lawfulness - DPO Hub

EDPB Guidelines 2/2024 Article 48 (public consultation)

members – 4 min read

New EDPB Guidelines are now open for public consultation (until 25 Jan) on Article 48, which covers official requests from third country public authorities for personal data transfers.

Dec 6, 2024

CJEU C-17/22 HTB Neunte Immobilien Portfolio

members – 5 min read

UPDATED: National case-law could be relevant under Article 6(1)(c) legal obligation. And while we get some further guidance on legitimate interest assessments, the CJEU creates some confusion around 'strictly necessary' again.

Nov 25, 2024

🇮🇪 DPC fines LinkedIn €310m for illegal behavioural analysis and targeted advertising

members – 2 min read

UPDATE 21 Nov: Key statement from DPC! 👇 6 years after a complaint, the DPC finds that LinkedIn breached the lawfulness (lacking both consent, legitimate interest AND contractual necessity), fairness and transparency principles. Result: reprimand, order to rectify violations + €310 million fine.

Nov 21, 2024

CJEU C-252/21 Meta Platforms and Others (General terms of use of a social network)

members – 6 min read

The 'Meta Bundeskartellamt' ruling: Legal bases are interpreted stricter and while you might rely on legitimate interest for direct marketing, network security or product improvement, processing personal data must be *strictly* necessary (but is it correctly applied? 🤔)

Nov 13, 2024

CJEU C-621/22 KNLTB (legitimate interests)

members – 3 min read

UPDATED: Article 6(1)(f) allows personal data to be disclosed for a commercial interest if the processing is strictly necessary and not outweighed by the interests, rights or freedoms of the data subjects. The interest doesn't have to be determined by law, but it must be lawful.

Oct 29, 2024

EDPB Guidelines 1/2024 Legitimate interests (public consultation)

members – 4 min read

The EDPB's recent new legitimate interest guidelines are on public consultation until 20 Nov 2024. Initial analysis: 📝 Document, document, document.

Oct 28, 2024

CJEU C-200/23 Agentsia po vpisvaniyata

members – 3 min read

An authority of a commercial register = both recipient and controller. Handwritten signatures = personal data. Temporary loss of control (e.g. public disclosure) can lead to damage, but harm must be proven. And a few more points in today's CJEU ruling!

Oct 4, 2024

Italy: bank fined €1m and rental company €250k for unclear DPAg and no legal basis

members – 4 min read

The 🇮🇹 Garante fined a bank €1 million for anti-fraud checks as a processor on behalf of a group company without a legal basis, breaching both Articles 28(3) and 5(1)(a). The rental company was separately fined €250,000, also for an insufficient privacy notice. Here are your key takeaways! 💡

Aug 21, 2024

AG Szpunar (C-394/23 Mousse)

members – 2 min read

Advocate General Opinion: On the principles of data minimisation and lawfulness of processing—where the 🇫🇷 CNIL made a somewhat startling decision on what's 'necessary for the performance of a contract'! + remember to spell out your legitimate interest when you collect the data!

Aug 9, 2024

Denmark Google Workspace for Education Chromebook case (Helsingørgate)

members – 9 min read

[15 July: Municipalities complies with Jan order + 🚨 DPA asks for EDPB opinion on the scope of a controller's documentation obligations regarding a processor's use of sub-processors] The Danish DPA's landmark decision of 2022 to ban certain use of Google products and US transfers, is still ongoing.

Jul 15, 2024

🔥 Dutch DPA: Web scraping almost always illegal AND:

members – 2 min read

The 🇳🇱 DPA issued new guidelines for the private sector (public sector one coming) on web scraping, stating it's "almost always illegal", and reiterates their highly controversial claim that ❌ You can't rely on legitimate interest for purely commercial reasons... 🤨

May 10, 2024

Denmark DPA says cookie walls are legal - and not

members – 2 min read

Update 26 Mar 2024: the DPA rejects reopening the cases, upholding that analytics/statistics aren't a necessary part of the alternative to paid access.

Mar 26, 2024