Controllers

Recital 93

Article 62

Maatregelen voor aanbieders en gebruiksverantwoordelijken, met name kmo’s, met inbegrip van start-ups

Article 50

Transparantieverplichtingen voor aanbieders en gebruiksverantwoordelijken van bepaalde AI-systemen

Recital 111

Article 26

Verplichtingen van gebruiksverantwoordelijken van AI-systemen met een hoog risico

Recital 73

Recital 74

Recital 171

Recital 165

Recital 158

Recital 133

Recital 23

Recital 72

Recital 27

Recital 29

Recital 10

Recital 140

Article 4

AI-geletterdheid

Recital 161

Recital 155

ECLI:NL:RBOVE:2026:715 Rechtbank Overijssel , 13-02-2026 / ak_25_971

Rechtbank Overijssel

Beroep n.a.v. afwijzing verzoek om inzage in verwerkte persoonsgegevens op grond van de Algemene Verordening Gegevensbescherming (AVG). Beroep ongegrond. Eiser wil inzage in persoonsgegevens in een adviesrapport van het Regionaal Informatie en Expertise Centrum (RIEC). Er zijn geen aanknopingspunten voor het oordeel dat de burgemeester zich niet op het standpunt heeft kunnen stellen dat de geheimhoudingsplicht op grond van de Wet bevordering integriteitsbeoordelingen door het openbaar bestuur (hierna: de Wet Bibob) ertoe leidt dat de beperking op het recht op inzage noodzakelijk en evenredig is ter waarborging van de rechten en vrijheden van anderen. Daarom heeft de burgemeester een zwaarder gewicht kunnen toekennen aan deze geheimhoudingsplicht dan aan de belangen van eiser bij inzage in (de persoonsgegevens in) het RIEC-advies.

ECLI:NL:RBNHO:2026:1171 Rechtbank Noord-Holland , 09-02-2026 / HAA 25/1285

Rechtbank Noord-Holland

AVG. Leerplichtwet 1969. Verzoek om wissen verklaring ex artikel 8 Leerplichtwet 1969. De rechtbank is van oordeel dat het belang van (de zoon van) eiseres niet zwaarder weegt dan het belang van het registreren van zijn gegevens. Het bewaren van gegevens is, in het licht van vorengaande overwegingen, proportioneel en evenwichtig.

ECLI:NL:RBNNE:2026:438 Rechtbank Noord-Nederland , 03-02-2026 / 24/1620

Rechtbank Noord-Nederland

Varia. Deze uitspraak gaat over eisers verzoek om inzage in zijn persoonsgegevens op grond van de Wet politiegegevens. Verweerder heeft dit verzoek gedeeltelijk toegewezen. Eiser is het niet eens met het afgewezen deel in het besluit. Hij voert daartoe een aantal beroepsgronden aan. De rechtbank komt in deze uitspraak tot het oordeel dat zij het beroep niet inhoudelijk kan behandelen, omdat het procesbelang van eiser onvoldoende is aangetoond. Het beroep is niet-ontvankelijk.

ECLI:NL:RBNNE:2026:452 Rechtbank Noord-Nederland , 03-02-2026 / 24/2480

Rechtbank Noord-Nederland

Deze uitspraak gaat over het verzoek van eiser om rectificatie van zijn politiegegevens op grond van de Wet politiegegevens. Verweerder heeft dit verzoek afgewezen. Eiser is het niet eens met de afwijzing en voert daartoe een aantal beroepsgronden aan. Aan de hand van deze beroepsgronden beoordeelt de rechtbank of de afwijzing rechtmatig is. De rechtbank komt in deze uitspraak tot het oordeel dat het beroep ongegrond is. Verweerder heeft zich dus terecht op het standpunt gesteld dat sprake is van een herhaalde aanvraag in de zin van de Awb. Verder biedt alleen de stelling van eiser dat de betreffende gegevens onjuist zijn, onvoldoende aanleiding voor de rechtbank om eiser in zijn standpunt te volgen.

