Search results

the Head of the DPA. This decision can then only be challenged by an action before an administrative court (judicial review - on a question of law). In

electronic form according to § 14(3) BDSG at bfdi.bund.de (in German). In case of an obviously unjustified complaint or excessive complaints from one complainant

Hamburg. The Hamburg DPA is divided into different departments. It offers an organigram here. There is a Data Protection Act of Hamburg (Hamburgisches

supervisory authority Article 78: Right to an effective judicial remedy against a supervisory authority Article 79: Right to an effective judicial remedy against

The Catalonian DPA (Autoritat Catalana de Protecció de Dades, in Catalan, or Autoridad Catalana de Protección de Datos, in Spanish) is the regional Data

supervisory authority Article 78: Right to an effective judicial remedy against a supervisory authority Article 79: Right to an effective judicial remedy against

The Data Protection Office (Valstybinė duomenų apsaugos inspekcija) is the national Data Protection Authority for Lithuania. It resides in Vilnius and

The Bulgarian Data Protection Authority (Комисия за защита на личните данни) is the national Data Protection Authority for Bulgaria. It resides in Sofia

The Portuguese Data Protection Authority (Comissão Nacional de Protecção de Dados) is the national Data Protection Authority for Portugal. It resides in

the Slovak DPA has issued penalties in an amount of 132 600 €. The highest penalty imposed on the controller was an amount of 50 000 € for breaching obligations

The Baden-Württemberg DPA (Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg) is the state Data Protection Authority

The Hesse DPA (Hessischer Beauftragter für Datenschutz und Informationsfreiheit) is the state Data Protection Authority for the German state of Hesse.

The Rhineland-Palatinate DPA (Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz) is the state Data Protection Authority

The Bavaria public sector DPA (Bayerischer Landesbeauftragter für den Datenschutz) is the state Data Protection Authority for the public sector for the

The Saarland DPA (Unabhängiges Datenschutzzentrum Saarland) is the state Data Protection Authority for the German state of Saarland. It is charge of enforcing

The Saxony DPA (Sächsische Datenschutzbeauftragte) is the state Data Protection Authority for the German state of Saxony. It is in charge of enforcing

The Bavaria DPA (Bayerisches Landesamt für Datenschutzaufsicht) is the state Data Protection Authority for the German state of Bavaria. It is in charge

The Bremen DPA (Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen) is the state Data Protection Authority for the

The Saxony-Anhalt DPA (Landesbeauftragter für den Datenschutz Sachsen-Anhalt) is the state Data Protection Authority for the German state of Saxony-Anhalt

supervisory authority Article 78: Right to an effective judicial remedy against a supervisory authority Article 79: Right to an effective judicial remedy against

district administration court (Verwaltungsgericht) in Düsseldorf. Regularly an appeal against the courts decision is possible at the Superior Administrative

The State Data Protection Inspectorate (Datenschutzstelle) is the national Data Protection Authority for Liechtenstein. It resides in Vaduz and is in charge

The Mecklenburg-Vorpommern DPA (Landesbeauftragte für den Datenschutz Mecklenburg-Vorpommern) is the state Data Protection Authority for the German state

The Brandenburg DPA (Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht) is the state Data Protection Authority for the German state

The Schleswig-Holstein DPA (Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein) is the state Data Protection Authority for the German state

The Thuringia DPA (Thüringer Landesbeauftragte für den Datenschutz und die Informationsfreiheit) is the state Data Protection Authority for the German

The Basque DPA (DBEB, Datuak Babesteko Euskal Bulegoa, in Basque or AVPD, Agencia Vasca de Protección de Datos, in Spanish) is the regional Data Protection

The Andalusian DPA (Consejo de Transparencia y Protección de Datos de Andalucía) is the regional Data Protection Authority for the Spanish autonomous region

The Ålandic DPA (Datainspektionen på Åland, in Swedish) is the regional Data Protection Authority for Finland's autonomous region of Åland. It is in charge

own motion. They provide an overview of their policy to ex officio supervision on their webpage. In addition they provide an overview over which sectors

