Search results

Spanish DPA holds that the refusal by an airline to send the telephone recordings to a customer infringes the right of access provided for in Article 15

Appeals Board for an assessment. In its decision, the Norwegian Privacy Appeals Board clarified that Article 17(3)(b) GDPR makes an exception to the right

obligation, gal, informs an administrative body of the existence of a certain fact that could justify the ex officio initiation of an administrative procedure

kind of information regarding the data that they process. After launching an investigation, the AEPD found that the one of the websites did have a privacy

with an access request. This request did not receive any reply. After examining the defense notes provided by the company, the Italian DPA opened an administrative

complaint before the Spanish DPA, which started an investigation and notified the controller about an alleged violation of Articles 6(1) and 15 in connection

infringement is punishable by a fine of up to €20,000,000 or, in the case of an undertaking, an amount equivalent to a maximum of 4 % of the total annual aggregate

689/1981; this is because "the security incident [...] caused, in an accidental manner, an unauthorized disclosure of the data entered by the participants

purpose. There was an additional breach in Article 2(4) GDPR and Article 24 GDPR, which relates to the principle of liability. This puts an obligation on the

account and the tribunal assumes that he will be given an overview of activities if he directs an inquiry to Microsoft Corporation. However, it will not

Transformation and Public Service (the Ministry of Transformation) regarding an email sent on 26 January 2023 to the civil service sector, containing a short

blocked the requested URLs, exceeding the one month time limit for responding to an access or erasure request. The DPA recalled the controller's obligation to

at Brobizz A / S. Brobizz A / S and customer A have entered into an agreement to issue an Autobizz which can be used to pay for ferry crossings. In connection

B14851612:A) For an infringement of article 21.1 of the LSSI, typified in Article 38.4.d) of theLSSI, a sanction of warning.B) For an infringement of article

a sanctioning procedure against the A.A.A for an alleged violation of article 6 of the GDPR typified as an infringement of basic principles for processing

Municipality of Manduria for unlawfully communicating the personal data of an employee to four newspapers. The DPA held that the Municipality could not

the provision), an assessment of whether the processing operations are necessary and moderate compared to their purpose (paragraph b), an assessment of the

32 GDPR) after an employee recorded video surveillance footage with their mobile phone and shared it on social media. The controller is an supermarket chain

The Croatian DPA (AZOP) imposed a fine of approximately €120,000 against an energy company for a violation of Article 15(3) GDPR by failing to provide

and Article 13 GDPR. On 14 February 2019, the Luxembourg DPA decided to open an investigation into the companies of Group A and particularly into Company

data of 1300 data subjects to incorrect email addresses. In the context of an online event that it was organising, the data controller erroneously sent

this case, the Cypriot DPA reviewed one of its previous decisions, following an order by the Administrative Court. In September and October 2018, four articles

receive their contract, the controller sent an email containing contract of another customer as well as an audio recording of that customer's data. The

Article 123 of the LPACAP, the interested parties may lodge, on an optional basis, an appeal for a reversal to the Director of the Spanish Data Protection

Seguridad del Estado) in November 2019. In addition, the system does not have an informational poster indicating the responsible person for data processing

Assembly meeting. The notification document included the claimant's name and an outstanding debt of €286,81 in his name. The defendant claimed that notifying

key card as an employee or as a private person. The error only affected people with NemID key cards who logged in as an employee, which is an unknown proportion

("Gedragscode Verwerking Persoonsgegevens Financiële Instellingen"); 2) IVR is an internal register of ING, appellant failed to demonstrate that the record

welfare service's handling of confidential personal data in an e-mail on 7 December 2021. In an email to A on 23 February 2022, the Norwegian Data Protection

SL despite being on the "Robinson List". Raise Marketing has entered into an agency contract for teleshopping with Factor Energía SA. In this contract

"Any person taken care of by a health professional, an establishment or service, a professional or an organization contributing to prevention or treatment

due to the voluntary and early payment of €3000. The respondent company sent an e-mail to the claimant requesting the return of a credit. To facilitate payment

including photo inserts, GZ. PAD/[...]/VStV, an official company register query on FN [...] dated 28.08.2018, an official online search at the Internet address:

in accordance with Articles 6 and 7 GDPR. The Spanish DPA (AEPD) launched an investigation on Orange's marketing practices after several complainants lodged

the monitoring activity for which an accreditation was granted , in fact cannot be exercised. Likewise, in this case, an effective interaction of the respective

factors (Article 83 (2) GDPR) to determine the level of the sanction: It is an intentional negligent action (art. 83 (2) (b) GDPR). The AEPD became aware

of this body may be considered an administrative offence in accordance with the provisions of the RGPD, classified as an infringement in its Article 83

The Spanish DPA dismissed a complaint about an unauthorised publication of nude photos of a minor on a pornographic website due to the lack of evidence

Spanish DPA (AEPD) fined an accommodation services company €6000 for signing a contract on behalf of the claimant without their consent. An action for breach

although in its historical file, there was an informed dischargeby Evo Finance on January 13, 2019, for an unpaid amount of € 738.76,which was terminated

year is a sufficient storage period. Statement received from the registrar An explanation has been requested from the registrar on May 27, 2020. The registrar

assignment of points in an evaluation of the organizational behavior of directors and executive personnel of an Italian municipality may cause an “unjustified and

Adherence to an approved code of conduct pursuant to article 40 or to a certification mechanism approved under article 42 may serve as an element to demonstrate

Regulation, the Sanctions Board has assessed the imposition of an administrative fine as an effective, proportionate and warning sanction based on Article

cookies and tracers, an adaptation period of six months during which the Commission announced that the continuation of navigation as an expression of consent

the activities of his office, which can be qualified as an SME. Said breaches only concern an employee in a specific, punctual context, marked by loss

fined electronics and appliance company EUR 3,000 because it kept contacting an individual for commercial purposes, although the individual had objected to

of €3000 on GTL for a breach of art. 12 and 15 of the GDPR in relation to an access request from a former employer. In particular, the Garante specified

considerations: “Indeed, current criminal law sets an age below which per- sona is unimputable (14 years old), and establishes an age range from 14 and under 18 years

had an impact on the privacy consents reported in the customer data sheets. In this regard, during the inspections, it was found that there was an inconsistency

Administrative Courts. For example, Administrative Courts are competent to deal with an action for misuse of powers against a national decree which allows uninterrupted

Garante held the following: The use of the mandatory tick of the box constituted an infringement of the fairness, lawfulness and transparency principle under

failing to properly respond to an access request, in violation of Articles 15(3) and 33 GDPR. The data subject made an access request to the controller

(CTR) and the General Data Protection regulation (GDPR) also does not provide an answer on that question. According to the Information Commissioner, the sponsor

any of the risks referred to in that article. On 5 December 2019, WM brought an action before the tribunal d’arrondissement de Luxembourg (Luxembourg District

Wiesbaden held a data subject could not make a claim for injunctive relief for an alleged violation of his data subject rights because the GDPR does not allow

access an official computer and whether the permission of an employee is required for the Head of Service to use any of the computers belonging to an agency

of appeal within 30 days of notification An appeal addressed to the Metropolitan Court may be challenged in an administrative lawsuit within one day. THE

The Slovenian Supervisory Authority (IP) issued an opinion as foreseen under Article 58(3) GDPR on the issue of the validity of consent to access digital

Helenic DPA (HDPA) caused by an external cyber attack. The starting point of the breach was a server of the OTE group, which has an annual turnover of €3,258

denounced that the respondent had installed a video surveillance system with an alleged focus on the complainant's house, infringing article 5(3) GDPR which

