Search results

to process sensitive personal data When you leave an assessment on Legelisten.no, you must provide an e-mail address. For many, the email address contains

The Rotterdam Court of First Instance rejected an access request to procedural files before the State of the Netherlands as inadmissible. The Court ruled

property is Ms. A.A.A. with an e-mail address for notification purposes ***EMAIL.1 and the tenants are Mr. B.B.B. and Ms. C.C.C., with an e-mail address for notification

section 25 of the Data Protection Act (1050/2018), an appeal against this decision may be lodged with an administrative court in accordance with the provisions

resolution may be considered as an infraction. administrative action in accordance with the provisions of the RGPD, classified as an infraction in its article

Authority first.C/ES/3409/13-05-2019 complaint by A concerning receipt of an unclaimed communication policy (e-mail message) to promote the candidacy of

breach is an objective fact that does not coincide with the controller’s lack of appropriate security measures – i.e. the mere GDPR infringement. An annoyance

Supervisory Authority, “an agreement whereby a minor user consents to the processing of his or her personal data in connection with the use of an information society

ordered CARREFOUR BANQUE to pay an administrative fine of €800000. Insofar as the company took the necessary measures to put an end to the breaches of which

complaint under Article 77 GDPR. A data subject made an access request with an address publisher and direct marketing company, the controller, asking it specifically

restricted committee of the Commission impose an administrative fine on the two companies, as well as an injunction to bring into compliance the processing

recipient, and revoked), by the exporter or by an entity trusted by the exporter under a jurisdiction offering an essentially equivalent level of protection

Oy, a company that keeps a credit information register. This register gives an overview of the creditworthiness of debtors, whose debts are shown in the

person, to an indeterminate number of individuals sicas 3. An approved certification mechanism may be used in accordance with article 42 as an element that

not support as an interpretation that the legislator intended to extend the concept of "insured party" to apply also to the applicant an insurance before

construction of an office building. During the project, workers who carried out activities at the construction site registered their presence through an electronic

by default (Article 25(2) GDPR). The DPA suggested that if an insurance company requests an individual's health information from healthcare services, the

the claimant). The claimant states that, on January 3, 2019, he submitted an e-mail requesting the cancellation of the inclusion of his data in the Asnef

indirectly, in particular by means of an identifier, such as example a name, an identification number, location data, an online identifier or one or more elements

validation for an email that did not belong to the data subject. The AEPD pointed out a violation of Article 6(1) GDPR by processing data without an adequate

Letter b) GDPR to. The provision only lists the frequent repetition as an example of an "excessive" application on. However, the use of the word "in particular"

context, the one in which an interested party can issue the required declaration by filling in an electronic form, sending an email, uploading a scanned

fixed phone of his office so that, in the event of an inconvenience, the recipient could request an exemption from a possible subsequent shipment. 5) Some

data as follows: «Any information about an identified or identifiable natural person (« the registered »); An identifiable natural person is a person who

on final convictions in the credit information register Thing Correction of an error in the credit information register and entry of default information

data with AFS. The DPA opened an investigation regarding the controller. In the procedure, the controller stated that it had an agreement with AFS for the

to which the vacancy notice for a vacancy for an official position, including a managerial position for an official, and for the recruitment of candidates

that it had submitted an request for erasure (Article 17 GDPR), but had never received an answer form the controller. The DPA started an investigation following

​​constitutional protection of telecommunications includes, alongside an objective dimension, an indispensable subjective dimension, Thus, it is important to consider

electoral census for delivery to political parties (date 06/03/2019).On 17/05/2019 an envelope with a miniature name and address, with the letterhead of the PSC

health data. Following the report made by a website, the CNIL carried out an online check in September 2019. On this occasion, the Commission found that

a copy of the image of an email as an example. They also declare that the employees have a consultation portal, providing as an example impression of a

and 418 ZPO. A is neither an official document on declarations within the meaning of § 415 ZPO nor an official document on an official order, disposition

identifier was strictly necessary for the provision of an online communication service at the user's request. If an identifier had multiple purposes, the provider

which had to be taken into account as an aggravating factor. The intensity of the intervention, which had also covered an unlimited number of passers-by and

subject rights do not apply. The details on processing of personal data in an employment context are regulated in the privacy booklet published by the Dutch

sentiment. b. Existence of an effective objection 35. Finally, it must be checked whether the respondent had to take into account an objection by the complainant

