Search results

91/1, 91 / 1-1, 91/2. ZP-1 Article 2, 2/2, 136, 136/1, 136 / 1-1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

here). More precise, Article 13(1)(e) GDPR, Article 14(1)(e) GDPR, Article 15(1)(c) GDPR. Klabunde, in Ehmann, Selmayr, DS-GVO, Article 4 GDPR, margin number

principles in Article 5 of Convention 108 from 1981. Following this tradition, Article 5 GDPR is also largely consistent with Article 6(1) of the previous

assess a possible "legitimate interest" under Article 6(1)(f) GDPR. Equally to Article 6(1)(c) GDPR, Article 6(2) and (3) GDPR require that Union or Member

requirements from Article 9(2) and Article 9 (3) GDPR, but will also require an additional concomitant legal basis contained in Article 6(1) GDPR. However

proportionality, enshrined in EU primary law in Article 5(4) TEU and Article 52(1)(2) CFR, is also reflected in Article 83(1) GDPR. In general, a measure is proportionate

make contact with him' (BVerwG, NJW 2006, 3367ff.)”. Article 1(1) in conjunction with Article 2(1) Directive (EU) 2016/680 of the European Parliament and

purpose(s) (Article 5(1)(b)); lawfulness of processing (Article 6); adequate, relevant and limited to what is necessary data (Article 5(1)(c)); limited

and controllers. If Article 28 GDPR did not intend any privilege, the rules of Article 28 GDPR, and in particular of Article 28(10) GDPR, would be superfluous

individual rights. These criteria have the same meaning as in Article 24(1) and Article 32(1). The "nature" of the processing consists of its “the inherent

dispute resolution mechanism under Article 65 GDPR in connection with Article 63 GDPR is triggered (Article 60 (4) GDPR). Article 60(2) GDPR clarifies that also

Commentary, Article 10 GDPR, p. 388 (Oxford University Press, Oxford, 2020). Schiff, in Ehmann, Selmayr, Datenschutz-Grundverordnung, Article 10 GDPR, margin

the reliance on Article 6(1)(f) GDPR or at least exercise the right to object under Article 21 GDPR. If the legal basis is Article 6(1)(f) GDPR (i.e. 'legitimate

further details see Article 14(1)(d) GDPR. Similar to the ex-ante information in Article 13(1)(e) and 14(1)(e) GDPR, Article 15(1)(c) GDPR requires the

91/1, 91 / 1-1, 91/2. ZP-1 Article 2, 2/2, 136, 136/1, 136 / 1-1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

protection of personal data in Greece is constitutionally established in Article 9A of the Greek Constitution. You can help us filling this section! As an

to access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction (Article 18 GDPR), notification (Article 19 GDPR) or

draw up. Indeed, the wording of Article 40(1) establishes that they “shall encourage” this (emphasis added). Article 40(1) GDPR clarifies that codes of conduct

GDPR (Article 31 GDPR). Direct liability of the representative is limited to the obligations set out in Article 30 and Article 58(1)(a) GDPR. Article 27(5)

remedies. CJEU: The CJEU has clarified in C-132/21 that "Article 77(1), Article 78(1) and Article 79(1) of Regulation (EU) 2016/679 [...] must be interpreted

(e.g. Article 25 (1) and (2), Article 28(1), Article 32(1) GDPR, Article 89(1) GDPR). These measures can also be regarded as measures under Article 24(1)

surveillance cameras, it was therefore in breach of Article 37(1)(b) GDPR by not having a DPO. Article 37(1) GDPR specifies three conditions in which the designation

the elements in Article 2(1) are fulfilled, the GDPR applies unless the processing falls under one of the exemptions named in Article 2(2)(a) to (d) GDPR

requirements of data minimization (Article 5(1)(c) GDPR) and storage limitation (Article 5(1)(e) GDPR). Under Article 30(1)(f) GDPR, where possible, the controller

May 2020 (Version 1.1), p. 10 (available here). EDPB, ‘Guidelines 05/2020 on consent under Regulation 2016/679’, 4 May 2020 (Version 1.1), p. 12 (available

is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning

Category:Article 75 GDPR Dix, in Kühling, Buchner, DS-GVO BDSG, Article 75 GDPR, margin number 1 (C.H. Beck 2020, 3rd edition). Case C-614/10, Commission

