CJEU C-768/21 Land Hessen (DPA obligation to act)
DPAs aren't obliged to exercise a corrective power in all cases of a breach, in particular imposing a fine, for example if the controller took necessary measures to end and further prevent the breach.
Sep 26, 2024
—
1 min read
You might also like
CJEU C-507-23 Pateretaju tiesibu aizsardzibas centrs 4 Oct 2024
members
–
1 min read
A GDPR violation doesn’t automatically count as damage under Article 82(1). An apology can be enough to compensate for non-material damage, if it fully covers the harm, especially when the original situation can’t be restored. And if you're sorry or not doesn't matter!
C-200/23 Agentsia po vpisvaniyata
members
–
3 min read
An authority of a commercial register = both recipient and controller. Handwritten signatures = personal data. Temporary loss of control (e.g. public disclosure) can lead to damage, but harm must be proven. And a few more points in today's CJEU ruling!
CJEU C-621/22 KNLTB 4 Oct 2024
members
–
2 min read
A long-anticipated case on whether a *commercial* interest can qualify as legitimate under Article 6(1)(f). The CJEU confirms that it can, provided the interest is lawful, but emphasises the *strict* necessity requirement.