Search results
From GDPRhub
- UOOU - UOOU-00196/20 (category Article 12(2) GDPR) (section English Machine Translation of the Decision)legal basis. The DPA found a violation of Article 6(1) GDPR, as the mere "scraping" of the public register did not fulfill the condition of necessity processing6 KB (752 words) - 09:03, 6 May 2021
- HDPA (Greece) - 3/2024 (category Article 24(2) GDPR) (section English Machine Translation of the Decision)details of the customers of the diagnostic center based on their verbal statement on the day of the visit, the Authority was informed that, in the context7 KB (843 words) - 09:06, 28 May 2024
- AP (The Netherlands) - 10.12.2020 (Booking.com) (category AP (The Netherlands)) (section English Machine Translation of the Decision)available at the moment of the notification. Moreover, according to the AP, Booking became aware of the breach on 13 January 2019: a) The email of 9 January77 KB (12,915 words) - 17:15, 12 December 2023
- DPC - C-XX-X-XX Groupon International Limited - December 2020 (category Article 12(2) GDPR) (section English Machine Translation of the Decision)infringed Articles 12(2),17(1)(a) and 6(1) in the circumstances of the complainant’s case. The decision also reprimanded Groupon in respect of the infringements4 KB (286 words) - 15:04, 10 August 2021
- dumping in the context of the GAS procedure. The Belgian DPA stressed that the Authority did not need to reveal the identity of the Complainant to the four suspects16 KB (2,341 words) - 06:44, 22 December 2021
- Datainspektionen - DI-2019-9432 (category Article 32(2) GDPR) (section The data breach should have been documented and reported to the DPA)According to the DPA, the university knew about the incident on at least April 3, 2019, not August 30, 2019, when it received the letter from the DPA informing59 KB (8,959 words) - 11:43, 7 April 2022
- follow-up to the exercising the right of inspection of the complainant. The allegations regarding the sending of 1 In accordance with Article 61 of the WOG, the38 KB (5,767 words) - 16:10, 19 March 2024
- The DPA dismissed a complaint considering that the measures taken by the controller, namely informing the DPA and the data subject of the breach of personal16 KB (2,256 words) - 11:25, 15 May 2024
- AEPD (Spain) - EXP202301323 (category Article 7(3) GDPR) (section English Machine Translation of the Decision)issued by the Director of the Spanish Agency for the Protection of Data in the procedure AI/00057/2023, for violation of the provisions of the Law 34/200231 KB (4,748 words) - 15:41, 27 March 2024
- Court of Appeal of Brussels - 2019/AR/741 (category Court of Appeal of Brussels (Belgium)) (section English Machine Translation of the Decision)requests of the Belgian DPA to remove certain video recordings. On 14/02/2019, the DPA warned the controller that they could sanction him for posting the videos31 KB (4,878 words) - 13:23, 31 March 2022
- ANSPDCP (Romania) - Sanction against Tensa Art Design SA (category Article 21(3) GDPR) (section English Machine Translation of the Decision)to Article 58(2)(i) GDPR, the DPA fined the controller €1,000 (RON 4,927.3). Moreover, based on Article 58(2)(d) GDPR, the DPA ordered the controller to5 KB (621 words) - 13:51, 21 February 2023
- LG Bonn - 29 OWi 1/20 (category Article 32(2) GDPR) (section English Machine Translation of the Decision)breach of Article 32(1) GDPR . The BfDI justified the fine by stating that the mere request of name and date of birth for the authentication of telephone58 KB (9,577 words) - 08:06, 16 September 2021
- Datatilsynet (Denmark) - 2021-432-0056 (category Article 28(3)(a) GDPR) (section English Machine Translation of the Decision)GDPR and Article 36(2) GDPR. The DPA ordered the municipality to: Change the data processing agreement with Google so that the DPA's remarks in their 1416 KB (2,135 words) - 16:52, 14 September 2022
- reduce the risk of infection, in accordance with the Covid- 19, the case of the first parts of Article 9 of the Law on the Management of the Spread of Infection21 KB (3,178 words) - 09:15, 28 August 2023
- examined the compliance of the processing with the principles set out in Article 5(1) GDPR. Regarding the accuracy principle, the DPA considered that the fact31 KB (4,851 words) - 05:33, 9 May 2023
- DSB (Austria) - 2023-0.594.826 (category Article 2(1) GDPR) (section English Machine Translation of the Decision)Therefore, the GDPR did not apply in material terms and thus, the DPA held that the right to lodge a complaint with the DPA must be denied. The DPA did note56 KB (8,692 words) - 14:58, 10 April 2024
- The Belgian DPA closed the procedure because of a prior settlement decision between the DPA and a press organisation regarding the use of cookies The data21 KB (3,176 words) - 11:00, 7 December 2022
- APD/GBA (Belgium) - 109/2023 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)article 95 § 2, 3° of the LCA as well as article 47 of the rules of order inside the DPA, a copy of the file may be requested by the parties. If one of parties18 KB (2,545 words) - 14:46, 29 August 2023
- article 47 of the rules of order inside the DPA, a copy of the file may be requested by the parties. If one of parties wishes to make use of the possibility16 KB (2,244 words) - 23:23, 12 March 2023
- APDCAT (Catalonia) - IAI 43/2022 (category Article 6(3) GDPR) (section English Machine Translation of the Decision)access in the file of the application of the protocol against school bullying in the case of a minor. The Commission for the Guarantee of the Right of Access34 KB (5,182 words) - 13:13, 14 December 2022
- protect the "vital interests of the data subject or of another natural person". However, the DPA noted that for the protection of vital interests of another18 KB (2,695 words) - 12:21, 31 January 2023
- APD/GBA (Belgium) - 137/2023 (category Article 28(3) GDPR) (section English Machine Translation of the Decision)application of the obligations of Article 28(3) GDPR which aims to ensure the protection of the rights and freedoms of the data subjects. The DPA concluded52 KB (7,789 words) - 11:38, 11 October 2023
- Garante per la protezione dei dati personali (Italy) - 9819285 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)measures to remedy the issue presented by the DPA. For these reasons, and in the absence of similar claims against the controller, the Italian DPA issued a warning34 KB (5,257 words) - 12:42, 9 November 2022
- CNIL (France) - SAN-2023-006 (category Article 9(2) GDPR) (section English Machine Translation of the Decision)Accordingly, the DPA held that there was a violation of Article 5(1)(e) GDPR before the controller complied during the proceedings. (2) The DPA considered7 KB (790 words) - 10:19, 23 May 2023
- Tietosuojavaltuutetun toimisto (Finland) - 6813/171/21 (category Article 25(2) GDPR) (section English Machine Translation of the Decision)section 3 of the Privacy Act (759/2004) and whether the registrar has been able to process the location data of employees. 2) Has the use of the location20 KB (3,011 words) - 14:48, 29 June 2022
- DSB (Austria) - 2023-0.603.142 (category Article 33(3) GDPR) (section English Machine Translation of the Decision)statement, the DPA established that the controller failed to cooperate with the DPA, breaching Article 31 GDPR. Therefore, the DPA fined the controller76 KB (12,550 words) - 09:24, 28 February 2024
- Datatilsynet (Norway) - 20/01772 (category Article 6(3) GDPR) (section English Machine Translation of the Decision)unless the exception of Article 17(3) GDPR (fulfillment of a task in public interest) applied. The DPA held that the controller did not full the requirements53 KB (7,945 words) - 10:46, 24 January 2023
- heard. In the absence of conclusions on the part of the complainant, they request the contentious chamber that the latter, in view of of the hearing, specifies19 KB (2,637 words) - 10:37, 7 December 2021
- instructions. The Data Inspectorate decides on the basis of Articles 58 (2) and 83 (i) the Data Protection Regulation and Chapter 6. Section 2 of the Data Protection23 KB (3,553 words) - 09:02, 13 May 2022
- refusing (free of charge except for the costs of the transmission of the refusal) the use of his contact details for the purposes of such direct marketing22 KB (2,764 words) - 16:07, 19 September 2021
- a lack of shifts in the staffing of the Disputes Chamber of the DPA, insufficient progress was made on this case. Due to the complexity of the case, the25 KB (3,583 words) - 07:57, 21 May 2024
- against the violation of the privacy of those involved. Therefore, the Court held that the DPA should not have issued the fine and annulled the decision29 KB (4,532 words) - 14:30, 17 August 2022
- DSB (Austria) - 2023-0.592.319 (category Article 7(3) GDPR) (section English Machine Translation of the Decision)available on the controller’s website. Thus, the controller failed to comply with the orders of the DPA under Article 58(2)(c) GDPR. The DPA held that the controller80 KB (13,210 words) - 09:09, 21 May 2024
- Datatilsynet (Denmark) - Decision of 2 December 2022 (section English Machine Translation of the Decision)First, the Danish DPA stated that a detailed description of the criminal offence by the controller in the sent email meant that the recipient of the information8 KB (999 words) - 12:38, 14 December 2022
- APD/GBA (Belgium) - 189/2022 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)Protection Authority against the controller. 2. The object of the complaint concerns the exercise of the right of inspection by the complainant without that21 KB (3,086 words) - 08:57, 11 January 2023
- processing of personal data and considers this a violation of his privacy. 2.4 In the opinion of the court, this passing of the sensors does not distinguish26 KB (4,142 words) - 15:30, 27 March 2024
- Persónuvernd (Iceland) - no. 2020010552 (category Article 2(2)(c) GDPR) (section English Machine Translation of the Decision)filed a complaint with the Icelandic DPA regarding the publication of pictures of the child in question on the Facebook page of the other parent (Parent26 KB (4,068 words) - 10:39, 7 December 2021
- UODO (Poland) - DKE.561.25.2020 (category Article 83(2) GDPR) (section English Machine Translation of the Decision)decision, the company has not contacted the DPA. The Polish DPA found that the company had breached the GDPR by failing to cooperation with the DPA in the performance28 KB (4,344 words) - 11:02, 22 June 2021
- APD/GBA (Belgium) - 160/2022 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)12. In the event of a continuation of the handling of the case on the merits, the Disputes Chamber the parties pursuant to Articles 98, 2° and 3° in conjunction17 KB (2,401 words) - 16:49, 29 November 2022
- DVI (Latvia) - SIA "Fitsypro" (category Article 83(2) GDPR) (section English Machine Translation of the Decision)reduce the risk of infection, in accordance with the Covid- 19, the case of the first parts of Article 9 of the Law on the Management of the Spread of Infection29 KB (4,404 words) - 07:53, 23 August 2023
- (free of charge except for the costs of transmission of the refusal) the use of his contact details for the purposes of such direct marketing, at the time41 KB (5,743 words) - 11:44, 21 September 2021
- ICO - Monetary Penalty on Marriott International Inc. (section English Machine Translation of the Decision)elsewhere in the EU, and in the rest of the world. 1.5. Marriott was the controller i respect of the personal data of its customers within the meaning of section241 KB (31,368 words) - 09:59, 9 May 2022
- APD/GBA (Belgium) - 14/2023 (category Article 58(2)(c) GDPR) (section English Machine Translation of the Decision)Article 62, § 1 of the LCA. 3. Pursuant to article 95 § 2, 3° of the LCA as well as article 47 of the rules of order inside the DPA, a copy of the file may be33 KB (4,897 words) - 14:05, 1 March 2023
- APD/GBA (Belgium) - 95/2023 (category Article 9(2) GDPR) (section English Machine Translation of the Decision)Consequently, the DPA dismissed the case. The Belgian DPA refers to case law of the Court of Cassation of 7 october 2021 which is the result from a DPA decision27 KB (3,839 words) - 13:12, 18 July 2023
- concerning the disclosure. The DPA rejected the data subject’s claim. As an introduction, the DPA recalled Article 39(1) of the Constitute of the Republic11 KB (1,635 words) - 11:03, 21 May 2024
- NAIH (Hungary) - NAIH-1006-3/2022 (category Article 13(2) GDPR) (section English Machine Translation of the Decision)provided that the controller can justify the proportionality of this during the balancing of interests, the DPA noted that the degree of danger of the work carried66 KB (10,597 words) - 16:56, 18 May 2022
- body and the court, the procedural conduct of the data subject throughout the proceedings and the nature of the measure and the interest of the data subject6 KB (792 words) - 12:49, 23 May 2023
- Garante per la protezione dei dati personali (Italy) - 9811300 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)non-compliance and the possibility of lodging a complaint with the DPA. The DPA also held a violation of Article 14 GDPR because the controller failed to27 KB (4,317 words) - 08:06, 20 October 2022
- NAIH (Hungary) - NAIH-2894-3/2021 (category Article 32(2) GDPR) (section English Machine Translation of the Decision)concerning the personal data breach, the District Office requested the opinion of the data protection officer of the Budapest Government Office. The data protection6 KB (656 words) - 09:33, 28 July 2021
- APD/GBA (Belgium) - 162/2022 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)38(1) and (3) of the GDPR. d. an infringement of Article 4, 11) of the GDPR, Article 5, paragraph 1, a) and paragraph 2 of the GDPR, Article 6, paragraph71 KB (10,426 words) - 08:21, 23 November 2022
- BVwG - W214 2228346-1 (category Article 4(2) GDPR) (section English Machine Translation of the Decision)Paragraph 28(2) of the VwGVG, the appeal is dismissed as unfounded and the ruling of the contested decision is upheld on the ground that - In the award head65 KB (10,246 words) - 09:42, 10 September 2021
- Garante per la protezione dei dati personali (Italy) - 9960875 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)after the deadline set by the GDPR and only after the filing of the complaint and the opening of the enquiry by the DPA. The DPA also acknowledged that the34 KB (5,386 words) - 16:16, 19 December 2023
- APD/GBA (Belgium) - 79/2023 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)79/2023 - 2/11 I. Facts and procedure 1. The complaint concerns the lack of follow-up given to the exercise of the right to rectification of the plaintiff31 KB (4,567 words) - 14:00, 5 July 2023
- Garante per la protezione dei dati personali (Italy) - 9817058 (category Article 58(2)(i) GDPR) (section English Machine Translation of the Decision)protocol from the moment of designing the website. Pursuant to Articles 58(2)(i) and 83(3) GDPR, the DPA fined the controller €15,000 for the aforementioned24 KB (3,588 words) - 13:43, 2 November 2022
- with the Belgian DPA The Belgian DPA stated that the data subject did not complain on the basis on the GDPR. The DPA referred the EDPB Guidelines 01/202221 KB (3,040 words) - 07:38, 21 June 2023
- NAIH (Hungary) - NAIH-7058-5/2022 (category Article 7(2) GDPR) (section English Machine Translation of the Decision)difficult for them to keep track of. Therefore, the DPA was of the opinion that the time of the cessation of e-mailing in the case of eDM is important information66 KB (10,499 words) - 08:55, 10 February 2023
- Persónuvernd - 2020010649 (category Article 25(2) GDPR) (section English Machine Translation of the Decision)characteristic of him, cf. 2. tölul. Article 3 of the Act and point 1. Article 4 of the Regulation. With processing refers to an action or series of actions in17 KB (2,376 words) - 10:11, 28 September 2020
- Tietosuojavaltuutetun toimisto (Finland) - 6132/151/19 (category Article 15(3) GDPR) (section English Machine Translation of the Decision)provided to him free of charge on the basis of Article 15(3) GDPR. The Finnish DPA requested the hospital to provide its opinion on the matter, and in particular14 KB (2,085 words) - 10:24, 4 November 2021