Authority in password-protected ZIP format with an online download option via a channel protected by an https SSL 3.1 certificate. 3. During the analysis

the amount of HRK 9,375.00. The data subject filed an appeal against the first instance verdict due to an incorrectly established factual situation, incorrect

The Spanish DPA issued a warning to an events organiser whose website did not provide clear information on cookies nor allowed users to reject cookies

video surveillance system, which is for security reasons. -It does not provide an impression of what in your case is captured with the camera(s) installed on

address of theclaimant was already on an internal list of persons who were notthey send communications, but due to an error they sent you a communication

with administrative fines of up to EUR 10 000 000 or in the case of an enterprise, an amount equivalent to a maximum of 2 % of total annual turnover for

debit or credit card and the abolition of cash payments on the bus and to take an enforcement action against this measure under the GDPR. The DPA rejected the

September 9, September 2020, an access to an available network drive is also detected in the equipment, locating information of an apparently sensitive nature

Articles 5(1)(c) and 5(1)(f) GDPR. The AEPD examined a complaint submitted by an anonymous citizen against the Regional Government of Andalucía (Department

tested for inconveniences. As a result of an error in the setup of a particular data filter in FLIS, there had been an unlawful disclosure of information, which

Summary In 2019, the Danish Data Protectioncarried out a planned audit at an office community of law firms. The audit focused on processing security, including

granularity"). Finally, the Datatilsynet reiterated that "consent must be an expression of an unequivocal expression of will on the part of the data subject." As

the case. After an unsuccessful appeal to the Higher Regional Court Vienna (Oberlandesgericht Wien - OLG Wien), the claimant flied an appeal with the Austrian

of this process, on April 8, 2020, the claimed states: That they have sent an email in response to the claim of the claimant. They attach a copy of the

as an addition to or substitute for the measures contemplated in article Article 58, section 2, letters a) to h) and j). When deciding to impose an administrative

Article 21 GDPR in conjunction with Article 23(4) LOPDGDD. Avilon Center SL made an voluntary, early and guilty payment of €12,000. The complainant filed a complaint

(AEPD) rejects A.A.A's claims against Google Spain, SL. The complaint concerned an alleged violation of the applicant's right of erasure (Article 17 GDPR). However

Article 123 of the LPACAP, the interested parties may lodge, on an optional basis, an appeal for reversal to the Director of the Spanish Data Protection

Italian DPA found that the violation of personal data was due to the lack of an adequate security framework in line with art. 5(1)(f) and 32 GDPR. More specifically:

designation of an obligation to cease and desist can - also taking into account the principles of effectiveness and equivalence - only include an obligation

indirectly, with particular reference to an identifier such as a name, an identification number, location data, an online identifier or one or more characteristic

of the Chamber, the problem that an employer collects a large amount of personal data about employees in the course of an employment relationship can only

notice of receipt in the file. FOURTH: On June 15, 2021, the claimant files an appeal optional replacement (***EXP.1) through the Electronic Registry of

with the sanction consisting of an administrative fine.1.c) of the GDPR, and could therefore entail the commission of an offence under Article 83.5 of the

until 22 April 2022. On August 8 2022, the controller responded that there was an error in the profile name. On August 29, the DPA made the same request as

However, the personal data collected in the specific case was for an article under an established newspaper with editorial control and with a clear public

Madridsedeagpd.gob.es Page 5 5/14as an ultimate object, avoid incidents such as those that occur and try at all times topromote an environment that advocates respect

the circulation of a report among other employees detailing the reasons for an employee's temporary assignment, and why they failed to meet the conditions

with Article 123 of the LPACAP, the interested parties may, on an optional basis, file an appeal for replacement to the Director of the Spanish Data Protection

Ombudsman (EOAK / 945/2016) that if an obligation to pay has been reasonably challenged in court in a way that may have an effect, the entry is in principle

controller under the GDPR. The data controller did not process personal data with an appropriate level of security, as required by article 32, read in conjunction

"calls for tenders and contracts"; - "the act of summons was considered an annex and an integral part of the resolution"; - "in relation to the publication

submitted a claim against their former employer company (the controller) for an illegal communication of their previous trade union membership data. Specifically

Authority has ruled in a case in which an attempt was made to refuse the National Commissioner of Police to provide an individual with certain information

The Romanian DPA (ANSPDCP) fined an eCommerce company €5000 for making available on its website a document containing detailed records of transactions

d'Oglio for having published the full text of the judgment involving Mrs. XXX - an employee of the Municipality - on its official website. The data controller

The HDPA issued an order to the Greek company managing dry bulk and container vessels, ALLSEAS MARINE S.A., to bring its processing operations with regard

that audio is personal data when it is stored and it is possible to identify an individual. As such, companies must inform data subjects when they collect

decide to submit an objection digitally or on paper to the Data Protection Authority article 38 of the UAVG suspends the submission of an objection to the

entered by the user, an unauthorized use of the app by from other users could lead to the leaking of this data). They publish an information page in the

this body may be considered as an administrative offense in accordance with the provisions of the GDPR, classified as an infraction in its article 83.5

carry out an audit of the data importer, and any sub-processor, who has the same scope and is subject to the same conditions that would apply to an audit of

includes a list of the "Group companies" and an annex with details of the consent collection process (corresponds to an extract of the training given to employees

concluded that the municipality had not sufficiently demonstrated that it had an ongoing legal obligation to process the data. The court set aside the municipality's

directly or indirectly, in particular using an identifier, such as a name, an identification number, location data, an online identifier or one or more elements

The Spanish DPA decided that, in light of an access request, the controller needs to inform the data subject about whether it has transferred their data

not affect common areas. Also, it must have an approved sign, indicating the controller's identity and an effective address to which it can be directed

Article 123 of the LPACAP, the interested parties may lodge, on an optional basis, an appeal for reversal to the Director of the Spanish Data Protection

until 28 December 2044 by virtue of an agreement with the National Civil Aviation Authority (ENAC) - has adopted an organization, management and control

The Spanish DAP ordered Google to delist an article based on the "right to be forgotten". The AEPD issued a decision related to the right to be forgotten

Disputes Chamber concludes that this case does not concern an assessment of a data processing by an authority in accordance with article 10/1, §1 of the decree

consent. Consequently, after considering some circumstances [(i) there is an unintended negligent conduct by the defendant, and (ii) basic personal data

Knuddels' favour: The transfer of user data to an unauthorized third party was not at Knuddels' instigation but by an external hacker attack. As a result of this

the laptop and external hard drives and in the form of paper documents in an appropriate manner, and whether the data controller's procedure was in accordance

appellant complained that the company, in response to his access request, provided an incomplete dataset in English. The DPA found that much of the data that the

on the Bundesanstalt’s website. The site was provided with a search tool. An agricultural undertaking, in the legal form of a partnership, and a full-time

a fine for an amount of 70,000 euros (seventy thousand euros). TENTH: Once the proposed resolution was notified, the defendant requested an extension of

The French-speaking Tribunal of First Instance in Brussels issued an interim order declaring admissible but unfounded the action brought by Mrs. KAHN.

obliged to correct an incorrect verdict and, if necessary, to make any missing determinations, it is not allowed to exchange the alleged act. An inadmissible

delete the audio recordings, as they are included as an essential element in patient treatment and on an equal footing with the doctors' other medical records

unauthorized persons. In this connection, the Family Court has entered into an agreement with an external auditing company to review the course of events and systems

already submitted samples for scientific purposes. The Icelandic DPA launched an investigation regarding the lawfulness of the processing. The Icelandic DPA