Verlag 2017). Generally, when terms are not defined in Union law, they take on an autonomous meaning, any definitions drawn from national law cannot be relied

EDPS reaches 100 employees. In 2019, the EDPS starts supervising Eurojust - an EU agency in charge of combating serious forms of crime - in its processing

supervisory authority Article 78: Right to an effective judicial remedy against a supervisory authority Article 79: Right to an effective judicial remedy against

regards to assessing safeguards whether the presence of an ombudsperson can ensure that the US provides an effective remedy to data subjects whether the SCCs

The adherence of the processor to an approved code of conduct or an approved certification mechanism may be used as an element to demonstrate compliance

advising the Commission. Article 71 GDPR states that the EDPB must draw up an annual report regarding the protection of natural persons with regard to data

on European Union, where an interpretation of the Treaties is not comprehensible and must thus be considered arbitrary from an objective perspective. If

The CJEU held that an Internet search engine operator is considered the controller (Article 2(d) Directive 95/46) in respect of the processing (within

Planet49 organized an online lottery hosted on their webpage. In order to participate in the lottery the participant had to enter a name and an address. Underneath

indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors

28 February 2022, the data subject filed an access request. Example: Not On 28.02.2022, the data subject filed an access request. Example: Not On February

submitted by a candidate at a professional examination and any comments made by an examiner with respect to those answers constitute personal data. The claimant

activities of an establishment of the controller on the territory of the Member State. It stated this notion of 'in the context of the activities of an establishment'

Directive 96/45 is defined as information relating to an identified or an identifiable natural person. Also, an identifiable person is one who can be identified

of such assumed political opinions of him. Therefore, the claimant brought an action for non-material damages before the Regional Court for Civil Law Matters

Compliance with an approved code of conduct referred to in Article 40 or an approved certification mechanism referred to in Article 42 may be used as an element

further considers that a company, an autonomous legal person, of the same group as the controller, can constitute an establishment of the controller within

concept of an undertaking, as defined in Articles 101 and 102 TFEU, and the principle of an economic entity, with the result that proceedings for an administrative

indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors

from a job applicant what data an employer requests from an employee under which conditions it is permissible to process an employee's personal data on the

complying with an Instruction; (b) an Instruction does not comply with European Data Protection Law; or (c) Google is otherwise unable to comply with an Instruction

Was this an appeal? Choose yes, if this case was an appeal from a lower court or from any other decision. Original Decision Details: If this was an appeal

consuming compared to accepting. An “opt-out” solution would not meet the requirements for a valid consent, as it would not be an “unambiguous indication of

too high, an impact assessment. Additionally, the DPA issued a warning that the use of G Suite’s supplementary programs without carrying out an impact assessment

Ch D165). However, the Minors’ Contracts Act 1987 states that an 18 year old can ratify an unenforceable contract entered into when they were under 18 years

in itself sufficient to achieve an acceptable level of protection in the context of data transfers to the US and that an analysis of the national provisions

administrative procedure, but can be appealed to the courts. Personvernnemnda is an independent administrative body subordinated to the Norwegian Ministry of

of the data subject's age that a refusal to disclose to an injured party personal data is not an appropriate measure when these data are necessary to initiate

Protection Authority handles complaints filed with them. An appeal can be brought to Personvernnemda, an independent administrative body following § 15 of the

Information relating to legal proceedings brought against an individual and information relating to an ensuing conviction are data relating to ‘offences’ and

the controller relies on an overall bundled consent to anything contained in the terms and the privacy policy. This represents an “all-or nothing” approach

already an unlawful transfer of personal data to the USA and thus to a third country. Irrespective of the geographical storage of the data, there is an accessibility

carried out an initial phase of analysis of the security flaw, which led to an action plan to be implemented from June 2018. She also indicated that an initial

concerns a complaint from an X AS against the Data Inspectorate's decision of 14 July 2021, where the inspectorate charged the company an infringement fee of

stated by the CJEU that in the context of the examination of an abuse of a dominant position by an undertaking on a particular market, it may be necessary for

citizen through his electronic identity card in the context of an IT application, must also an alternative that the use of the electronic identity card does

consumer in an alternative relationship to the button "Accept all". Thus, the wording "Change settings" does not contain an unambiguous reference to an alternative