- VG Mainz - 1 K 473/19.MZ (category Article 55(3) GDPR) (section English Machine Translation of the Decision)(EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals with regard to the processing of personal data31 KB (4,898 words) - 11:49, 19 April 2021
- Article 9, subsection 2, letter j, and § 10 of the Data Protection Act[2]. In its consultation response of 19 March 2021, the Region of Southern Denmark stated24 KB (3,668 words) - 14:53, 14 September 2022
- Garante per la protezione dei dati personali (Italy) - 9771545 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)relationship. The DPA further clarified that the data rights of workers must be protected in the employment relationship regardless of the legal nature of the relationship43 KB (6,766 words) - 14:59, 2 May 2023
- Article 38(3). The acting DPO at the time of the investigation also held the position of deputy CEO, senior lawyer and board member. The DPA held that that33 KB (5,086 words) - 13:03, 7 September 2022
- VG der Freien Hansestadt Bremen - 4 K 1338/21 (category Article 4(2) GDPR) (section English Machine Translation of the Decision)afterward. The erasure of the videos was justified as an act of the DPA under Article 58(2)(f) GDPR. The court also confirmed the decision of the DPA to refrain10 KB (1,353 words) - 10:42, 14 November 2022
- Creditinfo informed the Icelandic DPA that the letter had not been returned. After analysing the facts of the case, the Icelandic DPA considered that Creditinfo19 KB (2,786 words) - 11:36, 22 September 2021
- APD/GBA (Belgium) - 39/2022 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)information on the erasure of data by the controller. The DPA reprimanded the controller for several violations of the GDPR. First, the DPA found that the controller33 KB (4,904 words) - 15:58, 23 March 2022
- IP (Slovenia) - IP - 07141-10-2023 (category Article 17(2) GDPR) (section English Machine Translation of the Decision)77 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals in the processing of personal16 KB (2,454 words) - 16:23, 6 November 2023
- (i.e. legal bases for the processing of personal data in general). the Icelandic DPA rejected the idea that the processing of the Complainant's data should29 KB (4,514 words) - 09:02, 29 September 2021
- Datatilsynet (Denmark) - 2021-31-5542 (category Article 9(2)(d) GDPR) (section English Machine Translation of the Decision)and from the processor at the beginning of the investigation. The DPA agreed that the controller had a legitimate interest in assessing whether the data subject43 KB (6,531 words) - 14:04, 21 September 2022
- Persónuvernd (Island) - 2022050850 (category Article 9(2)(a) GDPR) (section English Machine Translation of the Decision)processing of special categories of personal data. As regards the political opinions of the data subject, the DPA ascertained that first, the data subject was26 KB (3,831 words) - 10:10, 10 January 2024
- transferred to the Disputes Chamber. 2 7. In accordance with Article 95, § 2, 3° of the WOG as well as Article 47 of the internal regulations order of the GBA, the17 KB (2,442 words) - 12:17, 27 March 2024
- revision of the controllers privacy policy was not sufficient. First of all, it didn’t indicate the purposes of the processing of the personal data of the persons14 KB (2,020 words) - 16:07, 22 June 2022
- Datatilsynet (Denmark) - 2020-442-8862 (category Article 33(3) GDPR) (section English Machine Translation of the Decision)not inform the Authority. Considering all of the foregoing, the DPA concluded that the controller violated Article 32(1) GDPR. Second, the DPA considered24 KB (3,735 words) - 17:29, 23 February 2022
- violation of Article 15 GDPR by one of the controllers. The DPA dismissed the claim on the basis of Article 57(4) GDPR. According to such provision, a DPA may28 KB (4,409 words) - 09:54, 25 April 2023
- Garante per la protezione dei dati personali (Italy) - 9773950 (section English Machine Translation of the Decision)supplying the camera traps delivered to the municipality [...] at the time of the contract award ". 2. The preliminary activity. With a note of the XX (prot34 KB (5,239 words) - 10:47, 28 June 2022
- Datatilsynet (Norway) - 21/00872 (category Article 6(3) GDPR) (section English Machine Translation of the Decision)assessed accordingly the Personal Data Act (2018) and the Privacy Ordinance. 3.2. The basic principles for the processing of personal data The basic principles27 KB (4,145 words) - 08:21, 27 June 2022
- Persónuvernd - 2020010548 (category Article 2(2)(c) GDPR) (section English Machine Translation of the Decision)collected with the cameras in question, of the residents of the house and their guests, on the video channel Youtube. In the light of the above, the processing23 KB (3,745 words) - 09:50, 6 May 2021
- receive. 14. The provisions of the DPA remain in force for the purposes of PECR notwithstanding the introduction of the DPA18: see paragraph 58(1) of Schedule31 KB (4,210 words) - 15:26, 20 June 2023
- Datatilsynet (Norway) - PVN-2022-21 (category Article 6(3) GDPR) (section English Machine Translation of the Decision)body in the case. The data subject contacted the DPA, but the DPA disagreed with the State Administrator, and viewed the State Administrator is the competent25 KB (3,868 words) - 15:17, 26 April 2023
- in the course of the proceedings before the authorities concerned, the complainant changed the orientation of the camera above the entrance to the building17 KB (2,442 words) - 14:33, 19 August 2022
- APD/GBA (Belgium) - 103/2023 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)admissible by the Front Line Service (SPL) of the DPA on the basis of Articles 58 and 60 of the LCA and the complaint is transmitted to the Litigation Division31 KB (4,549 words) - 11:50, 10 August 2023
- Datatilsynet (Norway) - 22/03622 (category Article 6(3) GDPR) (section English Machine Translation of the Decision)development work. 3.2.2 Assessment of the privacy intervention In the letter of 23 January 2023, it appears that Statistics Norway believes that the privacy intervention73 KB (10,929 words) - 08:41, 31 May 2023
- APD/GBA (Belgium) - 40/2024 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)Article 95, § 2, 3° of the WOG as well as Article 47 of the internal regulations order of the GBA, the parties can request a copy of the file. If one both15 KB (2,218 words) - 08:27, 14 March 2024
- Datatilsynet (Denmark) - 2022-31-6316 (category Article 12(2) GDPR) (section English Machine Translation of the Decision)Furthermore, the DPA placed weight on the fact that at the time of the decision on the case, the housing association did not appear to have responded to the resident's18 KB (2,611 words) - 14:52, 20 September 2023
- ANSPDCP (Romania) - Fine against a natural person (category Article 5(2) GDPR) (section English Machine Translation of the Decision)para. (1) lit. a) and b) and par. (2) of the GDPR and the provisions of art. 6 para. (1) of the GDPR. At the same time, the controller did not present evidence5 KB (639 words) - 13:56, 4 August 2021
- Garante per la protezione dei dati personali (Italy) - 9897055 (section English Machine Translation of the Decision)5, of the Code for the eventual adoption of the provisions pursuant to art. 58, par. 2, of the Regulation, notifying the alleged violations of the law19 KB (2,912 words) - 12:00, 26 July 2023
- notify the DPA and the data subject about the breach. The DPA highlighted the principles of lawfulness, fairness and transparency established by the GDPR10 KB (1,249 words) - 12:16, 8 May 2023
- Tietosuojavaltuutetun toimisto (Finland) - 8086/182/2019 (category Article 7(3) GDPR) (section English Machine Translation of the Decision)complied with in the Regulation on the processing of personal data and the protection of privacy in the field of electronic communications of the European Parliament17 KB (2,519 words) - 15:12, 25 April 2023
- assessment, the [DPA] finds that the grievances raised by the complainant do not meet the criteria of high personal impact." The DPA concluded that the burden20 KB (2,838 words) - 06:45, 20 September 2023
- Persónuvernd - 2020010343 (category Article 4(2) GDPR) (section English Machine Translation of the Decision)for employees, the DPA held that the data could not be processed based on consent. The DPA then examined whether the lawfulness of the processing could22 KB (3,447 words) - 15:12, 14 September 2020
- Garante per la protezione dei dati personali (Italy) - 9795404 (section English Machine Translation of the Decision)initiation of the sanctioning procedure, pursuant to art. 166, paragraph 5, of the Code in relation to the violation of art. 12, par. 3, and 15 of the Regulation32 KB (5,076 words) - 08:06, 5 September 2022
- Court of Appeal of Brussels - 2020/AR/582 (category Court of Appeal of Brussels (Belgium)) (section English Machine Translation of the Decision)_JCourt of appeal Brussels-2020/AR/582- p. 7 Pursuant to Article 95, §2 of the Law of 3 December 2017 establishing the Data protection authority, the Geschlllenkamer26 KB (3,871 words) - 07:59, 24 August 2023
- Garante per la protezione dei dati personali (Italy) - 9811361 (section English Machine Translation of the Decision)relationships. The DPA stated that the controller had therefore violated Articles 5, 6 and 9 GDPR as well as Articles 2-ter and 2-sexies of the Code. The DPA also34 KB (5,366 words) - 08:09, 20 October 2022
- identified in Article 9 (1) of the Regulation. 2. The warning is issued in accordance with Article 58 (2) of the Data Protection Regulation. 2, letter a. Below is36 KB (5,749 words) - 12:46, 13 April 2022
- by the DPA or the controllers and without prejudice for data subjects to go to court. On the basis of one of these settlements, the DPA closed the case29 KB (3,892 words) - 13:46, 7 December 2022
- meaning of Section 2 Paragraph 2 No. 3 TTDSG. Their collection, earmarking and storage is based on the provisions of the TTDSG. Telekom has given you information24 KB (3,831 words) - 16:21, 23 March 2022
- because the scope of application of § 14.3 TMG in conjunction with § 1.3 NetzDG had not been opened up. The application of Section 14 (3) of the German53 KB (8,894 words) - 15:56, 22 March 2022
- Datatilsynet (Denmark) - 2020-431-0075 (category Article 58(2) GDPR) (section English Machine Translation of the Decision)after the case's section 3.1. and 3.2. has been dealt with in the Data Council - pronounce the following: 1. Decision and order After a review of the case66 KB (10,335 words) - 14:38, 25 October 2022
- Garante per la protezione dei dati personali (Italy) - 9828901 (category Article 3(2)(a) GDPR) (section English Machine Translation of the Decision)Following the closure of the investigation, the DPA considered that the controller committed the following violations in the context of the provision of the91 KB (14,709 words) - 13:02, 14 December 2022
- APD/GBA (Belgium) - 71/2024 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)respected. So can the mailbox, with it in view of the legitimate interest of the defendant in accordance with the conditions of Article 6.1.f) of the GDPR, for23 KB (3,429 words) - 11:28, 15 May 2024
- Garante per la protezione dei dati personali (Italy) - 9955735 (section English Machine Translation of the Decision)quarantine related to the virus. The complainant contested the accuracy of the information on the day of publication, requesting the removal of the article, but31 KB (4,659 words) - 15:22, 12 December 2023
- APD/GBA (Belgium) - 99/2023 (category Article 17(3) GDPR) (section English Machine Translation of the Decision)GDPR, the data subject filed a complaint with the Belgian DPA. The Belgian DPA distinguished between the collection of the data subject's data and the collection33 KB (5,012 words) - 14:07, 26 July 2023
- APD/GBA (Belgium) - 147/2022 (category Article 2(1) GDPR) (section English Machine Translation of the Decision)requests a copy of the file (art. 95, §2, 3° WOG), which was transferred to him the same day. 8. At the request of the defendant, the date of the hearing is28 KB (4,311 words) - 15:09, 25 October 2022
- Garante per la protezione dei dati personali (Italy) - 9784626 (category Article 58(2) GDPR) (section English Machine Translation of the Decision)Protection (…). 2. The outcome of the investigation. Upon examination of the documentation produced and the declarations made by the party during the proceedings16 KB (2,332 words) - 12:19, 13 July 2022
- found the placement of the notice to breach of Article 76(3) ZVOP-2. As a result, the DPA held the controller liable on the basis of Article 100(3) ZVOP-2 in12 KB (1,770 words) - 16:59, 5 December 2023
- DPC (Ireland) - Whatsapp Ireland Limited - IN-18-5-6 (section English Machine Translation of the Decision)DPA (HmbBfDI) and later transferred to the German Federal DPA (BfDI), advanced a number of grounds upon which the consent of the data subject could not32 KB (4,686 words) - 14:17, 1 February 2023
- Garante per la protezione dei dati personali (Italy) - 9746047 (section English Machine Translation of the Decision)Station next to the headquarters of the club. 1.2. The Office, on the basis of the findings of the investigations carried out, notified the Club (prot. No15 KB (2,365 words) - 13:17, 23 February 2022
- Garante per la protezione dei dati personali (Italy) - 9778996 (category Article 6(2) GDPR) (section English Machine Translation of the Decision)c) and e), 2 and 3, lett. b) and art. 17 of the Regulations as well as art. 2-ter, paragraphs 1 and 3 of the Code (in the text prior to the changes made49 KB (7,883 words) - 15:12, 13 July 2022
- Garante per la protezione dei dati personali (Italy) - 9827119 (category Article 12(2) GDPR) (section English Machine Translation of the Decision)relationship and the list, from the date of hiring until the date of submission of the application, of the daily tasks assigned to the line of work, with specification42 KB (6,583 words) - 10:13, 13 October 2023
- Persónuvernd (Iceland) - no. 2020020909 (category Article 58(2)(g) GDPR) (section English Machine Translation of the Decision)complaint with the Icelandic DPA. The dispute brought to the attention of the Icelandic DPA therefore mainly concerned the date from which the four years period21 KB (3,099 words) - 10:00, 6 October 2021
- Following this, the two files have been joined. 4. Pursuant to article 95 § 2, 3° of the LCA as well as article 47 of the rules of order inside the DPA, a copy14 KB (1,869 words) - 14:49, 13 June 2023
- Authority against the controller. 2. The object of the complaint concerns the alleged use of a hem, according to the complainant relevant photo by the controller17 KB (2,310 words) - 12:56, 16 May 2023
- provisions of the DPA and subordinate legislation made under the DPA remain in force for the purposes of PECR notwithstanding the introduction of the Data Protection32 KB (5,066 words) - 09:04, 14 February 2022
- HDPA (Greece) - 39/2021 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)with a copy of the videotape material that recorded the closed circuit television of the bus at the location of the bus driver on the day of the incident16 KB (2,337 words) - 09:08, 22 September 2021
- HDPA (Greece) - 47/2023 (category Article 12(2) GDPR) (section English Machine Translation of the Decision)entry into force of the GDPR. Therefore, the DPA examined the request in light of the previous regime of Directive 95/46/EU. The DPA found that taking into36 KB (6,028 words) - 07:43, 20 March 2024
- Garante per la protezione dei dati personali (Italy) - 9815931 (section English Machine Translation of the Decision)regard to the nature, seriousness and duration of the infringement, as well as the degree of responsibility and the way the DPA became aware of the infringement30 KB (4,724 words) - 13:41, 2 November 2022
- APD/GBA (Belgium) - 110/2023 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)outside of the scope of the complaint. Firstly, prior to assessing the violations, the DPA clarified the data processing roles of the school and the municipality66 KB (9,820 words) - 10:13, 13 September 2023
- IMY (Sweden) - DI-2020-10549 (category Article 12(2) GDPR) (section English Machine Translation of the Decision)facilitate the exercise of the data subjects’ rights, thereby violating Article 12(2) GDPR. The DPA then examined the current practice of the controller56 KB (6,423 words) - 08:14, 30 April 2024