The Italian DPA decided on March 26th 2020 to impose on Cavauto srl., an appointed car dealer, a fine of € 10.000,00 as well as other measurements to ensure

formation of an opinion public. In accordance with the jurisprudence of the Constitutional Court and the Court Supreme, all the information referring to an event

days by submitting either: - an appeal under the Administrative Procedure Act to the Data Protection Inspectorate or - an appeal under the Administrative

system, an arbitrated procedure where the affected develops its activity. In accordance with the evidence available for such conduct constitutes an infringement

situation arose in the kindergarten's cloakroom where the boy in question had an outburst of anger. The incident was filmed by one of the staff. The recording

entities informed the respondent about it, so the inclusion of the data implies an illegitimate processing of personal data. Share your comments here! Share

List (advertising exclusion list). The Spanish DPA (AEPD) therefore began an investigation to clarify the facts at stake. This revealed that Vamavi Phone

consent, the lack of an appropriate cookie banner and the extent of information provided in the Cookies Policy. The AEPD gave the controller an opportunity to

opposition to data processing was available at an initial momentcial, by means of the communication of an e-mail address to which theinterested parties

controller notified the DPA, who conducted an investigation. The DPA found out that the personal data was retrieved from an unprotected database backup BACPAC

statement of consent or by taking an explicit consent. Article 6 of the General Data Protection Regulation contains an exhaustive list of situations in

also appears, such as his name and address. work email. The complainant sent an email on January 22, 2021 to members of the staff meeting in which he requested

the controller was informed of the complaint - the controller did not have an appropriate legal basis for the direct marketing and legitimate interests

claimed party is considered responsible for an infringementtypified in article 83.5.a) of the RGPD , in an initial assessment, they are considered concurrentthe

defendant was not at fault with regard to an alleged breach of the GDPR. Finally, there is no causality of an alleged breach of the GDPR for the alleged

out in the public interest under Article 6(1)(e) GDPR does not constitute an appropriate and adequate legal basis for all the personal data processed.

of some employees of an external commercial partner (the company Penta Finanziamenti Italia Srl, hereinafter "Penta") through an application called Speedy

have been accredited the following: PROVEN FACTS FIRST: The 08/07/2020 has an entry in the AEPD police report bulletin FORAL DE NAVARRA (hereinafter, the

for the infringement of Article 6(1) of the GDPR, as the defendant agreed to an early voluntary payment of the corresponding part (48,000 €) of the fine suggested

impose on the claimed person as responsible for an offense typified in the Article 83.5.a) of the RGPD, in an initial assessment, they are considered concurrent

without obtaining consent or a contract for doing so. The complainant filed an action against Alterna Operador Integral SL (Flip Energy). The complainant

failed to pay the invoices issued on June 16, 2016, for an amount of 32.74 euros and July 19, 2016, for an amount of 20.32 euros, reason for which the claimant

mother of the child, as an involved partyin the Y1 procedure, has the right to access the file.83. The Ethics Committee has issued an opinion on this matter

sedeagpd.gob.es, 7/11 A65067332, as responsible for an offense classified in article 83.5.a) of the RGPD, in an initial assessment, they are considered concurrent

competent to resolve this process. II The defendant is charged with committing an offense for violation of article 13 of the RGPD, regarding the information

had to assess whether the culpability constitutes a requirement for imposing an administrative sanction under the GDPR. The AEPD ruled that by sending the

such data and repealing Directive 95/46/EC (as regards (hereinafter GPRD), an offense under Article 83(5)(a) of the GPRD and described as very serious in

this body may be considered as an administrative offense in accordance with the provisions of the GDPR, classified as an infraction in its article 83.5

deletion of the personal data held by the data controller in the context of an job application process. The DPA undertook a broader investigation. Could

"ASOCIACIÓN DE VIGILANTES DE SEGURIDAD DEL AEROPUERTO DE BARCELONA" with €1800 for an infringement of the principle of confidentiality in the processing of data

veterinarian unlawfully. He argued that his personal data was processed for an illegitimate purpose, knowing that the controller used the complainant’s personal

controller had acknowledged this incident and had reported it as a data breach on an unspecified date. On 15 November 2019, the Dutch DPA decided that it would

in their publications that they are an ‘organisation in receipt of support from abroad’. The Commission brought an action for failure to fulfil obligations

The Croatian DPA imposed an administrative fine of €25,000 on Zagrebački Holding D.O.O., a public service company of the city of Zagreb, for violations

for an executive position within the Ministry and asked via e-mail that all candidates are provided with the right of objection and the right for an internal

"), while in Article 32 par. 2 GKP is provided in the context of an assessment of an appropriate level of security h taking into account the risk arising

Data Protection Authority informed Varde Municipality that an employee who has been assigned an internal responsibility for the processing of personal data

of an identifier, such as a name, an identification number, data from C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es 3/7 location, an online

indirectly, with particular reference to an identifier such as a name, an identification number, location data, an online identifier or one or more characteristic

photograph of an arrested person - attributable to a "mugshot" or similar to the latter - not justified by proven need for justice and police constitutes an unlawful

quarantine is not the same situation as an employee's sick leave. Compliying with quarantine is not the exercise of an employee's right, but observance of

Prosecutor's Office has now filed an appeal against this decision, arguing that for the application of the GDPR the mere establishment of an infringement, without

data where the data subject has not made an Article 17 GDPR request. The Hungarian DPA subsequently filed an action of unconstitutionality to set aside

of a complaint alleging that Actamedica SRL from Târgu-Mureș sent an information to an individual regarding the loss of his biological samples and a sum

personal data are not automatically, without the intervention of an individual, available to an unlimited number of individuals. The Budget Act (Official Gazette

ref.: 11.17.001.009.232 7 September 2023 Decision Failure to Fully Comply to an Erasure Request by Freedom Finance Europe Ltd 1. A complaint was lodged with

hereby returns to the case where users in a number of municipalities - due to an error in a planned release of a new version of Schultz Expose - have been

are personal data all data relating to an individual whose identity has been determined or can be determined, a an individual whose identity can be established

DPA warned that failure to comply with this decision will be sanctioned as an infringement of Article 58(2) GDPR. Share your comments here! Share blogs

Article 83.5 of the GDPR. The sanction that must be imposed is an administrative fine for an amount of 300 euros (THREE HUNDRED EUROS) Therefore, in accordance

as the main responsible B.B.B., with ***NIF.1. Third. The availability of an operating system for video cameras is accredited. deo-surveillance although

owners of 03/12/2018, the claimant andThe rest of the community members adopt an agreement regarding the undertaking of works inthe covered areas of each of

installation of video cameras are not necessarily illegal, so long as they have an information notice attached (Article 22(4) LOPDGDD). Conseguridad SL was fined

present their point of view. As their response, the controller sent the DPA an answer to the request by the data subject. However, the controller still did

June 8th, 2018, it created an internal data protection board with exactly the same role and functions as a DPO (and even an internal data protection sub-board

sending telematic notifications for an incident in the application database, while that of 10/31/2019 consisted of an incorrect handling of exceptions in

imposed an administrative fine in the amount of HRK 30,000 for the aforementioned violation. Precisely the corrective measure in the form of an administrative

rating of a single-person enterprise with no legal basis for such processing. An individual company was subjected to a credit rating by Odin Flissenter, despite

FRENCH PEOPLE Considering the following procedure: By a summary request and an additional memorandum, registered on January 21 and May 18, 2020 at the litigation

for the Protection of In this case, the accused entity may, on an optional basis, lodge an appeal for reversal the director of the Catalan Data Protection

administrative fines of 10,000,000 Eur as maximum or, in the case of an enterprise, an amount equivalent to 4% as maximum of the total annual overall turnover

above, the Agency considers that it deserves a sanction for the commission of an infringement of Article 6.1 of the GDPR, the amount of said sanction should

dati personali) imposed a fine of €2,000 on Poliambulatorio Talenti S.r.l., an outpatient clinic, for failing to respond to a data subject's access request

