Rie Aleksandra - DPO Hub (Page 3)

CJEU C-422/24 Storstockholms Lokaltrafik 1 Aug 2025 AG Opinion

members – 2 min read

AG Medina: When personal data is collected through body cameras worn by ticket inspectors working for a public transport company (🇸🇪 SL), Article 13 applies, not Article 14, as it’s collected directly from the data subject.

Aug 6, 2025

The European Data Protection Supervisor – EDPS

members – 2 min read

Overview page for all things EDPS.

Aug 5, 2025

EDPS audit of the Commission's MS365 use

members – 11 min read

28 July: EDPS closes its investigation into the European Commission’s use of Microsoft 365, now deeming it compliant after previously finding serious EUDPR violations, notably on purpose limitation and international transfers.

Jul 29, 2025

EDPB meeting minutes 3-4 Jun 2025

members – 2 min read

🚨 AI & Data Protection Training | EDPB-EDPS opinion simplifying Art. 30(5) ROPA | Scientific research GLs discussed but redacted (as was "Smart TVs") | New 🇪🇪 CJEU case & 🇧🇪 IAB Europe update – but no further details | Joint EC-EDPB DMA ↔ GDPR interplay guidelines | 🇫🇷 rec. coming for email pixels.

Jul 27, 2025

EU and China discuss new Cross-Border Data Flow Communication Mechanism

members – 1 min read

Last year, EU and China began discussing a new Cross-Border Data Flow Communication Mechanism for non-personal data. On 17 July, a second meeting took place. First sector out: automative.

Jul 23, 2025

🇮🇪 DPC fines TikTok €530m for China transfers

members – 3 min read

10 July: DPC launches new investigation into China transfers. Earlier: transparency breach by failing to disclose the third countries involved and didn't explain the nature of the transfers in its privacy policy --> get compliant in six months or stop the transfers (but order paused until Oct).

Jul 22, 2025

CNIL shares transfer impact assessment (TIA) practical template

members – 2 min read

NB: On 9 July, CNIL appears to have updated the webpage with that date, though there don’t seem to be any actual changes – and the PDFs are still from January. Either way, here’s a quick reminder! 💬 "CNIL TIA template is one of the best templates available to the public!"

Jul 22, 2025

EDPB Helsinki Statement 2 Jul 2025

members – 2 min read

In a "landmark statement", the EDPB announces ready-to-use templates, a harmonised breach notification form, practical checklists and case law-style publications, plus more agile guidance updates and cross-regulatory cooperation to simplify GDPR compliance – especially for SMEs!

Jul 4, 2025

EDPB Guidelines 2/2024 Article 48

members – 5 min read

Update 4 Jul: EDPB shared high-res diagram! Earlier: I've reviewed the final version – mostly clarifications and my annotations on the public consultation one are still valid | EDPB Guidelines on Article 48 covering official requests from third country public authorities for personal data transfers.

Jul 4, 2025

EDPB meeting minutes 5 May 2025

members – 3 min read

No major news, though lots going on in 🇧🇪 (interesting FATCA decision, "abuse of law by NOYB" and mass rejection of NOYB complaints) | Approved 🇬🇧 GDPR & LED adequacy decisions extensions | Interesting 🇫🇷 case the CNIL will "propose a collective and coordinated action" for.

Jun 30, 2025

CJEU C-40/17 Fashion ID 29 Jul 2019

members – 4 min read

You’re a (joint) controller if you use third-party tools on your website that share personal data with the provider – but only for parts where you (jointly) determine purposes and means. If you collect the data, you must inform and get consent, and each controller must pursue a legitimate interest.

Jun 17, 2025

EDPB Support Pool of Experts (SPE) projects

members – 5 min read

An overview of SPE projects. Latest: AI and Data Protection Training curriculum (Jun) | AI Privacy Risks and Mitigations LLMs (Apr) | AI: Complex Algorithms and effective Data Protection Supervision + OSS Case Digest: Right of access (Jan)

Jun 8, 2025