October 2020 (Annex K11, file, p. 421), the plaintiff received an answer from a landlord to an enquiry about a flat, stating that they could not rent him a

assessments on the website provide an e-mail address to the Medical List. This is not sensitive personal information. An email address in itself is not sensitive

subjects UF and AB underwent insolvency proceeding in Germany and were granted an early discharge from remaining debts by court decisions of 17 December 2020

in itself sufficient to achieve an acceptable level of protection in the context of data transfers to the US and that an analysis of the national provisions

personal information, for example as a customer to a supplier or as an employee or jobseeker to an employer. In a case like this, the criterion provides less guidance

GDPR constitutes an instrument for the exercise of public rights, whereas the legal action provided for in Article 79 GDPR constitutes an instrument for

because of an unresolved data breach, which allowed unauthorised users to access citizens' personal data via URL manipulation. On 20 June 2023, an individual

identification of an interested party that is published in an official newspaper with the information that is recorded in the FIJ, constitutes in turn an infringement

July 29, 2022, an explanation of what measures the data protection officer has taken as a result of the decision, unless it applies for an amendment to this

indirectly, in particular by reference to an identifier such as a name, an identification number, a location data, an on-line identification or one or more

directly or indirectly specifically identified referring to an identifier such as a name, an identification number, a location data or online identifiers

in itself sufficient to achieve an acceptable level of protection in the context of data transfers to the US and that an analysis of the national provisions

a general provision opening up for processing personal data that represent an important public interest based on a balancing of interest with the fundamental

not limited by recital 63 GDPR. Article 12(5), 15(1) and 15(3) GDPR impose an obligation on a controller to provide the data subject, free of charge, with

the City of Helsinki's Social services and healthcare division. As a part of an application process to volunteer as a support person for children and youth

information about categories of recipients is sufficient. A data subject sent an access request to the Austrian Post (the controller) to obtain information

investigation. As this is an international issue with complainants residing in various Member States, the Belgian DPA provides an interlocutory decision on

assessed by national courts. Such an interpretation is capable of ensuring the protection of personal data and the right to an effective judicial remedy against

Court pointed out there is no docuiment showing that the applicant submitted an inspection request of the procedural files at stake. Then, the Court clarified

24th February 2023 (Numero protocollo: 0033835) opened an investigation concerning ChatGPT, an AI service offered by the American company OpenAI. The investigation

The data subject made an access request (DSAR) to Wise Payments Limited ("Wise"), a financial institution with which he had an account. Wise declined

interface of the website. On the 23 September 2019, the controller learned that an ethical hacker managed to get access to the test database which contained

95/46 which is defined as any information relating to an identified or identifiable natural person, an identified person being one who can be identified directly

Administrative Court (BVwG): "This does not include provisions totalling EUR 18m for an administrative fine imposed on Austrian Post by the Austrian Data Protection

Anna Nichols Legal Trainee at noyb.eu n/a Please be aware that noyb employees, trainees, and members often act in their function as administrators of this

Constitutional Court, in Judgements 292/2000 and 254/1993, confirmed it as an autonomous right, independent of the rights to intimacy [privacy], honour

determining the conclusion of an employment agreement or for the execution of that agreement. There are provisions about the validity of an employee's consent, the

translation of the documents provided by the parties. On the 4th of February, an inspection report (of 13th July, 2020) was provided to the parties in French

data, and repealing Directive 95/46/EC (General Data Protection Regulation). An English translation is available here. There are no provisions in the national

committed an infringement of Article 83(4)-(6) GDPR. On 24 March 2020, the Lithuanian Minister of Health approved the development and implementation of an IT

The APD/GBA (the Belgian DPA) found that a hospital that requested an audit by an external expert was the controller for the audit-related processing activity

Asked whether an assessment of the health status of the BF had taken place, the MP stated that when an insurance contract was taken out, an assessment of

Administration Act states: When it is stipulated in law that an administrative sanction may be imposed on an enterprise, the sanction can be imposed even if no individual