# Identification — legal context bundle > Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/identification > Sources are cited per item. Verify against the official texts before relying on them. Methods and processes for identifying individuals ## Overview ## Legal Framework Identification sits at the heart of the GDPR's scope. [Article 4(1)](/laws/gdpr/art-4#par-1) defines personal data by reference to an identified or identifiable natural person, and the concept of identifiability—direct or indirect, through names, identification numbers, online identifiers, or other factors—determines whether the Regulation applies at all. [Article 11](/laws/gdpr/art-11) addresses the converse situation: where a controller's purposes do not require identification, the controller need not acquire additional information solely to comply with the GDPR. If the controller demonstrates it cannot identify the data subject, it must so inform the data subject, and Articles 15–20 do not apply unless the data subject provides additional information enabling identification. > "Member States may further determine the specific conditions for the processing of a national identification number or any other identifier of general application." > — [GDPR Art. 87](/laws/gdpr/art-87) [Article 87](/laws/gdpr/art-87) permits Member States to set specific conditions for national identification numbers, subject to appropriate safeguards. The AI Act's [Recital 17](/laws/ai-act/rec-17) introduces a functional definition of remote biometric identification systems, distinguishing identification (1-to-many) from authentication (1-to-1 verification), with the latter excluded from the remote biometric identification framework due to its comparatively minor rights impact. ## Key Developments The CJEU has consistently applied a broad reading of identifiability. In *Deutsche Post AG v Hauptzollamt Köln*, the Court reiterated the full Article 4(1) definition, confirming that indirect identification through any identifier suffices to bring data within the GDPR's scope. The same formulation appears in *Hauptpersonalrat der Lehrerinnen und Lehrer* and *Nacionalinis visuomenės sveikatos centras*, underscoring that identifiability does not require a name—any factor specific to the person's identity can suffice. Biometric identification has emerged as a particularly contested area. The Dutch Supreme Court in *Hoge Raad, 12-06-2026* addressed whether storing a photograph constitutes processing of biometric data under [Article 9(1)](/laws/gdpr/art-4#par-1) in connection with [Article 4(14)](/laws/gdpr/art-4#par-1). The EDPB's Guidelines 3/2019 clarify that raw video footage is not biometric data unless specifically technically processed for identification purposes: > "The video footage of an individual cannot however in itself be considered as biometric data under Article 9, if it has not been specifically technically processed in order to contribute to the identification of an individual." > — [EDPB Guidelines 3/2019 §37](/posts/38059#seg-37) Enforcement reflects this distinction. The Swedish DPA in *Storstockholms Lokaltrafik* found that audio recordings did not contribute to identifying fare evaders, violating data minimisation under [Article 5(1)(c)](/laws/gdpr/art-4#par-1). The EDPB's Opinion 11/2024 further separates authentication from identification, confirming both involve special-category biometric data but serve functionally distinct purposes. ## Status of the Debate This topic is actively contested in court. The boundaries of what constitutes identification—particularly through biometric processing—remain in flux. The divergence between *Schrems v Meta Platforms Ireland* and *European Commission v Republic of Poland* illustrates the tension: > "at the invitation of the Representation of the European Commission in Austria, Mr Schrems referred to his sexual orientation for the purpose of criticising Facebook's processing of personal data, including the processing of his own data." > — [Schrems v Meta Platforms Ireland](/posts/132159) The core dispute concerns whether publicly disclosed attributes can later serve as identifiers for processing purposes, and whether controllers who theoretically could identify individuals through combination of datasets must be treated as doing so. Courts have not uniformly resolved whether pseudonymised data remains personal data when the controller holds the key separately, though the prevailing doctrinal view treats it as personal data given the possibility of re-identification. ## Practical Guidance - **Assess identifiability contextually**: Determine whether a person can be directly or indirectly identified using all means reasonably likely to be used. If identification is not required for your purposes, document this under [Article 11](/laws/gdpr/art-11) and avoid acquiring additional identifying data. - **Distinguish authentication from identification**: 1-to-1 biometric verification for service access falls outside the AI Act's remote biometric identification rules, but still constitutes Article 9 special-category processing requiring an Article 9(2) exemption and an [Article 6(1)](/laws/gdpr/art-4#par-1) legal basis. - **Apply data