Supervisory Authorities

A collection of 82 posts

Supervisory Authorities

EDPB guidance on deceptive designs and EU data imports final

Two guidelines from the European Data Protection Board (EDPB) are now final. These are the guidelines on deceptive designs ("dark patterns") on social media and the guidelines on the rules when importing data from the European Union (EU).The guidelines were drafted in 2021 and 2022 by the Personal Data

Supervisory Authorities

Danish DPA issues cookie wall guidance

Denmark's data protection authority, Datatilsynet, published guidance on cookie wall deployment in the wake of two relevant decisions. The regulator provided summaries of its findings in its latest decisions to outline takeaways for ongoing best practices, noting companies "should take note" if they "wish to use a similar approach or

Supervisory Authorities

Tesla makes camera settings more privacy-friendly after AP investigates

Car manufacturer Tesla has made the settings of its built-in security cameras in cars more privacy-friendly. Tesla did this after the Personal Data Authority (AP) instituted an investigation into those cameras.The AP was investigating Tesla's so-called "Sentry Mode. Sentry Mode is supposed to protect the car from theft or

Supervisory Authorities

EDPB publishes 2023-2024 Work Programme

The European Data Protection Board released its 2023-2024 Work Programme, which takes from the priorities laid out in its 2021–2022 strategy. Notably, the program features "guidance to support and encourage Data Protection Authorities to use of the full range of cooperation tools at their disposal." The focus comes as

Supervisory Authorities

Artificial intelligence powered chatbot banned by the Italian privacy authority

The Italian privacy authority (the Garante) ordered the provisional restriction to the processing of personal data of Italian users of a chatbot owned by a U.S. company and powered by an artificial intelligence system. The Garante intervened after learning from recent press reports of some tests conducted on the

Supervisory Authorities

AI: ensuring GDPR compliance

ps must be carried out in compliance with the principles of the French Data Protection Act and the GDPR. The purpose of the AI system must be established at the design stage, and it must be legitimate and clear. Respect for this principle is especially important when large amounts of

Supervisory Authorities

German state DPA releases 2022 data protection activity report

The Baden-Württemberg Commissioner for Data Protection and Freedom of Information released its data protection activity report for 2022. Research and health data was a key focus during the year, with the LfDI providing “intensive advice in order to strengthen the trust of citizens in how researchers handle their data and

Supervisory Authorities

Garante investigates use of cookie walls

The Garante notes that the European legislation on the protection of personal data does not in principle preclude the owner of a site from making access to content by users subject to their consent for profiling purposes (through cookies or other tracking tools) or, alternatively, to the payment of a

Supervisory Authorities

ICO fined construction company 4.4M GBP fine over employee privacy violations

The U.K. Information Commissioner's Office fined construction company Interserve Group 4.4 million GBP over alleged employee data protection issues. The ICO found insufficient security measures that left 113,000 Interserve employees exposed to a phishing scheme that affected contact information, national insurance numbers, and bank account information. Information

Supervisory Authorities

European regulators are finalizing a decision blocking Meta from transferring data to the US

“Based on the facts of the case, we do not see how [Meta] could have continued its personal data transfers following the Schrems II judgment had it acted in accordance with the GDPR,” the Norwegian objection reads. https://www.politico.eu/article/norway-wants-facebook-to-be-fined-for-illegal-data-transfers/

Supervisory Authorities

Danish SA reprimanded Region Syddanmark for not having sufficiently clear processor auditing procedures

The DPA (SA) highlighted that entering into a data processing agreement that contains security obligations is not sufficient, and that the controller must also oversee that the processor actually adheres to the agreement. The fact that the controller had auditing procedures in place was not good enough if these auditing

Supervisory Authorities

The SA of Lower Saxony fined a bank EUR 900k for profiling enriched with third-party data for advertising purposes based on legitimate interests

The DPA [SA] of Lower Saxony fined a bank €900,000 for creating customer profiles, enriched with third-party data, for advertising purposes, without consent. The DPA held that such processing cannot be based upon legitimate interest https://gdprhub.eu/index.php?title=LfD_(Lower_Saxony)_-_Fine_EUR_900,000_

Supervisory Authorities

The Icelandic SA held that a there is a conflict of interest when a DPO is simultaneously also a company's senior lawyer