However, an administrator who creates a fan page, consents to the use policy, cookies policy, defines the objectives and promotes its activities has an influence

November of this year, the National Supervisory Authority completed an investigation at an Owners' Association in Iași, to which it imposed a fine and a warning

to impose on the defendant as responsible for an infraction typified in article 83.5.b) of the RGPD, in an initial assessment, they are estimated to be

BACKGROUND FIRST: The claim filed by Ms. A.A.A. (hereinafter the claimant), It has an entry dated 04/29/2019 in the Spanish Agency for Data Protection. The claim

legal basis, connected to Article 6 of the GDPR—, as the defendant agreed to an early and guilty voluntary payment of the corresponding part (600 €) of the

surveillance were facing the public road without any justified cause. Is it an offence to have cameras facing the public road? Does it constitute a breach

LGBT-rights association lodged a complaint with the Spanish DPA, which launched an investigation. During this investigation, Hazte Oir withdrew the leaflets

1, *** GROUP.2 or *** GROUP.3 of said Association, all of them made up of an average of four hundred people. Likewise, the claimant certifies that she

Following the publication of some press reports, this Authority has opened an investigation against the Ministry of Economic Development (MISE) regarding

necessary purposes”, but also that marketing was an object of the processing. URL 1 also did not provide an option to reject cookies. URLs 2, 3 and 4 had

Data Protection Commissioner has requested an explanation from the data controller on June 10, 2020, and an additional explanation on March 3, 2022. The

Kabel TV A / S. The DPA found a basis for criticizing TDC A / S for answering an access request only 5 months after the request was made. According to Article

and with the possibility of an advertising nature 5th We do not know the true intentions of this claimant who, based on an advertisement of November 2019

already requested the deletion of its data pursuant to Article 17 GDPR. On an undetermined date, a data subject issued a complaint to the Romanian DPA against

of Article 5(1)(a) GDPR. The controller in this case is an online newspaper which published an article regarding the spending of public funds within a

protection measures of the property, if necessary. The described facts suppose an affectation to the article 5.1 c) RGPD "The personal data will be: c) adequate

defendant refused to receive the notices by the AEPD, the AEPD carried out an investigation procedure, and it discovered that the website did not offer

indirectly, in particular by means of an identifier, such as a name, an identification number, data from location, an online identifier or one or more elements

Appeals Board overruled the DPA's decision to close a complaint case with just an informational letter to the controller, mandating them to assess the lawfulness

parents, siblings and those affected. • The Foundation is aware and has provided an e-mail in this regard, that the e-mail address has been used to send mail

reclaimed and requested information on the measures that had been adopted to put an end to the denounced irregular situation. The certificate issued by the FNMT

under Article 2(b) of Directive 95/46 includes any information relating to an identified or identifiable natural person. Hence, the term covers the name

data prior to that date. The PTS disagreed with Tele2 conclusion and brought an action before the Stockholm Administrative Court. After the court dismissed

data older than three years should have been deleted from its systems through an automatic deletion process, which had not been done due to a technical error

question will be able to meet its obligations. Both lenders and borrowers have an interest in the information and data used to assess creditworthiness being

mechanism was deemed to be not sufficient. The Court required an effective independent supervision by an institution which affords all appropriate technical means

(related proceedings Zlen W214 2223914-1 and W214 2224398-1). To this end, an oral hearing was held before the BVwG on July 2, 2020, and witnesses were

portals published by the controller do not contribute to the emergence of an important social debate. The data subject considered that the tax information

The Icelandic DPA issued an advisory opinion clarifying the interplay between the Information Act and the Privacy Act which implements the GDPR in Iceland

violating Articles 5, 13, 24, 32 and 35 GDPR. The Lithuanian DPA (VDAI) launched an investigation into the Lithuanian Quarantine App ("Karantinas") in May 2020

throughout the organisation. In December 2020, the Norwegian DPA initiated an audit of the Directorate of Norwegian Correctional Service (DCS, the controller)

Council did not appoint a DPO, but carried out a contract of 10 months with an external company to receive data protection advise. Is this behaviour in line

Personal Data Protection, through its procedural representative, expresses an opinion that the appealed decision is correct and there are no cassation grounds

communication via email without the data subject's consent. The complainant received an SMS from the political candidate which was promoting the candidate’s participation

freedoms of the data subject". Accordingly, an overall view of all measures and precautions taken - in the sense of an all-encompassing balancing of interests

rational indications of the existence of an infringement of the data protection regulations. " Against the agreement, an appeal for replacement is filed with

first contact was made on 19/06/2020 from telephone number 'T1' to promote an offer on electricity services, the claimant inquired about the call and was

sent an eye examination invitation for the next examination, generally two years after the last visit. If the patient (registered) refuses to send an eye

confidentiality principle specified at Article 5(1)(f) GDPR, as the defendant agreed to an early and guilty voluntary payment of the corresponding part (24,000 €) of

Article 123 of the LPACAP, the interested parties may lodge, on an optional basis, an appeal for a reversal to the Director of the Spanish Data Protection

alternatively makes an objection of excessiveness of the attorney's fees claimed. The defendant in the cassation appeal - G. Atanasova does not express an opinion

interest of the controller (Article 6(1)(f) GDPR). The Italian DPA started an investigation and found that personalized advertisement would likely involve

articles published by various news media in 2010, the subject of which was an arrest warrant against the data subject. After the controller refused to remove

husband and made a transfer of an undisclosed amount. The data subject found out about the identity theft after receiving an SMS informing of the controller

violation The National Supervisory Authority completed an investigation of a natural person, as an operator, during which it found a violation of some provisions

less than that required by the GDPR, and the information was not provided in an intelligible and easily accessible form with clear and simple wording, especially

GDPR. A fine of €1,000 was imposed. The controller, Tensa Art Design SA, was an optician and merchant for glasses, sunglasses as well as contact lenses. As

treatment about their obligations, as well as dealing with claims submitted by an interested party and investigate the reason for them. Correlatively, article

considering examining his request. On which condition can the controller ask for an ID proof in order to respond to a deletion request? The Datatilsynet noted

CGT's itself, but by an entity that is part of it and the has control only over the web and content of www.cgt-telemarketing. CGT is an Association of Trade

Such an appeal can be lodged by means of an inter partes petition must contain information listed in Article 1034ter of the Judicial Code7 . It an objection

out electoral propaganda, said requests may be made prior to the calling of an electoral process, in Municipalities, Consulates and Provincial Delegations

recording the employees is because a manager was threatened physically by an employee in the workplace. As there was no audio recording of the event, the

against a private school because its director constantly attended and monitored an employee's online courses without adequately informing her of the legal basis

appellant may challenge this decision within 30 days by submitting an appeal to an administrative court in accordance with the Code of Administrative Court

Agency is competent to resolve this procedure. II The defendant is charged with an infringement of Article 13 of the RGPD, which states "1.Where personal data

of the Spanish Telecommunications General Law, as the defendant agreed to an early voluntary payment of the corresponding part (4,000 €) of the fine suggested

known facts are considered to be constitutive of an infraction, attributable to the respondent, for an alleged violation of article 6 of the RGPD, indicated

consented to by the holders of the same. This duty of confidentiality is therefore an obligation incumbent not only on the controller and processor but also on

providing the pertinent answer, the request for information was repeated, granting an additional period of five days which was not answered. FOURTH: In relation

the fact that the parties made a settlement of their claims does not deprive an individual from their right of access when their personal data is processed

capacity of data controller, shall adopt rules and procedures for: (1) use of an infringement reporting system; (2) restrictions on the use of internal company

intimidation which is exceptional, which is actually borne by the beneficial owner as an individual, and which is clear, real and present? 2. Should this be answered

