Search results

freedoms of individuals", as stated in Article 35(1) and further elucidated in Article 35(3) and Article 35(4) GDPR. The WP29 developed a list of criteria

to Article 35(7)(d) GDPR has been conducted, if applicable; and the technical and organizational measures put in place pursuant to Article 32 GDPR. However

See, Article 35(7)(a) GDPR. Furthermore, the DPO will need to act as contact point throughout the consultation process. See Article 39(1)(e) GDPR. With

in line with the GDPR. Further, the DPA held that the new documentation is not in line with Article 35(1) and 35(7), as well as Article 36(1). Thus, the

under Article 35(7) GDPR, for not complying with the principle of transparency under Article 5(1) GDPR and for not anonymising the data under Article 25(1)

that Article 36(1) GDPR provides for a duty to consult if two conditions are met. First, a data protection impact assessment under Article 35 GDPR must

especially: 1) Violation of article 4.11 GDPR read in conjunction with article 6.1 a) GDPR as well Articles 7.1 and 7.3 GDPR: the Inspection Service determines

carried out before (Article 35(1) of the GDPR) and was not carried out in a manner that complied with the criteria of Article 35(7), which considerably

and thus failed to fulfil its obligations under Article 5(1) GDPR, Article 24(1) GDPR and Article 28(1) GDPR. Second, the DPA found that, since the data processing

United Kingdom Relevant Law: Article 5(1)(a) GDPR Article 6(1)(f) GDPR Article 9(2) GDPR Article 35(3) GDPR Article 35(7) GDPR Section 8 Data Protection Act

13(2)(e), 35(1), 35(3) and 35(7)(b) GDPR. It also fined the medical service €20,000 for violation of Articles 5(1)(c), 6(1)(e), 9(2)(g), 35(3) and 35(7)(b) GDPR

be equivalent to a DPIA under Article 35 GDPR. For this reason, the AP held that the controller violated Article 35(1) GDPR. In this, the AP considered it

Articles 32(1) and 32(2) GDPR. The DPA also identified a breach of Article 35(1), Article 35(2), Article 35(3) and Article 35(7) GDPR since, even though the

2016/679 Article 25 (1), Article 32 (1) and (2), Article 33 (1) and (5), Article 34 (1), Article 35 (1) and (7), Article 35 (3) (b), Article 58 (2), Article

the meaning of Article 9 of the GDPR must indeed be based on Article 9.2 of the GDPR, read in conjunction with Article 6.1 of the GDPR. 24 This has been

Articles 4(11), 6(1)(a), 7 and 8 GDPR. For the definition of 'consent', see the more commentary under Article 6(1)(a) GDPR and Article 7 GDPR. For the definition

provided for in Article 6(1)(a) GDPR or, as the case may be, Article 9(2)(a) GDPR, and consent is withdrawn according to Article 7(3) GDPR, data must be

of enforcing the GDPR in Spain. Its head office is in Madrid. The requirement to have a data protection authority stems from Article 44 of the Spanish

further details see Article 14(1)(d) GDPR. Similar to the ex-ante information in Article 13(1)(e) and 14(1)(e) GDPR, Article 15(1)(c) GDPR requires the controller

are dealt with in Article 12(6) GDPR. It is unclear why Article 12(2) GDPR refers to Articles 15 to 22 GDPR, while Article 11(2) GDPR only refers to Articles