- Tietosuojavaltuutetun toimisto (Finland) - 7732/161/23 (category Article 58(2)(f) GDPR) (section English Machine Translation of the Decision)rules of procedure of the Office of the Data Protection Commissioner, the sanctions panel deals with the matter of the prohibition of processing and the suspension32 KB (4,844 words) - 11:44, 11 October 2023
- Tietosuojavaltuutetun toimisto (Finland) - 2889/161/21 (category Article 28(3) GDPR) (section English Machine Translation of the Decision)affect the resolution of the matter. At the same time, Y Oy has been given the opportunity to raise such matters referred to in Article 83 (2) of the General40 KB (6,315 words) - 11:13, 22 September 2021
- at DECISIONS D A T U M 2 4 . 0 3 . 2 0 2 2 BUSINESS NUMBER W 2 5 3 2 2 2 6 2 6 1 - 1/8 E I M N A M E N D E R E P U B L I K ! The Federal Administrative16 KB (2,346 words) - 16:17, 18 May 2022
- Tietosuojavaltuutetun toimisto (Finland) - 9707/152/19 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)to Article 15 of the Data Protection Regulation. The initiator has said that as a result of the delayed implementation of the right, the legal actions initiated46 KB (7,186 words) - 14:12, 18 October 2023
- General to the Chairman of the Disputes Chamber (art. 91, §1 and §2 WOG). The report contains findings with regard to the subject matter of the complaint38 KB (5,625 words) - 10:37, 7 December 2021
- APD/GBA (Belgium) - 165/2023 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)a violation of: 1. Article 5.1.f) and 5.2 of the GDPR, Article 24.1 of the GDPR, Article 25.1 of the GDPR and Articles 32.1 and 32.2 GDPR; 2. Articles 3567 KB (9,908 words) - 11:09, 10 January 2024
- Persónuvernd (Island) - 2021091877 (category Article 58(2)(f) GDPR) (section English Machine Translation of the Decision)that are characteristic of him, cf. Number 2. Article 3 of the Act and number 1 Article 4 of the regulation. According to paragraph 2 Article 4 Act no. 90/201821 KB (3,317 words) - 14:19, 3 January 2024
- APD/GBA (Belgium) - 29/2024 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)against defendant. 2. The subject of the complaint concerns the online publication of the name, address and photo of the complainant on the defendant's website27 KB (4,073 words) - 10:26, 21 February 2024
- NAIH (Hungary) - NAIH-6484-2-2022 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)nor did it inform the DPA of the reason for the delay and when the data subject could expect a substantive response. Therefore, the DPA carried out an on-site66 KB (10,501 words) - 14:46, 12 October 2022
- UODO (Poland) - DKN.5131.11.2020 (category Article 34(2) GDPR) (section English Machine Translation of the Decision)on the theft of the folders. The DPA asked the Foundation to clarify whether the breach had to be reported to the DPA, demanding an analysis of the breach51 KB (8,179 words) - 12:07, 11 August 2021
- confirmed to the DPA that it had deleted the personal data of the data subject. On 8 October 2020, the DPA reprimanded the controller for not immediately complying12 KB (1,651 words) - 20:05, 7 September 2022
- Persónuvernd (Island) - 2022081290 (category Article 6(3) GDPR) (section English Machine Translation of the Decision)on the basis of the National Act on processing of personal data for law enforcement purposes implementing the LED. First of all, the Icelandic DPA considered31 KB (4,936 words) - 09:53, 10 January 2024
- 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal18 KB (2,465 words) - 13:23, 31 October 2022
- EDPB Plenary 2/Minutes (section Table on the powers of national SAs to bring action before national courts – discussion (Rapporteurs: DE DPA, FR DPA))4, 2.1, 2.2, 2.3 and 3.7.2 confidential according to Art. 33 RoP. The members of the EDPB discussed the meeting of the Chair and Vice Chairs with the US15 KB (2,014 words) - 19:45, 6 June 2020
- in Article 9(3) of the Spanish Constitution, as the the Spanish DPA fined the controller in accordance with the GDPR, and the alleged infringement had19 KB (3,026 words) - 09:52, 10 September 2021
- APD/GBA (Belgium) - 105/2022 (category Article 2(1) GDPR) (section English Machine Translation of the Decision)them of fraud. 2. On March 17, 2020, the complaint is declared admissible by the first-line service on the basis of the Articles 58 and 60 of the WOG and44 KB (6,420 words) - 11:00, 6 July 2022
- which not. However, the DPA asserted that it is not the task and responsibility of the data subject, nor of the DPA, rather than that of the controller, to78 KB (12,303 words) - 08:48, 23 February 2023
- for the clarification of the facts in question, by virtue of the powers of investigation granted to the control authorities in article 57.1 of the Regulation30 KB (4,594 words) - 07:25, 22 June 2022
- APD/GBA (Belgium) - 48/2024 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)channels, and not when the controller actually becomes aware of the request. The DPA also noted that the controller made an extension of 2 months, in accordance6 KB (774 words) - 14:54, 10 April 2024
- because of the judicial expulsion. Also the DPA considered the fact that the judgment imposing the deportation has been annulled. Thus, the DPA decided10 KB (1,496 words) - 21:12, 25 April 2024
- Tietosuojavaltuutetun toimisto (Finland) - 7099/183/2018 (category Article 7(2) GDPR) (section English Machine Translation of the Decision)here! The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details. 3/3/2022 Legality of data34 KB (5,367 words) - 08:14, 18 May 2022
- Datatilsynet (Norway) - 23/00708-28 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)safeguard the data subjects' privacy through technical and organisational security measures. Based on the findings of the audit, the DPA gave 3 orders to6 KB (650 words) - 12:27, 3 April 2024
- against the controller. 2. The subject of the complaint concerns the exercise by the complainant of his right to object to following the receipt of unwanted31 KB (4,547 words) - 15:54, 3 May 2022
- Garante per la protezione dei dati personali (Italy) - 9993105 (category Article 17(3)(e) GDPR) (section English Machine Translation of the Decision)which the [complainant] is the legal representative, of the company shares of minority at MP1” (note 9/5/2023, p. 3); b. “After the transfer of the company35 KB (5,495 words) - 15:17, 19 March 2024
- DSB (Austria) - DSB-D130.1174 (category Article 3 GDPR) (section English Machine Translation of the Decision)erasure of the personal data. The DPA first examined whether the processing activities fell within the territorial scope of the GDPR under Article 3 GDPR. The86 KB (14,497 words) - 13:42, 3 April 2024
- AP (The Netherlands) - z2023-00037 (category AP (The Netherlands)) (section English Machine Translation of the Decision)data by the college of the mayor and aldermen of the municipality of Voorschoten (hereinafter: the college) in the context the implementation of the waste42 KB (6,980 words) - 15:30, 21 November 2023
- HDPA (Greece) - 6/2024 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)use of his vehicule tracking outside of working hours and for the purpose of locating the data subject for the lack of legal basis. The DPA also found a breach19 KB (3,000 words) - 13:44, 6 March 2024
- the DPA granted the authorisation to the processing. However, the DPA imposed two additional conditions: first, processing of data subjects’ faces should31 KB (4,726 words) - 08:13, 16 November 2023
- to the USA. Therefore, the DPA concluded that the controller most likely transferred personal data to the US. Finally, the DPA highlighted that the CJEU69 KB (10,520 words) - 07:55, 10 August 2023
- Garante per la protezione dei dati personali (Italy) - 9949453 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such44 KB (6,773 words) - 08:38, 29 November 2023
- IMY (Sweden) - DI-2019-6696 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)...7 3.1.2 The Privacy Protection Authority's assessment...................................8 3.2 The right to access personal data and a copy of personal157 KB (18,556 words) - 12:00, 28 June 2023
- Tietosuojavaltuutetun toimisto (Finland) - 6745/163/18 (category Article 9(2)(g) GDPR) (section English Machine Translation of the Decision)of the patient in question. The Finnish DPA also considered the fact that, according to Article 9(2)(g) GDPR, the processing of health data is allowed26 KB (4,068 words) - 14:27, 24 February 2022
- channel used. The DPA further stated that there was currently no DPO under the name of the controller in the designated database operated by the DPA (accessible90 KB (14,299 words) - 13:52, 2 February 2023
- CNPD (Luxembourg) - Délibération n° 36FR/2021 (category Article 83(2) GDPR) (section English Machine Translation of the Decision)The Luxembourg DPA (CNPD) fined a company €13,200 for two violations of the GDPR identified in the course of an audit on the role of the Data Protection8 KB (868 words) - 07:39, 12 November 2021
- HDPA (Greece) - 38/2023 (category Article 3(2) GDPR) (section English Machine Translation of the Decision)from the list of search results in the search engine that appear on the basis of her name: 1. … 2 .… 3. … 4. … 5. … 6.… In view of the above, the Authority23 KB (3,704 words) - 18:18, 23 April 2024
- DSB (Austria) - 2020-0.829.566 (category Article 15(3) GDPR) (section English Machine Translation of the Decision)light of the above, the Austrian DPA rejected the complaint. The Austrian DPA's approach in this case unnecessarily limits the scope of application of the41 KB (6,603 words) - 07:12, 1 August 2023
- 1. until 1.4. The findings made were to be regarded as undisputed. 2.2. The fact that the accused published the medical diagnosis of the affected person35 KB (5,572 words) - 14:56, 27 March 2024
- UODO (Poland) - DKN.5131.43.2022 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)September 2022 the DPA initiated an ex officio investigation regarding the controller's handling of the data breach. The Polish DPA found that the controller57 KB (9,261 words) - 08:13, 25 October 2023
- that "the browsing the profiles of job seekers, your profile stood out to me.” THE letter […], as signed by the head of the office of the Respondent 2, and33 KB (4,956 words) - 15:55, 20 March 2024
- for the acts and stated that it had made a voluntary payment advance of € 1800. In assessing the adequacy of the sanction, the DPA considered the responsibility52 KB (7,751 words) - 14:16, 17 April 2024
- Upravni sud u Zagrebu - Usl-4017/23-6 (category Administrative Court of Zagreb (Croatia)) (section English Machine Translation of the Decision)1.2. The plaintiffs are submitting this administrative complaint to the title court based on the article Paragraph 3, paragraph 1, point 3 of the Administrative22 KB (3,379 words) - 09:05, 28 March 2024
- and (c) the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of his contact40 KB (5,684 words) - 18:42, 16 February 2022
- Garante per la protezione dei dati personali (Italy) - 9592011 (category Article 28(3)(g) GDPR) (section English Machine Translation of the Decision)provisions of Article 28(3)(g) of the GDPR by ensuring that all the personal data of the M5S members are given to Movimento 5 Stelle (M5S). The DPA, moreover40 KB (6,510 words) - 16:53, 26 May 2022
- Article 26(2) and (3) of the Law on the Prohibition of the Execution of Criminal Offences, and taking into account Article 17(2)(1) of the Law on the Prohibition12 KB (1,883 words) - 08:17, 16 May 2023
- APD/GBA (Belgium) - 188/2022 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)could use the licence plate to identify the data subject. The DPA also considered the purpose of the processing, which was the appearance of the car in the95 KB (14,325 words) - 14:27, 25 January 2023
- register the first six digits of the ID number, i.e. date of birth, when purchasing tickets. Copies of those emails followed the complaint. The complainant37 KB (6,136 words) - 16:05, 30 March 2022
- approval of a national archivist, the rules of the National Archives of Iceland or on the basis of a special legal provision. The DPA dismissed the part of13 KB (2,092 words) - 10:06, 6 May 2021
- Datatilsynet (Norway) - 20/02875-10 & 20/02875-11 (section English Machine Translation of the Decision)with others determines the purpose of the processing of personal data and the means to be used; when the purpose and the means of treatment are laid down56 KB (8,530 words) - 08:07, 8 June 2022
- regard to the subject matter of the complaints, decision that there is of infringements of Article 32(1), (2) and (4) of the GDPR and of 24(1) of the GDPR due35 KB (4,931 words) - 12:59, 9 November 2021
- Tietosuojavaltuutetun toimisto (Finland) - 3895/83/22 (category Article 9(3) GDPR) (section English Machine Translation of the Decision)assistance from the point of view of preventive health care. The registrar considers that the prevention of diseases is part of the organization of medical care41 KB (6,305 words) - 11:34, 28 October 2022
- Garante per la protezione dei dati personali (Italy) - 9991064 (category Article 28(2) GDPR) (section English Machine Translation of the Decision)inform "the controller without undue delay after becoming aware of the breach." The DPA referred to the Guidelines 9/2022 on the notification of personal data52 KB (8,196 words) - 15:46, 27 March 2024
- APD/GBA (Belgium) - 85/2022 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)comply with the GDPR. The controller refers to e.g. the French and Dutch DPA, who have provided this. Regarding the placement of cookies, the DPA first noted171 KB (24,826 words) - 15:55, 18 June 2022
- Garante per la protezione dei dati personali (Italy) - 9832838 (category Article 9(2)(b) GDPR) (section English Machine Translation of the Decision)data. The DPA declared that in the context of the employment relationship, the obligation to inform the employee is also an expression of the principle41 KB (6,619 words) - 13:06, 18 January 2023
- AEPD (Spain) - E/00647/2019 - CO/00198/2020 (category Article 80(2) GDPR) (section English Machine Translation of the Decision)this, the establishment of the person in charge in the Union where the carry out the main treatment activities in the context of the activities of a manager's17 KB (2,419 words) - 14:27, 24 November 2022
- on behalf of the DPA and issued an order to stop the processing of personal data. The DPA has not found which exact areas were filmed and if the complaint27 KB (4,149 words) - 16:02, 22 March 2022
- CJEU - C-768/21 - TR v Land Hessen (category Article 58(2) GDPR)and 77(2) GDPR impose certain obligations to the DPA, namely to "inform the complainant of the progress and the outcome of the investigation" (§42 of the9 KB (1,244 words) - 13:31, 23 April 2024
- DSB (Austria) - 2021-0.410.237 (category Article 9(2)(i) GDPR) (section English Machine Translation of the Decision)occupation. Furthermore, the DPA found that the protection of public health overrides the interest of the data subject to not disclose (part of) her health record18 KB (2,660 words) - 16:05, 20 April 2022
- park in the garage. The DPA concluded that the controller violated Article 5(1)(c) GDPR. The DPA found the processing of areas that cover the entrance72 KB (11,993 words) - 14:21, 10 April 2024
- NAIH (Hungary) - NAIH/4410-1/2023 (category Article 13(2) GDPR) (section English Machine Translation of the Decision)violated it 1.1. Article 6 (1) of the GDPR; 1.2. Paragraphs (1)-(2) of Article 13 of the GDPR. and condemns the Company for the violations established above30 KB (4,522 words) - 13:15, 26 July 2023
- First-tier Tribunal - Dennerlein v The Information Commissioner (2023) UKFTT 942 (GRC) (section English Machine Translation of the Decision)progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commissioner received the complaint26 KB (3,926 words) - 09:58, 14 December 2023
- Tietosuojavaltuutetun toimisto (Finland) - 3592/152/2019 (category Article 15(3) GDPR) (section On the application of the GDPR to an audio recording involving a private trader)clarify whether the Company had the right to provide a written transcript of the recording of the call. The Finnish DPA first examined whether the audio recording19 KB (3,000 words) - 11:39, 1 December 2021