minimisation to identification methods**: The *Storstockholms Lokatrafik* decision demonstrates that collecting more data than necessary for identification—such as audio where images suffice—violates [Article 5(1)(c)](/laws/gdpr/art-4#par-1). - **Check Member State rules on national identifiers**: [Article 87](/laws/gdpr/art-87) allows Member States to impose additional conditions on national identification numbers; verify local implementation before relying on such identifiers. - **Document technical processing boundaries**: Raw photographs or video footage are not biometric data under Article 9 unless technically processed for unique identification. Maintain records showing the purpose and method of any biometric processing to demonstrate compliance with the three-criteria test from EDPB Guidelines 3/2019. ## Legislation (full text of key provisions) ### Processing of the national identification number *Source: GDPR, gdpr-art-87-en, 2016-04-27 — https://overview.legal/posts/91433* Member States may further determine the specific conditions for the processing of a national identification number or any other identifier of general application. In that case the national identification number or any other identifier of general application shall be used only under appropriate safeguards for the rights and freedoms of the data subject pursuant to this Regulation. ### Processing which does not require identification *Source: GDPR, gdpr-art-11-en, 2016-04-27 — https://overview.legal/posts/90324* ### Presentation and restriction of calling and connected line identification *Source: ePrivacy Directive, eprivacy-art-8-en, 2002-07-12 — https://overview.legal/posts/132191* ### Identification numbers and lists of notified bodies *Source: AI Act, aiact-art-35-en, 2024-06-12 — https://overview.legal/posts/92528* ### Exceptions *Source: ePrivacy Directive, eprivacy-art-10-en, 2002-07-12 — https://overview.legal/posts/132202* ExceptionsMember States shall ensure that there are transparent procedures governing the way in which a provider of a public communications network and/or a publicly available electronic communications service may override:the elimination of the presentation of calling line identification, on a temporary basis, upon application of a subscriber requesting the tracing of malicious or nuisance calls. In this case, in accordance with national law, the data containing the identification of the calling subscriber will be stored and be made available by the provider of a public communications network and/or publicly available electronic communications service;the elimination of the presentation of calling line identification and the temporary denial or absence of consent of a subscriber or user for the processing of location data, on a per-line basis for organisations dealing with emergency calls and recognised as such by a Member State, including law enforcement agencies, ambulance services and fire brigades, for the purpose of responding to such calls. ### Services concerned *Source: ePrivacy Directive, eprivacy-art-3-en, 2002-07-12 — https://overview.legal/posts/132170* Services concernedThis Directive shall apply to the processing of personal data in connection with the provision of publicly available electronic communications services in public communications networks in the Community, including public communications networks supporting data collection and identification devices. ### Definitions *Source: ePrivacy Directive, eprivacy-art-2-en, 2002-07-12 — https://overview.legal/posts/132169* DefinitionsSave as otherwise provided, the definitions in Directive 95/46/EC and in Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (Framework Directive) ( 8 ) shall apply.The following definitions shall also apply:‘user’ means any natural person using a publicly available electronic communications service, for private or business purposes, without necessarily having subscribed to this service;‘traffic data’ means any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing thereof; ▼M2 ‘location data’ means any data processed in an electronic communications network or by an electronic communications service, indicating the geographic position of the terminal equipment of a user of a publicly available electronic communications service; ▼B ‘communication’ means any information exchanged or conveyed between a finite number of parties by means of a publicly available electronic communications service. This does not include any information conveyed as part of a broadcasting service to the public over an electronic communications network except to the extent that the information can be related to the identifiable subscriber or user receiving the information; ▼M2 ————— ▼B ‘consent’ by a user or subscriber corresponds to the data subject's consent in Directive 95/46/EC;‘value added service’ means any service which requires the processing of traffic data or location data other than traffic data beyond what is necessary for the transmission of a communication or the billing thereof;‘electronic mail’ means any text, voice, sound or image message sent over a public communications network which can be stored in the network or in the recipient's terminal