims regarding damages for future loss.
The controller brought forward that with the formation of the contract, the data subject was supplied with an informational which included a notice on the transfer of data to SCHUFA. It therefore concluded that the data subject was informed about the transfer, which nevertheless was necessary for fraud prevention


facts_Tietosuojavaltuutetun toimisto (Finland) - TSV/35/2022

The Finnish DPA was notified that a municipality-run educational institution (the controller) processed the personal data of its students for the marketing of courses offered by a third party without the consent of its students. The DPA asked the controller to explain the purpose of the personal data processing.
In response to the request, the controller clarified that a teacher had sent the students an email in which the teacher advertised their own course in another organisation. The controller emphasised that sending the email in question was not related to the activities of the controller.
The controller claimed that the email in question had been sent against the controller's instructions. According to the controller's privacy notice, personal data was not disclosed to third parties for direct marketing.


facts_Tietosuojavaltuutetun toimisto (Finland) - 6097/161/21

Otavamedia Oy (controller) is a publishing company whose online services reach approximately 2 million Finns monthly. Between 2018 and 2021, eleven data subjects complained about the controller to the Finnish Office of the Data Protection Commissioner (DPA). Five complaints concerned the controller's requirement for data subjects to send a filled and signed paper form if they wished to exercise their right for erasure under Article 17 GDPR. The rest reported that the controller did not respond to their subject access requests under Article 15 GDPR that were sent via an online form. With regard to the erasure requests, the controller justified the demand for a person's signature by the need to prevent identity fraud. For the other cases, the controller explained that the requests in question did not reach its customer service staff due to a technical error in its emailing system that lasted for seven months.


facts_ANSPDCP (Romania) - PPC Energie Muntenia S.A.

A data subject advanced a complaint before the DPA against the controller, an energy supply company. The complaint concerned marketing calls by an operator of the controller. The data subject asked the operator how he got their contact and advanced an access request as per Article 15 GDPR, to which no answer was given. The data subject reiterated their request, the controller replied but the data subject was not satisfied by the reply.


DIGI SPAIN TELECOM, S.L. (the controller) is a telecommunications company. On 6 April 2021, a third person requested to duplicate the data subject’s SIM card at a store that sold the controller's products. The data subject lost phone service. Two hours later, the data subject obtained a new SIM card duplicate at a different store, which gave them access to the service again. According to the data subject, the controller did not take any measures to verify the identity of the person requesting the SIM card duplicate. Furthermore, the third person committed identity theft, because the data subject noticed an unauthorised bank transfer from their account (this was not addressed in the case).
The data subject presented a complaint to the DPA on 12 July 2023. The DPA imposed a €200,000 fine on the controller for duplicating SIM cards for unauthorised third parties on 8 November 2024. The controller then filed an internal appeal to the DPA on 11 December 2024.
The controller argued that its procedure for situations such as these that was carefully followed, and allowed it to process data lawfully in accordance to its obligations. The controller also contested the unauthorised bank transfer as a result of the SIM duplicate. In addition, it argued that it could not be held completely responsible for identifying and mitigating fraud. The controller requested a lower fine based on mitigating circumstances, stating that the DPA had set a disproportionately high fine. Among others, it argued that it had effectively solved the situation and that it did not process special categories of personal data.


The complainant, a former affiliate to the political party, had fully unsubscribed from the political party and requested the erasure of all her personal data (even receiving a confirmation to that respect by the DPO of the controller). Notwithstanding that, she later received an email asking her about the possibility of acting as a party's representative in the Spanish general elections of November 2019. The complainant, therefore, assumes that her personal data had not been duly deleted. The controller answered to the first AEPD investigation stating that, as soon as the data subject sent the deletion request, her personal data were totally erased.

Dispute
The Authority has to assess the lawfulness of the processing following the withdrawal of consent under Article 7(3) GDPR. The Authority also considers the existence of a deletion request under Article 17 GDPR.


The data subject received different calls by the controller, which used different phone numbers. These were national, foreign and anonymous numbers. The nature of the controller and the nature of these calls were not specified in the decision. The data subject asked the controller for a copy of his data (Article 15 GDPR) and asked the controller multiple times to remove his data (Article 17 GDPR). The data subject submitted the erasure requests by e-mail and using the controller’s website. However, the controller never replied.


facts_ANSPDCP (Romania) - Fine against Telekom Romania Communications SA 3

When terminating the contract with Telekom, a previous customer withdrew their consent for data processing. After this, they were contacted again by Telekom for marketing purposes and the complainant exercised their rights to opposition and erasure. Despite this, complainant was further contacted by the controller for marketing purposes.

Dispute
The controller processed personal data even after the data subject withdrew his/her consent, objected to the processing and made an erasure request.


