fine - DPO Hub

Record GDPR fine from Norway (NAV)

members – 5 min read

[📝 Updated 11 April with full writeup] Norway's DPA upheld their record NOK 20m fine to the Labour and Welfare Administration (NAV) for several, grave violations.

Apr 11, 2024

France DPA fines Amazon €32m for invasive employee monitoring

members – 3 min read

[22 March update: Amazon has appealed] The 🇫🇷 CNIL fined Amazon for excessively intrusive monitoring, using several illegal indicators and unsecure video surveillance software, without sufficiently informing employees and visitors.

Mar 22, 2024

Sweden MedHelp 1177 case

members – 8 min read

This case is not only a goldmine for DPOs in the Swedish healthcare sector (although particularly so), but DPOs in general, for assessing roles, legal bases and processor liability.

Feb 22, 2024

Sweden court upholds ~$1m fine: major health data leak and forwarding calls to 🇹🇭

members – 2 min read

🇸🇪 MedHelp must pay SEK 11,3 million (~$1m) for leaking 2,7 million health-related conversations (of 170 000 hours) online for several years and no legal basis for forwarding call to Thailand.

Feb 18, 2024

CJEU C‑683/21 Nacionalinis visuomenės sveikatos centras

members – 4 min read

The definition of 'controller' is broad and you're liable for all processing, done directly or by others on your behalf, including processors. Joint controllership is determined by facts, not contracts. Know your role(s)!

Jan 6, 2024

CJEU C-807/21 Deutsche Wohnen

members – 3 min read

The definition of 'controller' is broad and includes legal persons, who are liable for any violations committed by any person in their business who act on their behalf. DPAs must demonstrate that you acted with intent or neglect to fine you and must base the max amount on the group's total revenue.

Jan 5, 2024