Search results

doctor. Lisa tells him all the details about a rash in an intimate area. The next day a friend of Lisa asks her about her rash. It turns out that the doctor

Article 8(2) CFR. A data subject may just want to get information about the data processed about him or her - independent of the exercise of any other right

must be informed about it. More particularly, the controller is under the duty to provide the data subject with "meaningful information about the logic involved"

guiding questions: Where are decisions about the purposes and means of the finally signed off’? Where are decisions about business activities that involve data

reduce that age limit to below 13. There is currently no rule in the GDPR about the age for consent if no "information society service" is involved, including

subject about the "action taken" following receipt of a request under Articles 15 to 22 GDPR. The wording of the law only requires an information about the

Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences

7(2) applies when data subjects and controllers communicate in written form about “other matters”, such as a longer contract, sign-up form and alike. In such

In both cases, it is argued, the information reveals something sensitive about the individual (either their political views, or a health condition) and

life. Results may vary from case to case, but when the data is about a public figure or about the professional life of a well-know individual, the argument

establishment: Where are decisions about the purposes and means of the processing given final “sign off”? Where are decisions about business activities that involve

responsibilities on a long-term and strategic basis. Further information about the ICO's decision making structure can be found here. When the General Data

Paragraph 4 reiterates the obligation on the data controller to inform about the existence of the right to object at the time of the first communication

accordance with Article 58(1)(d) GDPR, a SA can inform a controller or processor about an alleged – i.e. possible, but not yet determined – infringement of the

authority. Paragraph 4 grants controllers the possibility of sharing details about the breach in different phases when all the information cannot be provided

employee decided on behalf of the head of the DSB. There is no information about individual sections within the DSB. The DSB followed the previous "Datenschutzkommission"

individuals and society when state, social or economic power obtains knowledge about people in an uncontrolled and asymmetrical manner. At the same time, only

lead to the rejection of a required loan. In many cases false information about a data subject can also lead to severe emotional distress. Example: A pregnant

provisions is not mandatory, as the data subject may be not knowledgeable about the law and its technicalities. In theory, the controller could also be omitted

entities to gather unthinkable amounts of information about other people and entities. Information about a person usually allows to manipulate individual decision

processing; providing information about the storage of personal data; having malware detection systems; training employees about basic "cyber hygiene"; establishing

freedoms of data subjects; and (h) the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction

weeks, allowing for 14 weeks in total. The Chair of the EDPB makes decisions about the extension either on its own initiative or at the request of at least

happens, the controller is not obliged to process additional information about the data subject for the sole purpose of GDPR compliance. Article 11(2) GDPR

belonging to companies, public bodies or other legal entities. However, if data about a legal entity contains or relates to a natural person or a natural person

evidence or there is a dispute between the controller and the data subject about the accuracy of personal data. To avoid potentially deletion, sharing or

47(2)(h) GDPR). The format and procedures for the exchange of information about BCRs between the controllers, processors and DPAs shall be specified by the

obligation for the DPO to inform the controller, processor, and their staff about the obligations arising from the GDPR and other applicable data protection

authority (DPA) about the transfer and all relevant aspects are duly recorded. Lastly, the controller should inform the data subject about the transfer and

institution of updating courses to keep the DPO and their team informed about data protection developments and related disciplines. Alternatively, the

include: The name of the controller A description of what the complaint is about Their contact information (name, phone number and postal address only) Copies

consult the supervisory authority not only to seek advice about informing data subjects about a breach in accordance with Article 34, but also on the appropriate

term. The authority has an office in Rome with a staff currently numbering about 125 people. The Panel of the Italian DPA is currently composed of Pasquale

transfer personal data. In such cases, the processor must inform the controller about such requirements before commencing the processing. This provision emphasizes

applicable. The fifth section contains the provisions about the rights of data subjects. The sixth section is about the Hamburg Commissioner for Data Protection

certain about the fact that the processing entails high risks that cannot be mitigated by measures they are willing to adopt, or they have doubts about it.

The annual reports of NAIH are accessible in English (https://www.naih.hu/about-the-authority/annual-reports) and in Hungarian (https://www.naih.hu/eves-beszamolok)

Information about the law governing the DPA's activity can be found here. Complaints are governed by the Administrative Procedure Code. Information about investigations

"Procedural Information" for details on why we only get access to press releases about decisions. You can help us by filling in this section! You can help us by

involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it. Recital 62: Exceptions

to three separate incidents in which personal data including information about children was disclosed to unauthorised individuals. The second fine, in June

and marks; (d) established procedures and structures to handle complaints about infringements of the certification or the manner in which the certification

or processor, as the case may be, and inform the other CSAs and the EDPB about the decision, including a summary of the relevant facts and grounds. The

compliance with the GDPR, then it must have a "firm and reasoned notion about the legal basis of processing before it starts any operation, and this notion

months for complex cases, provided that the data subject has been informed about the reasons for such delay within one month of the original request. EDPB:

is usually also processed. Example: A company is processing information about customers in a digital spread sheet. While the entering of personal data

not a party to a complaints procedure. It only informs the data subject about the status of its complaint ("waiting", "in process" or "closed") althrough

According to Article 88(3) GDPR, Member States must notify the Commission about any laws they adopt pursuant to this Article. Currently Austria, Bulgaria

payment for services received from another controller); You make decisions about the individuals concerned as part of or as a result of the processing (e

the Slovakian Freedom of Information Act. You can find more information about it on the website https://dataprotection.gov.sk/uoou/en/content/access-information

CJEU's case-law under Article 47 CFR. The case-law includes statutory rules about appointment of the judges, length of service and the grounds for abstention