On 17 May 2020, the data subject exercised their right of access (Article 15 GDPR) at the Dutch Tax Authority, de belastingdienst (controller). The controller refused to provide access to the relevant files, which lead the data subject to file a complaint with the Dutch DPA on 17 June 2020.
On 25 March 2021, the DPA rejected the complaint of the data subject. The reason for the rejection was not specified in this decision.
On 2 November 2021, the data subject appealed the decision. According to Dutch administrative law, the DPA itself had to assess this appeal (in Dutch: bezwaar). On 3 May 2022, the DPA requested the controller to provide information regarding the data subject to assess this appeal. The controller replied on the same day and provided details about ongoing financial procedures between the controller and the data subject.
On 2 June 2022, the controller made a decision regarding the data subject's access request. It is not clear from this ruling if the controller provided access and if so, in what from.
On 11 July 2022, the DPA agreed with the appeal of the data subject and warned the controller for not answering the access request within the time limit, in violation of Article 12(3) GDPR. The data subject, who was apparently not satisfied, appealed this decision to the District court of Den Haag (in Dutch: Beroep).
On 18 October 2022, the data subject filed another complaint with the DPA against the controller because it provided information to the DPA on 3 May 2022.
In his appeal, the data subject filed claims against both the DPA and the tax authority.
Regarding his claim against the controller, the data subject stated that the controller never informed him about its decision of 2 June 2022 regarding the access request. The data subject claimed a compensation of €25,000.
Regarding his claim against the DPA, he stated that the DPA did not properly execute its tasks under the GDPR. For this, the data subject requested €25,000 for immaterial damages. The data subject also stated that the DPA violated Article 6 ECHR for the lack of a hearing within a reasonable time.
The data subject received some financial compensation, established in Dutch law, because the DPA did not respond in time to their request.


The company mivolta GmbH used partners to call hundreds of consumers to make telephone advertising for supply agreements (electricity and gas) of his own product. Thereby the telephoners also acted without and against the consumers wishes. Partially the telephoners used a hidden telephone number. In some cases the telephoners told the consumers that they are from the consumers electricity provider to get necessary data to be able to initiate a change of the provider. So the consumers had to make revocations of contracts they never concluded.

Dispute


facts_Datatilsynet (Denmark) - 2024-442-4149

On 17 June 2021, the City of Copenhagen (“the controller”) reported a personal data breach to the Danish DPA (“Datatilsnynet”).
During a routine scan on 15 June 2021 of the controller’s open file drive, the controller found that there was access to a normally closed drive that contained personal data. The data included name and address information, but the files also contained information about well-being, language assessment and information about children's dental and health care. Normally, only four data warehouse developers have access to this data, but now approximately 37,500 employees in the municipality gained unauthorised access to information about up to 3.7 million people. This was due to human error as an employee with administrator access mistakenly gave too wide access to the drive during a disk swap.
The unauthorised access existed for almost two months until the controller discovered the error. The access was then closed and reported to the DPA. The controller stated there was a very low probability of an ordinary employee encountering the drive, as it required special prerequisites to find it. Network registration was turned off on the individual PCs, which meant that employees could not find the drive through ordinary searches on the PC. It also meant that the URL had to be known or the drive had to be actively scanned for. Moreover, the controller, after investigation, found that no scanning tool had been used to look for open drives during the period of the breach.
Furthermore, examination of the administrative log showed access only for people with a work-related need. However, the controller's logs of all administrative IT users' potential access to the drive only went back in time 35 days and therefore the controller could not definitively conclude that no employees other than those with a work-related need had accessed the data during the period.
The controller also stated that the majority of the files were not immediately readable for those who gained unauthorised access as this required a specific program to process the data. The controller argued that the data was thus not readable for a random administrative employee.
The controller stated that they would implement stronger safeguards to ensure that appropriate security measures are implemented to reduce the risk of future breaches and to ensure that potential breaches are detected quickly.


facts_DSB (Austria) - DPA 2021-0.415.529

The data subject was registered as a jobseeker with the Austrian Public Employment Service. The data subject received unsolicited job offers from a company (“the controller”) by text message, whereby the company had informed the data subject by telephone that it had received the data subject’s contact details from the Austrian Public Employment Service (“AMS’).
The data subject emailed the controller with a request for erasure, but received no response from the controller. The data subject continued to receive further text messages with job offers from the controller.
The data subject then lodged a complaint with the Austrian DPA (“Datenschutzbehörde”).
The controller argued that since the data subject had had been registered as a jobseeker with the AMS at the time of the first contact, it was not considered unlawful to send a job offer to the data subject. It therefore had a right to process the data subject’s data for the purposes of its business and thus had legitimate interests under Article 6(1)(f) GDPR. The controller did not address the issue of the data subject's right to erasure in its statement.
The data subject stated that they did not question the legality of the collection of their data as they were aware that the controller collected personal data such as their telephone number from the AMS. The data subject only wanted to enforce their right to erasure. The data subject explained that they had suspended all of their job advertisements via the AMS’s online portal, because they no longer needed support from the AMS. However, the data subject still received text messages from the controller with job offers despite several requests for erasure.