Working with Children, according to which the municipality may only request an extract from the criminal record from the applicant. In light of this, the

The Greek DPA fined an employer €15,000 for the illegal installation and operation of a video surveillance system. It held that a CCTV surveillance system

where the personal data of 436 customers was exposed. The controller ran an online contest on Facebook to attract customers. There, a document was posted

imposing an administrative fine in the amount of 20,000 Euros. As regards Raiffeisen Bank S.A., the National Supervisory Authority has initiated an investigation

regulate a right to block an account (see BGH, judgment of July 29, 2021 - III ZR 179/20, BGHZ 230, 347, marginal no. 30 ff. for an older version of the terms

comprehensible and simple language. However, this provision does not contain an explicit rule on the national language in which this has to be done and must

claimed party is considered responsible for an infringement typified in article 83.5.a) of the RGPD, in an initial assessment, they are considered concurrent

took place, and (ii) the money laundering legislation would not be really an exclusion, as it is only addressed to avoid information in cases in which

private contact details of employees in order to warn about an infection in the company. An information sheet about data security and home office can also

That is because the request has forced the clinic to give to the claimant an express response, including any justified reasons for denying the request

minimisation principle specified at Article 5(1)(c) GDPR, as the defendant agreed to an early and guilty voluntary payment of the corresponding part (900 €) of the

his identity card. It also noticed that the data controller could have use an encryption system and send the medical records by e-mail. Therefore, the AEPD

the applicant. the applicant has infringed. An infringement of the applicant's privacy can be regarded as an infringement of the person as referred to in

mandatory impact assessment in case of "systematic observation of large scale of an area of public access "—in compliance with article 35.2 c) of the Regulation

law regulating cookies — and Article 13 of the GDPR. The defendant agreed to an early settlement of the case by paying a reduced fine (1,600 €) out of the

2019. However, they have verified that there is an interaction of the April 4, 2019, which contains an attempt to carry out a portability of the which

execution of an agreement to which [appellant] is a party or to take measures at the request of [appellant] prior to the conclusion of an agreement), under

2. The preliminary activity In relation to the case, an investigation was launched, during which an inspection was also carried out in collaboration with

through a letter sent to theAEPD by certified mail dated 11/15/2018, which had an entry in the registry ofthis body on 11/20/2018. The letter is signed by the

attended - in total 477 parents without parental responsibility received such an email. By logging in to the app, information about the child's name, school/kindergarten

services which infringe upon an intellectual property right to be provided by the infringer for proceedings related to such an infringement. Article 8(2)(a)

received several complaints regarding a security breach of personal data, where an employee of the bank (the controller) had shared a statement about a customer

status for the owner of an object threatened with forfeiture who is different from the accused. The applicant is not listed as an accused party in administrative

SIM cards by unauthorised third parties despite allegedly having carried out an identity check to rule out fraudulent behaviour. The data subjects filed a

The Italian Data Protection Authority (Garante) delivered an opinion stating that the Udine City Council acted lawfully when providing for a limited civic

2019, n. 3), hereinafter "Ethical rules"; NOTING that on 16 January 2023 an article entitled: "XX" was published on the Adnkronos.com website, available

Appeal), with the Data Protection Authority as Defendant. Such an appeal may be lodged by means of an adversarial petition that the 3 1034terof the Judicial Code

data is all data relating to an individual whose identity has been determined or can be determined ("the respondent"); 3 an individual whose identity can

rules"; HAVING DETECTED the publication by the online newspaper Dayitalianews of an article entitled: "XX" available at the link https://... in which, citing

rules"; HAVING DETECTED the publication by the online newspaper PalermoToday of an article entitled: "XX" available at the link https://... in which detailed

1 This cookie name is associated with Google Universal Analytics, which is an update important service most used analysis Google. This cookie is used to

and the order contained in clauses IV and V , but it may be challenged in an administrative lawsuit within 30 days of the notification. The application

similar way, In such a way that an application contrary only to our case, would suppose a serious economic impairment, generating an unattainable inequality for

since the only purpose of the emails sent are to accompany our clients in an exceptional situation, during the Alarm State that did not end until June

This infringement is punishable by a fine of up to or, in the case of an enterprise, an amount equivalent to a maximum of 4% of the total annual turnover for

Spanish Data Protection Agency is refined by Article 55 GDPR in the promotion of an obligation between controllers and processors to deal with complaints issued

case, as an additional or substitute for the measures referred to in article 58, section 2, letters a) to h) and j). When deciding to impose an administrative

restricted access parts, remember the elements that make up an order, carry out the process of purchasing an order, managing the payment, controlling fraud linked

my personal information, ID, telephone number, address, name, surname and an invoice for what was purchased with my bank details, data that I have not

proactive responsibility of the data controller to demonstrate compliance. This is an infringement punishable under Article 83(4)(a) GDPR. Assessing the circumstances

follows the four eyes principle. The principle calls for an employee, before the execution of an act, to ask for the verification from a colleague, who should

US. The data subjects are the people in Greece. The data subject submitted an access request with the controller. However, she was not satisfied with how

of current and former customers (data subjects) to identify customers with an affinity for digital media usage, in order to address them more intensely

to impose an administrative fine on the State Enterprise Center of Registers. Pursuant to the Law on the Legal Protection of Personal Data, an authority

previously stored forms. The controller has clarified that he has concluded an agreement with the controller in question on the processing of personal data

Article 13 GDPR. Was there a violation of Article 13 GDPR? The DPA imposed an administrative fine of €15,000 on the online store, taking into account that

protection officer (DPO) and to notify the Spanish DPA of his existence. This is an obligation imposed on public authorities under Article 37(1) GDPR. This obligation

of third-party properties as comparables to the complainant. Specifically, an individual brings the case against Federal Public Service Finance. The complainant

scientist-lawyer, as an assistant rapporteur, who left after the discussion of the case and before the conference and the decision and G. Paleologos, an employee of

of the pictures on the invoice to be sent to the parents. After receiving an invoice on which a miniature of his children's picture was printed, a parent

January 2018, complaints were directed to the City of Copenhagen and asked for an explanation as to why the municipality needed to process information on, among

bullies or victims of bullying being given an opportunity to counter these allegations. Spectrum is not an information system intended for transparency

well as the management of exports of anonymous data, must be formalized by an agreement between the two parties, in accordance with Article 28 of the General

transmission of a communication over an electronic communications network or, to the extent strictly necessary, for the provision of an information society service

of the right of access of the interested parties can be seen distorted by an offer of excess information, they offer the interested party the possibility

party claimed is considered responsible for an infringement typified in article 83.5.a) of the RGPD , in an initial assessment, they are considered concurrent

The data subject complained to the DPA that it was impossible to purchase an airline ticket from the controller's website without accepting cookies and

the Austrian citizen Heinz Huber moved to Germany to become self-employed as an insurance agent. As a non-national of Germany his data was stored in the register

customers (minors and legal representatives) through the personal phone of an employee of the operator, as well as transmissions of copies of these documents

purpose. The controller considered that it was “simply a question of whether an equally suitable but less intrusive means is available”. In this case, it

impose the claimed entity as responsible for an infraction typified in Article 83.5.a) of the RGPD, in an initial assessment, they are considered concurrent

