DPA decision - DPO Hub

🇮🇪 DPC fines LinkedIn €310m for illegal behavioural analysis and targeted advertising ('BA & TA')

members – 7 min read

Key takaways: Lack of lawful basis = loss of control = 'significant damage', lawful bases are notoriously tricky to get right, and most have lots to gain in improving information and transparency. Full decision = a key lesson on legitimate interest and LIAs.

Jan 22, 2025

🇮🇪 DPC fines Meta €91m for failing to safeguard passwords and notify breaches

members – 1 min read

UPDATE 1 Jan: Summary + full decision published! The DPC fines Meta for failing to safeguard users' passwords (storing them in plaintext!) and for notifying the breach too late.

Dec 30, 2024

noyb win: 🇳🇱 Dutch DPA fines Netflix €4.75m for lack of information

members – 1 min read

noyb gets their first big win in their streaming services complaint project, filed in January 2019 against Amazon Prime, Apple Music, DAZN, Flimmit, Netflix, SoundCloud, Spotify and YouTube. Unsurprisingly, Netflix has already objected.

Dec 19, 2024

Record GDPR fine from Norway (NAV)

members – 6 min read

🔥 On 17 Dec, the Privacy Appeals Board overturned substantial parts of the DPA's decision against the Labour and Welfare Administration (NAV), including the record NOK 20 million fine.

Dec 18, 2024

🇮🇪 DPC fines Meta €251m for failing on data protection by design and default and breach handling

members – 1 min read

Meta failed to properly notify and document a breach affecting 3m EEA Facebook users and to build in data protection requirements throughout the design and development cycle.

Dec 18, 2024

Norway DPA fines university for insufficient access control in MS Teams

members – 4 min read

The 🇳🇴 University of Agder was fined €12,500 (NOK 150k) for failing to secure personal data on Teams/SharePoint and insufficient internal controls. Short decision, several takeaways for everyone!

Sep 12, 2024

Dutch DPA fines Clearview AI €30.5m, warns personal liability and says use also illegal

members – 4 min read

[📝 NB! Massive post update 11 Sep] The 🇳🇱 DPA fines Clearview €30.5m, imposes four orders and warns of non-compliance penalties of €5.1m. Using Clearview is illegal and the DPA investigates if company directors can be held personally liable for the violations. Numerous questions on this decision!

Sep 11, 2024

Italy: bank fined €1m and rental company €250k for unclear DPAg and no legal basis

members – 4 min read

The 🇮🇹 Garante fined a bank €1 million for anti-fraud checks as a processor on behalf of a group company without a legal basis, breaching both Articles 28(3) and 5(1)(a). The rental company was separately fined €250,000, also for an insufficient privacy notice. Here are your key takeaways! 💡

Aug 21, 2024

Denmark Google Workspace for Education Chromebook case (Helsingørgate)

members – 9 min read

[15 July: Municipalities complies with Jan order + 🚨 DPA asks for EDPB opinion on the scope of a controller's documentation obligations regarding a processor's use of sub-processors] The Danish DPA's landmark decision of 2022 to ban certain use of Google products and US transfers, is still ongoing.

Jul 15, 2024

Spain: Massive €160k fine for ignoring the DPA

members – 1 min read

🇪🇸 Watium ignored the DPA (several times), was fined €160,000, but got a 40% discount for acknowledging responsibility and agreeing to pay voluntary. 💡 Make it a habit to respond promptly both to DPAs and data subjects! (And please reach out if you have answers to my questions.)

May 28, 2024

Denmark DPA says cookie walls are legal - and not

members – 2 min read

Update 26 Mar 2024: the DPA rejects reopening the cases, upholding that analytics/statistics aren't a necessary part of the alternative to paid access.

Mar 26, 2024

Sweden MedHelp 1177 case

members – 8 min read

This case is not only a goldmine for DPOs in the Swedish healthcare sector (although particularly so), but DPOs in general, for assessing roles, legal bases and processor liability.

Feb 22, 2024