Rie Aleksandra - DPO Hub (Page 8)

CJEU C-65/23 K GmbH (Processing of employees’ personal data) 19 Dec 2024

members – 2 min read

While Article 88 allows for more specific national rules for processing personal data in the employment context, you still have to comply with Articles 5, 6 and 9 and can't lower the standard for or ignore the 'necessity' requirement.

Dec 22, 2024

noyb win: 🇳🇱 Dutch DPA fines Netflix €4.75m for lack of information

members – 1 min read

noyb gets their first big win in their streaming services complaint project, filed in January 2019 against Amazon Prime, Apple Music, DAZN, Flimmit, Netflix, SoundCloud, Spotify and YouTube. Unsurprisingly, Netflix has already objected.

Dec 19, 2024

Record GDPR fine from Norway (NAV)

members – 6 min read

🔥 On 17 Dec, the Privacy Appeals Board overturned substantial parts of the DPA's decision against the Labour and Welfare Administration (NAV), including the record NOK 20 million fine.

Dec 18, 2024

🇮🇪 DPC fines Meta €251m for failing on data protection by design and default and breach handling

members – 1 min read

Meta failed to properly notify and document a breach affecting 3m EEA Facebook users and to build in data protection requirements throughout the design and development cycle.

Dec 18, 2024

EDPS: the European Commission's use of MS365 is non-compliant

members – 10 min read

10 Dec: EC submits compliance report. (Both parties sought annulment in July, so stay tuned!) After the EDPS' second investigation into the EC's use of Microsoft 365, they found (again) several serious EUDPR violations, notably related to purpose limitation and transfers, which are still ongoing.

Dec 11, 2024

CJEU C-446/21 Schrems (Communication of data to the general public) 4 Oct 2024

members – 5 min read

A ruling that sparks questions around 'strictly necessary' and 'purpose'. Facebook can't indiscriminately use personal data on or off their platform for personalised ads, without restricting the duration and type of data.

Dec 8, 2024

EDPB meeting minutes 4 Nov 2024

members – 2 min read

Never-before discussed 'Guidelines on the use of biometrics for physical access control' enter the spotlight! And "first complaint under the DPF redress mechanism"..? Here's the latest EDPB meeting minutes.

Dec 7, 2024

EDPB letter to the Commission on its review of 11 DPD adequacy decisions

members – 1 min read

EDPB Chair Anu Talus writes the Commissioner for Justice on the Commission's review of 11 adequacy decisions adopted under Directive 95/46/EC for: Andorra, Argentina, Canada, Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland, and Uruguay. And isn't entirely happy.

Dec 6, 2024

EDPB urges digital legislation to be aligned with the GDPR

members – 1 min read

The EDPB calls for digital legislation to align with the GDPR, emphasising the importance of legal certainty and coherence. And highlights the need for additional resources to support DPAs and the EDPB in addressing increasingly complex challenges.

Dec 5, 2024

📊 DPO Hub Pulse: AI topic page?

members –

Disclaimer: Work is underway on the legitimate interest topic page, but here’s your chance to weigh in on an AI one.

Dec 4, 2024

🚨 EDPB shares Art. 48 Guidelines (PC) and new Data Protection Seal certification

members – 1 min read

The EDPB just shared new Guidelines! This time for Article 48 and they're on public consultation until 25 Jan 2025. They also announced a new EU Data Protection Seal certification for 'Brand Compliance'.

Dec 3, 2024

CJEU C-169/23 Masdi 28 Nov 2024

members – 4 min read

The Art. 14(5)(c) derogation applies to *all* data not collected from the data subject, including self-generated. DPAs can, as per Art. 14(5)(c), verify if national law has measures to protect data subjects' legitimate interests, but this doesn’t include assessing Art. 32 security measures.

Nov 28, 2024