lawfulness - DPO Hub (Page 2)

CJEU C-252/21 Meta Platforms and Others (General terms of use of a social network) 'Bundeskartellamt' 4 Jul 2023

members – 6 min read

The 'Bundeskartellamt' ruling, where the CJEU applies 'strictly' to the legal bases necessity test for the first time. 🔥 You might rely on legitimate interest for direct marketing, network security or product improvement, but the processing must now meet this higher threshold.

Nov 13, 2024

CJEU C-621/22 KNLTB (legitimate interests) 4 Oct 2024

members – 3 min read

Article 6(1)(f) allows disclosure for a commercial interest if the processing is *strictly* necessary and not outweighed by the interests, rights or freedoms of the data subjects. The interest doesn't have to be determined by law, but it must be lawful. And CJEU nudges consent again.

Oct 29, 2024

EDPB Guidelines 1/2024 Legitimate interests (public consultation)

members – 4 min read

The EDPB's recent new legitimate interest guidelines are on public consultation until 20 Nov 2024. Initial analysis: 📝 Document, document, document.

Oct 28, 2024

Italy: bank fined €1m and rental company €250k for unclear DPAg and no legal basis

members – 4 min read

The 🇮🇹 Garante fined a bank €1 million for anti-fraud checks as a processor on behalf of a group company without a legal basis, breaching both Articles 28(3) and 5(1)(a). The rental company was separately fined €250,000, also for an insufficient privacy notice. Here are your key takeaways! 💡

Aug 21, 2024

Denmark Google Workspace for Education Chromebook case (Helsingørgate)

members – 9 min read

[15 July: Municipalities complies with Jan order + 🚨 DPA asks for EDPB opinion on the scope of a controller's documentation obligations regarding a processor's use of sub-processors] The Danish DPA's landmark decision of 2022 to ban certain use of Google products and US transfers, is still ongoing.

Jul 15, 2024

🔥 Dutch DPA: Web scraping almost always illegal AND:

members – 2 min read

The 🇳🇱 DPA issued new guidelines for the private sector (public sector one coming) on web scraping, stating it's "almost always illegal", and reiterates their highly controversial claim that ❌ You can't rely on legitimate interest for purely commercial reasons... 🤨

May 10, 2024

Denmark DPA says cookie walls are legal - and not

members – 2 min read

Update 26 Mar 2024: the DPA rejects reopening the cases, upholding that analytics/statistics aren't a necessary part of the alternative to paid access.

Mar 26, 2024

Sweden MedHelp 1177 case

members – 8 min read

This case is not only a goldmine for DPOs in the Swedish healthcare sector (although particularly so), but DPOs in general, for assessing roles, legal bases and processor liability.

Feb 22, 2024

Sweden court upholds ~$1m fine: major health data leak and forwarding calls to 🇹🇭

members – 2 min read

🇸🇪 MedHelp must pay SEK 11,3 million (~$1m) for leaking 2,7 million health-related conversations (of 170 000 hours) online for several years and no legal basis for forwarding call to Thailand.

Feb 18, 2024

CJEU C-582/14 Breyer (dynamic IP addresses) 19 Oct 2016

members – 2 min read

The CJEU held that not only static IP addresses (ref. Scarlet) are protected personal data under data protection law, but also dynamic ones, and that national laws can't restrict interest which are legitimate under EU law.

Feb 11, 2024

Denmark DPA orders municipalities to ensure Google-sharing compliance

members – 1 min read

🔥 Danish DPA with new decision in their Helsingørgate/Chromebook case!

Jan 30, 2024

EDPB Guidelines 5/2020 on consent

members – 6 min read

A 1-page summary of the EDPB's Guidelines: structure of valid consent, when is it invalid, what to do when it's withdrawn, key highlights and resources.

Dec 20, 2023