The events described above imply an impact on the content of the article 13 RGPD, lacking informative sign(s) with an effective address to the that, where

(article 100.1, 5 ° LCA) and an order of compliance detailed below (article 100.1, 9 ° LCA) accompanied by an administrative fine in an amount of 15,000 euros

for months, especially considering that he was the subject of an Interpol Red Notice and an intensified search. The main reason for the principle of the

58(2)(f) GDPR, the Italian DPA imposed a temporary limitation on processing of an AI-powered ChatBot. The privacy policy did not clarify which legal basis had

The CJEU held that the mandatory disclosure, in the context of an online transparency publication, of personal information concerning a public officer

€150,000 for sending unsolicited advertising messages, for not responding to an access request and for not facilitating the objection to processing of personal

this body may be considered as an administrative offense in accordance with the provisions of the GDPR, classified as an infraction in its article 83.5

July 29, 2022, an explanation of what measures the data protection officer has taken as a result of the decision, unless it applies for an amendment to this

of an illegal act will require the prior duty of information, which may be understood to have been fulfilled when the placed in a visible place an informative

An association that disclosed personal data of one of its members in a Whatsapp group was fined €3,000 for violating Articles 5(1)(f) and 32 GDPR. The

result information that is accompanied by an objectively perceptible factual error and which therefore gives an incorrect, incomplete or misleading picture

and that the term remains an autonomous concept of EU law. That means that it is not decisive if an offence is classified as an administrative offence in

they are the owner of the property being, therefore, an area of public access, which constitutes an access not authorized to said data. This document was

process, provided in particular as an ordinary way of dealing with the oral hearing of cases from May 30 to July 31, as an alternative to the purely paper-based

controller to reply to a data subject's request to delete personal data, to an objection of processing of data for marketing purposes, transfer to third

golf company AE’ (hereinafter ‘Glyfada GAAR’) which includes an event with the complainant and an employee of the company.This request was repeated on...,

not support as an interpretation that the legislator intended to extend the concept of "insured party" to apply also to the applicant of an insurance before

a credit score is a decision for the purposes of Article 22(1) GDPR, where an action taken by a third party ‘draws strongly’ from it. A data subject was

on ...2019 at ...2019 and time ... an automated telephone call from the number ..., to which he answered and heard an audio message that he had won 850

circumstances. The Belgian DPA brought an action before Court of First Instance of Brussels, Belgium on 11 September 2015, seeking an injunction against Facebook

provide for an observation period of at least five years with regard to the estimation of risk parameters. In contrast, data subjects have an interest in

certificate issued for ISO 27001 Certification (reflecting the result of an audit by an external auditor)." C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeagpd

controller's premises. The controller argued that the DPA should have requested an explanation from the other company as well, because the data subject was not

the case to the access to written answers of an exam already decided by previous judgements. Therefore an access to the driving test videos may have the

000. Share your comments here! Share blogs or news articles here! This is an available machine translated decision. Please refer to the Greek original

La Salud) hired Electromedical and Information Services (ASEI) to carry out an internal investigation to assess whether the access to the data subject's

security.In addition, you are told that 401 GSNA is an Organic Formation of the General Staff, subject to an administrative management relationship and as a

challenge” died. The “blackout challenge” is an internet phenomenon in which participants film themselves in an autoerotic asphyxiation. This practice is

violation of Article 5 GDPR to be restored, as well as of its authority to impose an administrative fine that amounted to 8,000 EUR. The complainants claimed that

mobile app on her phone, without informing employees or customers. Following an appeal, the Norwegian Privacy Appeals Board upheld the DPA's decision. A trade