equipment until it is collected by the recipient; ▼M2 ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed in connection with the provision of a publicly available electronic communications service in the Community. ### Recital 17 — remote biometric identification system definition *Source: AI Act, aiact-rec-17-en, 2024-06-12 — https://overview.legal/posts/93716* The notion of ‘remote biometric identification system’ referred to in this Regulation should be defined functionally, as an AI system intended for the identification of natural persons without their active involvement, typically at a distance, through the comparison of a person’s biometric data with the biometric data contained in a reference database, irrespectively of the particular technology, processes or types of biometric data used. Such remote biometric identification systems are typically used to perceive multiple persons or their behaviour simultaneously in order to facilitate significantly the identification of natural persons without their active involvement. This excludes AI systems intended to be used for biometric verification, which includes authentication, the sole purpose of which is to confirm that a specific natural person is the person he or she claims to be and to confirm the identity of a natural person for the sole purpose of having access to a service, unlocking a device or having security access to premises. That exclusion is justified by the fact that such systems are likely to have a minor impact on fundamental rights of natural persons compared to the remote biometric identification systems which may be used for the processing of the biometric data of a large number of persons without their active involvement. In the case of ‘real-time’ systems, the capturing of the biometric data, the comparison and the identification occur all instantaneously, near-instantaneously or in any event without a significant delay. In this regard, there should be no scope for circumventing the rules of this Regulation on the ‘real-time’ use of the AI systems concerned by providing for minor delays. ‘Real-time’ systems involve the use of ‘live’ or ‘near-live’ material, such as video footage, generated by a camera or other device with similar functionality. In the case of ‘post’ systems, in contrast, the biometric data has already been captured and the comparison and identification occur only after a significant delay. This involves material, such as pictures or video footage generated by closed circuit television cameras or private devices, which has been generated before the use of the system in respect of the natural persons concerned. ### Recital 32 — risks of real-time biometric identification law enforcement *Source: AI Act, aiact-rec-32-en, 2024-06-12 — https://overview.legal/posts/93746* The use of AI systems for ‘real-time’ remote biometric identification of natural persons in publicly accessible spaces for the purpose of law enforcement is particularly intrusive to the rights and freedoms of the concerned persons, to the extent that it may affect the private life of a large part of the population, evoke a feeling of constant surveillance and indirectly dissuade the exercise of the freedom of assembly and other fundamental rights. Technical inaccuracies of AI systems intended for the remote biometric identification of natural persons can lead to biased results and entail discriminatory effects. Such possible biased results and discriminatory effects are particularly relevant with regard to age, ethnicity, race, sex or disabilities. In addition, the immediacy of the impact and the limited opportunities for further checks or corrections in relation to the use of such systems operating in real-time carry heightened risks for the rights and freedoms of the persons concerned in the context of, or impacted by, law enforcement activities. ### Recital 95 — post remote biometric identification safeguards *Source: AI Act, aiact-rec-95-en, 2024-06-12 — https://overview.legal/posts/93872* Without prejudice to applicable Union law, in particular Regulation (EU) 2016/679 and Directive (EU) 2016/680, considering the intrusive nature of post-remote biometric identification systems, the use of post-remote biometric identification systems should be subject to safeguards. Post-remote biometric identification systems should always be used in a way that is proportionate, legitimate and strictly necessary, and thus targeted, in terms of the individuals to be identified, the location, temporal scope and based on a closed data set of legally acquired video footage. In any case, post-remote biometric identification systems should not be used in the framework of law enforcement to lead to indiscriminate surveillance. The conditions for post-remote biometric identification should in any case not provide a basis to circumvent the conditions of the prohibition and strict exceptions for real time remote biometric identification. ## Case law ### CJEU - C‑371/24 - Comdribus *Source: Court of Justice of the European Union, 2026-03-19 — https://overview.legal/posts/125595 — original: https://gdprhub.eu/index.php?title=CJEU_-_C‑371/24_-_Comdribus* Facts — In 2020, law enforcement officers