The data subject has multiple bank accounts with the controller, a bank.
On 13 November 2023, the controller asked the data subject to provide documents concerning their source of income. Since the data subject did not reply to this request, the controller closed their bank account.
On 29 November 2023, the data subject filed an access request to the controller according to Article 15 GDPR.
On 2 January 2024, the controller replied to the data subject, sending several data processed by it.
However, the data subject considered it implausible that the controller does not process any data about the blocking of the account and that the logic behind the decision-making cannot be explained. Therefore, the data subject informed the controller about this and requested the latter not to delete their data pursuant to Article 18(1) GDPR since they intended to file a lawsuit.
On 5 February 2024, the data subject initiated legal proceeding against the controller before the District Court of The Hague (Rechtbank Den Haag – Rb. Den Haag). More specifically, the data subject aimed at acquiring more information about the decision-making process about the blocking of their bank account and if this decision had been taken through automated means.
The controller argued that it had already sufficiently acted on the access request and pointed out that there was no automated decision-making (ADM). Indeed, the controller explained that, even though an alert about a suspicious transaction is triggered automatically, then human intervention is required to decide whether to take further action.
Furthermore, it noted that in the case at hand Article 41(1)(d) of the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming – UAVG) applies, since the purpose of this processing is preventing criminal offences pursuant to the Prevention of Money Laundering and Financing of Terrorism Act (Wet ter voorkoming van witwassen en financieren van terrorisme – Wwft).


A bank launched a new online portal for a selection of customers (about 500) where they would be able to see their loans. However, as a result of "frequent navigation" and, consequently, a problem with verifying sessions per user, some customers were able to see other customers' data, including contact information, while others only saw incorrect loan details. After a customer notified the bank that her loan details were incorrect, the bank immediately shut the portal down. By then, 91 customers had logged on and had potentially viewed incorrect data/ data of other data subjects. When asked about the exact reason why the discrepancy occurred, the bank was not able to recreate the error.
The bank claimed they tested the portal between May and August 2019. After this incident, they conducted thorough testing and added an extra verification measure in the system, before they testing once again and did another launch for a selection of customer. After 14 days without errors, they launched the portal to all customers and after six months operations, no new errors have been discovered.
When asked by the DPA, the bank said that they had assessed the risks for the rights and freedoms of the customers as "low" because they could not change the information themselves and the personal data presented were not of a sensitive nature. However, they were not able to document that they had made this assessment.

Dispute
Did the bank comply with the requirements of Articles 24 and 32 GDPR when introducing the new online customer portal?


A public body for the defense of consumers' rights filed a complaint with the AEPD against the defendant for failing to comply with Article 13 GDPR on its website.
In its investigation, the AEPD found that the defendant's website had a data collection form, but users did not have all the necessary information on the processing of their data according to Article 13 GDPR.
Subsequently, the AEPD verified that the defendant had updated the information on its website.

Dispute
The decision does not establish precisely why the information provided was not in accordance with the GDPR. However, on the basis of the available information it seems that the information appeared under the title "legal notice" instead of "privacy policy". In addition, the text referred to the old Spanish law instead of the current one.


Representatives of the Spanish Football Federation (RFEF), the Association of Spanish Footballers (AFE), and the Professional Football League (LNFP) held a meeting via Zoom on April 2020 to follow-up on the COVID-19 pandemic situation, and its impact on the national football landscape. According to the AFE and the LNFP, the RFEF shared the recording of this meeting with two radio broadcasters (Cadena Ser, COPE) without the participant's knowledge or consent, who eventually found out when the recordings were broadcasted a few days later. As a result, both the AFE and the LNFP filed several complaints against the RFEF with the Spanish DPA (AEPD). According to the claimants, the participants were not informed about the fact that the meeting was being recorded, and they did not receive the required information under Article 13 GDPR.
The RFEF alleged that during a prior in-person meeting, all the participants had agreed to record that meeting. The RFEF claimed that in the subsequent second meeting held on Zoom, all the participants were informed that the meeting was being recorded because there was an indicative red circle sign next to the word "recording" on the screen. Additionally, the RFEF stated that the meeting was recorded in order to obtain a literal transcript (the minutes), and to publish a press release according to its transparency requirements. The RFEF also alleged that it had only shared the recording to refute a false statement made by the AFE related to that meeting.
Lastly, the RFEF provided a document (drafted after the second meeting) that was shared with participants for setting up future meetings, which contained a data protection clause stating that participants consented to the recording of the meeting, and that this recording was carried out by the RFEF for public interest purposes.


