Rie Aleksandra - DPO Hub (Page 11)

EDPB Guidelines 1/2024 Legitimate interests (public consultation)

members – 4 min read

The EDPB's recent new legitimate interest guidelines are on public consultation until 20 Nov 2024. Initial analysis: 📝 Document, document, document.

Oct 28, 2024

EDPB Opinion 22/2024: obligations when relying on (sub-)processors

members – 8 min read

📚 You must list all (sub-sub-sub-sub...)processors (name, address, contact person, processing activity, roles & responsibilities) and always verify they've provided 'sufficient guarantees'—though the extent might vary based on risk—also for onwards transfers.

Oct 22, 2024

CJEU C-634/21 SCHUFA Holding (Scoring) 7 Dec 2023

members – 4 min read

Credit scoring = Art. 22(1) 'automated individual decision-making' when a third party heavily relies on a probability value to form or end a contract with a data subject. A ruling of "ground-breaking importance for AI-based decisions" according to the Hamburg DPA!

Oct 20, 2024

EDPB Guidelines 2/2023 Technical Scope of Art. 5(3) ePrivacy Directive

members – 1 min read

Likely one of the EDPB’s most controversial documents to date, though the sub-processor Opinion will definitely give it strong competition for first place!

Oct 16, 2024

EDPB meeting minutes 17 Sep 2024

members – 1 min read

New 💸 fines guidelines coming at the end of 2025. Plus, an exciting Support Pool of Experts legal report on 'the extra-territorial enforcement of the GDPR' is coming soon.

Oct 15, 2024

EDPB Strategy 2024-2027 and Work Programmes

members – 3 min read

New comparison table for their three Work Programmes. Check out which documents have just disappeared! 🧐

Oct 11, 2024

🚨 EDPB: (sub-)processor Opinion, legitimate interest Guidelines, draft enforcement regulation Statement, 2024-2025 work programme

members – 1 min read

Controllers should keep identity of *all* processors and sub-processors "readily available at all times" and their obligation to verify (sub-)processors' ‘sufficient guarantees’ should apply regardless of the risk. The EDPB also shares legitimate interest Guidelines for public consultation and more.

Oct 9, 2024

CJEU LED ePD C-548/21 Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile phone) 4 Oct 2024

members – 1 min read

A case relating to the ePrivacy and Law Enforcement Directives, concluding that police access to phones isn't limited to the fight against serious crime.

Oct 4, 2024

Interesting non-GDPR CJEU case on gender change (C-4/23 Mirin)

members – 1 min read

💡 (Non-GDPR/ePrivacy) CJEU ruling stating that Member States can't refuse to recognise changed name and gender approved in another Member State.

Oct 4, 2024

EDPB meeting minutes 16 July 2024

members – 2 min read

Systems overload! Is the EDPB taking on too much?

Oct 3, 2024

Norway DPA fines university for insufficient access control in MS Teams

members – 4 min read

The 🇳🇴 University of Agder was fined €12,500 (NOK 150k) for failing to secure personal data on Teams/SharePoint and insufficient internal controls. Short decision, several takeaways for everyone!

Sep 12, 2024

Dutch DPA fines Clearview AI €30.5m, warns personal liability and says use also illegal

members – 4 min read

[📝 NB! Massive post update 11 Sep] The 🇳🇱 DPA fines Clearview €30.5m, imposes four orders and warns of non-compliance penalties of €5.1m. Using Clearview is illegal and the DPA investigates if company directors can be held personally liable for the violations. Numerous questions on this decision!

Sep 11, 2024