ECLI:NL:RBNNE:2026:439 Rechtbank Noord-Nederland , 03-02-2026 / 24/1473

Rechtbank Noord-Nederland

Varia. Deze uitspraak gaat over het verzoek van eiser om rectificatie van zijn politiegegevens op grond van de Wet politiegegevens. Verweerder heeft dit verzoek afgewezen. Eiser is het niet eens met de afwijzing en voert daartoe een aantal beroepsgronden aan. Aan de hand van deze beroepsgronden beoordeelt de rechtbank of de afwijzing rechtmatig is. De rechtbank komt in deze uitspraak tot het oordeel dat het beroep ongegrond is. Uit de Wpg, in samenhang met het Mandaatbesluit politie 2024, volgt dat er geen territoriale begrenzing geldt als de Wpg van toepassing is. Van een bevoegdheidsgebrek is geen sprake. Verder weerspreekt eiser de juistheid van de betreffende gegevens, maar toont dit niet aan.

ECLI:NL:RBMNE:2026:429 Rechtbank Midden-Nederland , 21-01-2026 / C/16/597768 / HL RK 25-30

Rechtbank Midden-Nederland

AVG verzoek niet ontvankelijk. Veilig Thuis Gooi en Vechtstreek is een bestuursorgaan. Verzoek moet bij de bestuursrechter worden ingediend en niet bij de civiele rechter

Inzage en weigeringsgronden Wpg.

Rechtbank

Gedeeltelijke afwijzing van het verzoek van eiser om inzage in en informatie over de verwerking van zijn persoonsgegevens door de korpschef op grond van de Wpg. Het beroep, voor zover gericht tegen het besluit van 26 januari 2023, is niet-ontvankelijk. Het beroep, voor zover gericht tegen de besluiten van 24 april 2023 en 6 juni 2024, is gegrond, omdat deze besluiten een motiveringsgebrek kennen. De rechtbank ziet geen aanleiding om de rechtsgevolgen van de besluiten in stand te laten. De korpschef heeft het motiveringsgebrek in beroep namelijk niet volledig hersteld. Ook heeft de korpschef geen duidelijkheid gegeven over de – door eiser gemotiveerd betwiste – juistheid van de in het besluit van 24 april 2023 verstrekte informatie dat geen persoonsgegevens van eiser zijn gedeeld met andere instanties/derden.

X v Russmedia Digital SRL, Inform Media Press SRL

CJEU

In deze zaak gaat het in essentie om de verhouding tussen de e-Commerce Richtlijn en de AVG in het bijzonder bij verwerking van bijzondere persoonsgegevens (gegevens over iemands seksueel gedrag, art. 9 AVG). Specifiek draaide het hier om een online advertentieplatform dat anonieme gebruikers de ...

Inzage transactiegegevens. Overwegingen inzake toepassing Maltese uitzondering op inzagerecht.

Hoge Raad

Unibet/Risepoint/Kindred-zaak. Geen misbruik van recht. Wordt verzocht om een overzicht met zijn transactiegegevens. “De voorzieningenrechter is er niet van overtuigd dat [eiser] inzage verzoekt om zijn persoonsgegevens te controleren. Hij stelt dit weliswaar in de dagvaarding, maar heeft hier op...

Toesting Wpg-besluit kan niet via AVG-besluit. Geen profilering

Rechtbank

AVG inzageverzoek - omvang van het geding - Wpg-besluit van de Nederlandse Arbeidsinspectie dat n.a.v. bezwaar is genomen, kent een zelfstandige beroepsprocedure - geen toetsing van Wpg-besluit in dit beroep - minister SZW heeft inzage in de gegevensverwerking heimelijke salafisme-onderzoeken deugdelijk gemotiveerd - profilering artikel 4, lid 4 AVG - beroep ongegrond.

Inzage Wpg gegevens

Raad van State

Beroep ongegrond

Verzoek om informatie in dit geval geen verzoek om inzage ex art. 15 AVG. Relevant in 35 UAVG kader. Berekening van pensioen is geen persoonsgegeven.

Rechtbank

“De rechtbank is van oordeel dat de brief van [verzoeker] niet kan worden opgevat als een verzoek tot het krijgen van inzage in verwerkte persoonsgegevens in de zin van de AVG/UAVG. Weliswaar is een inzageverzoek niet aan een bepaalde vorm/indeling gebonden, maar het moet voor de verwerkingsveran...

