Search results

DEYA X violated GDPR's data minimization principle Article 5(1)(c) by sharing an employee's personal and health data with multiple recipients without proper

restriction, and objection. In its decision, the DPA held that, in principle, an employer could not consult private emails of his employees, even if the company

forgotten was not infringed and rejected the complaint. The data subject has filed an administrative appeal against this decision. The Austrian Federal Administrative

do not preclude national rules from laying down, without any limit in time, an obligation for Internet advertising service providers to communicate certain

controller, and about the fact that their personal data could have been used for an additional purpose. The Greek DPA also found that the objections of the customers

(in ahead, the claimed one). The claim indicates the following: “I received an email from pulpower to confirm my subscription, as I had not done no management

viewed that an activity cannot be regarded as purely personal or domestic where a) its purpose is to make the data collected accessible to an unrestricted

electricity supply corresponding to the claimant's supply point, providing an email address for the invoice to be sent. To be able to carry out the requested

Energéticas, the controler, filed a lawsuit against the data subject due to an alleged debt. In the judgment , a Spanish Court of First Instance dismissed

subject could exercise their right to object and erasure. This case concerns an interlocutory judgment in the case C/13/694440/KG ZA-20-1118 MvW/JE dated

willingness to be known, as well as regarding the conditions under which such an access should be provided. This question, as the HDPA found, was never answered

failing to implement appropriate technical and organisational measures to ensure an appropriate level of security. The failure resulted in a data breach and unauthorised

the Constitution also establishes that it is prohibited the attribution to an unique national number to the citizens. In Portugal the GDPR is implemented

bureaucratic steps that severely limit individual rights. Proceedings before an administrative tribunal can take up to 2 years. You can help us fill this

administrative fines of maximum EUR 20,000,000 or, in the case of a company, an amount equivalent to a maximum of 4% of the C/ Jorge Juan, 6 www.aepd.es 28001

and records relating to her, including any decision of the Supreme Court on an appeal. A relevant case: HDPA 12/2024 Please find relevant provisions of laws

fundamental rights of the data subject is not overridden, following § 12 (2). In an employment context, processing of personal data may take place on the basis

was fined 9898 RON (equivalent to €2000) for sending unsolicited message to an e-mail address collected indirectly from public sources for the purpose of

A car rental company filed an appeal with the Spanish National High Court against a Spanish DPA decision in which a fine of €25,000 was imposed for breaching

proceed and is not willing to open an investigation against a company established abroad that has not designated an EU Represenative. Rocketreach sells