facts_ANSPDCP (Romania) - Compania Națională Poșta Română SA

The investigation was started by ANSPDCP as a result of the notification of the controller for a data security violation by Compania Națională Poșta Română SA, as a processor.
As part of the investigation, it turned out that the Compania Națională Poșta Română SA lost certain postal items that contained decisions establishing pension rights, work cards and death certificates, affecting 35 natural persons .
It was also found that the processor did not implement adequate technical and organizational measures to ensure a level of confidentiality and security of the personal data of the data subjects, which led to the loss, unauthorized disclosure or unauthorized access to certain personal data .


facts_EDPB - Binding Decision 2/2022 - 'Instagram'

The DPC had conducted an investigation into Meta, specifically into Instagram. The DPC focused its investigation on two aspects. First: displayed information on business accounts of child users and second: default settings of newly created Instagram accounts. Based on this investigation, the DPC formulated a draft decision under Article 60(3) GDPR.
Processing of contact information on child user’s business accounts
The DPC held that Instagram permitted child users to switch from personal accounts to business accounts. During this switch from personal to business account, the child user was presented with an option screen (titled “Review Your Contact Info”). This screen was automatically filled with the user’s information, which was collected at the time of registration. The child user had the opportunity to modify this information. However, in order to complete switching process from personal- to business account, the child user also had to provide an email address or a phone number (contact information). Before September 2019, the phone number and e-mail were published on the respective user page in the form of a contact button. These contact details were not encrypted and visible in plain text.
Since 4 September 2019, an updated version of this option screen was presented, with possibilities to modify contact details. Also, the user could choose not to provide any contact details at all.
Before march 2019, the contact details of child users were also visible as plain text in the HTML source code of the web-version of Instagram.
Also, for a time between August 2020 and November 2020, e-mail addresses of Instagram business accounts were visible in the HTML source code of the Instagram website as plain text, including to persons not registered as Instagram users.
According to the DPC, by registering for a personal Instagram account, a data subject had to agree to the Instagram Terms of Use. The DPC held that Meta used two legal grounds in these terms of service for processing the personal data of Instagram child users: for the performance of a contract (Article 6(1)(b) GDPR) and for legitimate interest (Article 6(1)(f) GDPR).
Article 6(1)(b) GDPR
In its original draft decision, the DPC held that Meta could use Article 6(1)(b) GDPR GDPR as a legal ground for processing. The data subject would have to accept the terms of service. It also stated that Article 6(1)(b) GDPR does not require the inclusion of explicit contractual provisions. It would be sufficient if processing was necessary in the respective case. The DPC held that in this case, the contact information processing could be necessary for the performance of Meta’s Terms of Service with its users.
Article 6(1)(f) GDPR
The DPC also held that Meta could use Article 6(1)(f) GDPR as a legal ground for processing. This legal ground has three cumulative elements which need to be fulfilled by the controller in order to use this legal ground:
1) the pursuit of a legitimate interest by the controller or by the third party or parties to whom the data are disclosed; In its draft decision, The DPC held that the interests of Meta for processing the contact information were legitimate for Meta as well as for the Instagram users, because publication of contact details may be a reasonable and lawful mode to promote a business or other undertaking. The DPC did not specify if this concerned all Instagram users or a specific type of user. (The EDPB assumed all Instagram users based on submissions of Meta and the interpretation of these by the DPC).
2) the need to process personal data for the purposes of the specific legitimate interests; The DPC held that the processing of contact information could be considered necessary for business account users who wished to provide contact information outside of Instagram. The DPC held in its original draft that the principle of data minimization (Article 5(1)(c) GDPR) had been violated by Meta, which is a relevant factor to decide if processing is necessary. The DPC determined this violation because child users of Instagram business accounts had to publish their information publically on business accounts in the HTML-code of the Instagram Website, prior to 7 March 7 2019.
3) That the fundamental rights and freedoms do not take precedence. (Balancing exercise) The DPC held that Meta’s own analysis, regarding of the adequacy of the information provided to child users, was inadequate. The DPC also held that there was a lack of transparency because child users were not properly informed that the publication of their contact information might result in a high risk situation. Also, parts of the provided information were technical and hypothetical. The DPC came to the same conclusion for the security and safety measures implemented by Meta. The DPC held that these measures did not mitigate all relevant risks for child users. These inadequate measures would result in a risk of possible communication between child users and dangerous individuals, both on the Instagram platform itself as well as outside of the platform.
In the end, the DPC held that Meta could also use Article 6(1)(f) GDPR as a legal ground for processing. the DPC held that in cases where processing occurred in the context of the ‘well-considered professional activities’, it could happen that the legitimate interests at issue would not be overridden by the interests or fundamental rights and freedoms of the child user.
Public-by-default Instagram accounts
Besides the remarks regarding the legal grounds for processing contact information of child users (business accounts), the DPC also determined violations regarding public by default processing of personal Instagram account regarding child users.
The DPC had stated that Instagram accounts were public by default, including accounts belonging to child users. This meant that a new account would automatically be public without changing the settings. This meant that every user in the app or website, registered Instagram user or not, could see the contents of the account. If this had been the private setting, the user would have to approve who could look at their account. Meta informed its child users of the public-by-default account settings in its 2018 and 2020 Data Policies.
The DPC held that Meta had violated Article 12(1) GDPR because it did not inform child users of the purposes of the public-by-default processing in a clear and transparent way.
The DPC also held that Meta had violated Article 5(1)(c) GDPR and Article 25(2) GDPR, because the public-by-default processing was not necessary nor proportionate. The DPC also mentioned that that child users may have a reduced ability to change privacy settings. The DPC held that Meta had failed to implement technical and organizational measures to ensure that only personal data that was necessary for the relevant purpose of processing was collected.
The DPC also held that Meta violated Article 25(1) GDPR by not implementing appropriate technical and organizational measures.
The DPC also held that Meta had violated Article 24(1) GDPR because the DPC found that the safeguards and measures implemented by Meta IE did not assess the specific risks to the rights and freedoms of child users properly.
The Norwegian DPA objected this assessment regarding the 'public by default' accounts, because it wanted the DPC to conclude that the public-by-default processing was not necessary or proportionate on several grounds. It also wanted the DPC to conclude that Article 6(1)(b) GDPR and Article 6(1)(f) GDPR were not applicable legal bases for the public-by-default processing.
Draft decision sent to the EDPB
The DPC had published this draft decision and invited other DPA’s to react. Other DPA’s objected to this draft for various reasons, amongst other things that the conditions for Article 6(1)(b) GDPR and Article 6(1)(f) GDPR were not met. After this, the DPC submitted its draft decision to the consistency mechanism for dispute resolution by the EDPB (Article 65(1)(a) GDPR).