Rectificatie justitiële gegevens

Rechtbank

Varia. Wjsg. Awb. Doorzendplicht. Beroep tegen de afwijzing van het verzoek om justitiele gegevens te rectificeren. Verweerder is niet bevoegd om op het verzoek te beslissen. Na ontvangst had hij het verzoekschrift moeten doorzenden naar het bestuursorgaan dat die bevoegdheid wel heeft.

Inzageverzoek politiegegevens terecht weigeringsgronden toegepast en op juiste wijze, m.u.v. toepassen maar niet vermelden een weigeringsgrond.

Rechtbank

Deze uitspraken gaan over de (gedeeltelijke) afwijzing van de verzoeken van eisers om inzage in hun persoonsgegevens op grond van de Wet politiegegevens. De rechtbank heeft alle onder geheimhouding overgelegde stukken zorgvuldig bestudeerd. De rechtbank komt tot het oordeel dat de besluiten van de minister op de verzoeken van eisers een motiveringsgebrek kennen. De beroepen zijn daarom gegrond. De rechtbank ziet echter aanleiding om de rechtsgevolgen van de besluiten in stand te laten. De rechtbank is van oordeel dat de minister de motiveringsgebreken in beroep heeft hersteld en de verzoeken van eisers terecht (gedeeltelijk) heeft afgewezen.

FSV. Inzage. Beroep gegrond vanwege strijd met zorgvuldigheidsbeginsel

Rechtbank

Beroep, verzoek om inzage op grond van artikel 15 AVG, FSV, gegrond

Uitzondering openbare orde bij inzageverzoek incidentenrapport n.a.v. parachutsprong ongeluk

Rechtbank

Heeft verzoeker recht op inzage in incidentenrapport op grond van de artikel 15 AVG naar aanleiding van ongeval bij parachutespringen?

Geen vernietiging persoonsgegevens dossier RvdK, maar wel schadevergoeding voor inzage derden gedurende periode dat deze verwijderd hadden moeten zijn

Rechtbank

AVG. Verzoek van eiser om vernietiging van alle persoonsgegevens die de RvdK over hem heeft verwerkt. De RvdK heeft onvoldoende aannemelijk gemaakt dat derden geen kennis hebben genomen of hebben kunnen nemen van de gegevens die al vernietigd hadden moeten zijn. Gelet op de inhoud van het dossier is het bovendien niet uit te sluiten dat deze gegevens wel degelijk voor het derden toegankelijk zijn geweest. Eiser heeft de gestelde schade in voldoende mate aannemelijk gemaakt. Recht op schadevergoeding. Beroep gegrond.

Woo-zaak met zijdelings de Autoriteit Persoonsgegevens als betrokken partij

Rechtbank

Verzoek om openbaarmaking op grond van de Wet open overheid. Weigeringsgrond artikel 5.1, tweede lid, aanhef en onder i Woo. Het goed functioneren van de Staat, de procespositie van de Staat. Tussenuitspraak. Bestuurlijke lus.

Verhouding Wpg, Woo en AVG

Rechtbank

Afwijzing Woo-verzoek. Sprake van een herhaald verzoek. De Wpg regelt in de artikelen 3, derde lid, 7 en 25 zowel de openbaarmaking als de individuele verstrekking en is daarmee uitputtend. De AVG regelt naast de inzage in persoonsgegevens ook de individuele verstrekking van afschriften. De vangnetbepaling van artikel 5.5 van de Woo vindt, gelet op de gegevens waar eiser om heeft verzocht en waarvoor andere regelingen gelden met een uitputtend openbaarheidsregime en/of een uitputtend bedoeld verstrekkingsregime, geen toepassing. Beroep ongegrond.

Inlichtingen opvragen in kader van Pw mag, ook in dit geval gerelateerd aan het kind van de betrokkene

Rechtbank

Opschorting en intrekking op grond van de PW. Niet gemelde Bitvavo en crypto accounts. Geen schending van privacy ten aanzien van kinderen eiseres. Het college mag immers inlichtingen opvragen omtrent rekeningen en gegevens die op naam van eiseres staan. Zie artikel 6, eerste lid, sub c van de algemene verordening gegevensbescherming voor een grondslag voor verstrekking van de gegevens door eiseres.

