CJEU holds that Member States may force ISPs to retain IP addresses, in a general and indiscriminate manner, to combate criminal offences in general. 🤨
👮 CJEU on access to phone records related to crime + clarifies conditions for transmitting and using evidence in criminal cases with a cross-border dimension.
Consent is required for listing subscribers' details in publicly available directories. If you obtain it, including on behalf of other controllers, a data subject can withdraw it (which equates to an erasure request) from any of these, and every controller may be required to notify the others.
Breaching GDPR rights doesn't automatically result in non-material damage, and controllers can't (ever?) escape liability simply because someone under their authority didn't follow instructions.
[Updated 24 April with highlighted file + 🎙️] Is the EDPB trying to "rewrite the entire economic model of Big Tech and the adtech industry in the EU"? 🤔 Controversial Opinion just published!
🇩🇰 DPA changes sub-processor third-party beneficiary clause in their SCCs for data processing agreements as per Article 28(8). Agreements signed before this are still valid.
Breaching GDPR rights doesn't automatically result in non-material damage, and controllers can't (ever?) escape liability simply because someone under their authority didn't follow instructions, and an AG Opinion may disrupt DPAs workload. 😬