arrested several people from a climate protest. One of the individuals detained (the data subject) provided their identity, but refused to be fingerprinted and photographed, as well as to provide the code to their phone (or unlock it themselves). The data subject was later accused before the Paris Criminal Court of unlawfully organising a protest, as well as refusing to provide their data for identification and investigation purposes in accordance with national law . The court found them guilty of not providing their biometric data and fined the data subject €300. Both the data subject and Public Prosecutor appealed the decision to the Paris Court of Appeal. The court requested a preliminary ruling from the CJEU, regarding the compatibility of national law with provisions of the Law Enforcement Directive (LED), taking into consideration previous case law . Specifically, the court had questions regarding the systematic processing of biometric data of a data subject reasonably suspected of having committed or attempted to commit an offense in the context of an investigation, when the data subject has not necessarily been accused of committing an offense. The court referred the following questions: 1. Does the Law Enforcement Directive 2016/680 preclude national legislation from systematically processing identification data from data subjects who are suspected of having committed or attempted to commit an offense? 2. Does the Law Enforcement Directive 2016/680 require national legislation to oblige a competent authority to sufficiently explain why it is strictly necessary to process this data on an individual basis? 3. Does the Law Enforcement Directive 2016/680 preclude national legislation from allowing data subjects to be prosecuted on the basis of refusing to provide identification data, even if they are not prosecuted for or convicted of the offense under which said data was processed? The French Government argued that the national law complies with the strict necessity requirements of the LED. For example, the wording of the law leaves the competent authority the discretion to process non-sensitive data for the purposes of the investigation. In addition, national law provisions strictly limit the processing of biometric data for investigation purposes. Finally, the government questioned the admissibility of the second and third questions, arguing that both concerned matters outside the scope of EU law. Holding — Question 1: systematic collection of biometric data under national law — The court first noted that Article 10 Law Enforcement Directive 2016/680 aims to ensure a higher level of protection for personal data that is considered sensitive by nature (e.g. biometric data), as its processing can create significant risks for data subjects’ fundamental rights. Under Article 10 Law Enforcement Directive 2016/680, processing activities allowed under national law must also be strictly necessary in relation to the purposes of processing this data. This also requires the purposes to be sufficiently precise, and the processing activities to be relevant and respects the principle of data minimisation (Article 4(1)(c) Law Enforcement Directive 2016/680). Therefore, Member States must either delegate the responsibility of complying with these requirements to a competent authority, or include assessment criteria in national law for authorities to follow. In this case, the court found that national law is not compatible with the LED in terms of collecting biometric data in an indiscriminate and generalised manner. This is because it provided for the systematic collection of biometric and genetic data of any person accused of an intentional offense with the purpose of entering them in a record, without also obliging competent authorities to demonstrate first that this data processing is strictly necessary. The court stated that the scope of processing biometric data was particularly broad, as it concerned all data subjects reasonably suspected of having committed or attempted to commit a criminal offense. The court took into consideration the possible interferences with data subjects’ fundamental rights . The court concluded that it was for the referring court to determine whether national law required the police authority to carry out a systematic collection of biometric data, and to verify the data subject’s claim of an automated database containing the fingerprints of 6.5 million data subjects. Question 2: obligation of a competent authority to explain the necessity of the data processing — The court first stated that this question was admissible, as it concerned the obligations of a national competent authority in relation to EU law (Article 10 of the LED). The court then noted that the obligation to implement appropriate safeguards when processing biometric data is connected to data subjects’ fundamental right to an effective judicial remedy (Article 47 CFR). Therefore, a competent authority must provide data subjects with information on why it is “strictly necessary” to process their biometric data to allow them to exercise this right. The court stated that this information could be succinct in order to not compromise the investigation. However, the