Opinion 32/2025 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the CSG Group

EDPB

Opinion 32/2025 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the CSG Group

Opinion 31/2025 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Arcadis Group

EDPB

Opinion 31/2025 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Arcadis Group

Opinion 29/2025 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Illumina Group

EDPB

BCRs & CertificeringOpinion 29/2025 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Illumina Group

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020

Guidelines on data protection by design and by default

Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679

Guidelines on codes of conduct and monitoring bodies

Guidelines 05/2020 on consent under Regulation 2016/679

Guidelines on consent

Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679

Guidelines on derogations of Article 49

Guidelines 10/2020 on restrictions under Article 23 GDPR

Guidelines on restrictions under Article 23 GDPR

Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43 of the Regulation

Guidelines on certification and identifying certification criteria

Guidelines 02/2024 on Article 48 GDPR

Article 48 GDPR provides that: ' Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer...

Version history

Guidelines on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies

Guidelines 04/2022 on the calculation of administrative fines under the GDPR

Guidelines on the calculation of administrative fines under the GDPR

The European Data Protection Board (EDPB) has adopted these guidelines to harmonise the methodology supervisory authorities use when calculating of the amount of the fine. These Guidelines complement the previously adopted Guidelines on the application and setting of administrative fines for the purpose of the Regulation 2016/679 (WP253), which focus on the circumstances in which to impose a fine. The calculation of the amount of the fine is at the discretion of the supervisory authority, ...

Version history

Guidelines on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR

The GDPR does not provide for a legal definition of the notion 'transfer of personal data to a third country or to an international organisation'. Therefore, the EDPB provides these guidelines to clarify the scenarios to which it considers that the requirements of Chapter V should be applied and, to that end, it has identified three cumulative criteria to qualify a processing operation as a transfer: - 1) A controller or a processor ('exporter') is subject to the GDPR for the given processing. -...

Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement

Guidelines on the use of facial recognition technology in the area of law enforcement

More and more law enforcement authorities (LEAs) apply or intend to apply facial recognition technology (FRT). It may be used to authenticate or to identify a person and can be applied on videos (e.g. CCTV) or photographs. It may be used for various purposes, including to search for persons in police watch lists or to monitor a person's movements in the public space. FRT is built on the processing of biometric data , therefore, it encompasses the processing of special categories ...

Version history

Guidelines on the accreditation of certification bodies

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

Guidelines on the territorial scope of the GDPR

Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1)

Guidelines on the criteria of the right to be forgotten in the search engines cases under the GDPR (part 1)

Guidelines 06/2022 on the practical implementation of amicable settlements

Guidelines on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects

Guidelines 9/2022 on personal data breach notification under GDPR

Guidelines on personal data breach notification under GDPR

Richtsnoeren 2/2018 inzake afwijkingen op grond van artikel 49 van Verordening 2016/679

guidelines afwijkingen van artikel 49

Landlord: Insufficient legal basis for data processing

€1,800 fine - Spanish Data Protection Authority (aepd)

The Spanish DPA has imposed a fine of EUR 1,800 on a Landlord. The landlord used video surveillance in rental apartments without having a sufficient legal basis. The original fine of EUR 3,000 was reduced to EUR 1,800 due to immediate payment and admission of responsibility by the controller.

MediaLab.AI, Inc.: Insufficient legal basis for data processing

€284,450 fine - Information Commissioner (ICO)

The UK DPA has imposed a fine of GBP 247,590 (EUR 284,450) on MediaLab.AI, Inc.The controller of the image-sharing and hosting platform Imgur failed to implement age verification. This resulted in the controller processing children's data without sufficient legal basis, as the consent given was not provided by the children's parents or carers.

Tensa Art Design S.A: Insufficient cooperation with supervisory authority

€20,000 fine - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)

The Romanian DPA has imposed a fine of EUR 20,000 onTensa Art Design S.A.The DPA began investigating the controller's data processing activities, but the controller failed to respond to the DPA's requests.

GENPACT ROMANIA SRL: Insufficient technical and organisational measures to ensure information security

€10,000 fine - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)

The Romanian DPA has imposed a fine of EUR 10,000 on GENPACT ROMANIA SRL. The controller suffered a successful cyber attack due to insufficient technical and organisational measures. The attacker was able to exploit vulnerabilities in some passwords and in the way user accounts' authentication could be reset.