National Commission decided by decision no. […] Of 14 September 2018 to initiate an investigation in the form of a data protection audit with Company A located

impose the claimed entity as responsible for an infraction typified in the Article 83.5.a) of the RGPD, in an initial assessment, they are considered concurrent

previous infringements by the controller. An audit shows that the complainant company has not yet been subject to an administrative sanction by the Authority

with domain .es and another with .com, and that they were coexisting due to an administrative error. The old one was not up-to-date, what is what caused

be forgotten in relation to some URLs. The decision is the consequence of an investigation procedure started by the AEPD against the defendant due to a

only after the intervention of the Authority. Therefore, from An initial complaint is an infringement of Article 17 in conjunction with Article 21 par

are personal data all data relating to an individual whose identity has been determined or can be determined, a an individual whose identity can be established

On 04/12/22, by the Director of the Spanish Agency for Protection of Data, an agreement is issued to admit the processing of the claim presented, in accordance

(1050/2018), the Office of the Data Protection Commissioner has requested an explanation from the data controller with the following questions. The report

Director of the Spanish Data Protection Agency punish the complained party for an infringement of article 6.1 of the RGPD, typified in the Article 83.5 of the

personal address details. The office address of an administrator may therefore be used, but this is not an obligation. The complainant wanted to be mentioned

hereinafter referred to as: The Authority has taken the following decision in an ex officio data protection authority proceeding against the Notifier (hereinafter

submitting either: — an appeal pursuant to the Administrative Procedure Act to the Director General of the Data Protection Inspectorate, or — an appeal under the

Communications SA concluded subscription contracts on their behalf. The DPA conducted an investigation and found that the operator did not implement sufficient security

In 2018, PrivatBo - as a management company - assisted a housing fund with an intended sale of three properties. On that occasion, PrivatBo provided material

subject’s employer would likely be experienced as extra distressing and could have an impact on the data subject’s employment relationship. Share blogs or news

in exchange, demanded payment of a fee of EUR 12,80. The plaintiff brought an action contesting that request for payment. The referring court was of the

in data protection cases. The Verein für Konsumenten Information (VKI) is an Austrian consumer rights organisation and entiteld to bring collective redress

highly recommend to use the GDPRhub Submission Form for anyone that is not an expert in editing mediawiki. If you search for a page that doesn't exist (using

harmed by the publication of the information and it argued that there was an obligation to publish those data in accordance with art. 73 of D. Lgs. 118/2011

person is responsible, in an assessment initial, the following factors are considered concurrent: - In the present case we are facing an unintentional negligent

citizen brought the facts to the attention of the Croatian DPA, which initiated an ex officio investigation due to the high risk to the rights and freedoms of

their aunt with a mobile network operator (the controller). After receiving an e-mail addressed to their deceased aunt, the data subject informed the controller

Vodafone after having exercised his right to object in 2017. The AEPD launched an investigation and discovered that Vodafone, that was determined to be the

According to the Italian DPA, the company did not provide employees with an adequate corporate IT policy informing of the management of the email account

in Article 4(1) of the GDPR because they contain “information relating to an identified or identifiable natural person (“data subject”)…” and its treatment

responded to the claimant's request for deletion. Is the lack of response an infringement of the data subject's right to erasure (Article 17 GDPR)? The

the claimed party in 2017, he continues to receive e-mails telling him that an invoice has been issued in his name. After several attempts to clarify the

erased under GDPR Article 17. The National Supervisory Authority conducted an investigation into Viva Credit following a complaint by a data subject claiming

GDPR by failing to implement appropriate technical measures that would ensure an appropriate level of security for its voicemail box functions? The Datatilsynet

adjust their working methods if necessary. In the short term, the AP will start an investigation into whether cookies are being used lawfully. Ticked in advance

to notify a data breach under Article 33 GDPR. The Romanian DPA initiated an investigation following the receiving of a complaint, investigation which

December 2016 concerning the treatment of passenger information establishes an obligation for carriers and travel operators to communicate passenger information

according to the instructions of the controller. The Romanian DPA started an investigation on Lugera & Makler Broker S.R.L. (a data processor), following

its employees' personal data against a data breach by a bookshelf theft. On an unspecified date, a logistics firm (controller) notified the Romanian DPA

he/she shall provide the AEPD with any information required in the course of an investigation. Consequently, after considering some mitigating circumstances

stated that he cannot make a decision regarding the constitutionality of such an obligation providing that this is a competence of the Constitutional Tribunal

European administrative law fundamentally require that an intervention (especially fines) against an individual may only take place if there is clear support

telecommunications services. On 17/04/20, the entity BUBO MEDIA, S.L. sent to AEPD an e-mail indicating that the way that their customers know about their products

information regarding vehicles within their own area of ​​responsibility and work. An updated list of user rights will be available in the system at all times.

by certificate and a new confirmation by email of having proceeded, after an incident, to solve it, I continue to receive SMS initially accused more than

the municipality. In this case, the municipality of Langedijk had received an unspecified number of reports of concern regarding the minor in recent years

of the banner where the cookie settings were displayed and where there is an option to untick cookies and save settings. This, according to the complainant

and 10% from Asia. Your banner graphic on top of GDPRhub will be shown as an exclusive sponsorship on the page and alternate with up to three other banners

union. A data subject lodged a complaint and a German DPA (Berlin) started an investigation against the controller. The DPA found that the controller unlawfully

H&M has to introduce corrective measures, provide employees with damages and an apology. This summary is based on a press release. Share blogs or news articles

million to €5,091,000. This case was initiated when the DPA followed up on an earlier supervisory decision against Google. In the earlier decision, the

The personal data is first stored locally, but approximately once an hour it is sent to an Azure server located in Ireland. The app would try to send the

protection in Saarland, the defendant, ordered a limitation of the processing and an erasure of the unlawfully processed personal data of the petitioners by the

Conducting credit scoring of individuals and companies are common practice and not an issue in itself. The issue here was the misuse of credit scoring by one employee

claimant ”), and based on the following, BACKGROUND FIRST: On 01/02/20, you have an entry in this Agency, a complaint filed by the claimant in which it indicated

organise an assembly regarding the data subject. The data subject filled a complaint with the AEPD. Could disclosure of personal data about an organisation's

history of the complaining party and indicates that, constantly, produces an improvement in the management and procedure in terms of data protection within

Office of the Data Protection Commissioner has requested an explanation from the data controller with an explanation request dated August 2, 2022. On August

against the defendant. The first complaint was from a data subject who received an email regarding the candidacy of the defendant in the parliamentary elections

the defendant does not comply with these requirements, this could lead to an economic sanction procedure due to a serious breach of the 73(o) of Spanish

similar to the products/services offered in the contract, and (ii) there is an obligation for the digital services provider to offer a simple and free process

insurance providers (controllers) owned by the same mother company were using an app (NN Direct) to facilitate the services offered to their customers. Due

end-to-end encrypted. It is investigated whether the recipient has published an S / MIME certificate on the public tunnel mail list, in which case the e-mail

States in the EU and wordwide. Customers (data subjects) had to register for an online service in order to use all the features of the devices, which required

vehicles; f) finding flagrant offenses and misdemeanors; g) preventing of an imminent danger to the life, health and physical integrity of a person. The

which is an integral part of this. 2. For the other categories of accommodation (except for organized tourist camps) is applied Annex I, which is an integral

well as the management of exports of anonymous data, must be formalized by an agreement between the two parties in accordance with Article 28 of the General

November and December 2021, he received commercial calls. On 12/03/2021, he sent an opposition request to the YOIGO DPO by email Email addressed to ***EMAIL.1

no. 8. Option to withdraw consent Google LLC is required to give the user an immediate access to withdraw his compa- thick for cookies and similar technologies

the one he uploaded it. Following the submission of a complaint to the DPA, an investigation was initiated. During its investigation, the DPA found that

entitled to receive such information. Does a physician have a right not to grant an access request for the health data of a minor to a divorced parent? HDPA imposed

does not have an account, the scholarship is paid as a gift card. For this reason, we ask the guardians to check that the student's Wilma has an account number

