Rie Aleksandra - DPO Hub (Page 7)

CJEU GC EUDPR T‑354/22 Bindl v Commission 8 Jan 2025

members – 2 min read

[19 March: The case is appealed.] The CJEU's General Court orders the European Commission to pay €400 in non-material damages for US transfers made in March 2022, when no adequacy decision or alternative safeguard was in place.

Mar 19, 2025

New SCCs on public consultation

members – 1 min read

Latest: The public consultations for new SCCs (third-country importers directly subject to the GDPR), announced in Sep 2024, are delayed from Q2 to Q3 2025. 🤔

Mar 19, 2025

Lawfulness: Consent

members – 6 min read

Latest update: Luxembourg DPA with updated guidance. Start here for all things consent: when to rely on and not, practical tips and key resources (GDPR, DPD, CFR, OECD, CJEU rulings and EDPB guidance).

Mar 17, 2025

CJEU C-247/23 Deldits 13 Mar 2025

members – 2 min read

A Member State can't, under any circumstances, require a data subject to provide proof of gender reassignment surgery to exercise their right to rectification. However, they may need to provide relevant and sufficient evidence reasonably needed to show that the data is inaccurate.

Mar 13, 2025

CJEU C‑829/24 Commission v Hungary 12 Feb 2025 Order

members – 1 min read

The CJEU fast-tracks a case against Hungary where the European Commission claims violations of multiple EU laws, including the GDPR Articles 5, 6, 9 and 10.

Mar 13, 2025

CJEU C-203/22 Dun & Bradstreet Austria 27 Feb 2025

members – 4 min read

You must clearly explain actual procedures and principles applied in ADM and if you claim information contains protected data or trade secrets, you must provide it to the DPA or court, which'll balance rights and interests and determine the extent of a DSAR.

Mar 10, 2025

Lawfulness: Legitimate interests

members – 2 min read

v1 of the legitimate interest topic page is ready, with key resources, CJEU rulings and DPA guidance - though only from ICO, CNIL, Datatilsynet and IMY. Have anything to share from your country? Submit your contribution and earn a gold star!

Mar 6, 2025

EDPB CEF 2025: Right to erasure (right to be forgotten)

members – 2 min read

15 Oct 2025: Final report due in "the coming months" | The right to erasure is one of the most frequently exercised GDPR rights and a major source of DPA complaints. This CEF action aims to assess how controllers have implemented it in practice.

Mar 5, 2025

CJEU C-638/23 Amt der Tiroler Landesregierung 27 Feb 2025

members – 2 min read

An entity without legal personality can be a controller if it can fulfil those obligations and national law at least implicitly defines the processing scope; it doesn’t need to precisely specify processing activities or purpose.

Mar 3, 2025

Rights: Access (DSAR, Right of access)

members – 3 min read

[Latest: C-203/22 Dun & Bradstreet, updated elements table.] Got a DSAR? Start here for all things right of access: Article 15 elements table, DSAR flowchart and key CJEU rulings.

Feb 28, 2025

Member memos

members – 32 min read

Important update: Member memos have moved to the DPO Hub Community (separate platform). If you’re not a member yet, reply to the last email update to request an invite, as the link isn’t shared publicly.

Feb 20, 2025

Dealing with access requests in practice

members – 3 min read

Recommendations on how to deal with the Right of access - DSARs - in practice (with grumpy DSARs checklist).

Feb 18, 2025