Category:Article 31 GDPR Hartung, in Kühling, Buchner, DS-GVO BDSG, Article 31 GDPR, margin numbers 1-4 (Beck 2020, 3rd edition). For instance, Article 58(1)(f)

number 99. Spiecker et al., GDPR Article-by-Article Commentary (2023), p 1075. Spiecker et al., GDPR Article-by-Article Commentary (2023), p 1074. For example

material or non-material damage. Article 32(1) GDPR reflects the principle of integrity and confidentiality enshrined in Article 5(1)(f) GDPR. The controller and

specific rules. Article 82 GDPR introduces a right to compensation for damage caused as a result of an infringement of the GDPR. Article 82(1) contains the

defined by Article 4(2) GDPR), because Article 81(1) GDPR explicitly refers to 'processing by the same controller or processor'. As a result, the Article does

adoption of a final decision that can be challenged under Article 78(1) GDPR. Again, Article 57(1)(f) GDPR is instructive regarding the SA's obligation "[to

concerning the interpretation of Article 28(1) of Directive 95/46/EC ("DPD"), the Regulation's predecessor. Article 28(1) DPD established the existence of

cases (Article 4(23) GDPR), several supervisory authorities (SA) could be competent according to Article 55 GDPR. For this reason, Article 56(1) GDPR establishes

relationship between the GDPR and the EPD is to be found in Recital 10 and Article 1(2) EPD. Article 1(2) EPD provides that the EPD's provisions serve to "particularise

only bring proceedings under Article 79(1) GDPR in limited circumstances of substantive violations. Instead, Article 79(1) GDPR should be read as excluding

Hence, Article 89(2) and (3) GDPR also allow for specific derogation to the GDPR for these purposes, as further detailed below. Article 89(1) GDPR provides

information in the course of an investigation, in accordance with Article 58(1) GDPR. Article 90 GDPR was drafted with a view to regulate potential conflicts

paragraph of Article 80 GDPR establishes several cumulative conditions for entities to qualify as NPOs. For the purposes of Article 80(1) GDPR must be

design, Article 35(2) explicitly states that the controller must "seek advice" from the DPO when undertaking a DPIA. Additionally, Article 39(1)(c) assigns

two deputy chairs under Article 73(1) GDPR. In the case of the latter provision, the wording of which differs from Article 72(1) GDPR, has lead to the view

of documents within the cooperation and the consistency mechanisms”. Article 10 11(1) of the EDPB RoP require the competent SA to send the relevant documents

definition of the notion of religion in general. For instance, under Article 10(1)(b) of Directive 2011/95/EU, “[t]he concept of religion shall in particular

access (Article 15 GDPR), rectification (Article 16 GDPR), deletion (Article 17 GDPR), restriction of processing (Article 18 GDPR), objection (Article 21 GDPR)

the parties concerned before the civil court (Article 152 of the Code, which makes a reference to Article 10, D.lgs. 150/11). For most data protection claims

Article 99 - Entry into force and application 1. This Regulation shall enter into force on the twentieth day following that of its publication in the Official

the relevance of Article 29 GDPR were rooted in the fact that Article 28(3)(b) GDPR already seems to cover much of the scope of Article 29 GDPR. More specifically

on the basis of (i) its legitimate interest (Article 6(1)(f) GDPR) or (ii) the public interest (Article 6(1)(e) GDPR). Hence, data subjects may find themselves

on categories of data listed under Article 9(1) GDPR. There have been conflicting arguments as to whether Article 22(1) GDPR lays down a right or a general

considered as one of the 'other administrative or non-judicial' remedies, which Article 78(2) GDPR refers to. If the DPA decides to uphold their decision, they

legal basis than Article 6(1)(c)(e), for example based on consent or contract (Article 6(1)(b)), the same entity is subject to Article 56. This means that

basis of Article 6(1)(c) GDPR (i.e. processing is necessary for compliance with a legal obligation to which the controller is subject) or Article 6(1)(e) GDPR

Article 94 - Repeal of Directive 95/46/EC 1. Directive 95/46/EC is repealed with effect from 25 May 2018. 2. References to the repealed Directive shall

recitals for Article 97 GDPR. Article 97 GDPR imposes a "comprehensive reporting obligation" upon the Commission. The first paragraph of Article 97 GDPR sets

protection principles (Article 5), determination of the legal basis for processing (Article 6), implementation of security measures (Article 32), notification

According to the final paragraph in Article 49(1) GDPR, when none of the derogations described above (Article 49(1)(a-g) GDPR) is applicable, transfers

(GDPR), Article 96 GDPR, p. 1305 (Oxford University Press 2020). Moore, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 96 GDPR

that process them. This was already the case under Article 8(7) of the DPD, the precursor of Article 87 GDPR. In many Member States, the processing of NIN

Article 8: Conditions applicable to child’s consent in relation to information society services 1. Where point (a) of Article 6(1) applies, in relation

one Member State (Article 64(2) GDPR). Docksey notes that the “subject-matter is thus not limited to the matters listed in Article 64(1) and could concern

point, it is important to note that Article 13(1)(f) GDPR, Article 14(1)(f) GDPR, Article 15(1)(c) GDPR and Article 15(2) GDPR, make specific reference

deliberations of the Board's predecessor, the Article 29 Working Party (“WP29”), were wholly privileged. Under Article 11(1) of WP29's Rules of Procedure, any minutes

However, Article 5(1)(d) GDPR gives the controller some leeway to continue processing inaccurate data - see more details under Article 5(1)(d) GDPR. Article

accordance with Article 58(2) [GDPR]”. These is a reference to the information that SAs must keep in internal records according to Article 57(1)(u) GDPR. The

