CJEU C-46/23 Ujpesti Polgarmesteri Hivatal
DPAs can order controllers to delete unlawfully processed data without a prior request from a data subject, and regardless of where the data came from (the data subject or elsewhere).
Mar 26, 2024
—
1 min read
You might also like
CJEU C-21/23 Lindenapotheke 4 Oct 2024
members
–
5 min read
UPDATED: Competitors can take legal action against your GDPR violations if considered an illegal unfair commercial practice. And 'special category personal data' threshold is now lower—ordering pharmacy-only medicinal products online is considered sharing health data, requiring explicit consent.
CJEU C-252/21 Meta Platforms and Others (General terms of use of a social network) 4 July 2023
members
–
6 min read
Legal bases are interpreted stricter and while you might rely on legitimate interest for direct marketing, network security or product improvement, processing personal data must be *strictly* necessary (but is it correctly applied? 🤔)
CJEU C-621/22 KNLTB (legitimate interests)
members
–
3 min read
UPDATED: Article 6(1)(f) allows personal data to be disclosed for a commercial interest if the processing is strictly necessary and not outweighed by the interests, rights or freedoms of the data subjects. The interest doesn't have to be determined by law, but it must be lawful.