CJEU C-383/23 ILVA (GDPR fine) 13 Feb 2025
Update Sep 2025: ILVA fined €201k | Feb 2025: When fining a controller in a corporate group, DPAs must base the maximum fine on the *group’s* total worldwide turnover from the prior business year. A crucial ruling for anyone in a company group.
Sep 2, 2025
—
4 min read
You might also like
CJEU C-526/24 Brillen Rottler 19 Mar 2026
members
–
2 min read
If a DSAR is made solely to engineer a compensation claim rather than to verify lawful processing, it can be refused as abusive – even if it's the first request.
CJEU C-413/23 P EDPS v SRB (Concept of personal data) 4 Sep 2025 – Case closed!
members
–
6 min read
Pseudonymised data isn’t always personal in every case to everyone – but measures must be effective. Comments are personal by nature – no need to assess content, purpose or effects. Whether a person can be identified must be assessed from the controller’s perspective, when collecting the data.
CJEU C-604/22 IAB Europe TC String 7 Mar 2024
members
–
6 min read
[9 Jan: DPA must reassess] GDPR definitions are broad: information = personal data if someone can be identified using third-party data. Joint controllership doesn’t automatically cover further processing, but you are one if you set binding rules and jointly decide purposes and means.