The controller is BREBAU GmbH. Its business consists mainly of building and managing residential apartments. During its investigation the DPA of Bremen found that BREBAU was processing information of over 9,500 prospective tenants about their the skin colour, ethnicity, religion, religious affiliation, sexual orientation, health status and even the hairstyle, body odour and personal appearance.


facts_Personvernnemnda (Norway) - 2021-13 (20/01874)

In May 2018, an employee at a restaurant lodged a complaint against camera surveillance at the work place. One year later, the Norwegian DPA (Datatilsynet) requested additional information from the company running that restaurant (the Company). Even though the Company replied within a few weeks, the DPA did not follow up again until March 2020.
After receiving more information from the Company, it took another five months before the DPA managed to issue a preliminary decision, which included an injunction to end the camera surveillance due to the lack of a valid legal basis as per Article 6(1)(f) GDPR and a fine of €30,382 (NOK 300,000) for breaching Article 6(1)(f), 13 and 24.
After the Company shared its comments and objections to the preliminary decision, the DPA issued a final decision where the fine was reduced to €20,255 (NOK 200,000) due to the company's financial situation under the COVID-19 pandemic.
The Company argued that the administrative fine was too high and therefore appealed the decision before the Norwegian Privacy Appeals Board. After reviewing the case, the DPA decided to uphold its decision, and the case was submitted to the Privacy Appeals Board (Personvernnemnda, PVN) for consideration.


On 20 April 2022 a mother made a complaint to Instagram and the Spanish Civil Guard because a photo of her 13 year old son was used as the profile picture of a false Instagram account. The account included a video of man masturbating, face hidden. The DPA requested from Meta Platforms Ireland, as the data controller of the Instagram portal, the date, time and IP address from which the profile was created, and the identification and contact information of the profile's creator. As of July 14 2022, the profile had been deleted and the profile was at least available until 22 April 2022.
On August 8 2022, the controller responded that there was an error in the profile name. On August 29, the DPA made the same request as above with the corrected profile name. A response from the controller was received on September 23, and on September 26 the DPA determined that the IP address came from Digi Spain Telecom SL. Digi Spain then provided the details of the profile creator, AAA. The DPA proceeded to initiate a sanctioning procedure, under Article 83(5)(a) of the GDPR, against AAA on 21 December 2022, due to a infringement of Article 6. AAA was the father of the minor who created the profile. He gave a written statement in response to the allegations, generally stating that the infraction was committed by a knowing minor who had no intention or knowledge of causing harm, that no damage was caused, that the violation had no social repercussions and that it only lasted a few hours.
The DPA decided to fine AAA €10,000 on February 27 2023, although AAA reiterated his previous statements on March 23 in response to the decision.