information must also be sufficiently clear. Furthermore, this obligation was essential in ensuring that a competent authority carries a case by case assessment on whether it is “strictly necessary” to process a data subject’s biometric data, as well as allowing national courts to review the competent authority’s decision. This is especially relevant in relation to the competent authority’s obligation to demonstrate compliance with Articles 4(1)(a) to (c) Law Enforcement Directive 2016/680, as it acts as a controller in accordance with Article 3(8) Law Enforcement Directive 2016/680. In any event, this judicial review cannot compensate for cases where the competent authority is not obliged to state the reasons why the data processing is strictly necessary. Finally, the court noted that this obligation is not an excessive burden for the authority, since it was clear that it may not systematically process biometric data of data subjects reasonably suspected of having committed or attempted to commit an offense. Question 3: refusal to provide biometric data as an offense — The court first stated that this question was admissible, as it was not obvious that the facts in dispute bear no relation to EU law. The court clarified that the LED was also applicable to situations in which a competent authority attempts to process personal data. Therefore, if national law imposes a criminal penalty for refusing to provide this data, this penalty is lawful if it complies with the LED (in essence, the processing must meet the conditions of strict necessity in accordance with Article 10 Law Enforcement Directive 2016/680 and Articles 4(1)(a) to (c) Law Enforcement Directive 2016/680 and 8 Law Enforcement Directive 2016/680). The court stated that the LED does not preclude national law allowing data subjects to be prosecuted on the basis of refusing to provide identification data, even if they are not prosecuted for or convicted of the offense under which said data was processed. However, national law must meet the strict necessity requirement under Article 10 Law Enforcement Directive 2016/680, and the criminal penalty must be proportionate. The court noted that fact that a data subject is reasonably suspected of committing an offense or attempted to commit an offense is not in itself decisive to determine whether the data processing is strictly necessary. In addition, the criminal penalty must be proportionate to the offense, and take into account the individual circumstances of each case. The court concluded that it was for the referring court having jurisdiction to impose a criminal penalty to take into consideration the individual circumstances of the case. ### CJEU - C-205/21 - Ministerstvo na vatreshnite raboti *Source: Court of Justice of the European Union, 2023-01-26 — https://overview.legal/posts/158437 — original: https://gdprhub.eu/index.php?title=CJEU_-_C-205/21_-_Ministerstvo_na_vatreshnite_raboti* Facts — A data subject was accused of a criminal offence and refused to consent to the collection of her genetic and biometric data (Photographs and fingerprints), which the Bulgarian Police required to create a record. The data subject also refused to let the police take a sample for the purpose of creating a DNA profile. In the end, the police did not collect this data. The police went to a Bulgarian Criminal court (Spetsializiran nakazatelen sad), which was also the referring court in this case. Here, the police asked the court to authorise the forced collection of the genetic and biometric data, considering there was enough evidence to convict the data subject of the crime. The police position was mostly based on Bulgatian law (ZMVR, Law of the ministry of Home affairs) authorising the collection of biometric and genetic data for, among the others, law and order purposes. However, the referring court had doubts whether the such law was actually compliant with EU law. This Bulgarian law did refer to Article 9 GDPR, but did not refer to EU directive 2016/680. The latter is an EU directive which concerns the protection of personal data regarding processing of competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. This directive states that the processing of certain special category data, including genetic and biometric data, can be lawful if this is compliant with EU law or national law. The Bulgarian law had even taken over some of the wording from Article 10(a) of this directive for its national provision. The court determined that there were two problems resulting from the fact that this national law contained a reference to the GDPR, but did not mention the aforementioned directive. The first problem was the fact that the GDPR was not applicable to the processing of personal data with regard to criminal investigations, pursuant to Article 2(2)(d) GDPR. The second problem was the fact that Article 9 GDPR prohibited the processing of genetic and biometric data. The court also reiterated that a law enforcement purpose could not fall under one of the exceptions under Article 9(2) GDPR. The referring court referred several questions to the CJEU. The main issue was to know whether the processing of genetic and biometric data