Information background As part of its priority topic of investigation on commercial prospecting in 2022, the CNIL focused on the practices of professionals in the sector, in particular those who resell data, including many intermediaries in this ecosystem, known as data brokers. On this occasion, the CNIL decided to initiate

Denmark's data protection authority, Datatilsynet, ruled school districts cannot pass on student information to help Google maintain and improve its services or for measuring performance of new functions in its Chrome products. The data can be passed on to help provide the service and improve its security, as well as

The essentials AMAZON FRANCE LOGISTIQUE manages the AMAZON group's large warehouses in France, where it receives and stores items and then prepares parcels for delivery to customers. As part of its activities, each warehouse employee is given a scanner to document the performance of certain tasks assigned to them in

Background information YAHOO EMEA LIMITED publishes several web services such as a search engine and an e-mail service. The CNIL received 27 complaints reporting the failure to take into account the refusal of cookies and the obstacles encountered in withdrawing consent to the deposit of cookies. In October 2020 and

The Netherlands data protection authority, Autoriteit Persoonsgegevens, announced a fine for credit card company International Card Services. The AP fined the company 150,000 euros for allegedly not conducting a data protection impact assessment before processing the personal data of 1.5 million customers.Full story https://iapp.org/news/

Belgium's Data Protection Authority announced an administrative fine of 174,640 euros to data management company Black Tiger Belgium. The ADP enforced three administrative fines after Black Tiger Belgium allegedly violated the EU General Data Protection Regulation by not being transparent about the company's data processing of personal data.Full

The European Data Protection Board published a guide to EU General Data Protection Regulation one-stop-shop cases concerning security of data processing and data breach notification. The digest, which covers enforcement actions under Articles 32, 33 and 34 of the GDPR, aims to offer "insights on how DPAs have interpreted and

Norway's data protection authority, Datatilsynet, announced a NOK20 million fine issued to the Norwegian Labour and Welfare Administration. A Datatilsynet investigation found the agency's system measures "are not satisfactory to ensure compliance with the privacy regulations, and that the safeguarding of confidentiality in the IT systems is also not satisfactory.

Croatia's Personal Data Protection Agency fined debt collection agency EOS Matrix 5.47 million euros for alleged EU General Data Protection Regulation violations. A complaint filed with the AZOP in March claimed the agency processed the data of a large number of individuals without authorization, including 294 minors. Among its

On September 15, 2023, the Irish Data Protection Commission announced a fine of 345 million Euros against TikTok Technology Limited for non-compliance with GDPR rules regarding the processing of personal data from child users.  Continue Reading https://www.huntonprivacyblog.com/2023/09/22/irish-regulator-fines-tiktok-345-million-euros/

The EDPB adopted a dispute resolution decision on the basis of Art. 65 GDPR concerning a draft decision of the Irish Data Protection Authority (DPA) regarding TikTok Technology Limited (TTL). The binding decision addresses legal questions arising from objections to the draft decision of the Irish DPA as lead supervisory

On 31 December 2021, in addition to imposing a fine of 150 million euros, the CNIL's restricted committee ordered GOOGLE LLC and GOOGLE IRELAND LIMITED to allow users of the websites google.fr and youtube.com located in France to refuse the cookies placed on their terminal as easily as

Norway's data protection authority, Datatilsynet, issued informal guidance notes on the use of website analytics and tracking tools under the EU General Data Protection Regulation. Datatilsynet outlined nine areas of consideration for companies exploring tools, including data minimization, avoiding cookie banners and potential cross-border data transfers.Full story https://iapp.

With its “sandbox”, the CNIL helps innovative actors to understand the regulation of personal data protection, to apply it to their projects and, above all, to integrate GDPR compliance from the design of their solutions (“privacy by design”). For its first two editions of the “sandbox”, the CNIL has accompanied

France's data protection authority, the Commission nationale de l'informatique et des libertés, launched a new economic analysis team to promote a better understanding of the data protection ecosystem and the regulations by which it operates. The team will conduct impact studies, sectoral analyses and quantitative work to better inform CNIL

Mar España Martí, director of Spain's data protection authority, detailed current points of focus for the Agencia Española de Protección de Datos during a meeting at Menéndez Pelayo International University. Martí discussed children's privacy considerations, artificial intelligence's data protection impacts and the current need for increased resources to support the

The Garante per la protezione dei dati personali (‘GPDP’) submitted a request for clarification to MG Freesites Ltd, the Cypriot company that manages the Pornhub site, regarding the Italian version of the site.  Further to a complaint lodged by a user, the Authority intends to shed light on a number

All four companies have based their decisions on the transfer of personal data via Google Analytics on standard contractual clauses. From IMY's audits, it appears that none of the companies' additional technical security measures are sufficient. IMY issues an administrative fine of 12 million SEK against Tele2 and 300,000

Italy's data protection authority, the Garante, fined Rome's city council and third-party property management firm Ama a combined 415,000 euros over privacy violations related to sensitive data breaches of individuals who have undergone abortions. The Garante found the city council was allowing the Ama to disclose the names of

Background information CRITEO specialises in “behavioral retargeting”, which consists of tracking the navigation of Internet users in order to display personalised advertisements. To this end, the company collects the browsing data of Internet users thanks to the CRITEO tracker (cookie) which is placed on their terminals when they visit certain

Brussels, 21 June - During its latest plenary, the EDPB has adopted a template complaint form to facilitate the submission of complaints by individuals and the subsequent handling of complaints by Data Protection Authorities (DPAs) in cross-border cases. EDPB Chair, Anu Talus said: “The template is one of the commitments

The U.K. Information Commissioner's Office fined two energy companies a combined GBP250,000 for making illegal marketing phone calls to citizens and entities on the country's 'do not call' register. Maxen Power Supply and Crown Glazing were fined GBP120,000 and GBP130,000, respectively. France's data protection authority, Commission

The U.K. Information Commissioner's Office called on businesses leveraging generative artificial intelligence tools "to address the privacy risks" while announcing "tougher checks on whether organisations are compliant with data protection laws." ICO Executive Director of Regulatory Risk Stephen Almond said at Politico's Global Tech Day that companies must consider

The Personal Data Authority ("the AP") contacted OpenAI, the developer of ChatGPT, because the AP is concerned about the way the chatbot is trained. Indeed, the large quantities of data fed to the self-learning algorithm may contain personal data. The AP is tasked with enforcing the General Data Processing Regulation

Sweden's data protection authority, the Integritetsskyddsmyndigheten, fined Spotify SEK58 million for alleged EU General Data Protection Regulation violations related to transparency. The IMY found Spotify responds to data access requests but "does not inform clearly enough about how this data is used by the company." The regulator added Spotify needs