facts_First-tier Tribunal - Vestani v Information Commissioner

On 2 November 2020, Capital Letters (London) Limited informed its employee, Jashu Vestani, that he was the victim of a data breach affecting the company. Mr. Vestani later experienced cyber attacks and other fraudulent activities which he concluded had resulted from Capital Letters' data breach.
On 4 January 2023, Vestani submitted a complaint about the data breach to UK DPA - the Information Commissioner's Office (ICO). On March 14, 2023, the ICO decided not to investigate the complaint further, due to lack of evidence directly linking the attacks to the breach.
On 23 June 2023, Vestani appealed the ICO's decision to the First-Tier Tribunal.
The ICO argued that under Section 166 of the Data Protection Act, the Tribunal cannot examine the underlying merits of the original complaint, only whether the ICO took appropriate action. As the expert regulator, the ICO has wide discretion in handling complaints that the Tribunal cannot override without evidence of mishandling.
The core legal dispute centred on the scope of the Tribunal's authority to review the ICO's processing of data breach complaints and whether it can evaluate the regulator's decision itself or merely the appropriateness of internal procedures followed.


The CNIL received a complaint from several unions in May 2020 regarding the collection and storage of data on the number of days that RATP's agents had been on strike days. These data were kept in files normally used for careers advancement procedures. The RATP recognized that four bus transport units were concerned by this practice. The investigation conducted by the CNIL confirmed that this practice had been commonplace in at least three bus transport units of the RATP. During the investigation, the CNIL also found other breaches regarding storage limitation and data security.


facts_AZOP (Croatia) - Decision 21-07-2022 (car dealership)

The Croatian DPA carried out an investigation over the processing of personal data by a car dealership in Zagreb (the controller). The controller used a video surveillance system on its premises.


The CNIL received a complaint on the ground that he was very regularly cold called by a company whose activity consists of direct marketing solicitations via phone (the controller). Although the complainant had previously informed the controller they did not want to be called and had already exercised their right to object via e-mail, the controller continously sent them marketing emails. Thus, a complaint was lodged with the CNIL.

Dispute
In addition to the violation of the right to object, could unsolicited direct marketing phone calls lead to additional GDPR infringments?


facts_Garante per la protezione dei dati personali (Italy) - 9435753

The Italian DPA (Garante) received complaints from Wind Tre and non-Wind Tre users about unsolicited marketing communications made without their consent via texting, emails, faxes, and automated phone calls. In several complaints, the complainants noted that they were unable to withdraw their consent or object to the processing of their data for marketing purposes, in part due to inaccurate contact information in Wind Tre's privacy policies. Other complainants' personal data had been included in public phone directories despite objections being made by those complainants.
The investigation by the Garante also found that the MyWind and My3 apps had been "configured in such a way as to require the user to consent, on each access, to processing for various purposes including marketing, profiling, communication of data to third parties, data enrichment and geolocation; withdrawal of such consent was allowed after 24 hours." The investigation also uncovered a number of infringements affecting Wind Tre's business partners, including a fine of eur 200,000 against a business partner who had subcontracted without a legal instrument whole sets of processing activities to call centres, who collected data on behalf of the business partner.
An interesting finding of the DPA’s investigation concerned practices for the identification of data subjects. In many cases, the company stated that it did not act on data subjects’ requests to withdraw consent if these did not come with a copy of an ID. The Garante clarified that while indeed Article 12(6) GDPR allows controllers to request further information, this is possible “only if they have reasonable doubts about the identity of the person making the request”. Moreover, Recital 64 GDPR require the measures adopted to identify data subjects to be “reasonable”. This aims, according to the Garante, at discouraging “excessive requests aimed at discouraging the exercise of rights, but also to avoid the collection and retention of unnecessary data.” Utmost importance must here be given to the principles of proportionality, necessity and adequacy. In the specific context of data processing for commercial purposes, the illegitimate exercise of the right to withdraw consent from a third party poses, according to the Garante, an almost insignificant risk to the legal sphere of the data subject, so that the collection and processing of ID copies cannot be considered reasonable. Even more so, in cases where the person trying to withdraw her consent is not a customer of Wind Tre. In such cases, the request “appears even more disproportionate and may involve the acquisition of personal data that are not already available to the owner and are therefore not necessary.”

Dispute
Was the collection of the personal data by Wind Tre a breach of Articles 5, 6 and 24 GDPR?
Was the processing by Wind Tre in violation of Articles 5 and 6 GDPR?
Was the information provided by Wind Tre to the users in breach of Articles 12 and 13 GDPR?


