CJEU C-638/23 Amt der Tiroler Landesregierung 27 Feb 2025
An entity without legal personality can be a controller if it can fulfil those obligations and national law at least implicitly defines the processing scope; it doesn’t need to precisely specify processing activities or purpose.
Mar 3, 2025
—
2 min read
You might also like
🚨 CJEU C-203/22 Dun & Bradstreet Austria 27 Feb 2025
members
–
3 min read
You must clearly explain actual procedures and principles applied in ADM and if you claim information contains protected data or trade secrets, you must provide it to the DPA or court, which'll balance rights and interests and determine the extent of a DSAR.
CJEU C-383/23 ILVA (GDPR fine) 13 Feb 2025
members
–
3 min read
When fining a controller in a corporate group, DPAs must base the maximum fine on the *group’s* total worldwide turnover from the previous business year. A crucial ruling for anyone in a company group – here's also text you can copy for an email to your Management/Board.
CJEU C-413/23 P EDPS v Single Resolution Board 6 Feb 2025 AG Opinion
members
–
1 min read
A much-anticipated case on the concept of personal data, but the AG only advices the CJEU to set aside the General Court’s ruling and send the case back to decide on the second plea (breach of good administration and fair procedure). We're still in the dark on several aspects.