Rie Aleksandra - DPO Hub (Page 3)

CJEU C-621/22 KNLTB (legitimate interests) 4 Oct 2024

members – 4 min read

[update] Article 6(1)(f) allows disclosure for a commercial interest if the processing is *strictly* necessary and not outweighed by the interests, rights or freedoms of the data subjects. The interest doesn't have to be determined by law, but it must be lawful. And CJEU nudges consent again.

Oct 21, 2025

EDPB Support Pool of Experts (SPE) projects

members – 6 min read

Latest: The Digital Euro and its token-based offline modality (Oct) | AI and Data Protection Training curriculum (Jun) | An overview of SPE projects.

Oct 21, 2025

'Pay or OK' – 'Consent or Pay' resources

members – 4 min read

ICO shares guidance for the public | EDPB to discuss "draft 'Consent or Pay' guidelines" on 7 Oct | Dutch court orders Meta to change Facebook and Instagram timeline settings (DSA) |🇬🇧 ICO on Meta ads model | 🇦🇹 Court rules newspaper's Pay or OK model not OK – likely heading for a CJEU referral next

Oct 20, 2025

EDPB meeting minutes 8 Jul 2025

members – 2 min read

Oct 17, 2025

EDPB CEF: Coordinated Enforcement Framework

members – 2 min read

2026 topic: 📝 transparency & information | 2025 report due in "months" | The EDPB created the CEF initiative under its 2021-2023 Strategy to enhance enforcement and strengthen cooperation among DPAs. Each year, they collectively choose a priority enforcement topic for coordinated (voluntary) action.

Oct 15, 2025

DPIAs: Key resources

members – 5 min read

Data Protection Impact Assessments (DPIAs) key resources v1 – starting with every DPA's website!

Oct 12, 2025

UK ICO fines Clearview AI €8.9m and orders stop in processing

members – 2 min read

And on 8 Oct 2025, the 🇬🇧 Upper Tribunal (appeal court) upheld three of Information Commissioner’s four grounds of appeal, sending the case back to the lower appeal court.

Oct 12, 2025

The DPO role: Article 37(1)(b)

members – 5 min read

10 Oct: Estonia's thresholds for 'large-scale' (5k, 10k, 50k) | Breaking down Article 37(1)(b) key terms: 'core activities', 'regular', 'systematic', 'monitoring' and 'large scale'. And what should you do if you're still unsure whether you need to appoint a DPO? Appoint one voluntarily?

Oct 10, 2025

CJEU T-384/20 RENV OC v Commission (C-479/22 P)

members – 4 min read

🔥 Update: After the CJEU sent the case back, the General Court has ordered the European Commission to pay a Greek scientist €50,000 for unlawfully processing her personal data in a press release, causing reputational, career and health-related harm.

Oct 7, 2025

Norway DPA fines the Labour and Welfare Administration (NAV) NOK 20 million

members – 6 min read

[updated] After the Privacy Appeals Board overturned substantial parts of the DPA's decision against the Labour and Welfare Administration (NAV), including the record NOK 20 million fine, the DPA has decided to reassess the case.

Oct 1, 2025

Norway DPA fines Telenor ASA NOK 4 million for DPO violations

members – 9 min read

[updated] After initially flagging a potential NOK 99m (~€8.3m) fine, Datatilsynet fined Telenor ASA NOK 4m (~€351,000) for failing to properly assess and document the DPO role (independence, conflicts of interest, reporting lines) – the case is now with the 🇳🇴 Privacy Appeals Board.

Sep 29, 2025

Your OSS for the EU-US DPF

public – 7 min read

EDPS opines on EU-US data exchanges for security screenings and identity verifications | The General Court dismissed Latombe's action for annulment – and the EU-US DPF is safe for now.

Sep 23, 2025