Article 53 - General conditions for the members of the supervisory authority 1. Member States shall provide for each member of their supervisory authorities

territorial scope of the GDPR (Article 3)’, 12 November 2019 (Version 2.1), p. 16 (available here) referring to Article 1(1)(b) Directive (EU) 2015/1535

reasoned objection of a SA (Article 65(1)(a) GDPR), when there are different views on which SA is the lead SA (“LSA”) (Article 65(1)(b) GDPR), and where a SA

restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been

rules, do not fall within the scope of this article. → You can find all related decisions in Category:Article 48 GDPR Kuner, in Kuner, Bygrave, Docksey,

to in Article 42(5) and approved by the supervisory authority which is competent pursuant to Article 55 or 56 or by the Board pursuant to Article 63; (c)

to in Article 46(2)(d) GDPR, contractual clauses referred to in Article 46(3)(a) GDPR, or binding corporate rules within the meaning of Article 47 GDPR

implementing acts are delegated to the Commission pursuant to Article 291 TFEU, Article 93(1) GDPR provides that the Commission shall be assisted by a committee

prejudice to requests by the Commission referred to in point (b) of Article 70(1) and in Article 70(2), the Board shall, in the performance of its tasks or the

The authority addressed under Article 66(1)-(2) GDPR is the CSA within the meaning of Article 4(22) GDPR. In contrast, Article 66(3) refers to “any supervisory

best practices referred to in point (l) of Article 70(1) as well as of the binding decisions referred to in Article 65. Recital 100: Establishment of Certification

it establishes an EU-wide penalty regime for violations under Article 83 GDPR, Article 84(1) GDPR dispenses with complete harmonisation. It does, however

exchange of knowledge between them. This way, Article 50 GDPR expands the exhortation under Article 57(1)(g) GDPR that calls for cooperation between EU

under Article 8(1) GDPR, then the processing is unlawful and therefore the general clause under Article 17(1)(d) GDPR applies. Contrary to Article 17(1)(a)

commentary to Article 60 GDPR, Article 61 GDPR, Article 62 GDPR, Article 63 GDPR, Article 64 GDPR, Article 65 GDPR, Article 66 GDPR and Article 56 GDPR. The

in accordance with Article 98'. → You can find all related decisions in Category:Article 98 GDPR The CJEU has yet to rule on Article 98 GDPR. Nonetheless

codes of conduct on the basis of Article 41 of Regulation 2016/679 and of a certification body on the basis of Article 43 of Regulation 2016/679; To ensure

Article 38 - Position of the data protection officer 1. The controller and the processor shall ensure that the data protection officer is involved, properly

is not apparent why the principle laid down in Article 72(1) GDPR should be deviated from. Article 72(1) GDPR stipulates that the Board shall take decisions

establishment of SAs, please refer to Article 51(1) GDPR and Article 52 GDPR in this Commentary. Article 54(1)(b) GDPR echoes Article 53(2) GDPR, which outlines the

between Article 21(3) GDPR and Article 17 GDPR on the right to erasure must be considered. The tight relationship between Article 21(3) and Article 17(1)(c)

including the power to adopt binding decisions pursuant to Article 65 GDPR (Article 70(1)(t) GDPR). Article 68 GDPR is the first of nine Articles (Articles 68-76

Datenschutzrecht, Wolff/Brink DS-GVO Article 64 margin numbers 19-20.1 (35th Edition 1.2.2021). Caspar in Kühling, Buchner, GDPR Article 64, margin number 24 (C.H

delegation of power as necessitated by Article 290 TFEU, such as its duration (Article 290(1) TFEU), its revocability (Article 290(2)(a) TFEU), and the dependence

subjects - which would be counterproductive. Article 11 GDPR is meant to address this matter. Under Article 11(1) GDPR, when a processing operation does not

notify the competent supervisory authority of such a breach. Article 34(1) GDPR differs from Article 33 GDPR. Instead of having to notify the supervisor authority

territory of its Member State in accordance with Article 55(1). In that case, the urgent need to act under Article 66(1) shall be presumed to be met and require

controller is subject, under Article 6(1)(c) GDPR. In line with the general objectives of the GDPR, as outlined in Article 1 GDPR Article 16 TFEU, SAs are also

basis of Article 49(1); (k) draw up guidelines for supervisory authorities concerning the application of measures referred to in Article 58(1), (2) and

act under Article 66(1) shall be presumed to be met and require an opinion or an urgent binding decision from the Board pursuant to Article 66(2). Recital

additional benefit of Article 14(1)(d) GDPR may be questionable, if one agrees that Article 14(1)(c) (see commentary on Article 13(1)(c) GDPR) already requires

processing of personal data (see Article 5(1)(a) GDPR), the need to limit the purpose of such processing (see Article 5(1)(b) GDPR), the requirement to have

consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and (b) the processing is

by other DPAs concerned. The BCR Lead the submits, following Article 64(1) GDPR and Article 64(4) GDPR, a draft decision to the EDPB. The EDPB, in turn

deadline of Article 36(1) GDPR, and it is still disputed whether the outcome of the procedure rather resembles that of Article 58(3)(a) GDPR or Article 58(3)(b)