- connection with the third paragraph of Article 3.a, Article 8 and the fourth paragraph of Article 153 of the Constitution of the Republic of Slovenia. The alleged30 KB (4,982 words) - 14:27, 17 September 2021
- NAIH (Hungary) - NAIH-4137- 8/2022 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)maintained by the controller in the context of providing private healthcare fell within the scope of the GDPR. Third, the DPA noted the obligations of the controller75 KB (11,860 words) - 13:16, 19 October 2022
- (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of personal data and on the free movement of such data ; Having90 KB (14,556 words) - 17:08, 6 December 2023
- inform the data subject about the reasons of the refusal pursuant to Article 12(4) GDPR and about the possibility to lodge a complaint with the DPA. In other39 KB (6,150 words) - 14:23, 29 August 2023
- by such DPA to the data subject, not by the Danish DPA. The document made available on the EDPB as "final decision" is a letter of the Danish DPA referring11 KB (1,614 words) - 09:36, 13 December 2023
- account the nature, scope of treatment, context and purpose and the specific risks of the treatment. Of ch. 3 Section 8 of the BDL states that the person43 KB (5,083 words) - 11:43, 7 April 2022
- Persónuvernd (Island) - 2022111927 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)that the conditions of the loan terms are met for the registration of non-payments. Secondly, the DPA considered the lawfulness of the processing of perosnal40 KB (6,452 words) - 15:31, 12 July 2023
- it in the form of paper is insufficient. Considering the above, the DPA held that the controller acted in violation of the GDPR. It ordered the controller17 KB (2,597 words) - 17:53, 22 December 2022
- one of the legal bases set out in Article 6(1) GDPR and the principles of processing of Article 5(1) GDPR. The DPA specified that in order for the recording22 KB (3,422 words) - 11:26, 3 October 2023
- Article 2, 10° of the eGovernment Decree1 and described on the website of the Flemish Government2 , as the defendant meets the criteria of Article I, 3, 6°58 KB (9,477 words) - 18:41, 1 June 2022
- plain language. The DPA held that the text next to the tick box of the controller’s website gave the data subject the impression that the controller’s legal17 KB (1,990 words) - 09:02, 8 May 2024
- Datatilsynet (Denmark) - 2021-31-4871 (category Article 58(2)(d) GDPR) (section English Machine Translation of the Decision)fulfilled the 'freely given' requirement of Article 4(11) GDPR. Second, the DPA determined that the controller did not demonstrate that the processing of personal29 KB (4,447 words) - 16:32, 3 November 2023
- Datatilsynet (Norway) - 19/02450 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)data related to the exercise of the public authorities' tasks. The DPA also refers to the French DPA's use of this lawful basis for several of their processing46 KB (7,180 words) - 17:22, 9 March 2022
- objection that the issue of the allocation of roles affects the determination of the moment of awareness of the Breach, as the knowledge of a breach must183 KB (30,819 words) - 09:50, 20 January 2023
- Tietosuojavaltuutetun toimisto (Finland) - 7635/162/21 (category Article 6(2) GDPR) (section English Machine Translation of the Decision)Article 4 (2) of Chapter 1 of the Data Protection Regulation defines the processing of personal data, the processing of personal data also requiring the controller16 KB (2,293 words) - 17:30, 23 February 2022
- KamR Stockholm - Case No. 5888-20 (category Article 9(2) GDPR) (section English Machine Translation of the Decision)with the Data Inspectorate. 2 The Data Inspectorate decides on the basis of ch. Section 2 of the Data Protection Act and Articles 58 (2) and 83 of the Data62 KB (7,607 words) - 08:56, 7 October 2021
- DSB (Austria) - D130.1178 2023-0.631.894 (category Article 7(3) GDPR) (section English Machine Translation of the Decision)however, the Austrian DPA held that since the data of the complainant had already been deleted at the time of the decision, an order to delete the complainant’s6 KB (787 words) - 16:19, 16 February 2024
- Datatilsynet (Norway) - 23/00708 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)with the privacy regulations, cf. the privacy regulation article 5 no. 2, article 24 no. 1 and 2 and article 32 no. 1, 2 and 4, as the local the inspection59 KB (8,718 words) - 14:50, 20 December 2023
- ICO (UK) - HIV Scotland (category Article 32(2) GDPR) (section English Machine Translation of the Decision)Article 58(2)(d)of the GDPR the Commissioner has the power to notify controllers of alleged infringemenof GDPR. By Article 58(2)(i) she has the power to55 KB (6,916 words) - 07:27, 26 October 2021
- “defendant 2”). 2. The subject of the complaint concerns the lack of response by defendant 1 to the exercise of the right of access and request for erasure;19 KB (2,654 words) - 08:43, 3 April 2024
- UODO (Poland) - DKN.5131.59.2022 (category Article 33(3) GDPR) (section English Machine Translation of the Decision)type of data breach requires the implementation of actions, including the notification of the DPA and data subjects. The DPA also added that the notification108 KB (17,728 words) - 07:57, 25 April 2024
- transmitted to the Chamber st 2 Litigation under article 62, § 1 of the LCA. 10. Pursuant to article 95 § 2, 3° of the LCA as well as article 47 of the order regulations17 KB (2,386 words) - 07:43, 30 April 2024
- and (c) the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of his contact39 KB (5,404 words) - 11:56, 21 September 2021
- was also based on the data subject in Procedure 4.2 05475-02-0301/21 object of the complaint of the lack of legality of the Processing of personal data by35 KB (5,593 words) - 08:56, 9 January 2024
- accessed the requested data. The MP attached the statement of the BF of February 21, 2020 to the complaint. 2. In its supplementary statement of March 1225 KB (4,053 words) - 11:11, 10 March 2023
- IDPC (Malta) - COMP/138/2022 (category Article 15(3) GDPR) (section English Machine Translation of the Decision)to noyb, the controller violated Article 15 GDPR. In the procedure before the DPA, the controller maintained its position. Initially, the DPA emphasized7 KB (862 words) - 14:35, 23 May 2023
- Article 4:17(2) of the same law defines the size of the penalty: 23 EUR per day for the first 14 days of delay, 35 EUR per day for the subsequent 14 days3 KB (325 words) - 16:32, 10 March 2022
- filed on the basis of article 62, § 1 of the WOG transferred to the Disputes Chamber. 2 5. In accordance with Article 95, § 2, 3° of the WOG as well as21 KB (3,085 words) - 14:47, 29 April 2024
- Datatilsynet (Denmark) - 2019-431-0031 (category Article 14(2) GDPR) (section English Machine Translation of the Decision)with the fulfillment of the duty of disclosure in Article 13 of the Data Protection Regulation solely for the activity relating to the sending of a letter35 KB (5,528 words) - 08:12, 24 January 2022
- authority in the case and the Swedish DPA to be the supervisory authority concerned. The DPA sent a draft of this decision to the Swedish DPA. The draft had44 KB (7,217 words) - 10:04, 12 May 2021
- Datatilsynet (Norway) - 21/01164 (category Article 24(2) GDPR) (section English Machine Translation of the Decision)Article 6(1)(f) GDPR and the national regulation § 2 second sentence. The DPA further held that the company had failed to inform the data subject about this6 KB (572 words) - 06:25, 18 May 2022
- Leudelange 2/9 In the absence of a reaction from the Mayor, the president of the CNPD told him sent a reminder dated September 23, 2022 (EXHIBIT 2). On the date23 KB (3,112 words) - 11:34, 3 January 2024
- indication of processing of personal data of the data subject or any form of going above what is necessary. The DPA also mentioned Article 22(2) Organic18 KB (2,701 words) - 11:04, 24 May 2023
- Datatilsynet (Denmark) - 2021-431-0142 (category Article 13(2) GDPR) (section English Machine Translation of the Decision)sufficient to fulfil the information obligations. The DPA therefore found no violation of the GDPR. However, the DPA recommended that the controller prepares11 KB (1,586 words) - 08:51, 6 October 2021
- Garante per la protezione dei dati personali (Italy) - 9578184 (category Article 6(3) GDPR) (section 2. Unsuitability of the legal basis)certification are the following: “personal data necessary to identify the data subject; a unique identification of the certificate; the date of expiry of the certificate33 KB (5,141 words) - 10:30, 19 May 2021
- basis of a review of video recordings in the store. The Danish Data Protection Authority found that the description of the criminal offence, which was the reason12 KB (1,708 words) - 08:02, 27 September 2023
- APD/GBA (Belgium) - 159/2023 (category Article 7(3) GDPR) (section English Machine Translation of the Decision)reached the GBA the following day. 2 In particular Article 10/2 of the Act of 30 July 2018 on the protection of natural persons with regard to the processing54 KB (7,683 words) - 16:04, 10 January 2024
- Garante per la protezione dei dati personali (Italy) - 9815665 (section English Machine Translation of the Decision)transparency on the web by public entities and other obligated entities". The DPA found a violation of Article 2-ter of the Code on the Protection of Personal59 KB (9,359 words) - 08:38, 16 November 2022
- (…). 2. On 6 July 2020, the complaint will be declared admissible by the Frontline Service on the basis of the Articles 58 and 60 of the WOG and the complaint17 KB (2,519 words) - 16:04, 23 March 2022
- DVI (Latvia) - Nacionālajam veselības dienestam (section English Machine Translation of the Decision)stated in the request of the Orphan's Court. [2] In order to verify the legality of the Service's actions and in accordance with the Data of Natural Persons22 KB (3,276 words) - 11:46, 26 July 2023
- UODO (Poland) - DKN.5131.16.2021 (category Article 33(3) GDPR) (section English Machine Translation of the Decision)(what was the security and confidentiality of the data). First, the DPA held that the notification of data breaches to the DPA is especially important because88 KB (14,432 words) - 10:31, 24 November 2021
- to his or her identity or one or more of the characteristics characteristic of him, cf. Item 2 Article 3 of the Act and Paragraph 1. Article 4 Regulation14 KB (2,082 words) - 16:32, 18 May 2020
- UOOU (Slovakia) - Opinion of 24 August 2021 - FATCA (section English Machine Translation of the Decision)assessment of the sufficiency of the legal framework of international treaties on the exchange of tax information in terms of the requirements for the protection18 KB (2,319 words) - 12:51, 28 September 2022
- reference to the concept of consent in the UK GDPR as defined in section 3(10) of the DPA 2018 [1: see regulation 2(1) of PECR, as amended by Part 3 of Schedule41 KB (5,879 words) - 12:39, 23 March 2022
- that the complainant also did not respond to the DPA's note of 2 October 2023, the DPA concluded that the controller had remedied the breach of the right5 KB (567 words) - 10:50, 24 January 2024
- *** URL.2 " A copy of the sms is provided. 4. Provide a copy of the DNI that served to prove the identity of the client stating in it the name of D. B.B24 KB (3,728 words) - 10:06, 18 August 2021
- VG Wiesbaden - 6 K 549/21.WI (category Article 58(2)(g) GDPR) (section English Machine Translation of the Decision)a complaint with the DPA, pursuant to Article 77(1) GDPR, and that the DPA has the duty to monitor and enforce the application of the GDPR pursuant to32 KB (5,175 words) - 08:40, 12 January 2022
- CNIL (France) - SAN-2023-015 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)2002/58/EC of the European Parliament and of the Council of July 12, 2002 concerning the processing of personal data and the protection of privacy in the electronic67 KB (10,546 words) - 13:55, 25 October 2023
- Persónuvernd - 2020010616 (category Article 9(2)(a) GDPR) (section English Machine Translation of the Decision)90/2018 but that the dissemination of the information to the committee had relied on point 3. the same articles and under the conditions of point 6. Paragraph23 KB (3,612 words) - 13:17, 17 July 2020
- APD/GBA (Belgium) - 47/2022 (category Article 6(3) GDPR) (section 6. Security and integrity of the data)the DPA recognised that the the protection against COVID-19 was a matter of public interest in the area of public health. The DPA considered that no legal207 KB (31,357 words) - 14:21, 8 June 2022
- UODO (Poland) - DKN.5131.29.2022 (category Article 28(3) GDPR) (section English Machine Translation of the Decision)60 and art. 102 paragraph. 2 and sec. 3 of the Act of May 10, 2018 on the protection of personal data (Journal of Laws of 2019, item 1781), hereinafter48 KB (7,612 words) - 09:46, 25 April 2024
- Therefore, the DPA rejected the part of the complaint seeking a redress for the unlawful transfer. However, in the DPA's view, following the transfer of the file51 KB (8,202 words) - 14:49, 12 October 2022
- Tietosuojavaltuutetun toimisto (Finland) - 9492/153/22 (section English Machine Translation of the Decision)request. Subsequently, the parent filed a complaint with the Finnish DPA. During the course of the opened proceedings, the DPA contacted the controller but did10 KB (1,416 words) - 17:28, 10 January 2023
- but that the interests of the complainant outweighed the interests of the defendant. The DPA therefore ordered that the electronic summary of payments17 KB (2,491 words) - 13:17, 5 October 2020
- Datatilsynet (Denmark) - 2021-432-0070 (category Article 14(3) GDPR) (section English Machine Translation of the Decision)research. The storage of the residual material takes place pursuant to Section 10 of the Data Protection Act[2]. SSI has stated that the purposes of the storage39 KB (6,054 words) - 15:54, 10 May 2023
- ANSPDCP (Romania) - 13.11.2023 (category Article 32(2) GDPR) (section English Machine Translation of the Decision)by the operator of several notifications of violations of the security of personal data, between 20.07.2021 and 3.02.2022, according to art. 33 of Regulation6 KB (726 words) - 13:57, 22 November 2023
- APD/GBA (Belgium) - 16/2023 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)article 95 § 2, 3° of the LCA as well as article 47 of the rules of order inside the DPA, a copy of the file may be requested by the parties. If one of parties27 KB (3,881 words) - 14:40, 14 March 2023
- Garante per la protezione dei dati personali (Italy) - 9776444 (category Article 9(2)(b) GDPR) (section English Machine Translation of the Decision)specific rights of the controller or of the data subject under Article 9(2)(b). The DPA found multiple violations of the GDPR. The DPA held that personal data24 KB (3,752 words) - 11:47, 9 November 2022
- characteristic of him or her, cf. 2. tölul. Article 3 of the Act and point 1. Article 4 of the Regulation. Processing refers to an operation or series of operations16 KB (2,410 words) - 13:17, 5 October 2020
- Considering the sending to the parties of the minutes of the hearing and the comments of the parties; II- The facts of the complaint 12. The complainant92 KB (13,989 words) - 14:56, 3 February 2022
- ICO (UK) - Monetary Penalty Notice to Easylife Limited (section English Machine Translation of the Decision)Obligations of the Controller 5. Easylife is a controller for the purposes of the GDPR and the DPA, because it determines the purposes and means of processing77 KB (9,347 words) - 07:39, 13 October 2022
- pupils of the list of teachers who can be met during the meeting of parents of pupils of the establishment of March 29, 2022. The facts are more fully detailed57 KB (8,705 words) - 11:48, 16 May 2023
- NAIH (Hungary) - NAIH-5361-1/2022 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)request on 2 April 2021. The DPA held that the controller violated Article 15(1) and (3) and Article 12(3) GDPR. The DPA considered the communication sent50 KB (8,064 words) - 14:42, 29 June 2022
