Search results

fact, Article 15 GDPR does not provide for any limitation as to the information relating to the data subject that may be accessed. The GDPR expressly provides

of the GDPR – (article 13.1. c) of the GDPR) and does not mention the data retention periods personal data processed (article 13.2. a) of the GDPR more precisely);

under Article 80(1) GDPR and Article 80(2) GDPR. Also, the court clarified, making reference to CJEU case C-319/20, that Article 80(2) GDPR does not presuppose

paragraph 1 GDPR and Article 25 (1) GDPR 84. Based on Article 12(1) GDPR, Article 13(1) and (2) GDPR and Article 14(1) and paragraph 2 of the GDPR, it is necessary

Article 6(1)(c) and 6(1)(e) GDPR. The DPA points out that, in these cases, the public authority must comply with Article 6(3) GDPR: the processing must be

and 7(1) GDPR; Articles 5, paragraph 2 and 24 GDPR; Articles 12, paragraph 1, j° 13 and 14 GDPR; Article 5(1)(e) GDPR; and Article 7(3) GDPR. - order the

within the meaning of consent as defined in Article 4(11) GDPR. As explained by recital 42 GDPR, "[c]onsent should not be regarded as freely given if the

1 lit. c GDPR. It cannot be deduced from Section 256 IO that Insolvency data (at all) also based on other permitted circumstances Art. 6 GDPR may no longer

c) GDPR in conjunction with Article 5.1 a) GDPR and Article 5.2 GDPR. - Violation of article 13.1 d) GDPR in conjunction with article 5.1 a) GDPR and

5(1)(f) GDPR and a fine of €100,000 for the violation of Article 37 GDPR. The DPA issued a reprimand for the violations of Article 5(1)(e) GDPR and Article

of contract (Article 6(1)(b) GDPR), legal obligation (Article 6(1)(c) GDPR) and legitimate interest (Article 6(1)(f) GDPR) and determined that the controller

000 under Article 82(1) GDPR for a violation of Articles 15 GDPR and 12(3) GDPR. The LAG held that a mere violation of the GDPR does not give rise to a

purpose to process special categories of data according to Article 9 (1) GDPR is not proportional and necessary, as there are less restrictive measures

the defendant violated its obligation under Art. 32 GDPR and Art. 5 GDPR. According to Art. 32 GDPR, the person responsible and the processor have appropriate

right to an effective remedy (read: appeal), according to recital 143 of the preamble of the GDPR. The court states that a warning (with publication) constitutes

found that GDPR does not prevent the claimant from exercising their basic right. In this regard the court referred to Article 6(1)(f) GDPR to highlight

process) and that, therefore, in view of recital 50 of the GDPR, there is no need to invoke Article 6(4) of the GDPR. (1)(b), on a separate legal basis other

from the GDPR under Article 2(2) of the GDPR. 165. Article 2(2) of the GDPR outlines certain types of processing of personal data to which the GDPR does not

respect. Hence, the controller argued that it did not violate Article 33(1) GDPR. The DPA held that the data breach entailed a risk of violating the rights

her". 7. Recital 32 of the GDPR materiallstates that "When the processing has multiple purposes, consent should be given for all of them". Recital 42 materiallyprovides