10/31/18 an analysis of the website www.garanti- has been analyzedzaautomocion.com , confirming that said page does not install cookies.On 10/31/19, an analysis

purposes, and being registered on the Robinson list, he/she considers such call an intrusion and a violation of his/her data privacy. SECOND: After receiving

is punishable by a fine of up to EUR 20 000 000 or, in the case of an undertaking, an amount equivalent to a maximum of 4% of total annual turnover for

initiate and to solve this procedure. II The defendant is accused of committing an offense for violation of the Article 6.1 of the RGPD. Article 6, Legality

establishing the Next: “1. When personal data relating to him is obtained from an interested party, the responsible for the treatment, at the moment in which

indirectly, with particular reference to an identifier such as name, an identification number, location data, an online identifier or one or more characteristic

Information Office of the *** Town Hall of LOCALIDAD.1 (Ref. 1252/19) where an invoice appears issued by the respondent dated September 15, 2019. Claimant

health crisis caused by Covid-19, the French Ministry of Health decided to make an application available to its citizens, aiming to improve the detection process

data processing. This was based on the fact that the right to information is an essential prerequisite for data subjects to be able to assert other rights

COVID-19 Pandemic, the controller was ordered by the Belgian government to start an initiative to promote train travel. On 13 October 2020, the controller emailed

number in the "opt-out" record of Article 11(2) Law 3471/2006 and is there an even larger meaning regarding the sector of political communication through

ignored the Article 29 Working Party's Opinion on the right to erasure over an extended period of time. Although the Opinion is not strictly binding, the

published personal data regarding the state of health of the data subject in an article posted in a personal blog, without obtaining the express consent of

the controller not to deliver any such recordings unless a judicial order or an administrative authority request was received. Upon expiration of the applicable

order to reach an amicable settlement witht he other party. The complainant started the procedure on 30 December 2019 and only received an answer from the

Norway. On 21 February 2020, the Data Inspectorate sent OpenX a request for an account of various overriding issues concerning processing responsibility

may be transmitted in combination with standard icons that allow provide in an easily visible, intelligible and clearly legible way a suitable overview of

(model100) from Ms. B.B.B..  November 9, 2018, 9:00. Since the operation required an input The option of having guarantors to guarantee the operation is valued

document or electronic instrument certifying such representation. The use of an electronic signature identifying the affected party will exempt from the presentation

article 12 of Regulation (EU) 2016/679 is will be deemed fulfilled by placing an information device in place sufficiently visible identifying, at least, the

which the defendant filed an objection in a timely manner, through the defense attorney, attorney T.R., so it was invalidated and an urgent misdemeanor procedure

birth and health information) without consent or other legal basis. Following an investigation the ANSPDCP found that Estee Lauder Romania SRL violated Article

filed a complaint against data subject in 2014 for a lack of aftercare after an operation. This led, ultimately, to a procedure before the Central Disciplinary

way of delight, will not (yet) belong to it,it will always seduce that such an argument does not succeed. Deselogo, and as explainedin the deliberation project

Clerici; WHEREAS 1. The instance With a note dated May 29, 2018, Ms XX filed an appeal pursuant to art. 145 and ss. of the Code, in force at the time of the

was rendered by the court in the civil proceedings on 15 May 2019, because an appeal has been lodged against that judgment, according to the court. What

presence of erroneous information; 3. The use of techniques that may have an impact on the choices of the data subject including the granting of free consent

belonging to 81 data subjects. The National Supervisory Authority conducted an investigation into the Romanian National Post Company, and found that it did

controller) stating that some documentation (backup records) to be kept by an external security company located in Luxembourg (data processor) affecting

and GDPR came into effect. The court held that Lloyds provided Mr Lees with an adequate answer to each of the DSARs. As a result, Lloyds complied with the

Romanian original for more details. The National Supervisory Authority completed an investigation at the operator Qualitance QBS SA and found the violation of

containing their personal data to another Enel customer via e-mail. Following an investigation, the DPA found that the operator did not take sufficient security

50 lei (approx. 5,000 Euros). The National Supervisory Authority conducted an investigation into Tarom's security measures and found that Tarom had not

requests in breach of Articles 12, 15, and 17 GDPR. The ANSPDCP conducted an investigation into Vodafone România S.A. and found that the controller could

Then, the Court stated that the request for deletion must be regarded as an appeal to Article 21(1) GDPR, and the Court must therefore conduct the balancing

attention to an application to exercise the rights established in articles 15 to 22 of Regulation (EU) 2016/679, it will be initiated by an agreement of

basis of that the communication that had taken place with the bank constituted an internal communication with "no possibility of disclosure". In this context

more details. On 13.02.2020, the National Supervisory Authority completed an investigation with the operator of the "SOS Infertility" Association and found

information be provided in the context of proceedings concerning an infringement of an intellectual property right. To be completed with the CJEU ruling

personal data of the website's customers were visible. If customers placed an order on the website, some of their personal data could be accessed without

of cookies, with an initial penalty of 5,000 euros and due to the impossibility of managing the cookies used once the consent, with an initial penalty of

electronic ticketing system. On 18 November 2019, the Authority carried out an on-site inspection at OASA to determine compliance with the previously issued

Norwegian Data Protection Authority has decided to give Indre Østfold municipality an infringement fee of NOK 200,000 for breach of confidentiality. Personal information

which additional elements were represented and in particular that: - "From an immediate analysis of the incident, it was found that the error was due to

campaign aimed at getting more Danes to rent out their cottages on the basis of an agreement concluded in the Folketing on 17 May 2018. . Decision The Danish

to Twitter. 3 July 2020 - After the holding above, the claimant submitted an internal administrative appeal ("recurso de reposición") stating that, prior

at home on maternity leave at the time of the episode, and therefore it was an improper access". According to what was stated, the access was made "with

32, 25, 24, and 5(2) GDPR. The decision concerns access by employees within an unnamed financial institution to the Central Credit Register ('CCR') operated

Premium €12,50/y). 2. By downloading, printing and filling out a form, attaching an ID copy and submitting it per mail. On 29-04-2019 the BKR added free digital

requested copies of credit documentation (e.g. book keeping card, repayment plan, an annex to the loan agreement, review of changes in interest rates). The Bank

which had informed the company as early as 2017 that such requests constitute an exercise of the right of access, which it must satisfy, imposed a fine of

more details. On 11.02.2020, the National Supervisory Authority finalized an investigation at the operator of Vodafone Romania SA and found that it violated

geolocation systems in employee vehicles. Under the Report, employers had an obligation to inform employees about the purpose, type, retention time and

16 January 2019, the executive-committee of the Belgian DPA (GBA) started an investigation on the placement of cookies on Belgian media websites. The controller

since no “just cause” was to be found in the present case. The Company filed an appeal against the decision. The issue raised was whether Article 38(3) GDPR

was given to City Traffic B.V., now Bureau RMC. Bureau RMC then contracted an unnamed party to do the installation and maintenance of the sensors and to

CSO with a request to send documents in connection with the initiation of an investigation, 9) the handover protocol for the Complex of General Education

transcript of the phone call. On 17 January 2022, A.A.A. (the complainant) filed an access request against ESCO EXPANSION, S.L.. On 18 January 2022, the complainant