- Garante per la protezione dei dati personali (Italy) - 9917900 (section English Machine Translation of the Decision)context of data protection. The Italian DPA concluded that the disclosure of a minor’s details did not fall within the scope of the test of essentiality. Noting8 KB (928 words) - 08:31, 23 August 2023
- Datatilsynet (Norway) - 0/02422 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)advance notification. The DPA assessed the different arguments made by the controller. The DPA first assessed the argument that the DPA's decision was arbitrary162 KB (24,007 words) - 19:41, 15 February 2023
- pointed out that the telephone number of the complainant alone falls under the concept of personal information, according to Number 2. Article 3 Act no. 90/201819 KB (2,776 words) - 15:39, 6 December 2022
- section 55A of the Data Protection Act 1998 (“DPA”). The penalty is being issued because of a serious contravention of regulation 21 of the Privacy and38 KB (4,984 words) - 23:21, 29 January 2021
- APD/GBA (Belgium) - 115/2022 (category Article 9(2) GDPR) (section English Machine Translation of the Decision)considering the sensitive nature of the data. Therefore the DPA held that the further processing was incompatible with the purpose of the original processing42 KB (6,237 words) - 11:23, 5 August 2022
- articles 6.1 and 10 of the LOPD, for part of AAA, typified as serious in articles 44.3.b) and 44.3.c) of the LOPD. SEVENTH: On 10/18/2017, the defendant filed33 KB (5,107 words) - 14:56, 25 October 2022
- directed to the City of Reykjavík and the complainant considers the publication to be infringing in violation of the Privacy Act and the provisions of the Constitution29 KB (4,469 words) - 07:42, 2 October 2020
- AP (The Netherlands) - z2020-08787 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)2022 made to the AP. 8 Email of 29 March 2020 from the person concerned to the DPO of the CAK. 9 Email of 9 April 2020 from the DPO of the CAI< to the person13 KB (2,134 words) - 09:16, 19 May 2023
- ensure the proper administration of welfare. In summer 2021, the Danish DPA investigated the data practices of a number of national municipalities. The controller14 KB (2,094 words) - 11:21, 26 January 2022
- Datatilsynet (Norway) - 21/02504 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)rating of the data subject, to validate his claims. Following the data subject's complaint, the DPA launched an investigation. The DPA found that the controller40 KB (5,993 words) - 05:16, 16 February 2022
- Garante per la protezione dei dati personali (Italy) - 9960920 (section English Machine Translation of the Decision)of the measures referred to in the articles. 58, par. 2, and 83 of the Regulation, in compliance with the provisions of the art. 166, paragraph 5, of the27 KB (4,036 words) - 13:37, 2 January 2024
- DSB (Austria) - 2021-0.187.619 (category Article 17(3)(a) GDPR) (section English Machine Translation of the Decision)as the interest of the public to use the search engine. The DSB rejected the argument of the controller that the processing was lawful because the database25 KB (3,905 words) - 14:45, 11 May 2022
- IP - 07121-1/2021/517 (category Article 55(3) GDPR) (section English Machine Translation of the Decision)assess the concrete processing of personal data outside the control procedure. According to the second indent of Article 2(1) of the ZInfP, the IP is responsible5 KB (679 words) - 10:42, 6 May 2021
- APD/GBA (Belgium) - 50/2024 (category Article 17(3)(e) GDPR) (section English Machine Translation of the Decision)Justification 4. On the basis of the elements in the file that are known to the Disputes Chamber, and on the basis of the powers granted to it by the legislature14 KB (1,990 words) - 14:50, 10 April 2024
- sends the DPA an explanation on which basis the processing took place and the DPA confirms that the processing complies with the provisions of the law. Share17 KB (2,716 words) - 16:21, 13 April 2021
- Datainspektionen - DI-2019-3840 (category Article 5(2) GDPR) (section Has the hospital broken the law by not taking sufficient technical and organizational measures?)could access the medical records of all departments within the hospital, except one. On this basis, the DPA concluded that the majority of the hospital's87 KB (13,573 words) - 11:43, 7 April 2022
- Datainspektionen - DI-2019-3845 (category Article 32(2) GDPR) (section English Machine Translation of the Decision)analysis of the risks to the rights and freedoms of data subjects. According to the DPA, this analysis should form the basis of a new assessment of the way93 KB (11,610 words) - 11:43, 7 April 2022
- Garante per la protezione dei dati personali (Italy) - 9964761 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)requirement of easy accessibility of the information underlying Article 12 GDPR in the broader context of the basic principle of transparency. Thus, the DPA confirmed65 KB (10,464 words) - 09:48, 17 January 2024
- Garante per la protezione dei dati personali (Italy) - 9971433 (section English Machine Translation of the Decision)active. 2. DISPUTE OF VIOLATIONS On 7 September 2023, the Company was notified of the start of the procedure, pursuant to art. 166, paragraph 5, of the Code51 KB (7,993 words) - 12:39, 6 February 2024
- purposes. The recording of such calls are therefore covered by the legal bases of vital interest of employees and are necessary for the performance of the agency's28 KB (4,404 words) - 09:22, 30 September 2021
- affected by the controller's processing. The Spanish DPA rejected the part of the data subject's complaint concerning the language of the standard request81 KB (13,337 words) - 14:55, 22 February 2023
- Datatilsynet (Norway) - 20/01727 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)related to the transfer basis. The description of the facts of the case is based on Ferde's response to the request for a statement dated 3 4 November53 KB (7,990 words) - 08:37, 6 October 2021
- under their care. During the phone call, the employee of the CPC wrote down the name of the Complainant, but not the identity of the children concerned. Because28 KB (4,334 words) - 07:57, 5 October 2021
- In view of this, the DPA considered that the processing in question was not in accordance with the GDPR. Furthermore, the DPA held that the controller13 KB (1,930 words) - 00:06, 11 December 2020
- NSA - III OSK 4727/21 (category Article 9(2) GDPR) (section English Machine Translation of the Decision)entitling to the processing of personal data. In the opinion of the Court, the risk of the possibly erroneous classification of the processing of personal15 KB (2,254 words) - 12:03, 10 September 2021
- NAIH (Hungary) - NAIH-4667-10/2022 (category Article 28(3)(c) GDPR) (section English Machine Translation of the Decision)legality of the data management on behalf of the controller. The DPA confirmed that the processor (the KRÉTA system) provided information on of the date on62 KB (9,999 words) - 10:21, 7 December 2022
- IP (Slovenia) - 06111-1/2023/8 (category Article 2(1) GDPR) (section English Machine Translation of the Decision)2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals in the processing of personal data and on the free18 KB (2,848 words) - 16:45, 6 November 2023
- 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of natural persons with regard to the processing of personal16 KB (2,159 words) - 16:19, 13 March 2024
- Rb. Rotterdam - C/10/655051 KG ZA 23-243 (category Article 28(3) GDPR) (section English Machine Translation of the Decision)procedure 2.1. The course of the procedure is evidenced by: - the summons of March 28, 2023 and the deed with exhibits 1 to 31 of Blauw; - the deed change33 KB (5,443 words) - 06:20, 26 April 2023
- AEPD (Spain) - PS/00003/2021 (category Article 12(2) GDPR) (section English Machine Translation of the Decision)accordance with the provisions of article 56 of Regulation (EU) 2016/679, of the European Parliament and of the Council, of 04/27/2016, regarding the Protection115 KB (18,312 words) - 11:58, 16 March 2022
- characteristic of him or her, cf. 2. tölul. Article 3 of the Act and point 1. Article 4 of the Regulation. Processing refers to an action or series of actions16 KB (2,483 words) - 10:10, 6 May 2021
- Garante per la protezione dei dati personali (Italy) - 9931319 (category Article 58(2)(i) GDPR) (section English Machine Translation of the Decision)removal of the camera placed above the cash register. The Office, with a note dated 8.2.2023 (protocol no. 22296), notified the act of initiation of the sanctioning21 KB (3,135 words) - 07:35, 4 October 2023
- AEPD (Spain) - PS/00209/2021 (category Article 83(2)(b) GDPR) (section English Machine Translation of the Decision)G57922429 by virtue of the powers of attorney established in art. 58.2 of the RGPD and in articles 47, 64.2 and 68.1 of the Organic Law 3/2018, of December 5,19 KB (2,809 words) - 09:21, 1 September 2021
- From the report to the DPA, the CTA stated that the affected data subject was informed on 10 July. Because of the information they had provided, the DPA18 KB (2,834 words) - 07:37, 4 October 2021
- 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of natural persons with regard to the processing of data27 KB (3,962 words) - 08:59, 21 May 2024
- APD/GBA (Belgium) - 38/2024 (category Article 7(3) GDPR) (section English Machine Translation of the Decision)2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of natural persons with regard to the processing of personal15 KB (1,952 words) - 16:12, 18 March 2024
- Copy to The appellant 2 3Article 15.1 of the data protection regulation. 4Article 15.3 of the data protection regulation. Article 15.4 of the data protection12 KB (1,314 words) - 13:28, 10 April 2024
- subparagraph 1, of the ZVOP-1 and applying the same provisions of the PDL-1, P a g e 1. the responsible person of the legal person ...: for the offence of unlawful19 KB (2,784 words) - 09:16, 25 April 2024
- offered in the first level of information, such as details of the purpose of the processing, the identity of the controller and the existence of the rights58 KB (8,226 words) - 07:35, 22 July 2021
- be unlocked again. 2.2. The complainant's observations The complainant states that the password is systematically the date of birth of all Joga customers13 KB (1,976 words) - 15:32, 10 November 2021
- Point 3 Article 3 the same law, cf. Paragraph 1 Article 9 of the Regulation, to comply with any of the additional conditions of Article 11. of the Act,18 KB (2,798 words) - 10:23, 8 July 2020
- departure of the employee, with a view to ensuring the proper functioning of the company and the continuity of its services.” However, the DPA noted that this27 KB (4,043 words) - 11:36, 11 October 2023
- section 3(2) Data Protection Act 1998 (DPA). 3. Responding to the Request by processing the Personal Data in this case would contravene the Data Protection28 KB (4,450 words) - 15:12, 20 October 2023
- courts. 3. point of view [B] On the part of [B], it is based on the fact that she suffered violence at the hands of the complainant. Part of the violence21 KB (3,374 words) - 13:28, 8 March 2023
- Commissioner (Cyprus) - 11.17.001.008.229 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)data of the data subject were processed. On the basis of the evidence provided, the DPA found that a data transfer to the United States occurred. The DPA56 KB (8,616 words) - 15:31, 6 March 2024
- Datatilsynet (Denmark) - 2021-31-5553 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)part of the alternative to payment. The company was therefore notified of an order to ensure that the consent of the visitors to jv.dk meets the requirements32 KB (4,997 words) - 14:09, 22 February 2023
- IMY (Sweden) - 2022-1032 (category Article 12(2) GDPR) (section English Machine Translation of the Decision)regarding the information requested, the DPA assessed if the controller had reasonable grounds to doubt the identity of the data subjects. The DPA pointed39 KB (4,578 words) - 08:16, 24 April 2024
- ANSPDCP (Romania) - Fine against S.C. Delivery Solutions S.A. (Sameday) (category Article 32(2) GDPR) (section English Machine Translation of the Decision)(RaidForums). Following the complaint, the DPA started an investigation. The database contained the personal data of 26,566 customers (name of the recipient, contact6 KB (676 words) - 06:36, 21 July 2022
- fine under the Article 83(1) GDPR. Considering the facts of the case and the changes requested by the complainant, the DPA rejected all the changes; arguing6 KB (483 words) - 12:23, 27 February 2024
- Tietosuojavaltuutetun toimisto (Finland) - 8422/161/21 (category Article 12(2) GDPR) (section English Machine Translation of the Decision)at the time of the submission of the clarification, it no longer kept the recording of the calls with the data subjects. The DPA then contacted the data74 KB (11,917 words) - 06:52, 27 September 2023
- AEPD (Spain) - PD-00207-2022 (category Article 15(3) GDPR) (section English Machine Translation of the Decision)timely provided, including the change of control over the data. The DPA dismissed the complaint of the data subject. Since the controller did provide timely19 KB (2,685 words) - 08:52, 30 January 2024
- considers that the appeal should be rejected. THE REASONS FOR THE DECISION The question in the case 8. The question in the case is about the Data Protection15 KB (1,596 words) - 09:21, 27 November 2023
- discovered, the municipality notified the Danish DPA of the incident. The municipality reported that the content of the email had possibly been encrypted on11 KB (1,561 words) - 11:19, 8 April 2022
- Article 9(2) GPDR. As a result, the DPA concluded that the nonbinary response violated Article 9(1) GDPR. The DPA imposed warning sanctions for the controller’s34 KB (5,149 words) - 16:00, 20 March 2024
- with the principles of the first paragraph Article 8 Act no. 90/2018. In view of the above, the conclusion of the DPA is that the processing of the complainant's26 KB (4,341 words) - 09:57, 18 March 2021
- Datatilsynet (Denmark) - 2023-432-0022 (category Article 9(2)(g) GDPR) (section English Machine Translation of the Decision)DPA found that the processor conducted processing of personal data in compliance the GDPR. The DPA believed that the relevant legal basis for the processor's59 KB (9,296 words) - 09:10, 29 November 2023
- DSB (Austria) - 2022-0.083.310 (category Article 2(2)(a) GDPR) (section English Machine Translation of the Decision)consequence, the DPA asserted to have the general competence of reviewing the actions of the Federal Minister of Finances under the GDPR. However, the DPA nevertheless52 KB (8,272 words) - 16:33, 18 January 2024
- CJEU - C-33/22 - Österreichische Datenschutzbehörde (category Article 2(2)(a) GDPR)Article 2(2)(a) GDPR. The GDPR will not apply if the activity of the controller falls outside the scope of Union Law under Article 2(2)(a). The court does8 KB (1,127 words) - 08:53, 30 January 2024
- AEPD (Spain) - PS/00410/2020 (category Article 2(2)(c) GDPR) (section English Machine Translation of the Decision)The Spanish DPA fined an individual €1500 for sharing personal data related to the sex life of the complainant on a website. The DPA rejected the individual's47 KB (7,334 words) - 17:00, 14 December 2022
- legal analysis of the case: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons15 KB (1,805 words) - 10:08, 13 November 2023
- APD/GBA (Belgium) - 57/2023 (category Article 12(2) GDPR) (section English Machine Translation of the Decision)sufficient. The DPA found that in this case, the controller should have provided a copy of the recordings. Regarding the rights of the employees, the DPA held99 KB (15,129 words) - 09:21, 31 May 2023
- offered on the first layer of the banner. That being said, the DPA endorsed the idea that the GDPR does not contain fixed requirements for the design of cookie46 KB (6,937 words) - 15:56, 26 September 2023
- Garante per la protezione dei dati personali (Italy) - 9899914 (section English Machine Translation of the Decision)according to the accountability principle, to facilitate the exercise of this right (Article 5(2) and Article 12(2) GDPR). For these reasons, the DPA found that52 KB (8,442 words) - 10:31, 27 June 2023
