Search results

controller. At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time

the records are meant to show the status of Peter at the time where he was at the hospital in 2016. At the same time, as Peter has moved to a new address

necessary. Data subjects can (at least theoretically) make informed decisions about the use of a service or product, or at least exercise their rights under

wording, that tries to camouflage the processing, or aims at marketing purposes rather than at providing a plain explanation, would violate this provision

authorities addressed to the public should include specific measures directed at controllers and processors, including micro, small and medium-sized enterprises

subject, at the latest at the time of the first communication to that data subject; or (c) if a disclosure to another recipient is envisaged, at the latest

to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability

decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as

remuneration, at a distance, by electronic means and at the individual request of a recipient of services.” The same article clarifies that "at a distance"

the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement

first newspaper can at least directly inform the major news outlets where the news appeared. In fact, it is very simple to verify, at least within the narrow

binding. 3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing

evaluated, in particular analysing or predicting aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability

existence of one or more infringement(s) necessarily implies the existence of (at least) a sanctionable "conduct". According to the EDPB, the difference between

personal data breach. 3. The notification referred to in paragraph 1 shall at least: (a) describe the nature of the personal data breach including where

movement of personal data within the Union. 7. The assessment shall contain at least: (a) a systematic description of the envisaged processing operations

evaluated, in particular analysing or predicting aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability

the nature of processing and the information available to the processor; (g) at the choice of the controller, deletes or returns all the personal data to

DPA for 2019 can be consulted at: https://www.autoriteprotectiondonnees.be/publications/rapport-annuel-2019.pdf (FR) and at https://www.gegevensbeschermingsautoriteit

safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller