lawfulness - DPO Hub

CJEU C-252/21 Meta Platforms and Others (General terms of use of a social network) 4 July 2023

members – 6 min read

Legal bases are interpreted stricter and while you might rely on legitimate interest for direct marketing, network security or product improvement, processing personal data must be *strictly* necessary (but is it correctly applied? 🤔)

Nov 13, 2024

CJEU C-621/22 KNLTB (legitimate interests)

members – 3 min read

UPDATED: Article 6(1)(f) allows personal data to be disclosed for a commercial interest if the processing is strictly necessary and not outweighed by the interests, rights or freedoms of the data subjects. The interest doesn't have to be determined by law, but it must be lawful.

Oct 29, 2024

EDPB Guidelines 1/2024 Legitimate interests (public consultation)

members – 4 min read

The EDPB's recent new legitimate interest guidelines are on public consultation until 20 Nov 2024. Initial analysis: 📝 Document, document, document.

Oct 28, 2024

🇮🇪 DPC fines LinkedIn €310m for illegal behavioural analysis and targeted advertising

members – 1 min read

6 years after a complaint (!), the DPC finds that LinkedIn Ireland breached the principles of lawfulness (lacking both consent, legitimate interest AND contractual necessity), fairness and transparency. Result: reprimand, order to rectify violations + €310 million fine.

Oct 24, 2024

C-200/23 Agentsia po vpisvaniyata

members – 3 min read

An authority of a commercial register = both recipient and controller. Handwritten signatures = personal data. Temporary loss of control (e.g. public disclosure) can lead to damage, but harm must be proven. And a few more points in today's CJEU ruling!

Oct 4, 2024

CJEU C-17/22 HTB Neunte Immobilien Portfolio

members – 2 min read

A ruling on Article 6(1)(b), (c) and (f) and disclosing personal data not part of a contract (on the contrary; it's prohibited by it). Grab Rie's highlighted file and diagram here.

Sep 15, 2024

Italy: bank fined €1m and rental company €250k for unclear DPAg and no legal basis

members – 4 min read

The 🇮🇹 Garante fined a bank €1 million for anti-fraud checks as a processor on behalf of a group company without a legal basis, breaching both Articles 28(3) and 5(1)(a). The rental company was separately fined €250,000, also for an insufficient privacy notice. Here are your key takeaways! 💡

Aug 21, 2024

AG Szpunar (C-394/23 Mousse)

members – 2 min read

Advocate General Opinion: On the principles of data minimisation and lawfulness of processing—where the 🇫🇷 CNIL made a somewhat startling decision on what's 'necessary for the performance of a contract'! + remember to spell out your legitimate interest when you collect the data!

Aug 9, 2024

Denmark Google Workspace for Education Chromebook case (Helsingørgate)

members – 9 min read

[15 July: Municipalities complies with Jan order + 🚨 DPA asks for EDPB opinion on the scope of a controller's documentation obligations regarding a processor's use of sub-processors] The Danish DPA's landmark decision of 2022 to ban certain use of Google products and US transfers, is still ongoing.

Jul 15, 2024

🔥 Dutch DPA: Web scraping almost always illegal AND:

members – 2 min read

The 🇳🇱 DPA issued new guidelines for the private sector (public sector one coming) on web scraping, stating it's "almost always illegal", and reiterates their highly controversial claim that ❌ You can't rely on legitimate interest for purely commercial reasons... 🤨

May 10, 2024

Denmark DPA says cookie walls are legal - and not

members – 2 min read

Update 26 Mar 2024: the DPA rejects reopening the cases, upholding that analytics/statistics aren't a necessary part of the alternative to paid access.

Mar 26, 2024

Sweden MedHelp 1177 case

members – 8 min read

This case is not only a goldmine for DPOs in the Swedish healthcare sector (although particularly so), but DPOs in general, for assessing roles, legal bases and processor liability.

Feb 22, 2024