In 2016, the complainant contacted BORJAMOTOR, S.A. and objected to the processing of his personal data for direct marketing via e-mail. However, the complainant continued to receive e-mails with offers, although less frequently.
The complainant contacted the company on two further occasions to stop receiving emails: in November 2018 and in September 2019. During the latest unsubscribe request, the complainant used the contact form on the company's website to insist that he did not want to receive any more advertisements and to inform the company that he was going to lodge a complaint with a supervisory authority. The company responded to the data subject by showing its apologies. The AEPD decided to dismiss the case under the wrong impression that the situation had been rectified. However, in June 2020, the complainant received an SMS from the defendant with advertising content, so the data subject filed a new complaint with the AEPD.
After a request for information, the company said that the complainant had received the SMS because months before he had used the contact form on the BORJAMOTOR, S.A. website to inform them about his complaint. In order to send the complainant's message correctly, it was necessary to accept the privacy policy and, therefore, the sending of electronic commercial communications.

Dispute
Did the obtained a valid consent from the data subject to send him commercial communications? Is it correct to send commercial communications to a person just because they used a contact form?


facts_Tietosuojavaltuutetun toimisto (Finland) - 8493/161/21

The Finnish DPA was notified that the controller (Lääkäriklinikka Estetic Oy, a medical clinic) had refused to provide patient records to the data subject despite an access request pursuant to Article 15 GDPR. The DPA had asked the controller to explain why it had refused to fulfil the data subject's request.
In response to the request, the controller clarified that the data subject had been treated at the controller's premises by a surgeon from another company, which is an independent controller of its patient records. The controller did not have access to that company's patient records.
The controller stated that its patients could access their personal data by visiting the controller's premises and that the personal data was not sent by email. The controller also claimed that it had already provided the requested personal data to the data subject.


The controller is a company providing workplace health promotion services by consulting other companies on this topic and developing tailored measures for them. Its main customer base are care facilities.
The controller informed its employees that due to an amendment of the German Infection Protection Act, access to care facilities was only permitted to persons that are either vaccinated, recovered or tested negative against Covid-19. The controller asked their employees to prove their vaccination status by either handing over a screenshot of the digital vaccination certificate or by presenting the vaccination card. It also informed them that a copy will be made for documentation purposes.
On 03 December 2021, the data subject, who was employed as a counselor, presented her vaccination card to the controller. When asked by the HR officer whether she also has a QR vaccination code, she explained that she only has a digital vaccination certificate stored on her private mobile phone, which she did not have with her at the moment. As it was not possible for the controller to check the validity of the vaccination certificate without the QR code, the controller carried out a batch query, which means that it compared the provided vaccination data with publicly available information on the availability of vaccination batches in order to determine irregularities. It found that the vaccination data provided by the data subject was inconclusive as the first vaccination allegedly took place at a time when only elderly people were vaccinated. During a conversation with the data subject, the suspicion of forgery could not be dispelled, as she then asserted to never have stored the QR code on her phone because of data protection reasons and that she did not know whether she still had the QR code in paper form. As the data subject was unable to provide proof that the vaccination had actually been carried out, the controller terminated the employment relationship.
The data subject took legal action against the termination. During the court proceedings the data subject did not contest that it was not vaccinated but argued that the request to present the vaccination card as well as the subsequent processing of personal data had been unlawful and, therefore, the court was prohibited from considering the the fact that she was not vaccinated.


A credit information agency (the controller) stored data regarding three undisputed and settled claims against an individual (the data subject) for a total of about €750. The last of these claims dated to February 2022 and was paid in December of the same year.
In November the data subject reached out to the controller and requested the erasure of the claims. The controller only erased the oldest claim and refused to delete the other two, claiming that the retention was justified under the legal basis of its legitimate interest.
The two remaining claims were updated with a settlement note. Additionally, creditworthiness scores were calculated based on the claims and were disclosed to a number of third parties: several banks, an energy supply company, and a telecommunications company.
The data subject requested the Regional Court of Cologne to order the erasure of the two remaining claims. The data subject also required compensation for immaterial damages. The Regional Court dismissed both request and held that the legitimate interest of the controller justified the retention of the data for three years.
The data subject challenged the ruling and claimed that the legitimate interest of the controller did not justify the storage of settled claims for longer than six months. In this regard, the data subject referenced the case law of the EU’s Court of Justice.
The controller requested the Court to dismiss the appeal. It argued again that it had a legitimate interest in storing the data, based on empirical analyses showing a correlation between an individual’s paid debts and their risk for insolvency. The controller also argued that the retention complied with a relevant code of conduct drafted by the Association of credit information agencies and approved by the Hessian DPA.


The Police Force of Navarra (Spain) reported to the AEPD the fact that they had found documentation held by controller next to a garbage container in a building. The documents included personal data of clients and suppliers. The police officers tried to locate the controller, but the business activity had ceased the activity at their premises. However, the person responsible for the company responded to a communication from the police informing that they had ceased their activity and that they had disposed of the "files that they could".

Dispute
Did the controller appropriately process the personal data under its responsibility by adopting the necessary technical and organizational measures?