Regulation as any form of information about an identified or identifiable natural person (“the data subject”). An identifiable natural person means a natural

processing activities. The board rejected the request. Eventually, the DPA brought an appeal before the Supreme Administrative Court, which referred the following

the principle of accountability. Moreover, the processing was conducted in an opaque way with regard to both its general policy and dealing with the data

organization may be considered as an administrative offense in accordance with the provisions of the RGPD, classified as an infraction in its articles 83.5

(Garante) imposed a fine of €12.25 million on Vodafone Italia S.p.A, following an inquiry into their telemarketing practices which revealed that Vodafone was

form of processing based on Article 4(2) GDPR. The DPA has the power to issue an ex officio interim order for immediate total or partial temporary restriction

organization may be considered as an administrative offense in accordance with the provisions of the RGPD, classified as an infraction in its articles 83.5

HDPA ran an on site audit at the Ministry of Foreign Affairs as being the data controller according to VIS Regulation and VIS Decision. VIS is an information

of the principle of accountability, had to examine whether there was an issue of an adverse effect on the rights and freedoms of the mother with a view

for review by the second contested decision. The data subject claimed for an annulment of the decision by European Data Protection Supervisor (EDPS) of

rules"; HAVING DETECTED the publication by the online newspaper La Cronaca24 of an article entitled: "XX" available at the link https://... in which, citing

participant in an electronic database, it is possible that among the numerous registered calls there is an error in the number, due to an incorrect entry

resolution may be considered as an infraction administrative in accordance with the provisions of the RGPD, classified as an infringement in its article 83

DEYA X violated GDPR's data minimization principle Article 5(1)(c) by sharing an employee's personal and health data with multiple recipients without proper

restriction, and objection. In its decision, the DPA held that, in principle, an employer could not consult private emails of his employees, even if the company

forgotten was not infringed and rejected the complaint. The data subject has filed an administrative appeal against this decision. The Austrian Federal Administrative

do not preclude national rules from laying down, without any limit in time, an obligation for Internet advertising service providers to communicate certain

controller, and about the fact that their personal data could have been used for an additional purpose. The Greek DPA also found that the objections of the customers

(in ahead, the claimed one). The claim indicates the following: “I received an email from pulpower to confirm my subscription, as I had not done no management

viewed that an activity cannot be regarded as purely personal or domestic where a) its purpose is to make the data collected accessible to an unrestricted

electricity supply corresponding to the claimant's supply point, providing an email address for the invoice to be sent. To be able to carry out the requested

Energéticas, the controler, filed a lawsuit against the data subject due to an alleged debt. In the judgment , a Spanish Court of First Instance dismissed

subject could exercise their right to object and erasure. This case concerns an interlocutory judgment in the case C/13/694440/KG ZA-20-1118 MvW/JE dated

willingness to be known, as well as regarding the conditions under which such an access should be provided. This question, as the HDPA found, was never answered

failing to implement appropriate technical and organisational measures to ensure an appropriate level of security. The failure resulted in a data breach and unauthorised

the Constitution also establishes that it is prohibited the attribution to an unique national number to the citizens. In Portugal the GDPR is implemented

bureaucratic steps that severely limit individual rights. Proceedings before an administrative tribunal can take up to 2 years. You can help us fill this

administrative fines of maximum EUR 20,000,000 or, in the case of a company, an amount equivalent to a maximum of 4% of the C/ Jorge Juan, 6 www.aepd.es 28001

and records relating to her, including any decision of the Supreme Court on an appeal. A relevant case: HDPA 12/2024 Please find relevant provisions of laws

fundamental rights of the data subject is not overridden, following § 12 (2). In an employment context, processing of personal data may take place on the basis

was fined 9898 RON (equivalent to €2000) for sending unsolicited message to an e-mail address collected indirectly from public sources for the purpose of

A car rental company filed an appeal with the Spanish National High Court against a Spanish DPA decision in which a fine of €25,000 was imposed for breaching

proceed and is not willing to open an investigation against a company established abroad that has not designated an EU Represenative. Rocketreach sells