for purposes of criminal investigations in this case was permissible under the national law, despite the mention of Article 9 GDPR, and despite the fact that EU directive 2016/680 was not mentioned in the national law. Holding — First, The CJEU determined that both Article 9 GDPR and Article 10 of the directive contain provisions regarding the processing of special categories of personal data, including biometric en genetic data. Second, The CJEU determined that processing of biometric and genetic data by the police authorities could be permissible, as long as this processing fell under Article 10(a) of the directive. This meant that the processing had to be strictly necessary, with adequate safeguards and was provided for in national / EU law, pursuant to Article 52 CFR. However, it could still be unlawful to process this data, when this processing also fell within the scope of the GDPR. Third, The court stated that the requirement of authorised by Union or Member State' law in Article 10a of the directive must be interpreted pursuant to Article 52(1) CFR, which states that any limitation on the exercise of a fundamental right "must be ‘provided for by law". The legal basis which is used for this limitation (in this case, the legal basis was the Bulgarian law), must define the scope of the limitation sufficiently clearly and precisely. This meant that there should not be any uncertainty about the laws concerning - or the conditions of the processing of genetic and biometric data. However, The CJEU also noted that these conditions of processing could vary between the GDPR and the directive. In this context, The CJEU determined that the member states were free to organise their processing operations under either the GDPR or the aforementioned directive. However, member states would have to make sure that there would be no uncertainty about the fact which law would be applicable to different kinds of processing of biometric/genetic data. Fourth, The court also determined that member states were not obligated to cite the directive in the national law itself when they were transposing this directive into national law. It was therefore not necessary for the Bulgarian legislature to mention directive 2016/680 in its transposed national provisions. Fifth, the CJEU noted that national courts had the obligation to explain the national law. For this explanation, the national court had to consider the wording of the directive and the context of the directive. This was an obligation pursuant to Article 288 TFEU, which was applicable to all public bodies of a member state, including national courts. In the present case, where there was an obvious conflict between the GDPR and the directive, the national court had to provide an explanation which would keep the useful working of the directive intact. The CJEU stated that it was up to the national court to determine if the reference to Article 9 GDPR in the Bulgarian law was even correct. The court concluded that it was up to the national court to assess the case. In summary, the Court noted that the processing of the biometric and genetic data by the police could be lawful in this case if it fell under Article 10(a) of the directive. Also, the national implementation of the directive needed to have a sufficiently clear and precise legal basis for the processing of biometric/genetic data by the Bulgarian police. The fact that Article 9 GDPR was mentioned in this law was of no consequence for the legality of this processing, nor was the fact that the directive was not mentioned in the national implementation. However, the explanation by the national court of this Bulgarian law had to be sufficiently precise and clear. Also, this explanation of the national court should state in an unequivocal manner whether certain processing of biometric and genetic data would fall under the directive, or would fall under the GDPR. ### GHAMS - 200.324.736/01 *Source: Court of Appeal Amsterdam, 2024-04-30 — https://overview.legal/posts/125642 — original: https://gdprhub.eu/index.php?title=GHAMS_-_200.324.736/01* Facts — The data subject had a business credit card issued by the controller. In 2021, the controller asked the data subject to identify themselves online by taking a picture of the ID and then taking a selfie of themselves. The data subject wanted to upload a copy of the ID with a watermark on it for fraud prevention purposes (saying, for example: “copy for [the controller]”). The controller, on the other hand, rejected this copy, arguing that the data subject should upload a copy without any writing on it. Therefore, the data subject brought legal proceedings before the District Court of Amsterdam (Rechtbank Amsterdam - Rb. Amsterdam), seeking the court to declare that the controller cannot request an ID copy without the watermark and that the controller should not block the credit card. On 20 April 2022, the District Court of Amsterdam dismissed the data subject’s request. The data subject appealed the decision before the Court of Appeal of Amsterdam (Gerechtshof Amsterdam - GHAMS). They argued that the provisions of the Money Laundering and Terrorist Financing Prevention Act (Wet ter voorkoming van