- Persónuvernd (Iceland) - 2020061965 (category Article 9(2)(h) GDPR) (section English Machine Translation of the Decision)numbers of the complainant's other children to the father of the complainant's oldest child who did not have custody of them, it was the opinion of the Personal17 KB (2,649 words) - 16:40, 21 December 2022
- prior to the transfer of their staff to IG’s facilities. The DPA reminded the Hospital that the GDPR must be complied with even in the context of the COVID-1946 KB (7,050 words) - 09:55, 16 December 2021
- since the document was locked with a password, that it reported the data breach to the DPA and notified the parents. The DPA first stressed that the sending16 KB (2,478 words) - 09:18, 12 April 2023
- Garante per la protezione dei dati personali (Italy) - 9838992 (category Article 58(2)(d) GDPR) (section English Machine Translation of the Decision)and the start of the procedure. With a note received on 15.7.2020, the local police of the Municipality of Modena transmitted the service report of a check41 KB (6,437 words) - 12:47, 8 February 2023
- in the processing of personal data. Considering the above, the DPA held that the consent to disclose the data personal data could not have met the conditions36 KB (5,751 words) - 15:12, 25 January 2023
- misdemeanor. (3) On the basis of the above, the Office first notified the accused of a breach of the Regulation Regulation (EU) 2016/679 of the European Parliament14 KB (2,229 words) - 14:36, 30 March 2022
- characteristic of him, cf. 2. tölul. Article 3 of the Act and point 1. Article 4 of the Regulation.With processing means in an action or sequence of actions in19 KB (2,873 words) - 07:57, 5 May 2021
- accordance with the ZVOP-2. This is stated in the original source of the DPA's decision. The ZVOP-2 replaced the ZVOP-1 which was the Personal Data Protection53 KB (8,251 words) - 08:30, 27 September 2023
- Garante per la protezione dei dati personali (Italy) - 9825667 (category Article 5(2) GDPR) (section The processing of customer data acquired through the merger)(within 2-3 days). The DPA therefore decided not pursue an investigation into the possible violation of Article 12(3) GDPR. The DPA also tested the data collection131 KB (21,176 words) - 12:52, 20 December 2022
- place. The Icelandic DPA ruled that the disclosure, by the Directorate of Labor, of the Complainant's e-mail address to other recipients of the bulk email12 KB (1,601 words) - 15:28, 4 October 2021
- TVP in relation to the infringements of S.40 of the DPA 18 (Security) of the DPA 2018 set out above. 2Further Action Recommended The Commissioner recommends8 KB (949 words) - 18:11, 2 June 2023
- Garante per la protezione dei dati personali (Italy) - 9828987 (section English Machine Translation of the Decision)proceedings from the DPA; and the controller’s cooperation with the DPA during the investigation. Based on the afore-mentioned elements, the Italian DPA imposed41 KB (6,326 words) - 14:38, 20 December 2022
- Garante per la protezione dei dati personali (Italy) - 10013356 (section English Machine Translation of the Decision)Since the controller failed to meet the national specification regarding the processing of personal data in the context of employment, the DPA found violations57 KB (9,035 words) - 19:11, 28 May 2024
- characteristic of him or her, cf. 2. tölul. Article 3 of the Act and point 1. Article 4 of the Regulation. Processing refers to an action or series of actions17 KB (2,548 words) - 17:10, 13 April 2021
- 15(4) GDPR and section 22 of the Danish Data Protection Act. After reviewing the facts of the case, the Danish DPA found that the insurance company had infringed21 KB (3,182 words) - 10:18, 15 September 2021
- First-tier Tribunal - Clearview AI Inc. v ICO (category Article 3(2)(b) GDPR) (section English Machine Translation of the Decision)fell outside the scope of the (UK) GDPR, as Clearview did not monitor the behaviour of people in the EU within the meaning of Article 3(2)(b) (UK) GDPR.99 KB (16,103 words) - 08:41, 25 October 2023
- Garante per la protezione dei dati personali (Italy) - 9909702 (section English Machine Translation of the Decision)brought to the attention of the Guarantor. concerning the use of an application aimed at allowing the total or partial reimbursement of the cost of the motorway81 KB (13,367 words) - 11:39, 2 August 2023
- Datatilsynet (Denmark) - 2021-431-0163 (category Article 58(2)(b) GDPR) (section English Machine Translation of the Decision)with the DPA, the processor itself reported the data breach to the DPA. The DPA then launched an independent investigation. Considering the facts of the26 KB (3,912 words) - 10:46, 22 November 2023
- processing the IP address of the website visitor. The DPA pointed out that the processing of an IP address is inherent in visiting a website and that the cinema28 KB (4,488 words) - 10:44, 31 May 2022
- Datainspektionen - DI-2019-3841 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)accept the view of the Healthcare committee that it was the responsibility of the head of each health department to carry out the analysis. The DPA took91 KB (11,084 words) - 11:43, 7 April 2022
- AEPD (Spain) - PS/00178/2022 (category Article 4(2) GDPR) (section English Machine Translation of the Decision)laws, neither the employees nor the controller's costumers were informed of the hidden audio recordings. The DPA held that the conduct of the controller infringed59 KB (9,122 words) - 14:48, 22 September 2022
- Garante per la protezione dei dati personali (Italy) - 9963509 (category Article 9(2)(j) GDPR) (section English Machine Translation of the Decision)and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such51 KB (7,841 words) - 08:22, 21 December 2023
- HDPA (Greece) - 12/2021 (category Article 58(2)(g) GDPR) (section English Machine Translation of the Decision)and 6 GDPR? The DPA held that the use of the camera by the Company cannot be justified in the light of the principle of proportionality. The camera was18 KB (2,578 words) - 09:51, 12 May 2021
- Garante per la protezione dei dati personali (Italy) - 9998877 (category Article 9(2) GDPR) (section English Machine Translation of the Decision)https://worldcoin.org/, the processing of biometric data is based on the legal basis of the consent of the interested parties which is requested in the face of information24 KB (3,470 words) - 14:50, 10 April 2024
- IP - 07120-1/2020/345 (category Article 9(2)(b) GDPR) (section English Machine Translation of the Decision)Article 58 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing11 KB (1,695 words) - 11:11, 13 January 2021
- that the (named) members of the complainant's board of directors caused the establishment of XXXX GmbH for the purpose of the operative business of "XXXX"18 KB (2,717 words) - 12:08, 5 August 2022
- refusing (free of charge except for the costs of the transmission of the refusal) the use of his contact details for the purposes of such direct marketing42 KB (5,271 words) - 13:44, 23 June 2021
- Garante per la protezione dei dati personali (Italy) - 9827402 (section English Machine Translation of the Decision)of the exercise of a right. First, the DPA held that the controller did not reply to the request for deletion of personal data made by the data subject34 KB (5,373 words) - 10:16, 16 June 2023
- ruling. 2. The complainant's views The complainant considers that the publication of the opinion of the Parliamentary Ombudsman on the website of the Association12 KB (1,686 words) - 13:01, 23 July 2020
- 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of personal data and the free movement of such data;9 KB (1,306 words) - 08:00, 20 September 2023
- examination of AA's appeal. The Court of Appeal stated following. The decision in the supervisory case means that the Privacy Protection Authority 2 6 2 . O D15 KB (1,753 words) - 09:24, 27 November 2023
- as ZVOP-2), on the application of the applicant: ....., dated 21.2.2023, against the decision of the controller: MNZ, Policija, Štefanova ul. 2, 1501 Ljubljana31 KB (4,975 words) - 10:15, 5 December 2023
- IP - 0712-1/2019/2725 (category Article 58(3) GDPR) (section English Machine Translation of the Decision)Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data5 KB (506 words) - 14:45, 17 March 2022
- APD/GBA (Belgium) - 104/2022 (category Article 17(3)(a) GDPR) (section English Machine Translation of the Decision)access to the article was limited to subscribers. The DPA thus found the processing in line with the adequate measures of Article 89 GDPR. The DPA therefore39 KB (5,774 words) - 15:31, 29 June 2022
- findings, the DPA initiated proceedings against the controller. The DPA recalled that Article 33(1) GDPR obliges the controller to inform the DPA of any personal63 KB (10,380 words) - 08:26, 17 October 2023
- UODO (Poland) - DKE.561.23.2020 (category Article 58(2)(i) GDPR) (section English Machine Translation of the Decision)paragraph. 2, art. 103 of the Act of May 10, 2018 on the Protection of Personal Data (Journal of Laws of 2019, item 1781), as well as Art. 58 sec. 2 lit. i)33 KB (5,262 words) - 13:02, 16 June 2021
- to the treatments controlled by the agents of the CNPD. 2 4. During the said visit, the representatives of the inspected confirmed to the agents of the30 KB (4,164 words) - 11:12, 16 June 2021
- between the data subject and the controller, but the actual content of the email exchange was not shared with the APD. Regarding the legal basis of the processing19 KB (2,807 words) - 11:02, 17 April 2024
- Tietosuojavaltuutetun toimisto (Finland) - 2437/161/22 (category Article 58(2)(b) GDPR) (section English Machine Translation of the Decision)The Finnish DPA issued a reprimand against the Ministry of Foreign Affairs for the late notification of a data breach to both the DPA and the data subjects21 KB (3,220 words) - 17:44, 27 April 2022
- ANSPDCP (Romania) - Fine against IAMSAT Muntenia SA (category Article 12(3) GDPR) (section English Machine Translation of the Decision)equivalent of 2,000 euros for violating the provisions of art. 12-13 of the General Regulation on Data Protection; fine in the amount of 4,946.2 lei, the equivalent6 KB (737 words) - 15:50, 1 March 2022
- restrictions on the right of access should only be made on the basis of a specific assessment of the information available at the time of receipt of an access31 KB (4,887 words) - 13:45, 14 July 2022
- DPC (Ireland) - 20.07.2023 (case number redacted) (section English Machine Translation of the Decision)is subject to the Article 12(3) GDPR time limitations. The DPC found that the suspension of the Article 12(3) GDPR was applicable in this instance. Nonetheless14 KB (2,023 words) - 14:34, 5 September 2023
- imposed on the controller. The case was analysed in terms of the criteria for the individualisation of fines set out in Article 83(2) and (3) of the GDPR, in10 KB (1,393 words) - 14:16, 5 September 2023
- deadline, the Data Protection Inspectorate will determine to the addressee of the injunction on the basis of § 51 (3) of the Public Information Act: Extortion42 KB (6,456 words) - 11:36, 22 March 2023
- APD/GBA (Belgium) - 73/2023 (category Article 4(2) GDPR) (section English Machine Translation of the Decision)i.e. the same day the complaint was filed, the Service de Première Ligne (SPL) of the DPA declares the said complaint admissible on the basis of Articles29 KB (4,037 words) - 11:59, 26 June 2023
- applies, the particulars mentioned in paragraph (2)(a) and, if the recipient of the call so requests, those mentioned in paragraph (2)(b). 3, • ICO. Information50 KB (6,389 words) - 10:14, 9 February 2022
- HDPA (Greece) - 13/2021 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)objections to the sending of messages. the complainant provided approval for the sending of informative / promotional SMS 3 at the completion of his transaction22 KB (3,167 words) - 07:59, 14 October 2021
- understand the reason for issuing the invoice. The insurance company indicates that she was not informed of the end of the contract of work between the complainant19 KB (2,672 words) - 07:53, 24 April 2023
- Persónuvernd - 2020010628 (category Article 9(2)(b) GDPR) (section English Machine Translation of the Decision)as it communicated the personal data of the complainant to the municipality. Second, the DPA held that the municipality breached the GDPR (especially Articles24 KB (3,675 words) - 09:19, 28 October 2020
- Tietosuojavaltuutetun toimisto (Finland) - 7587/163/20 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)now implement the right, and 3 ) on what basis the data controller has processed the applicant's data after the end of the customership. The registrar has30 KB (4,753 words) - 19:08, 24 August 2022
- the father of a child. The child is the relevant data subject in the case at hand. The complaint alleged that the principal of the data subject's school13 KB (1,928 words) - 13:08, 5 October 2022
- mentioned in the following ruling. The handling of the case has been delayed due to a great deal of work on the part of the Data Protection Authority.2. When33 KB (5,130 words) - 08:30, 28 September 2021
- Persónuvernd (Island) - Mál nr. 2022050836 (category Article 8(2) GDPR) (section English Machine Translation of the Decision)about the changed purpose of the tachograph before the processing took place. The controller responded to the complaint and told the DPA that the data subject22 KB (3,527 words) - 11:22, 13 December 2023
- regard to the design and content of the entries on the individual therapists, the platform of the first defendants offers a free version on the one hand27 KB (4,141 words) - 14:14, 2 May 2023
- DSB (Austria) - 2021-0.119.956 (category Article 15(2) GDPR) (section English Machine Translation of the Decision)information directly from the registration service of the city of Vienna (Meldeservice - MA 62). The Austrian DPA decided on the complaint of the data subject, represented50 KB (8,021 words) - 15:40, 18 January 2024
- II. FOUNDATIONS OF LAW FIRST. - The purpose of this appeal is the Resolution of December 2, 2018 (PS / 00336/2018), of the Director of the Spanish Data Protection25 KB (3,951 words) - 09:52, 10 September 2021
- Garante per la protezione dei dati personali (Italy) - 0007060 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)Therefore, the DPA dismissed the objection of the excessive storage limitation. Lastly, the DPA stated that data retention period for processing of data from94 KB (14,814 words) - 14:42, 30 April 2024
- ANSPDCP (Romania) - Fine against VODAFONE România S.A. 5 (section English Machine Translation of the Decision)(Article 3(3)(b) of Law no. 506/2004). The violation of the provisions of the GDPR was sanctioned with a fine of approx €1,500 (RON 7,421.25) and the violation8 KB (976 words) - 11:53, 19 November 2021
- Persónuvernd (Island) - Mál nr. 2022050993 (category Article 9(2)(h) GDPR) (section English Machine Translation of the Decision)The Icelandic DPA rejected a complaint about the sharing of medical data by the City of Reykjavík as the exemption under Article 9(2)(h) GDPR applied.30 KB (4,852 words) - 08:56, 30 January 2024
- Garante per la protezione dei dati personali (Italy) - 9925674 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)attribution of responsibility for the alleged violations of the following provisions of the Regulation: 2.1. articles 5, par. 2, 24 and 25 of the Regulation63 KB (9,986 words) - 12:04, 11 October 2023
- Garante per la protezione dei dati personali (Italy) - 9996588 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)waive the hearing initially requested "due to the lack of new elements in the case". 3. The outcome of the investigation. Upon examination of the documentation36 KB (5,693 words) - 11:50, 3 April 2024
- October 2022. Upon the request of the DPA, the data subject provided a statement that they became aware of the violation of the right to secrecy in December47 KB (7,632 words) - 21:00, 10 May 2024
- by the person, (b) subsection (2) or (3) applies. (2) This subsection applies if the contraventiowas deliberate. (3) This subsection applies if the person48 KB (6,084 words) - 16:29, 25 January 2022
- APD/GBA (Belgium) - 01/2022 (category Article 12(2) GDPR) (section English Machine Translation of the Decision)incorrectly refers to 2 and 3 March 2019 as data for the e-mails notifying the activation of the Y portal account resp. the e-mails related to the request for data38 KB (5,715 words) - 13:33, 17 February 2022