The data subject, an employee of the Municipality, filed a complaint with the AEPD because of a video surveillance system that recorded employees and citizens actions within the Municipality's premises, even though no proper authorisation was requested and granted. Moreover, since the cameras could also record audio, personal conversations of employees and visitors could be recorded. Lastly, although there was a sign that informed visitors and employees of the presence video surveillance cameras, it was unclear for which purpose these cameras were installed. The AEPD informed the Municipality (hereafter: respondent) regarding the complaint but never got a reply. Hence, it agreed to process the complaint.


On 03.05.2023 the HDPA sent a single questionnaire to be completed on the designation and position of the Data Protection Officer (DPO) to selected public bodies, such as the Ministry of Rural Development and Food. The deadline for submission of the questionnaire was set for 19 May 2023. The Ministry of Rural Development and Food did not submit the questionnaire on time and a new closing date of 31.05.2023 was set. Despite being urged by the authority, the questionnaire was not submitted. The authority was informed that during the concerned period, the Ministry of Rural Development and Food was in the process of designating a DPO.
On 28.11.2023, the authority sent a summons to the Ministry of Rural Development and Food to be heard on 19.12.2023. The Ministry of Rural Development and Food in a memorandum clarified that the contract of the DPO of the Ministry had expired on 04. 08.2022, while a new DPO was appointed on 20.06.2023; in the interim period, during which there was no designated DPO, it was stated that a personal data protection and security plan was in place and that the data subjects did not suffer any harm. Further, they claimed that an employee of the Directorate of Administrative Organization and Supervision of Legal Entities of the Ministry after receiving the second letter on 26.05.2023 immediately proceeded to complete and submit the questionnaire, which could not be done due to a technical error.


facts_Datatilsynet (Denmark) - 2022-432-0099

A Danish citizen lodged a complaint with the Danish DPA regarding the Danish Agency for Digital Government's (the controller) processing of his personal data in their Driving Licence app, which he had not registered for or used.
The app is a digital alternative to the physical driving licence and contains information about the licence holder's name, birth data, place of birth, nationality, licence number, passport number, passport photo, social security number, health, and data relating to criminal convictions and offences.
Following the complaint, on 7 September 2022, the DPA started an own-volition investigation of the matter. They found that the controller was processing the personal data of approximately 3.96 million Danish citizens with a driving licence, yet only 1.7 million had registered for the app, while the remaining group had not joined the app.
The controller attributed the excessive processing to technical constraints of the driving licence database, built on an outdated mainframe system, which gave it access to all valid Danish driving licenses. They explained to have initially considered three possible solutions for the app but deemed only the one adopted realistically viable. The one adopted complied with certain operational and performance requirements while allowing for the digital driving licence, updated with the latest information, to be made accessible to citizens. Consequently, they claimed that the processing was in line with Article 5(1)(c) GDPR.


facts_NAIH (Hungary) - NAIH-2501-10/2022

The controller is a limited liability company in Hungary and also part of the Samlerhuset Group, an international group of companies based in Amsterdam. It sold different versions of commemorative and historical coins, with a specific focus on Hungarian history. The controller acquired the data of its customers as follows: they can place an order by filling in a form, received as part of advertising materials via postal mail. This data includes name, address, phone number, e-mail address.
Since July 2020, the DPA received several complaints from data subjects concerning the processing of their data by the controller and objecting to its data processing practices. In most cases, the controller created a user account (profile) with the personal data provided during the purchase or ordering process. However, it only informed the data subjects afterwards about the processing. The DPA therefore carried out a test registration on the controller's website and analysed the privacy notices on the website and from the postal mail. Based on its findings, the DPA suspected an infringement of GDPR and launched an investigation.
During the DPA’s investigation, the controller provided the following information on its data processing: potential new customers received a promotional mailing by post. In the controller's view, this did not constitute direct marketing under the Hungarian Act CXIX of 1995 on the processing of name and address data for research and direct marketing. The controller argued that the promotional material was sent to the data subjects together with a newspaper, to which they were subscribed pursuant to a contract with another separate company. Thus, the controller did not contact data subjects directly by itself. The data subjects could then contact the controller online, by phone or by post, in case they would like to order coins.
In the online shopping process, the information on data processing is linked at the end of the order. The controller emphasized that the online registration did not involve the processing of any more personal data than a purchase without registration. It was also possible to order products by phone or by post, without registering an online account. The data subjects gave their consent by signing the order form in writing for postal orders, verbally for phone orders and by ticking a specific checkbox for online orders.
The controller also informed the DPA that for the purpose of targeted advertising on Facebook and Google social media platforms, the controller manually selected – without automated decision-making – a group of its customers with an e-mail address for whom the given advertisement may be relevant. This list of addresses was hashed and uploaded to the Facebook and Google advertising systems for the display of the advertisement to data subjects whose email address hash matched an element of the uploaded hash list.
The controller further stressed that it found data protection highly important, and it employed a dedicated data protection officer (DPO) as well.