Municipality of Delft: Insufficient legal basis for data processing

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Delft. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up

Municipality of Ede: Insufficient legal basis for data processing

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Ede. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up me

Municipality of Huizen: Insufficient legal basis for data processing

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Huizen. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up

Municipality of Veenendaal: Insufficient legal basis for data processing

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Veenendaal. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism steppe

Municipality of Zoetermeer: Insufficient legal basis for data processing

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Zoetermeer. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism steppe

Municipality of Haarlemmermeer: Insufficient legal basis for data processing

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Haarlemmermeer. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism st

FREE TECHNOLOGIES EXCOM, S.L.: Insufficient technical and organisational measures to ensure information security

€10,000 fine - Spanish Data Protection Authority (aepd)

The Spanish DPA has imposed a fine of EUR 10,000 on FREE TECHNOLOGIES EXCOM, S.L. The controller had reset user passwords and communicated the new passwords to the clients via email. However, the email was not encrypted and did not implement any other appropriate security measures.

Municipality of Gooise Meren: Insufficient legal basis for data processing

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Gooise Meren. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism step

Municipality of Hilversum: Insufficient legal basis for data processing

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Hilversum. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped

Municipality of Eindhoven: Insufficient legal basis for data processing

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Eindhoven. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped

Alliance for the Union of Romanians (AUR) Party: Insufficient fulfilment of data subjects rights

€1,000 fine - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)

The Romanian DPA has imposed a fine of EUR 1,000 on the Alliance for the Union of Romanians (AUR) Party. The controller failed to react adequately to a data subject's request to exercise their rights regarding a personal letter containing electoral information.

Municipality of Tilburg: Insufficient legal basis for data processing

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Tilburg. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped u

Natural Person: Non-compliance with general data processing principles

€10,000 fine - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)

The Romanian DPA has imposed a fine of EUR 10,000 on a natural person. The controller operated a website on which identity cards containing personal data, including special category data, possible criminal convictions, data on the intimate lives of data subjects and possible debts, were published. The processing of this data was not based on a sufficient legal basis, and the controller did not ensure that the data was correct, complete or transparent. Furthermore, the controller did not adequate

Sportadmin i Skandinavien AB: Insufficient technical and organisational measures to ensure information security

€565,000 fine - Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)

The Swedish DPA has imposed a fine of EUR 565,500 on Sportadmin i Skandinavien AB. The controller suffered a sucessfull cyber attack, resulting in personal and special category data of 2,126,075 individuals, including minors, beeing published in the darknet. The attack happend due to an succesfull SQL injection on one of the controllers websites, which had not been protected against this kind of attack, granting the attacker access to the controllers server, allowing him to exfiltrate said data.

FRANCE TRAVAIL: Insufficient technical and organisational measures to ensure information security

€5,000,000 fine - French Data Protection Authority (CNIL)

The French DPA has imposed a fine of EUR 5,000,000 on FRANCE TRAVAIL. The controller suffered a successful cyber attack due to insufficient technical and organisational measures, resulting in the leak of personal and special category data concerning 38,820,828 individuals. The attack was carried out using the 'social engineering' method, meaning that the attacker obtained goods or information by exploiting the trust, ignorance or credulity of third parties.

Continental Automotive Products SRL: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen.

Boete van €15.000 - Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP).

De Roemeense Autoriteit voor Persoonsgegevens heeft een boete van 15.000 euro opgelegd aan Continental Automotive Products SRL. De verantwoordelijke partij heeft onvoldoende technische en organisatorische maatregelen genomen, wat heeft geleid tot een cyberincident.

DSB (Austria) - 2024-0.199.724

Corrected and added some links, removed duplicate in short summary. }}}} An DPA denied a complaint against a public body under Articles 9 and 77 GDPR, holding that publication of a data subject’s political donation did not violate the GDPR because the controller had a lawful basis.An DPA denied a complaint against a public body under [[Article 9 GDPR|Articles 9]] and [[Article 77 GDPR|77 GDPR]], holding that publication of a data subject’s political donation did not violate them because the cont

ICO (UK) - Allay Claims Ltd

The controller claimed it relied on the soft opt-in in Regulation 22(3) of the Privacy and Electronic Communications Regulations 2003 (PECR), where an organisation may send direct marketing communications to its customers even if they did not specifically consent to electronic mail. However, only the organisation that collected the contact details can rely on the soft opt-in rule. The controller claimed it relied on the soft opt-in in Regulation 22(3) of the Privacy and Electronic Communications

TI - 9/2026

|Appeal_From_Case_Number_Name=16.07.2025|Appeal_From_Case_Number_Name=16.07.2025 |Appeal_From_Status=|Appeal_From_Status= |Appeal_From_Link=https://www.dataprotection.ro/?page=Comunicat_Presa_16.07.2025|Appeal_From_Link=https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_a_Romanian_politician |Appeal_To_Body=|Appeal_To_Body= |Appeal_To_Case_Number_Name=|Appeal_To_Case_Number_Name= A politician, the operator of a website (the controller), appealed a DPA decision sanctioning him fo

OGS Zagreb - Pn-877/2023-29

English Summary }}}} A court awarded €3,000 to a data subject after finding a news portal violated her privacy under [[Article 5 GDPR]] by publishing her personal data unnecessarily and disproportionately, despite claims of public interest.A court awarded €3,000 in damages to a data subject after finding that a news portal violated her right to privacy by publishing her personal data unnecessarily and disproportionately in two articles, despite the controller’s claims of public interest. == Engl

Article 13 GDPR

Contact details: typo The controller's contact details are necessary for the data subjects to get in touch with the controller and to further exercise their rights under the GDPR. The contact details must enable data subjects to easily contact the controller and should include different forms of communications.The controller's contact details are necessary for the data subjects to get in touch with the controller and to further exercise their rights under the GDPR. The contact details

EDPB identifies challenges hindering the full implementation of the right to erasure

Brussels, 18 February - The European Data Protection Board (EDPB) has adopted a report on its Coordinated Enforcement Framework (CEF) action on the right to be forgotten (Art.17 GDPR). The Board selected this topic as it is one of the most frequently exercised GDPR rights and one about which DPAs frequently receive complaints from individuals. The main objectives of this coordinated action are to ensure that the right to erasure is effectively exercised by individuals in Europe and understand ho

OGS Zagreb - Pn-877/2023-29

Facts The first article reported on payments related to the football club Dinamo Zagreb and included the data subject’s full name, bank account number, and payment amounts. The second article referred to the first article via a hyperlink but did not mention the data subject directly.The first article reported on payments related to the football club Dinamo Zagreb and included the data subject’s full name, bank account number, and payment amounts. The second article referred to the first article

APD/GBA (Belgium) - 23/2026

}}}} The DPA ordered a company to erase the data provided by potential tenants after not entering into a lease agreement with them.The DPA ordered a landlord to erase the data provided by potential tenants after not entering into a lease agreement with them. == English Summary ==== English Summary == In 2023 the data subjects intended to enter into a lease agreement with a company (the controller). The controller requested various information from the data subjects, including identity documents,

CA Paris - 25/04270

}}}} A court held that a former employee cannot receive access to their work email correspondence and files based on an access request when the emails and files only contain the employee’s identification information.A court held that a former employee cannot request access to their work email correspondence and other work-related files when the emails and files only contain the employee’s identification information. == English Summary ==== English Summary == Following his dismissal, the data sub

APD/GBA (Belgium) - 25/2026

}}}} The DPA issued a warning to the Federal Public Service for Finances to ensure compliance with security of personal data processing after an employee accessed the address of an individual and visited her at her home.The DPA issued a warning to the Federal Public Service for Finances after an employee unlawfully accessed the address of an individual in the controller’s database and visited her at her home. == English Summary ==== English Summary ==

VDAI (Lithuania) - Nr. 3R-219 (2.13-1.E)

}}}} The DPA partially upheld a complaint and issued a reprimand against a travel company for unlawful direct marketing, excessive passport copy collection, inaccuracies in travel documents, lack of transparency, and an incomplete access response.The DPA partially upheld a complaint and issued a reprimand against a travel company for unlawful direct marketing, excessive passport copy collection, inaccuracies in travel documents, lack of transparency, and an incomplete response to an access reque

AEPD (Spain) - EXP202306354 (PS/00312/2024)

English Summary The Spanish Data Protection Agency (AEPD) investigated Vodafone España, S.A.U. as controller after a SIM swapping incident.The Spanish Data Protection Agency (AEPD) investigated Vodafone España, S.A.U. as controller after a SIM swapping incident. On 21 September 2021, an unknown third party requested a duplicate SIM card for the mobile line of a data subject. The request was made through Vodafone’s internal telephone support channel for retail stores. The caller impersonated staf

Garante per la protezione dei dati personali (Italy) - 10214411

Facts: typo The Local Territorial Agency for Residential Housing (Azienda territoriale per l’edilizia residenziale) submitted a complaint to the DPA regarding the installation of security cameras by the business “Macelleria La Costata s.r.l.s.”, a local butcher . The Local Territorial Agency for Residential Housing (Azienda territoriale per l’edilizia residenziale) submitted a complaint to the DPA regarding the installation of security cameras by the business “Macelleria La Costata s.r.l.s.”, a

LG Kassel - 10 O 81/24

Link fixed. === Facts ====== Facts === The data subject had a mobile contract with the controller, a telecommunications company, starting 17 April 2019. The contract included privacy notices stating that personal data, including contract initiation, execution, and completion (“positive data”), could be sent to a credit scoring agency for credit scoring, under Articles 6(1)(b) and 6(1)(f) GDPR.The data subject had a mobile contract with the controller, a telecommunications company, starting 17 Ap

VG Osnabrück - 7 A 6/24

Fixed a link. }}}} A court held that a public authority violated Article 12(3) and [[Article 15 GDPR#1|Article 15(1) GDPR]] by failing to respond within one month to an access request and by wrongly requiring a reference date.A court held that a public authority violated [[Article 12 GDPR|Article 12(3)]] and [[Article 15 GDPR#1|Article 15(1) GDPR]] by failing to respond within one month to an access request and by wrongly requiring a reference date. == English Summary ==== English Summary == The

AEPD (Spain) - EXP202306354 (PS/00312/2024)

Facts The Spanish Data Protection Agency (AEPD) investigated Vodafone España, S.A.U. as controller after a SIM swapping incident.The Spanish Data Protection Agency (AEPD) investigated Vodafone España, S.A.U. as controller after a SIM swapping incident. On 21 September 2021, an unknown third party requested a duplicate SIM card for the mobile line of a data subject. The request was made through Vodafone’s internal telephone support channel for retail stores. The caller impersonated staff of an au

VG Düsseldorf - 29 K 9469/23

Facts }}}} The court held that under [[Article 15 GDPR#3|Article 15(3) GDPR]] controllers may lawfully redact third-party data as long as the data subject’s information remains complete and understandable.A court held that under [[Article 15 GDPR#3|Article 15(3) GDPR]] controllers may lawfully redact third-party data as long as the data subject’s information remains complete and understandable. == English Summary ==== English Summary == The data subject was subject to a home visit by the public

UODO (Poland) - DKN.5131.4.2025

English Summary }}}} The DPA fined the Polish national postal operator €232k for a DPO conflict of interest. The DPO concurrently served as a Security Director and company proxy, effectively monitoring their own decisions regarding the means of data processing.The DPA fined the national postal operator €232,000 for appointing a DPO with a conflict of interest. The DPO concurrently served as a Security Director and representative of the controller, effectively monitoring their own decisions regar

AEPD (Spain) - PS-00456-2025

Facts }}}} The DPA fined a business support company with 80,000 euros for transferring personal data from its employees to a third party without the proper legal basis, in violation of Art. 6 (1) GDPR.The DPA fined a customer support provider €80,000 for unlawfully transferring its employees’ private phone numbers to its business customer without a valid legal basis. == English Summary ==== English Summary == === Facts ====== Facts === MAJOREL SP SOLUTIONS, S.A. (the controller) entered into an

CNIL (France) - SAN-2025-014

=== Facts ====== Facts === DEEZER (the controller) notified the French DPA (CNIL) of a data breach affecting 21,574,775 users, out of which 9,849,354 users were located in France. The controller identified Mobius Solutions Ltd (the processor) as the likely source of the data breach. The DPA launched an investigation into the processor.DEEZER (the controller) notified the French DPA (CNIL) of a data breach affecting approximately 46,900,000 users worldwide, out if which 21,574,775 users located i