principles - DPO Hub

Denmark Google Workspace for Education Chromebook case (Helsingørgate)

paid – 12 min read

🇩🇰 DPA concludes the case, applies the dreaded EDPB Opinion and signal enforcement change – and shares takeaways in webinar. Must-read if you're in Denmark but crucial to everyone using third-country processors, especially US ones.

Feb 13, 2026

UK ICO fines Capita £14 million for breach after weak security and slow reaction

paid – 8 min read

After first flagging a fine with a potential starting point of £97m, the 🇬🇧 DPA heavily reduced it after several mitigating factors we can all learn from. A decision packed with practical lessons for DPOs, data protection and security teams alike!

Oct 26, 2025

🇮🇪 DPC fines TikTok €530m for China transfers

paid – 3 min read

10 July: DPC launches new investigation into China transfers. Earlier: transparency breach by failing to disclose the third countries involved and didn't explain the nature of the transfers in its privacy policy --> get compliant in six months or stop the transfers (but order paused until Oct).

Jul 22, 2025

CJEU C-40/17 Fashion ID 29 Jul 2019

paid – 4 min read

…

Jun 17, 2025

CJEU C-247/23 Deldits 13 Mar 2025

paid – 2 min read

…

Mar 13, 2025

CJEU C‑829/24 Commission v Hungary 12 Feb 2025 Order

paid – 1 min read

The CJEU fast-tracks a case against Hungary where the European Commission claims violations of multiple EU laws, including the GDPR Articles 5, 6, 9 and 10.

Mar 13, 2025

🇮🇪 DPC fines LinkedIn €310m for illegal behavioural analysis and targeted advertising ('BA & TA')

paid – 7 min read

Key takaways: Lack of lawful basis = loss of control = 'significant damage', lawful bases are notoriously tricky to get right, and most have lots to gain in improving information and transparency. Full decision = a key lesson on legitimate interest and LIAs.

Jan 22, 2025

CJEU C-394/23 Mousse 9 Jan 2025

paid – 5 min read

…

Jan 13, 2025

CJEU C-65/23 K GmbH (Processing of employees’ personal data) 19 Dec 2024

paid – 2 min read

…

Dec 22, 2024

noyb win: 🇳🇱 Dutch DPA fines Netflix €4.75m for lack of information

paid – 1 min read

noyb gets their first big win in their streaming services complaint project, filed in January 2019 against Amazon Prime, Apple Music, DAZN, Flimmit, Netflix, SoundCloud, Spotify and YouTube. Unsurprisingly, Netflix has already objected.

Dec 19, 2024

Italy: bank fined €1m and rental company €250k for unclear DPAg and no legal basis

paid – 4 min read

The 🇮🇹 Garante fined a bank €1 million for anti-fraud checks as a processor on behalf of a group company without a legal basis, breaching both Articles 28(3) and 5(1)(a). The rental company was separately fined €250,000, also for an insufficient privacy notice. Here are your key takeaways! 💡

Aug 21, 2024

France DPA fines Amazon €32m for invasive employee monitoring

paid – 3 min read

[22 March update: Amazon has appealed] The 🇫🇷 CNIL fined Amazon for excessively intrusive monitoring, using several illegal indicators and unsecure video surveillance software, without sufficiently informing employees and visitors.

Mar 22, 2024