EDPB Opinion 22/2024: obligations when relying on (sub-)processors
paid
–
8 min read
📚 You must list all (sub-sub-sub-sub...)processors (name, address, contact person, processing activity, roles & responsibilities) and always verify they've provided 'sufficient guarantees'—though the extent might vary based on risk—also for onwards transfers.
Italy: bank fined €1m and rental company €250k for unclear DPAg and no legal basis
paid
–
4 min read
The 🇮🇹 Garante fined a bank €1 million for anti-fraud checks as a processor on behalf of a group company without a legal basis, breaching both Articles 28(3) and 5(1)(a). The rental company was separately fined €250,000, also for an insufficient privacy notice. Here are your key takeaways! 💡
Dutch DPA on education sector social media marketing
paid
–
4 min read
The DPA stresses that their advice applies generally to all social media and "of great importance" to all educational institutions and similar organisations in 🇳🇱.