witwassen en financieren van terrorisme – Wwft) do not require that the identification process is performed in the way envisaged by the controller. Therefore, the legal basis provided for by Article 6(1)(c) GDPR cannot be used, since there is no legal obligation to require this kind of identification. Moreover, they argued that the controller should not store the copy of the ID. The controller pointed out that the electronic technique used in the scanning of the ID has currently the highest reliability in the field of authentication and that the use of this technique enables it to recognize high value forgeries of IDs better than with the use of persons trained and educated for this purpose. Holding — First of all, the court noted that the Wwft does not prescribe a way in which the identification should be conducted. Moreover, it pointed out that neither the GDPR nor the Wwft confer the data subject a right to a non-online identification. Secondly, the court noted that Article 13(1)(a) Directive 2015/849 allows the controller to perform the identification through electronic means. Thirdly, the court agreed with the controller’s argument. It held that, since there is an added value in using this ID scanning tool, this use may be considered necessary within the meaning of Article 6(1)(c) GDPR in order to comply with its obligation to conduct a customer due diligence under the Wwft. The court pointed out that, due to the large amount of customers, the controller has a legitimate interest in organizing the identification and verification procedure as uniformly as possible. Fourthly, as for the retention issue, the court noted that the controller is obliged to keep a copy of the proof of identity whose authenticity it has verified by means of the scan pursuant to Article 33(1) Wwft. However, the court highlighted that the controller is obliged to store this data securely. Therefore, the court dismissed the appeal and upheld the judgement of the District Court of Amsterdam. ### W. P. Willems and Others v Burgemeester van Nuth and Others *Source: Court of Justice of the European Union, C-446/12, 2015-04-16 — https://overview.legal/posts/132363 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0446* In Joined Cases C-446/12 to C-449/12, the Court of Justice of the European Union (Fourth Chamber) ruled on a preliminary reference from the Dutch Raad van State regarding whether biometric data collected for passport issuance under Regulation (EC) No 2252/2004 may be stored in and used from central national databases for purposes beyond document issuance. The Court held that while the Regulation does not itself regulate the establishment or use of such databases—leaving that to national law—any secondary storage or use of biometric data must comply with the data protection principles of Directive 95/46/EC and the fundamental rights to privacy and data protection under Articles 7 and 8 of the EU Charter, including requirements of necessity, proportionality, and purpose limitation. No fine was imposed. ### VG Berlin - 42 K 73/25 *Source: Administrative Court Berlin, 2026-05-06 — https://overview.legal/posts/291280 — original: https://gdprhub.eu/index.php?title=VG_Berlin_-_42_K_73/25* Facts — The controller ran 29 outdoor swimming pools in Berlin. In summer 2023, the controller introduced expanded identity verification checks and video surveillance measures due to safety concerns, such as aggressive behaviour and verbal and physical attacks by potential customers (the data subjects). Swimmers aged 14 and older were only granted access to the outdoor pools upon presentation of a photo ID, and video surveillance was implemented in the entry and exit areas. The video footage was stored for 72 hours. The DPA issued the controller a reprimand in August 2025. It held that the identity checks and the video surveillance were not necessary to fulfil the controller’s duties set forth in national law or ensure safety at the swimming pools and found a violation of Article 5(1)(a) GDPR. The controller appealed the DPA decision in September 2025. Holding — The court annulled the DPA decision and held that the identity verification checks and video surveillance had been necessary for the performance of a task carried out in the public interest within the meaning of Article 6(1)(e) GDPR. First, the court pointed out that the processing operations must serve objectives in the public interest in order to be lawful under Article 6(1)(e) GDPR. The aim of both measures was to prevent criminal offences, restore safety at the outdoor swimming pools for swimmers and staff members, and to protect the lives, health, and freedom of these individuals. This requirement was therefore fulfilled. Second, the court held that the criterion of necessity was also satisfied regarding both processing operations. According to the court, there did not appear to be a less intrusive measure that would interfere less with the fundamental rights of the data subjects and improve safety at the pools just as effectively than requiring swimmers to present a photo ID upon entry. Similarly, video surveillance was deemed the only viable option to ensure safety in the exit and entry areas, where the