- alone, the DPA concluded that processing must have taken place and that the case, consequently, fell within the scope of the GDPR. Secondly, the DPA analysed19 KB (2,935 words) - 12:16, 11 January 2023
- APD/GBA (Belgium) - 26/2024 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal15 KB (2,178 words) - 10:12, 21 February 2024
- NAIH (Hungary) - NAIH-5114-35/2022 (category Article 58(2)(f) GDPR) (section English Machine Translation of the Decision)jacuzzi on the terrace, and 3) the camera facing the patio. With regard to 4) the camera above the reception desk, the DPA found that the controller had146 KB (22,679 words) - 15:52, 3 May 2023
- for violation of the Article 6 of the RGPD, "Legality of the treatment", which indicates in its section 1 the cases in which the processing of third party26 KB (3,947 words) - 10:42, 21 July 2021
- Datatilsynet (Norway) - 20/02319 (category Article 12(3) GDPR)basis. The DPA held that main subject-matter of the contract was the issuance of a credit card, not direct marketing, and that the controller's use of Article36 KB (5,718 words) - 11:25, 22 February 2022
- considering the failure to notify the DPA of the data breach, the DPA found that the controller did not assess the risk to the rights and freedoms of natural80 KB (13,127 words) - 07:57, 14 September 2022
- is a breach of the Act or the GDPR on the basis of complaints made. However, the DPA does not consider itself to be competent to assess the boundaries between40 KB (6,474 words) - 10:13, 6 May 2021
- APD/GBA (Belgium) - 32/2024 (category Article 15(3) GDPR) (section English Machine Translation of the Decision)Article 95, § 2, 3° of the WOG as well as Article 47 of the internal regulations order of the GBA, the parties can request a copy of the file. If one both21 KB (3,062 words) - 07:42, 20 March 2024
- 2020-442-8862, the DPA decided it was the Capital Region responsible for the violation. As the automatic translation of the decision is not very clear on the technical17 KB (2,465 words) - 14:29, 27 July 2022
- Art 17 of the GDPR, paragraph 2). Using the right of deletion in accordance with Article 17 of the GDPR Under the conditions of paragraph one, the data subject22 KB (3,496 words) - 14:10, 12 September 2023
- Garante per la protezione dei dati personali (Italy) - 9582723 (section English Machine Translation of the Decision)prevention of Emilia-Romagna for assessing the claim. Then, the Officer asked for the advisory opinion of the Italian DPA. The Italian DPA agrees with the considerations24 KB (3,805 words) - 13:05, 19 May 2021
- Datatilsynet (Norway) - 20/02376 (category Article 32(2) GDPR) (section English Machine Translation of the Decision)requirements of the Personal Data Act 4.1. The responsibility of the "controller" The "treatment manager" is the one who decides the purpose of the treatment38 KB (5,620 words) - 07:40, 4 October 2021
- ICO (UK) - The Central Young Men’s Christian Association (section English Machine Translation of the Decision)Framework Obligations of the Controller 5. The Central YMCA is a controller for the purposes of the UK GDPR and the DPA, because it determines the purposes and54 KB (7,579 words) - 16:44, 7 May 2024
- processing (Article 4(7) of the Regulation). Data subjects are the employees of the Louis Companies (Article 4(1) of the Regulation). 4.2 The Louis Companies,15 KB (2,128 words) - 10:02, 15 February 2024
- Article 95, § 2, 3° of the WOG as well as Article 47 of the internal regulations order of the GBA, the parties can request a copy of the file. If one both21 KB (3,024 words) - 09:26, 17 April 2024
- NAIH (Hungary) - NAIH-2727-2/2022. (category Article 5(2) GDPR) (section English Machine Translation of the Decision)subject and the DPA with a copy of the initial erasure request. The DPA concluded that the controller, after becoming aware of the DPA’s proceedings, deleted79 KB (12,461 words) - 16:08, 22 June 2022
- reviewed by the DPA and the whether the data subject was informed of result of the examination. The petition was factually and legally reviewed by the DPA and35 KB (5,807 words) - 14:24, 12 October 2022
- com[2], where the complainant has documented Leadwise's placement of cookies before the complainant has accepted or refused to consent to this. 2.2. Leadwise's16 KB (2,345 words) - 10:17, 16 June 2023
- UODO (Poland) - DKN.5131.42.2022 (category Article 34(2) GDPR) (section English Machine Translation of the Decision)aspects of the court's activities. The Court's reference to the previous decision of the DPA was also not applicable. Furthermore, the Court of Appeal in95 KB (15,337 words) - 16:38, 19 March 2024
- showing the addresses of the rest of the recipients to all they. 2.- Description of the procedure established for the submission of this type of communications35 KB (5,473 words) - 05:14, 26 April 2023
- was annulled by the Court of Appeal because the DPA had not sufficiently specified the controller's alleged GDPR infringements. The DPA was also ordered86 KB (12,864 words) - 06:37, 23 February 2023
- consider "the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood87 KB (10,588 words) - 14:32, 16 March 2022
- IDPC (Malta) - CDP/COMP/429/2023 (category Article 2(2)(c) GDPR) (section English Machine Translation of the Decision)therefore the exemption under Article 2(2)(c) GDPR applied. Article 2(2)(c) GDPR states that the GDPR will not apply if the data is processed in the course19 KB (3,039 words) - 14:24, 21 February 2024
- granted. The controller appealed the decision. The Austrian Federal Administrative Court managed the case. The Court upheld the decision of the DPA to deny32 KB (4,943 words) - 06:09, 23 August 2022
- UKSC - Richard Lloyd v Google LLC (2021) UKSC 50 (section English Machine Translation of the Decision)Schedule 1 of the DPA 1998. Section 13 of the DPA 1998 gives individuals a right to compensation from the controller if they suffer damage as a result of a contravention169 KB (26,941 words) - 08:48, 25 November 2021
- the controller €500 for the infringement of Article 58(1) GDPR. First, since the controller never cooperated with the DPA, the Spanish DPA considered the18 KB (2,653 words) - 14:03, 21 February 2024
- position that the claim of the claimant essentially concerns the answer to the question whether or not the provision of personal data by the SVB to the tax authorities19 KB (2,958 words) - 08:33, 14 September 2022
- GDPR, in the opinion of the DPA, should include an assessment of the consequence (e.g. high, medium, low) for the data subjects in case of loss of confidentiality67 KB (10,296 words) - 15:15, 31 January 2024
- Rb. Midden-Nederland - UTR 19/1627 (category Article 55(3) GDPR) (section English Machine Translation of the Decision)concerns the interpretation of the EU law concept of “judicial task” and the assessment of the compatibility of the national interpretation of the concept15 KB (2,242 words) - 09:13, 8 August 2023
- contract, which the use of cameras certainly was not. The DPA also rejected the argument of the controller that the processing of personal data could be based19 KB (2,941 words) - 09:40, 11 January 2023
- also applies for the purposes of PECR(see regulation 2(2) PECRand paragraphs 430 & 432(6) to Schedule 19 of the DPA18). 6. At the time of the alleged contraventioPECRwas63 KB (8,280 words) - 14:53, 2 March 2022
- about the processing of personal data with the DPA. The complaint was accompanied by a copy of the communication log between the data subject and the processor23 KB (3,524 words) - 18:40, 10 June 2023
- Datatilsynet (Norway) - 20/02136 (notification) (category Article 58(2)(i) GDPR) (section English Machine Translation of the Decision)monitor the application of the GDPR on the territory of the Kingdom of Norway. This follows from the Norwegian Personal Data Act Section 20. 3. Facts and77 KB (11,517 words) - 10:36, 22 October 2022
- qualification of the violation of article 5 of the RGPD If confirmed, the aforementioned violation of article 5.1.f) of the RGPD could mean the commission of the26 KB (3,952 words) - 09:44, 14 February 2024
- circumstances. The DPA concluded that the processing that took place went against the stated procedures of the office of the Chief of Police in the capital area30 KB (4,809 words) - 09:52, 9 September 2021
- Garante per la protezione dei dati personali (Italy) - 9817535 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)both the means and the purposes of the processing, as the promotional activity was performed in the name, on behalf of and in the interest of the controller56 KB (8,922 words) - 10:20, 16 November 2022
- declarations of the data providers to the Austrian DPA. The Austrian DPA assessed the documents the respondent provided, and held that the processing of the complainant's33 KB (5,128 words) - 09:43, 2 December 2021
- Garante per la protezione dei dati personali (Italy) - 9856345 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)object to the transfer of data between the controller and company XX. This resulted in a violation of Articles 12(2), 12(3) and 21(2) GDPR. Fourth, the DPA held133 KB (21,637 words) - 07:03, 7 March 2023
- Garante per la protezione dei dati personali (Italy) - 9815745 (section English Machine Translation of the Decision)hall of the building that takes up the space in front of the elevator; two placed on the wall in front of the courtyard at the rear of the building, which31 KB (4,916 words) - 10:32, 26 October 2022
- Paragraph 5 of Art. the provision on the decision of the Directorate of Immigration regarding the expulsion of EEA and EFTA citizens. The letter from the Directorate22 KB (3,406 words) - 10:37, 2 July 2020
- VG Berlin - 1 K 561/21 (category Article 15(3) GDPR) (section English Machine Translation of the Decision)Article 8(2) of the Charter and Article 5(1)(a) GDPR, overrides the interests of the data subject. Furthermore, the court emphasized that the automatic57 KB (9,204 words) - 10:55, 23 November 2023
- relation to Article 13(2)(b) GDPR. The Swedish DPA decided on the basis of Articles 58(2) and 83 GDPR that the Education Board of the City of Stockholm violated10 KB (1,365 words) - 13:53, 25 October 2023
- VG Berlin - 1 K 391/20 (category Article 91(2) GDPR) (section English Machine Translation of the Decision)The Administrative Court of Berlin held that the Berlin DPA is not competent for matters of church taxes because of the special competence of the independent36 KB (5,768 words) - 14:17, 18 May 2022
- UODO (Poland) - DKN.5130.2215.2020 (category Article 28(3)(c) GDPR) (section English Machine Translation of the Decision)account the state of technical knowledge when defining them. The DPA cited the legal doctrine indicating that the need to consider the state of the art may110 KB (17,650 words) - 12:27, 29 April 2022
- Garante per la protezione dei dati personali (Italy) - 9746068 (section English Machine Translation of the Decision)reported in the notice regarding the incomplete confirmation of the Company to the exercise of the rights promoted by the complainant: the itself, in fact22 KB (3,423 words) - 14:22, 2 March 2022
- applies, the particulars mentioned in paragraph (2)(a) and, if the recipient of the call so requests, those mentioned in paragraph (2)(b). (2) The particulars41 KB (6,563 words) - 15:07, 14 July 2021
- Garante per la protezione dei dati personali (Italy) - 9955372 (category Article 9(2)(g) GDPR) (section English Machine Translation of the Decision)for each the name of the employee, the proceeding authority, the reasons for the dispute, the hearing dates and the value of the dispute". 2. The preliminary44 KB (6,633 words) - 15:46, 5 December 2023
- document number 2 a copy of the certificate issued by the indicated agent comercial, Fundraising F2F, S.L., certifying the deletion of the data of the claimant22 KB (3,372 words) - 10:12, 1 July 2021
- Garante per la protezione dei dati personali (Italy) - 9885177 (section English Machine Translation of the Decision)complaint was therefore filed with the Italian DPA. The latter transferred the complaint to the Dutch DPA in the context of the cooperation mechanism envisaged25 KB (3,824 words) - 07:04, 31 May 2023
- ANSPDCP (Romania) - Fine against Vodafone România S.A. 4 (section English Machine Translation of the Decision)Article 32 of the GDPR and Article 3(1) of the Law no. 506/2004. The latter is the transposition of the E-Privacy Directive and additionally to the provisions4 KB (477 words) - 13:23, 2 June 2021
- necessary based on the purpose of the processing. The DPA held that the controller had complied with these principles. As the subject matter of the investigation25 KB (3,986 words) - 08:54, 16 February 2023
- Y [read the respondent] determined the means of treatment consisting of use the data from the list of seniors in the municipality of Z. The Inspection21 KB (2,892 words) - 14:16, 11 August 2021
- Garante per la protezione dei dati personali (Italy) - 9871886 (section English Machine Translation of the Decision)promote the services of Vodafone, where the DPA considered the Company as the processor of Vodafone. The DPA also noted that the contract between the Company80 KB (12,843 words) - 06:02, 26 April 2023
- were notified on the same day. The DPA opened an investigation following the notification of the data breach. The DPA found that the controller violated14 KB (1,992 words) - 20:39, 26 July 2022
- Garante per la protezione dei dati personali (Italy) - 9668051 (category Article 58(2)(d) GDPR) (section English Machine Translation of the Decision)with the Guidelines, through the electronic access point activated at the Presidency of the Council of Ministers"; GIVEN art. 8, paragraph 3, of the decree54 KB (8,704 words) - 13:10, 23 June 2021
- identity." The Spanish DPA forwarded the complaint to the Irish DPA as the main establishment of Facebook in Europe is in Ireland. The Irish DPC forwarded11 KB (1,725 words) - 09:56, 12 November 2021
- related to the GDPR. First, EasyJet told the DPA that they responded to the complainant by 01/04/2022. The DPA pointed out that Article 12(3) GDPR requires52 KB (8,320 words) - 13:18, 14 February 2024
- used for the purposes of a credit rating at the request of the data subject, which is four years from the registration of the information. The company then21 KB (3,273 words) - 10:42, 22 June 2020
- (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data13 KB (1,925 words) - 08:13, 18 May 2022
- 2023 (the day of their response to the AEPD) and 13 February 2023 (the day of a second response to the AEPD) of the requested users (including the controller)43 KB (7,147 words) - 14:51, 28 May 2024
- opinion of the President of the Office for Personal Data Protection, the processing of the Applicant's personal data after the expiry of the aforementioned obligations32 KB (4,998 words) - 09:29, 26 May 2021
- Icelandic DPA held that the Health Inspectorate of the South complied with the provisions of the GDPR when collecting information on the movable property17 KB (2,537 words) - 09:58, 6 May 2021
- Garante per la protezione dei dati personali (Italy) - 9771142 (section English Machine Translation of the Decision)acquire the consent of the data subjects. 2. Violation of articles 37 and 163 Privacy Code, for failure to notify the DPA of the breach. 3. Violation of Article31 KB (5,020 words) - 11:07, 1 June 2022
- NAIH (Hungary) - NAIH-1855-4/2022 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)allowance. The amount of the late fee is the legal interest, which is due to the delay is the same as the central bank base rate valid on the first day of the50 KB (7,405 words) - 13:58, 28 November 2022
- DSB (Austria) - 2021-0.518.795 (category Article 4(2) GDPR) (section English Machine Translation of the Decision)basis of the following evidence assessment: 2.1. The findings with regard to the transmission of the health data in question in the sense of the allegation29 KB (4,581 words) - 10:13, 10 March 2022
- including the unlawful processing of biometric data. At the end of 2021, the Hellenic DPA (HDPA) became aware of the Ministry of Migration and Asylum's (the controller)12 KB (1,511 words) - 16:01, 10 April 2024
