data minimisation

C-200/23 Agentsia po vpisvaniyata

members – 3 min read

An authority of a commercial register = both recipient and controller. Handwritten signatures = personal data. Temporary loss of control (e.g. public disclosure) can lead to damage, but harm must be proven. And a few more points in today's CJEU ruling!

Oct 4, 2024

AG Szpunar (C-394/23 Mousse)

members – 2 min read

Advocate General Opinion: On the principles of data minimisation and lawfulness of processing—where the 🇫🇷 CNIL made a somewhat startling decision on what's 'necessary for the performance of a contract'! + remember to spell out your legitimate interest when you collect the data!

Aug 9, 2024

Denmark Google Workspace for Education Chromebook case (Helsingørgate)

members – 9 min read

[15 July: Municipalities complies with Jan order + 🚨 DPA asks for EDPB opinion on the scope of a controller's documentation obligations regarding a processor's use of sub-processors] The Danish DPA's landmark decision of 2022 to ban certain use of Google products and US transfers, is still ongoing.

Jul 15, 2024

France DPA fines Amazon €32m for invasive employee monitoring

members – 3 min read

[22 March update: Amazon has appealed] The 🇫🇷 CNIL fined Amazon for excessively intrusive monitoring, using several illegal indicators and unsecure video surveillance software, without sufficiently informing employees and visitors.

Mar 22, 2024

France: unemployment breach impacts 43m dating back 20 years

members – 1 min read

🇫🇷 Massive breach and what we can learn immediately from it: data minimisation, deletion, breach response plans - and communication that people actually understand!

Mar 20, 2024