CJEU C-768/21 Land Hessen (DPA obligation to act) 26 Sep 2024
⏰ Quickly deal with data breaches and listen to the DPA to reduce the chance of a fine (and keep access logs >3 months). DPAs aren't required to exercise a corrective power, like impose a fine, if not appropriate, necessary or proportionate to remedy the violation and ensure full GDPR compliance.
Dec 28, 2024
—
3 min read
You might also like
CJEU C-416/23 Österreichische Datenschutzbehörde (Excessive requests) 9 Jan 2025
members
–
4 min read
Art. 57(4) 'requests' include 'complaints' in 57(1)(f) and 77(1) and aren't 'excessive' due to volume alone; DPAs must show abuse, and can then charge a reasonable fee or refuse to act after considering all circumstances and ensuring their choice is justified.
CJEU C-394/23 Mousse 9 Jan 2025
members
–
5 min read
Processing customers' titles to personalise communication based on gender isn’t essential for performing a contract; nor is it for a legitimate interest if they weren't informed beforehand, the processing isn't strictly necessary, or the balancing test goes in their favor.
CJEU C-21/23 Lindenapotheke 4 Oct 2024
members
–
5 min read
NB! Updated re: explicit consent. Competitors can take legal action against your GDPR violations if considered an illegal unfair commercial practice. Special category personal data threshold is lowered: ordering pharmacy-only medicinal products online is considered sharing health data.