- and (c) the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of his contact72 KB (8,623 words) - 10:38, 26 May 2021
- Garante per la protezione dei dati personali (Italy) - 9932951 (category Article 58(2)(i) GDPR) (section English Machine Translation of the Decision)part of that public deed. Hence, the public nature of the will deprived it of any confidentiality, and the photograph of the page of the will and the publication39 KB (6,150 words) - 07:57, 4 October 2023
- requests for the deletion of the information were not answered within a reasonable time. The DPA invited the police to respond to the complaint. The police replied19 KB (3,102 words) - 12:48, 17 January 2024
- Garante per la protezione dei dati personali (Italy) - 9872646 (section English Machine Translation of the Decision)Authority the report of the control, carried out on 2.2.22, by the Guardia di Finanza of Seregno (MB) at the sole proprietorship engaged in the activity37 KB (5,802 words) - 09:38, 16 June 2023
- (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data13 KB (1,970 words) - 16:12, 22 March 2022
- ......3 2.1 Description of the group-wide personal data processing......4 2.1.1 Description of the processing of personal data contained in the behavior103 KB (15,684 words) - 07:17, 12 July 2023
- paragraph 2 point g the inspection has the right to order the deletion of personal data based on Article 17. 11. According to § 27 (2) point 3 of the Administrative12 KB (1,754 words) - 10:51, 3 January 2023
- Garante per la protezione dei dati personali (Italy) - 9909907 (section English Machine Translation of the Decision)activities, the DPA considered that the updated version of the privacy policy provided by the controller clarified the role of the latter in the campaigns122 KB (19,640 words) - 08:16, 3 August 2023
- .............. 25 3.3.2 Assessment of the infringement concerning complaint 2 .......................... 25 3.3.3 Assessment of the infringement concerning96 KB (12,267 words) - 11:43, 7 April 2022
- AEPD (Spain) - 00027-2022 (category Article 24(2) GDPR) (section English Machine Translation of the Decision)towards the access door to the Garage, in the case of of a sidewalk of limited dimensions. Fourth. There is evidence of the presence of several informative16 KB (2,612 words) - 15:47, 6 December 2022
- Garante per la protezione dei dati personali (Italy) - 9954241 (section English Machine Translation of the Decision)Taking all this into account, the DPA issued its final decision on the case. First of all, DPA held that the thesis of the controller included several medical77 KB (12,282 words) - 16:43, 12 December 2023
- IMY (Sweden) - IMY-2022-9109 (category Article 12(2) GDPR) (section English Machine Translation of the Decision)against the controller at the French DPA. Given the cross-border nature of the processing, the Swedish DPA (“Integritetsskydds myndigheten”) made use of the65 KB (7,759 words) - 10:10, 30 April 2024
- Datatilsynet (Norway) - 21/02293 (category Article 58(2) GDPR) (section English Machine Translation of the Decision)deadline for carrying out the orders appears in section 11 of the decision. 3. More about the facts of the case On 15 June 2021, we received a complaint from39 KB (5,691 words) - 08:12, 14 September 2022
- Garante per la protezione dei dati personali (Italy) - 9902472 (section English Machine Translation of the Decision)with the adoption of the Cookiebot platform [...]", which "allows the user to independently manage the verification of the current status of the consent63 KB (10,048 words) - 09:42, 2 August 2023
- follows a closer review of the case and a rationale for the Data Protection Authority's decision. 2. The circumstances of the case 2.1. JP had implemented28 KB (4,202 words) - 17:23, 22 November 2022
- Persónuvernd (Iceland) - Case no. 2021010248 (category Article 17(3)(d) GDPR) (section English Machine Translation of the Decision)purposes The Icelandic DPA rejected the complaint. The DPA held that processing for the benefit of the field of genealogy may rely on the legal basis of Article18 KB (2,641 words) - 10:46, 5 January 2023
- article 83.5.b) of the RGPD. -For the purposes specified in the art. 64.2 b) of Law 39/2015, of 1/10, of the Procedure Common Administrative of Public Administrations28 KB (4,459 words) - 14:26, 24 November 2022
- escort around the area. Among other things, photographs were taken of the guest's cars where the number of the cars was visible. The window of the complainant's20 KB (3,127 words) - 09:53, 14 April 2021
- in the circumstances referred to in paragraph (2)." 5. Regulation 21A paragraphs (2), and (3) provide that: "(2) Those circumstances are where the called43 KB (5,548 words) - 10:45, 28 July 2021
- result in a risk to the rights and freedoms of the data subject and did not notify the DPA or the data subject of the data breach. The DPA held that there61 KB (9,994 words) - 08:37, 14 September 2022
- BlnBDI (Berlin) - 521.11.871 (category Article 58(2)(b) GDPR) (section English Machine Translation of the Decision)2019, the data subject sent the controller an email requesting the controller to erase his data. The controller confirmed the erasure of data on the same12 KB (1,330 words) - 10:52, 30 June 2022
- 2023, the appeal filed was sent to the party claimed within the framework of the provisions of article 118.1 of Law 39/2015, of 1 October, of the Common57 KB (8,604 words) - 15:40, 20 March 2024
- APD/GBA (Belgium) - 63/2024 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)complaint to the Data Protection Authority against defendant. 2. The subject of the complaint concerns the complainant's exercise of the right of access, in33 KB (4,817 words) - 09:49, 15 May 2024
- were completed at the National Court, as in the opinion of the Personal Protection Authority, the content of the dispute was the same as the complaint his15 KB (2,398 words) - 08:50, 3 April 2024
- NAIH (Hungary) - NAIH-3734-15/2023 (category Article 38(2) GDPR) (section English Machine Translation of the Decision)around in the field of view of the cameras placed on the front of the store, monitoring the public area. (3) According to the Applicant's knowledge, the previous48 KB (7,721 words) - 11:09, 10 January 2024
- for the administrative proceedings instituted before the CPLD on the complaint of Mr. I.R. According to the base Article 34, paragraph 3 of the APC, the administrator36 KB (5,922 words) - 08:02, 18 April 2024
- during the investigation, none of these provisions were fulfilled. In the opinion of the DPA, the company has not demonstrated that the aim of securing21 KB (3,334 words) - 10:01, 6 May 2021
- At the moment of the alleged facts, Defendant 1 was the supervisor of the complainant. Defendant 2 was the one alleged controller of the data of the staff28 KB (4,064 words) - 10:29, 13 March 2024
- refers to the need to carry out an assessment of the impact on the processing of personal data due to the monitoring before the processing began. 3. RU's views39 KB (6,287 words) - 17:26, 6 April 2022
- Subject of the proceedings Based on the statements of the responsible parties, the subject of the proceedings is the question of whether the image processing19 KB (2,904 words) - 12:53, 17 April 2024
- Garante per la protezione dei dati personali (Italy) - 9759779 (category Article 58(2)(f) GDPR) (section English Machine Translation of the Decision)paragraph 3, of the Code, which provides that in the event of the dissemination or communication of personal data for journalistic purposes, the limits of the18 KB (2,622 words) - 13:18, 27 April 2022
- Garante per la protezione dei dati personali (Italy) - 9842783 (section English Machine Translation of the Decision)paragraph 5, of the Code, the initiation of the procedure for the adoption of the provisions pursuant to art. 58, par. 2 of the Regulation, given that the publication51 KB (8,159 words) - 00:03, 18 January 2023
- therefore requesting a declaration of a violation of the right to deletion. 2. In the hearing of the parties on July 3, 2020, the complainant submitted in a letter27 KB (4,315 words) - 09:28, 23 February 2024
- ensure an appropriate level of security. The ICO investigated the Exemption within Paragraph 15(1) of Part 2 of Schedule 2 of the Data Protection Act 201879 KB (10,566 words) - 10:48, 7 December 2021
- Datatilsynet (Norway) - 20/02144 (category Article 32(2) GDPR) (section English Machine Translation of the Decision)carrying out the orders appears in section 7 of the decision. 3 More about the facts of the case The background to the case is two notifications of breaches38 KB (5,449 words) - 14:08, 18 January 2023
- creditworthy. 3. The views of Creditinfo Lánstraust hf. Regarding the part of the complaint concerning the preparation of a credit rating of the complainant65 KB (10,686 words) - 09:50, 3 March 2021
- APD/GBA (Belgium) - 141/2023 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)guarantor of the confidentiality of personal data of members of the section within the meaning of article 21, §3 of the statutes of the local sections of the23 KB (3,548 words) - 23:16, 11 December 2023
- matter of the complaint Based on the submissions of the parties, the subject of the complaint in these proceedings is the question of whether the respondent28 KB (4,091 words) - 05:23, 14 August 2021
- Garante per la protezione dei dati personali (Italy) - 9873408 (section English Machine Translation of the Decision)access to the contact details of the recipients of the marketing messages. The Italian DPA rejected the arguments of the submission. According to the materials46 KB (7,332 words) - 13:27, 3 May 2023
- solve it. The Belgian DPA considered that the disclosure of the personal data of the Complainant to the Third Party was made in breach of the principles22 KB (3,222 words) - 09:51, 29 November 2021
- AZOP (Croatia) - Decision 23-03-2023 (category Article 12(2) GDPR) (section English Machine Translation of the Decision)2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals in connection with the processing of personal24 KB (3,725 words) - 16:01, 28 November 2023
- provisions of article 57 of the Law 39/2015, of October 1, of the Common Administrative Procedure of the Administrations Public (hereinafter, LPACAP) the director46 KB (7,089 words) - 14:00, 29 March 2023
- Despite been notified of the complaint, the Landlord did not respond to the DPA request. The DPA first confirmed that the rental of a property or part thereof23 KB (3,550 words) - 10:03, 18 October 2023
- Garante per la protezione dei dati personali (Italy) - 9938463 (section English Machine Translation of the Decision)Hence, the DPA found a breach of Article 5(1)(a) GDPR and Article 5(1)(d) GDPR. Additionally, the DPA found that the controller sent the results of the PCR73 KB (11,856 words) - 13:54, 25 October 2023
- processing of the personal data was automated. Thus Article 2(1) GDPR applies and the processing falls within the scope of the GDPR. The DPA assessed that43 KB (5,076 words) - 09:32, 21 November 2023
- Garante per la protezione dei dati personali (Italy) - 9815947 (category Article 12(3) GDPR) (section English Machine Translation of the Decision)duration of the infringement, the degree of responsibility, and the manner in which the DPA became aware of the infringement, the DPA fined the controller63 KB (10,108 words) - 14:38, 25 October 2022
- accordance with the provisions of the Title VII, Chapter I, Second Section, of the LOPDGDD, being aware of the following extremes of the claimed party:81 KB (12,762 words) - 12:51, 29 November 2022
- ANSPDCP (Romania) - Fine against S.P.E.E.H. Hidroelectrica S.A. (category Article 32(2) GDPR) (section English Machine Translation of the Decision)fine in the amount of 24,739.50 lei, the equivalent of 5,000 EURO, for violating the provisions of art. 32 para. (1) lit. b) and para. (2) of the RGPD; &6 KB (708 words) - 17:20, 3 November 2021
- over the former employee's access rights. In summer 2021, the Danish DPA conducted inspections in selected municipalities. The DPA focused on the municipalities'20 KB (2,922 words) - 12:53, 18 May 2022
- Garante per la protezione dei dati personali (Italy) - 9864063 (category Article 25(2) GDPR) (section English Machine Translation of the Decision)storage of the content of text messages sent, in 2021 the DPO of a client company requested the intervention of the Italian DPA. As a result, the Italian DPA152 KB (24,743 words) - 14:39, 21 March 2023
- reflects the degree of difficulty of the 2019 Exam in relation to the degree of difficulty of the corresponding Exam of 2017, i.e. the Exam which is the reference53 KB (8,451 words) - 22:10, 28 February 2024
- with the provisions of Article 7 of Decree 278/1993, of 9 November, on the sanctioning procedure for application to the areas of competence of the Generalitat22 KB (3,269 words) - 17:08, 30 March 2022
- OVG Rheinland-Pfalz - 10 A 10302/21 (category Article 4(2) GDPR) (section Scope of Application of the GDPR not Opened)58(2)(f) GDPR does not authorise the ordering of the dismantling of a (decommissioned) camera. In the court's opinion, the scope of application of the31 KB (4,797 words) - 10:46, 27 July 2021
- Garante per la protezione dei dati personali (Italy) - 9921112 (category Article 5(2) GDPR) (section English Machine Translation of the Decision)and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such87 KB (13,867 words) - 13:11, 28 September 2023
- Garante per la protezione dei dati personali (Italy) - 9979112 (section English Machine Translation of the Decision)details to the DPA. Considering the findings, the DPA informed the controller of the start of a sanctioning procedure under Article 58(2) GDPR. The DPA also34 KB (5,295 words) - 10:52, 21 February 2024
- CNPD (Portugal) - Deliberaçao 2024/137 (category Article 7(3) GDPR) (section English Machine Translation of the Decision)attached to the case file). Cf. Reply to the CNPD, set out in points 2 and 3 of Part III and in the clarification to question 2 of the Annex to the Reply. Cf49 KB (7,923 words) - 14:36, 3 April 2024
- submitted his complaint at the Bulgarian DPA. The Bulgarian DPA does not mention Article 6 GDPR, despite the fact the DPA mentions that the controller does not29 KB (4,826 words) - 14:14, 6 February 2023
- processor in the debt position system. The DPA held that the processing of financial data is considered personal data and falls under the authority of the DPA.24 KB (3,629 words) - 09:57, 16 June 2023
- Garante per la protezione dei dati personali (Italy) - 9880317 (category Article 58(2)(d) GDPR) (section English Machine Translation of the Decision)lit. a) of the Regulation and of the art. 130 of the Code, since the sending of promotional communications via e-mail was carried out without the consent40 KB (6,513 words) - 13:47, 3 May 2023
- amount of the fine, the DPA took into account, among other factors, the small size of the company and the limited number of data subjects affected (1), as20 KB (3,078 words) - 14:26, 24 November 2022
- disclosure of the complainant's social security number falls within the scope of section 11, subsection 1 of the Data Protection Act. 2, no. 3, according12 KB (1,761 words) - 13:52, 25 April 2023
- purposes. The use of the personal data was also solely authorised for this purpose by the Ministry of Interior. The DPA was of the opinion that the controller120 KB (19,907 words) - 10:48, 9 November 2022
- arguing that the Austrian DPA transferred the complaint to the AEPD when pursuant to Article 60(8) GDPR, the Austrian DPA should have been the DPA to adopt31 KB (4,895 words) - 11:51, 2 May 2024
- retained on the basis of § 47 after the expiry of the time limits specified in subsections 1–6 of § 47, unless the legislation regulating the relevant field12 KB (1,460 words) - 10:11, 11 January 2023
- ruling by the Constitutional Court of Belgium and pending the decision on the appeal to the Administrative Law Division of the Council of State (the Division)19 KB (2,970 words) - 16:16, 10 March 2022
- Datatilsynet (Norway) - 20/01893 (category Article 9(2) GDPR) (section English Machine Translation of the Decision)letter c and e and the requirement of necessity pursuant to Article 6 no. 1, cf. Article 9 No. 2. 2. Description of the deviation The deviation report states40 KB (5,895 words) - 15:30, 12 January 2022