Sweden's data protection authority, the Integritetsskyddsmyndigheten, fined Spotify SEK58 million for alleged EU General Data Protection Regulation violations related to transparency. The IMY found Spotify responds to data access requests but "does not inform clearly enough about how this data is used by the company." The regulator added Spotify needs

Italy's data protection authority, the Garante, called on TikTok to explain reports of its personal data being accessed by the Communist Party of China. The Garante gave the company 15 days to produce a response to the reports and outline how Italian and EU users' data is protected from alleged

During its latest plenary, the EDPB adopted a final version of the Guidelines on the calculation of administrative fines following public consultation. These guidelines aim to harmonise the methodology data protection authorities (DPAs) use to calculate fines and include harmonised ‘starting points’. Hereby, three elements are considered: the categorisation of

EDPS Wojciech Wiewiórowski attended ENISA's Annual Privacy Forum where he delivered a keynote speech on Artificial Intelligence and Data Protection. Read Speech.Read Closing Remarks of the CPDP Conference 2023.The EDPS and the German BfDI, and the Bavarian BayLDA organise the high-level event: “5th Anniversary of the GDPR: Still

The Berlin Commissioner for Data Protection and Freedom of Information fined an unnamed bank 300,000 euros for violating transparency obligations under the EU General Data Protection Regulation in an automated decision rejecting a credit card application. "When companies make automated decisions, they are obliged to justify them in a

On December 19, 2022, MICROSOFT IRELAND OPERATIONS LIMITED was fined 60 million euros by the CNIL's restricted committee, the body responsible for imposing sanctions. It also required the company, within three months, to allow users of "bing.com" located in France to give their consent to the use of tracers

The EDPB has elected Anu Talus as the new Chair of the European Data Protection Board (EDPB) to replace outgoing Chair Andrea Jelinek. She was elected with 19 votes out of 27, in two rounds. Anu Talus is the head of the Finnish Data Protection Authority (DPA), a function she

France's data protection authority, the Commission nationale de l'informatique et des libertés, published its 2022 annual report. Among the highlights, the CNIL said for the first time since the EU General Data Protection Regulation entered into force, it handled more complaints — 13,160 — than it received — 12,193. The CNIL

Finland's Office of the Data Protection Ombudsman ordered the Finnish Meteorological Institute to halt EU-U.S. data transfers using Google Analytics and Google's reCAPTCHA. The ombudsman ruled the institute had no legal basis for processing to facilitate data flows and continued transfers based on cookie consent despite the invalidation of

Brussels, 22 May - Following the EDPB’s binding dispute resolution decision of 13 April 2023, Meta Platforms Ireland Limited (Meta IE) was issued a 1.2 billion euro fine following an inquiry into its Facebook service, by the Irish Data Protection Authority (IE DPA). This fine, which is the

Cyprus' Commissioner for Personal Data Protection Irini Loizidou Nikolaidou announced the completion of 30 audits regarding the use of cookies by news and public information websites. Nikolaidou said some websites did not disclose the purposes of using cookies, while others that did provide that information did not receive users' express

Clearview AI data use deemed illegal in Austria, however no fine issued The Austrian DPA has decided: Clearview AI, the company that sells facial recognition software to law enforcement agencies in the U.S. is no longer allowed to process biometric data. https://noyb.eu/en/clearview-ai-data-use-deemed-illegal-austria-however-no-fine-issued

Background information CLEARVIEW AI collects photographs from a wide range of websites, including social networks, and sells access to its database of images of people through a search engine in which an individual can be searched using a photograph. The company offers this service to law enforcement authorities. Facial recognition

France's data protection authority, the Commission nationale de l'informatique et des libertés, announced Clearview AI is required to pay a 5.2 million euro penalty for delayed compliance with a prior order from the regulator. Clearview received a 20 million euro fine over EU General Data Protection Regulation violations from

European Data Protection Supervisor Wojciech Wiewiórowski published his Annual Report 2022. International data transfers continued to be a priority in 2022, while the EDPS offered guidance and expertise on health, artificial intelligence and other areas. Wiewiórowski said he is proud of the office's "dedication to make the fundamental right to

Denmark's data protection authority, Datatilsynet, published a questionnaire circulated to gauge competencies of municipal data protection officers. The regulator pulled the curtain back on its questions after "a number of inquiries from citizens, companies and public authorities who are interested in the questions asked in the investigation." Lithuania's State Data

Italy's data protection authority, the Garante, fined a digital marketing services company 300,000 euros for allegedly illegally processing users' personal data for marketing purposes. The Garante said the company's online portals used dark patterns to entice users "to pay consent to the processing of data for marketing purposes and

The Personal Data Authority (AP) is fining the Social Insurance Bank (SVB) 150,000 euros for inadequate identity verification by the telephone helpdesk. Clients with AOW benefits ran the risk that sensitive information would end up with people who are not entitled to it. The SVB has since taken measures.

Austria’s Data Protection Authority ruled in favor of privacy advocacy group NOYB's complaints against multiple Austrian newspapers, Euractiv reports. In 2021, NOYB lodged complaints against seven Austrian and German news organizations for their use of cookie paywalls and the resulting "disproportionate cost between subscription fees and data sharing." The

The Czech Republic's data protection authority, Úřad pro ochranu osobních údajů, fined cybersecurity software company Avast 13.7 million euros for allegedly illegally processing consumers' data. Consumer rights organization FACUA, which filed a complaint against the company in 2020, said users could have been identified through private browsing data collected

Norway's data protection authority, the Datatilsynet, fined U.S.-based Argon Medical Devices 2.5 million kroner for failing to report a July 2021 data breach within the 72-hour deadline required by the EU General Data Protection Regulation. "This case is an important reminder that data controllers — including those established

On 15 March 2023, the French Supervisory Authority (the “CNIL”) unveiled in a post its four key priorities regarding its upcoming investigations for 2023 targeting specific sectors (I), to which it added another topic related to DPO in line with the coordinated enforcement framework of the European Data Protection Board

Data protection officers could be "solicited" by their data protection authority in the "weeks and months to come" as part of the European Data Protection Board’s freshly launched 2023 coordinated enforcement action, Deputy Head of the EDPB Secretariat Gwendal Le Grand told DPOs at the IAPP Data Protection Intensive:

In reaction to the invalidation of the Privacy Shield in July 2020 by the Court of Justice of the European Union (CJEU), US President Joe Biden adopted on 7 October 2022 a new legal framework (Executive Order) to strengthen safeguards on the collection and use of personal data by US

On February 28, 2023, the European Data Protection Board issued its Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU-U.S. Data Privacy Framework.  Continue Reading https://www.huntonprivacyblog.com/2023/02/28/edpb-issues-its-opinion-on-the-eu-u-s-data-privacy-framework/