The Icelandic DPA (SA) held that a there is a conflict of interest when a DPO is simultaneously also a company's senior lawyer, deputy CEO or board member. However, a DPO can hold the position of compliance officer. https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_(Iceland)_-_2020061979&

Supervisory Authorities

The Belgian SA held that a controller can rely on legitimate interest for direct marketing to former customers if the relationship ended 'not that long ago'

The Belgian DPA (SA) held that a controller can rely on legitimate interest as a legal basis to send former customers direct marketing if the relationship ended 'not that long ago' and the data subject did not object to this processing. https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)

Supervisory Authorities

Danish SA temporarily suspended its processing ban for Google Workspace ordered to change the data processing agreement with Google

Danish DPA temporarily suspended its processing ban against Helsingor municipality for the use of Google Chromebooks and Workspace for Education until 5 November 2022 and, amongst other things, ordered them to change their data processing agreement with Google. The SA ordered the same to the Aarhus municipality for using Google

Supervisory Authorities

Danish SA: fine of of approx. EUR 67k for a law firm hit by ransomware for its insufficient security safeguards

The Danish DPA held that the law firm lacked basic security measures, especially considering the fact that its processing involved special categories of personal data. The DPA emphasized that in such cases a data breach would almost certainly entail a high risk to the data subjects' rights. Therefore, the controller

Supervisory Authorities

The Italian SA acted against a municipality due to the use of its video surveillance system and by appointing its DPO to defend it in court proceedings

Lastly, the DPA held that the controller, by entrusting its DPO with its defence in court proceedings, placed the DPO in a position of conflict of interest in violation of Article 38(6) GDPR. This was especially because it led to the data subject feeling unable to contact the DPO

Supervisory Authorities

The Belgian SA held that discussing a data subject's health in a staff meeting where she was absent and documenting this in the minutes of the meeting does not have a legal basis

The Belgian DPA (SA) held that discussing a data subject's health-related personal data in a staff meeting where she was absent and consequently including the data in the minutes of the meeting was incompatible with the purpose of the original processing (personnel management) and did not have any other legal

Supervisory Authorities

AP is zeer kritisch op de nieuwe voorgenomen FSV-verwerking door de Belastingdienst

https://www.tweedekamer.nl/downloads/document?id=2022D33681

Supervisory Authorities

The Spanish SA fined an individual EUR 10k for doxing a person on an online blog

The Spanish DPA (SA) fined an individual 10,000€ for publishing personal data of a third person without their consent on an online blog. https://www.aepd.es/es/documento/ps-00134-2022.pdf https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_PS-00134-2022&mtc=today

Supervisory Authorities

Greek SA fines Clearview AI for EUR 20M

A rundown of the fine on IAPP: https://iapp.org/news/a/a-rundown-of-the-greek-dpas-clearview-ai-fine-findings https://iapp.org/news/a/greek-dpa-imposes-20m-euro-fine-on-clearview-ai-for-unlawful-processing-of-personal-data

Supervisory Authorities

ICO finds multiple public, private entities 'repeatedly' failed to meet SAR deadlines

The U.K. Information Commissioner’s Office issued reprimands and practice recommendations for seven public and private entities for failure to respond to subject access requests. The entities included the Ministry of Defence, the Home Office, Kent police and Virgin Media. The ICO found the organizations “repeatedly failed" to meet

Supervisory Authorities

TikTok faces potential 27M GBP fine from ICO

The U.K. Information Commissioner's Office announced a notice of intent to fine TikTok 27 million GBP for alleged U.K. data protection violations. The ICO's investigation found potential violations concerning nonconsensual processing of minors' data, unlawful processing of special category data and insufficient transparency. https://iapp.org/news/a/

Supervisory Authorities

Berlin DPA imposes 525K euro fine over DPO violation

The Berlin Commissioner for Data Protection and Freedom of Information issued a 525,000 euro fine to a Berlin-based retailer for violation of data protection officer requirements under the [GDPR]. An investigation found an alleged conflict of interest concerning the DPO's employment status and decision-making responsibilities that violated Article 38(

Supervisory Authorities

Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures

The Danish Data Protection Agency has looked into the tool Google Analytics and its settings, and the terms under which the tool is provided. On the basis of this review, the Danish Data Protection Agency concludes that the tool cannot, without more, be used lawfully. Lawful use requires the implementation