TOMs - DPO Hub

EDPB Opinion 22/2024: obligations when relying on (sub-)processors

members – 8 min read

📚 You must list all (sub-sub-sub-sub...)processors (name, address, contact person, processing activity, roles & responsibilities) and always verify they've provided 'sufficient guarantees'—though the extent might vary based on risk—also for onwards transfers.

Oct 22, 2024

DPC fines Meta €91m for failing to safeguard passwords and notify breaches

members – 1 min read

And for once, no other DPA objected to the DPC's draft decision. Read their handy one-pager here. 👇

Sep 27, 2024

Norway DPA fines university for insufficient access control in MS Teams

members – 4 min read

The 🇳🇴 University of Agder was fined €12,500 (NOK 150k) for failing to secure personal data on Teams/SharePoint and insufficient internal controls. Short decision, several takeaways for everyone!

Sep 12, 2024

Record GDPR fine from Norway (NAV)

members – 5 min read

Norway's DPA upheld their record NOK 20m fine to the Labour and Welfare Administration (NAV) for several, grave violations.

Apr 11, 2024

Sweden MedHelp 1177 case

members – 8 min read

This case is not only a goldmine for DPOs in the Swedish healthcare sector (although particularly so), but DPOs in general, for assessing roles, legal bases and processor liability.

Feb 22, 2024

CJEU C-340/21 Natsionalna agentsia za prihodite (cybercrime)

members – 7 min read

Unauthorised disclosure or access doesn't equate to inadequate measures, but must be proven to prevent damages claims. National courts must assess your case concretely and cannot systematically rely on expert reports. Mere fear 😱 = non-material damages (but must be proven by the data subject).

Jan 8, 2024

Denmark DPA shares useful security measures catalogue

members – 1 min read

Only in Danish but useful with in-browser translate!

Nov 28, 2023

Denmark DPA criticises processor for poor security

members – 2 min read

…

Nov 13, 2023

Denmark DPA audits 16 banks and municipalities

members – 1 min read

…

Sep 30, 2023

Sweden DPA issues fines and orders controllers to stop using Google Analytics

members – 1 min read

…

Jul 3, 2023

Romania DPA fine for insufficient employee training

members – 1 min read

…

Jan 24, 2023

Romania DPA fine for insufficient employee policies and measures

members – 1 min read

…

Jan 23, 2023