fine - DPO Hub

🇮🇪 DPC fines LinkedIn €310m for illegal behavioural analysis and targeted advertising

members – 1 min read

6 years after a complaint (!), the DPC finds that LinkedIn Ireland breached the principles of lawfulness (lacking both consent, legitimate interest AND contractual necessity), fairness and transparency. Result: reprimand, order to rectify violations + €310 million fine.

Oct 24, 2024

DPC fines Meta €91m for failing to safeguard passwords and notify breaches

members – 1 min read

And for once, no other DPA objected to the DPC's draft decision. Read their handy one-pager here. 👇

Sep 27, 2024

Norway DPA fines university for insufficient access control in MS Teams

members – 4 min read

The 🇳🇴 University of Agder was fined €12,500 (NOK 150k) for failing to secure personal data on Teams/SharePoint and insufficient internal controls. Short decision, several takeaways for everyone!

Sep 12, 2024

Dutch DPA fines Clearview AI €30.5m, warns personal liability and says use also illegal

members – 4 min read

[📝 NB! Massive post update 11 Sep] The 🇳🇱 DPA fines Clearview €30.5m, imposes four orders and warns of non-compliance penalties of €5.1m. Using Clearview is illegal and the DPA investigates if company directors can be held personally liable for the violations. Numerous questions on this decision!

Sep 11, 2024

Italy: bank fined €1m and rental company €250k for unclear DPAg and no legal basis

members – 4 min read

The 🇮🇹 Garante fined a bank €1 million for anti-fraud checks as a processor on behalf of a group company without a legal basis, breaching both Articles 28(3) and 5(1)(a). The rental company was separately fined €250,000, also for an insufficient privacy notice. Here are your key takeaways! 💡

Aug 21, 2024

Grindr NOK 65m fine upheld in Norway (again)

members – 2 min read

The Oslo District Court ruled in favour of the state on all points, after Grindr sued the authorities after the Privacy Appeals Board fully upheld the DPA's decision, including the NOK 65m record fine. Preliminary win, but expect an appeal.

Jul 5, 2024

Record GDPR fine from Norway (NAV)

members – 5 min read

Norway's DPA upheld their record NOK 20m fine to the Labour and Welfare Administration (NAV) for several, grave violations.

Apr 11, 2024

France DPA fines Amazon €32m for invasive employee monitoring

members – 3 min read

[22 March update: Amazon has appealed] The 🇫🇷 CNIL fined Amazon for excessively intrusive monitoring, using several illegal indicators and unsecure video surveillance software, without sufficiently informing employees and visitors.

Mar 22, 2024

Sweden MedHelp 1177 case

members – 8 min read

This case is not only a goldmine for DPOs in the Swedish healthcare sector (although particularly so), but DPOs in general, for assessing roles, legal bases and processor liability.

Feb 22, 2024

Sweden court upholds ~$1m fine: major health data leak and forwarding calls to 🇹🇭

members – 2 min read

🇸🇪 MedHelp must pay SEK 11,3 million (~$1m) for leaking 2,7 million health-related conversations (of 170 000 hours) online for several years and no legal basis for forwarding call to Thailand.

Feb 18, 2024

CJEU C‑683/21 Nacionalinis visuomenės sveikatos centras

members – 4 min read

The definition of 'controller' is broad and you're liable for all processing, done directly or by others on your behalf, including processors. Joint controllership is determined by facts, not contracts. Know your role(s)!

Jan 6, 2024

CJEU C-807/21 Deutsche Wohnen

members – 3 min read

The definition of 'controller' is broad and includes legal persons, who are liable for any violations committed by any person in their business who act on their behalf. DPAs must demonstrate that you acted with intent or neglect to fine you and must base the max amount on the group's total revenue.

Jan 5, 2024