Search results

court or DPA, this will be used for titles. Abbreviations of the DPAs can be found in the DPA overview. Abbreviations of courts can be found in the court overview

not to be assessed according to a risk-based approach ("all-or-nothing") could not be accepted. This was not in line with the GDPR and had to be seen against

[Hungarian version of Directive 95/46 to translate ‘data processing’] be considered to be equivalent to the usual term for data processing, “adatkezelés”, used

Articles 101 and 102 TFEU, would require Germany to allow that GDPR fines may be initiated directly against an undertaking, despite Germany's administrative

know and be informed, in particular of the recipients of personal data. The Court pointed out Recital 63 GDPR does not mention that this right can be limited

possibility. Alternatively, the decision may also be appealed in the competent court, which in most cases would be a first instance administrative court (Art

where only consent should be the relevant legal basis. The NO DPA also considers that data cannot be a commodity and it should not be possible to pay with it:

data by the operator must be regarded as processing special categories of personal data. The CJEU held that such practices must be regarded as processing

data can also be personal data managed so that this is not processed outside the EU / EEA, that the information about the individual user can be data minimized

remedies should be implemented in the present situation, according to national law. However, the CJEU emphasised that certain safeguards needed to be applied while

means of processing, they shall be joint controllers. The CNIL considers that Google Ireland Ltd and Google LLC should be considered as joint controllers

question that should be answered only by the Data Controller. The same criterion should be answered by any party to whom the data are asked to be disclosed. Secondly

determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person

It replied to him and stated that "exam scripts do not generally fall to be considered [for data protection purposes] … because this material would not

15(3) of the GDPR is to be seen as an independent right to be provided with the complete information. Otherwise, it would not be possible to check the accuracy

themselves be considered make individuals identifiable, however, it must be considered that these unique identifiers in it the current case can be combined

preventive character, and must that be taken into account in the assessment of the amount of non-material damage to be compensated at the expense of the

(basically ordinary personal data, but it cannot be ruled out that sensitive personal data will also be included) will be transferred to unsafe third countries without

that in order to establish whether an entity, such as the CNSP, can be considered to be responsible for the processing for the purposes of Article 4(7) GDPR

readers to find your summary. Please take care to be very precise, as many elements require each digit to be correct, so that your summary shows up in the