Legislative Decree No. 101/2018); - with the obligation to regulate, by means of an act having the characteristics set out in Article 28, paragraphs 2 and 3 of

and/or legal arguments which could lead to a different decision, it may send an e-mail to litigationchamber@apd-gba.be to submit a request to the Litigation

subject complained about this fact to the Croatian DPA which in turn started an investigation and asked the controller for submissions. The controller argued

association”), and based on the following, BACKGROUND FIRST: On 01/09/20, you have an entry in this Agency, a complaint filed by the claimant association in which

indicate whether consumers intend to have a longer contractual relationship with an electricity supplier or regularly use offers for new customers. Consumers

corresponding to the employer The biometrics to be provided will be included in an automated file called "customers and suppliers" that will be used for access

Regional Court of Bremen dismissed the application. The data subject filed an immediate appeal against this decision. The Bremen Higher Regional Court (OLG

conclusion of their contractual relationship. The Romanian DPA (ANSPDCP) conducted an investigation into ING Bank N.V. Amsterdam – Bucharest Branch and found that

the link you have followed has expired or that the page can only be seen by an audience to which you do not belong."FUNDAMENTOS DE DERECHOIDe in accordance

original for more details. The Romanian Supervisory Authority has completed an investigation of the controller S.C. Type Top Food Industry S.R.L and found

eventually withdrew their complaint. Individual complained that they received an SMS from politician promoting his candidacy at the upcoming -at that time-

replace the address of the property entered on the parking permit tags with an identification code consisting of numbers. Finally, the report emphasizes

(Bundesverwaltungsgericht - BVwG) had declared these provisions inapplicable in lack of an opening clause under the GDPR (see W211 2210458-1 and here). Hence the DSB

PARLIAMENT AND OF THE COUNCIL of 8 June 2000 Article 14 - Hosting: 1. Where an information society service is provided that consists of the storage of information

/ cash outlay) is therefore 600.00 Euro Payment term: If you do not raise an objection, this sanction is immediately enforceable. In this case, the total

treatment about their obligations, as well as dealing with claims submitted by an interested party and investigate the reason for them. Correlatively, article

decision), the defendant dismissed the claimant's objection. The plaintiff lodged an appeal against the contested decision. The hearing took place on 10 December

agreement as not in line with the GDPR (see GDPRhub summary). The controller filed an appeal with the Appeal Court requesting that the decision be suspended and

During the first research procedures, the AEPD proved that (i) in order to make an order, the website requires personal data such as name, surname, scanned copy

presumption of innocence. SECOND: A.A.A. (hereinafter the appellant) lodged an appeal for reconsideration with the Agency on 10 December 2019, basically

of risk. Likewise, the Benidorm City Council had action protocols for face an incident like the one now analyzed, which has diligently allowed the identification

observation of the camera on the façade of the establishment does not presuppose an infringement of the right to the image of third parties, and it may capture

appropriate level of security pursuant to Article 32 GDPR. The DPA imposed an administrative fine on the controller, The DPA further reprimanded to controller

criminal court rejected the petition, against which the supermarket chain filed an appeal before the Barcelona Court of Appeal (Audiencia Provincial de Barcelona)

(APD/GBA) held that disclosure of personal data cannot be a condition for an individual to access public information. The DPA therefore reprimanded the

procedures for identifying a request under the Data Protection Regulation. In an overall assessment of the circumstances, the IMY finds that it is a question

effective consent of the consumers. The company just checked the consents in an insufficient way or in some cases also not at all. They also kept making that

identification in its decisions posted on its website. On the one hand, the DPA has an obligation to openly and publicly available the decisions it adopts contributing

access to third party personal data. The complainant has requested a copy of an inspection report named kennels to the Pendle Borough Council (the Council)

of the debt in question. After that, the attorney of the data subject filed an objection to the processing of their data according to Article 21 GDPR. The

12 GDPR and Article 13 GDPR. The controller asked data subject to provide an email address so that contact could be made in the event of a product recall

Subsequently, the AEPD received a complaint regarding these facts and launched an investigation. The council answered extemporaneously to the AEPD's requests

of conservation; has prescribed to integrate the general census plan with an indication of the methods for returning to the municipalities, in aggregate

Fund to process your inquiry." Subsequently, the complainant entered into an agreement on repayment of holiday money, which the Labor Market Holiday Fund

privacy rights of such a person must be considered. The applicant submitted an application requesting public access to all the documents concerning additional

facilities a video surveillance system with 9 cameras and 1 recorder. During an inspection to the facilities by the public police forces, officers found that

the provisions regarding data protection of the TMG and TKG and plans also an implementation of the Code electronic communication into the national law

original for more details. The Authority examined a request for remedy against an act of filing, with which a complaint against telecommunications providers

data that the controller held about them. The complainant did not receive an answer from the company The AEPD notified the controller that the request

messages other than those concerning the costs and security of the calls, an option brought to the attention of the controller. Although after his request

by answering the data subject’s requests. Furthermore, the DPA reminds that an infringement to Art. 12, 15 and 17 GDPR are to be considered particularly

the data subject's prior consent. The controller must give the data subject an opportunity to unsubscribe easily and without payment. The controller must

mix-ups during patient admission, which lead to incorrect invoicing practices. An investigation revealed structural technical and organisational deficits in

Protection Regulation, hereinafter RGPD), Thus, withdate 04/01/19 and 04/12/19, an information request is addressed to the entity claim-gives.THIRD: According

appellant complained that the company, in response to his access request, provided an incomplete dataset in English. Could Article 15 GDPR be exercised although

contracted the data controller telecommunications services as a new customer, but an employee of the data controller used his information and falsified his signature

a complaint with the AEPD against Electric Renting Groups, S.L for sending an advertisement email and disclosing the recipients of this email. Indeed, the

of up to 800 euros (200 fine units) may be imposed on a natural person in an expedited procedure for violation of the requirements for the processing of

used by the European Court of Human Rights. It ascertained: the existence of an interference with privacy in the facts at issue; that interference was in

enforceability prerequisite that would make the the competence of a DPA to launch an infringement procedure conditional on the exercise of a right by the data

the case is a 16-year-old boy. In December 2015, when he was 11 years old, an online tutor raised certain concerns about his alleged behaviour with the

security company, reported the breach of personal data to the DPA, arising after an employee of the company recorded the video surveillance footage with a smartphone

uploaded on a public portal (“diavgeia”) a decision where the personal data of an employee including her full name, position, place of employment and involvement

Finance Limited (hereafter 'SPF') by different partner companies, so it launched an investigation into SPF's data practices. The company is a subsidiary of Saga

Article 17 and Article 21 GDPR. The controller must give the data subject an opportunity to unsubscribe easily and without payment. In accordance with

of public online disclosure of sensitive personal data of the complainant. An individual posted on Facebook sensitive personal data of another individual

Services Limited (hereafter 'SSL') by different partner companies, so it launched an investigation into SSL's data practices. The company is a subsidiary of Saga

that the pictures published had been obtained from her work intranet with an external IP address. Thus, she filed a complaint with the AEPD against the

a basis from Article 6. Therefore, the AEPD considered that there has been an infringement of Article 6.1, entailing a fine of €2000. Article 14 refers

treatment about their obligations, as well as dealing with claims submitted by an interested party and investigate the reason for them. Correlatively, article

the dispute: "I. The National Commission for data processing and freedoms is an independent administrative authority. It is the national supervisory authority

identity of the data subject, cf. Article 12 (2) of the Regulation 6th As an example of this, the Municipality of Odense has stated that the municipality

"TuPassi" provided by Miropass s.r.l.. Consequently, the Garante carried out an investigation on the platform "TuPassi" provided by Miropass s.r.l.; in its

for the Processing of Personal Data completed in July of the current year an investigation at the operator Med Life SA and found a violation of the provisions