Articles 60(4), 63 and 65(1)(a) GDPR”. However, we share the doubts of Hijmans about the compliance of the RoP of the EDPB with Article 41 CFR. Finally, the decision

alleviate burdens placed on DPAs by controllers and processors seeking advice about the legality of their processing activities under the GDPR. This is, in theory

consists of informing national and EU authorities as well as the larger public about the activities the supervisory authority (SA) has performed over the previous

such as victims or witnesses are not included. However, there is discussion about whether suspects should be included. The notion of “offence" must be interpreted

complaints under Article 77 GDPR. The BfDI has to inform the complainant about the ongoing procedure and the results of a complaint procedure. Complaints

employees as per 1st October 2022 out of totally approved 34 positions. About 76 % are women, 24% are men.   Historical numbers: 2021: 33 positions totally

motion. Cases were so far triggered by media reports or larger public debates about controllers. Appeals against decisions are possible in the German administrative

posture in a time frame consistent with mission needs. In other words, it is about the tolerance and compensatory ability of a system against disturbances.

data in documents held by a public authority or a public body’. A decision about its scope will have to be determined by member states or eventually the CJEU

mechanisms, seals or marks, should provide easily accessible information about the certification process which is meaningful and intelligible. It is important

parties are required to, among the others, (i) fully inform the data subjects about the processing and the transfer, (ii) ensure the full exercise of their GDPR

operation; (c) established procedures and structures to handle complaints about infringements of the code or the manner in which the code has been, or is

Datenschutzrecht, Article 53 GDPR, margin number 4 (NOMOS 2019). https://edps.europa.eu/about-edps/supervisors_en Recital 121 GDPR. Hijmans, in Kuner, Bygrave, Docksey

the basis of registries enables researchers to obtain essential knowledge about the long-term correlation of a number of social conditions such as unemployment

information (25 May 2018) and update obligation vis-à-vis the Commission about national legislation adopted in fulfilment of the obligation under Article

covered by the obligation of professional secrecy, in particular information about undertakings, their business relations or their cost components.' Other relevant

Directive 1995 (Directive 95/46/EC) (DPD). However, although the DPD spoke about the designation of a DPO, it did not make this mandatory. With the GDPR’s

categories of personal data as defined in Article 9 (for example information about individuals’ political opinions), as well as personal data relating to criminal

to the Austrian Post (the controller) to obtain information about what personal data about him was processed as well as whether it was disclosed to third

Google. IN 1 regarding the processing of personal data and about the free flow of such data and about the cancellation of avr med directive 95/46/EC (General

physical or mental health status of the data subject. This includes information about the natural person collected in the course of the registration for, or the

not in itself allow to contact the person directly or collect information about behaviour. The Danish DPA held that whilst it is possible for the Municipality

personal data to Google LLC in the U.S. in violation of Chapter V. of the GDPR. About a month after the "Schrems II ruling" by the CJEU (CJEU - C-311/18 - Schrems

other third parties (“New Subprocessors”). 11.2 Information about Subprocessors. Information about Subprocessors, including their functions and locations,

to check its lawfulness". Thus, Article 15 is about the data subject receiving sufficient information about the specific processing in order to be able to

The Norwegian Data Protection Authority fined Grindr about €6,4 million (NOK 65 million) for not collecting users' valid consent for sharing data with

collect information for advertising purposes, there should be information about “the duration of the operation of cookies and whether or not third parties

possible, add the "date decided" in the box. Only if there is no information about the date a case was decided, you can at least add the data a case was published

the elements and the knowledge that is available, both about the processing itself, but also about conditions surrounding the solution and technology , which

yourself. We encourage you to avoid sharing information about your own health in reviews you write about health professionals. " The doctor's list also offers

following. 1 regarding the processing of personal data and about the free flow of such data and about the cancellation of avr med directive 95/46/EC (General

terms of 1 regarding the processing of personal data and about the free flow of such data and about the cancellation of aver med directive 95/46/EC (General

(i.e. 1 regarding the processing of personal data and about the free flow of such data and about the cancellation of avr med directive 95/46/EC (General

by the insurance institution about the insured's and claimant's state of health, illness, or disability, or information about the treatment measures directed

present, the defendant provided information about the plaintiff in such a way that only the information about the plaintiff's discharge of residual debt

no is an important source for the general public to acquire information about healthcare providers. The measures taken to limit privacy concerns also satisfied

clocking systems are not acceptable under Article 5(1)(c) GDPR. When talking about money, use the € symbol, but the official codes for other currencies. Put

Norwegian Privacy Appeals Board upheld a DPA decision fining a beauty salon about €10,000 for unlawful camera surveilling that gave the general manager constant

that in addition to the criminal record extract, there will be information about home alarms. The data subject has exchanged correspondence on the matter

average calculations used here, are neither information about a specific person nor a statement about a specific person and are therefore not personal data

pseudonymous information about how visitors interact with the website. It is not possible to draw any direct conclusions about a person. The legal basis

provided is incomplete as users are still not informed about their right to oppose to these cookies, nor about the means made available to them for this purpose

published about the applicant. The wanted notice is no longer valid. The public no longer has a reason to inform the police of their observations about the applicant

medicine. Subjective personal data about healthcare personnel pertains to the reviews posted about them. Information about warnings and penalties issued from

specifically to provide him with information about his data stored in relation to "political preference" and about the recipients of his "target group" data

complained to Datatilsynet about the Danish Meteorological Institute's (hereafter “DMI”) processing of personal data about him in connection with the display

by the insurance institution about the health, illness, or disability of the insured and the claimant, or information about the treatment measures assigned

handled by the insurance institution about the insured's and claimant's health, illness or disability, or information about the treatment measures assigned

result links from Google Search because they led to outdated information about the data subject. The controller had only removed some of the links, rather