CJEU - DPO Hub

CJEU C-252/21 Meta Platforms and Others (General terms of use of a social network) 4 July 2023

members – 6 min read

Legal bases are interpreted stricter and while you might rely on legitimate interest for direct marketing, network security or product improvement, processing personal data must be *strictly* necessary (but is it correctly applied? 🤔)

Nov 13, 2024

CJEU C-621/22 KNLTB (legitimate interests)

members – 3 min read

UPDATED: Article 6(1)(f) allows personal data to be disclosed for a commercial interest if the processing is strictly necessary and not outweighed by the interests, rights or freedoms of the data subjects. The interest doesn't have to be determined by law, but it must be lawful.

Oct 29, 2024

CJEU C-634/21 SCHUFA Holding (scoring)

members – 4 min read

Credit scoring = Art. 22(1) 'automated individual decision-making' when a third party heavily relies on a probability value to form or end a contract with a data subject. 🚨 A ruling of "ground-breaking importance for AI-based decisions" according to the Hamburg DPA!

Oct 20, 2024

CJEU C-507/23 Pateretaju tiesibu aizsardzibas centrs

members – 1 min read

A GDPR violation doesn’t automatically count as damage under Article 82(1). An apology can be enough to compensate for non-material damage, if it fully covers the harm, especially when the original situation can’t be restored. And if you're sorry or not doesn't matter!

Oct 4, 2024

C-200/23 Agentsia po vpisvaniyata

members – 3 min read

An authority of a commercial register = both recipient and controller. Handwritten signatures = personal data. Temporary loss of control (e.g. public disclosure) can lead to damage, but harm must be proven. And a few more points in today's CJEU ruling!

Oct 4, 2024

C-548/21 Bezirkshauptmannschaft Landeck (attempt to access personal data stored on a mobile phone)

members – 1 min read

A case relating to the ePrivacy and Law Enforcement Directives, concluding that police access to phones isn't limited to the fight against serious crime.

Oct 4, 2024

Interesting non-GDPR CJEU case on gender change (C-4/23 Mirin)

members – 1 min read

💡 (Non-GDPR/ePrivacy) CJEU ruling stating that Member States can't refuse to recognise changed name and gender approved in another MS.

Oct 4, 2024

CJEU C-446/21 Schrems (communication of data to the general public)

members – 3 min read

Facebook (and similar platforms) can't use all personal data obtained for targeted ads, without restriction as to time and distinction as to type of data.

Oct 4, 2024

CJEU C-21/23 Lindenapotheke

members – 2 min read

The CJEU rules against the Advocate General's Opinion, concluding that any medicinal product you order, prescription or not, is health data and requires your explicit consent. 🤯

Oct 4, 2024

CJEU C-768/21 Land Hessen (DPA obligation to act)

members – 1 min read

DPAs aren't obliged to exercise a corrective power in all cases of a breach, in particular imposing a fine, for example if the controller took necessary measures to end and further prevent the breach.

Sep 26, 2024

CJEU C-17/22 HTB Neunte Immobilien Portfolio

members – 2 min read

A ruling on Article 6(1)(b), (c) and (f) and disclosing personal data not part of a contract (on the contrary; it's prohibited by it). Grab Rie's highlighted file and diagram here.

Sep 15, 2024

AG Tour on DPA complaints (C-416/23 Österreichische Datenschutzbehörde - excessive requests)

members – 2 min read

Advocate General Opinion: The Art. 57(4) concept of 'requests' covers 'complaint' in 57(1)(f) and 77(1) and aren't 'excessive' just because there are many in a certain period; the DPA must show abusive intent, and can then charge a fee or refuse to act.

Sep 6, 2024