CJEU C-768/21 Land Hessen (DPA obligation to act) 26 Sep 2024
⏰ Quickly deal with data breaches and listen to the DPA to reduce the chance of a fine (and keep access logs >3 months). DPAs aren't required to exercise a corrective power, like impose a fine, if not appropriate, necessary or proportionate to remedy the violation and ensure full GDPR compliance.
Dec 28, 2024
—
3 min read
You might also like
CJEU C-621/22 KNLTB (legitimate interests) 4 Oct 2024
members
–
4 min read
[update] Article 6(1)(f) allows disclosure for a commercial interest if the processing is *strictly* necessary and not outweighed by the interests, rights or freedoms of the data subjects. The interest doesn't have to be determined by law, but it must be lawful. And CJEU nudges consent again.
CJEU T-384/20 RENV OC v Commission (C-479/22 P)
members
–
4 min read
🔥 Update: After the CJEU sent the case back, the General Court has ordered the European Commission to pay a Greek scientist €50,000 for unlawfully processing her personal data in a press release, causing reputational, career and health-related harm.
CJEU T-553/23 Latombe v Commission 3 Sep 2025
members
–
3 min read
[🇬🇧 version finally available!] "The General Court dismisses the action for annulment" and the EU-US DPF remains valid.