staff were exposed to considerable danger of assaults and threats. The court deemed the restriction to the right of informational self-determination to be relatively minor, since video surveillance was only used in four pools where the risk was high, did not cover the entire pool area, and resulted in recordings that were only stored for 72 hours. ### JH v Policejní prezidium *Source: CJEU, 2025-11-20 — https://overview.legal/posts/51304 — original: https://www.annaberlee.nl/cjeu/62023CJ0057.pdf* HvJ EU 20 november 2025, C-57/23, ECLI:EU:C:2025:905, (JH v Policejní prezidium). ### Criminal proceedings against V.S *Source: Court of Justice of the European Union, C-205/21, 2023-01-26 — https://overview.legal/posts/132297 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0205* In Case C-205/21, the Court of Justice of the European Union (Fifth Chamber) issued a preliminary ruling responding to a request from the Spetsializiran nakazatelen sad (Specialised Criminal Court, Bulgaria) in criminal proceedings against V.S., who refused to consent to the collection of her biometric and genetic data by police. The Court interpreted Directive (EU) 2016/680, addressing the principles of purpose limitation and data minimisation, the lawful processing of biometric and genetic data under Member State law, the concept of "strictly necessary," and the requirement to maintain a clear distinction between personal data of different categories of data subjects in light of Articles 7, 8, 47, 48, and 52 of the EU Charter of Fundamental Rights. No fine was imposed, as the ruling solely provides interpretive guidance on the compatibility of coercive data collection from accused persons with EU data protection law. ### RL v Landeshauptstadt Wiesbaden *Source: Court of Justice of the European Union, C-61/22, 2024-03-21 — https://overview.legal/posts/132266 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0061* The Court of Justice of the European Union (Grand Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden in proceedings between RL and the Landeshauptstadt Wiesbaden concerning RL's request for an identity card without fingerprints, which the city rejected. The core issue was the validity of Regulation (EU) 2019/1157, particularly Article 3(5), which obliges Member States to include two fingerprints in the storage medium of EU citizens' identity cards, and whether the regulation was validly adopted under Articles 21(2) and 77(3) TFEU and complies with Articles 7 and 8 of the Charter of Fundamental Rights. The Court upheld the regulation's validity, finding the legal basis appropriate and the fingerprint storage requirement a proportionate interference with fundamental rights that is justified by the objective of strengthening identity document security and preventing fraud, while also clarifying Member States' obligation to conduct data protection impact assessments under Article 35 of GDPR for the national implementing measures. ### CE - N. 433539 *Source: Supreme Administrative Court, 2026-04-30 — https://overview.legal/posts/122869 — original: https://gdprhub.eu/index.php?title=CE_-_N._433539* Facts — Several digital rights organisations asked the Prime Minister to repeal Decree No. 2010-236 of 5 March 2010. The decree regulated an automated personal data processing system used by the French authority for freedom of communications (ARCOM, hereinafter the French authority) for France’s online copyright enforcement mechanism, known as the graduated response procedure. Under this system, the French authority could receive IP addresses linked to alleged copyright infringements and request the corresponding subscriber identity data from electronic communications operators. This data could then be used to send warnings to subscribers and, in repeated cases, refer the matter to the public prosecutor. The applicants argued that the decree allowed the French authority to access personal data linked to IP addresses without sufficient safeguards under EU law. The court had previously referred questions to the CJEU, which ruled in Case C-470/21 that such access may be allowed, but only under strict conditions. Following the CJEU judgment, the court reviewed whether the French decree complied with EU law. Holding — The court partly upheld the action. First, the court held that EU law allows the general and indiscriminate retention of IP addresses for combating criminal offences in general only where serious interference with private life is effectively excluded. This requires strict separation between different categories of retained data, secure technical safeguards and regular monitoring by an independent public authority. The court found that French law did not require electronic communications operators to retain subscriber identity data and IP-related data under these conditions. Therefore, the decree was unlawful insofar as it allowed the French authority to process data that had not necessarily been retained in compliance with EU-law safeguards. Second, the court held that the French authority may access subscriber identity data linked to IP addresses in order to identify persons suspected of online copyright infringements and send the first two warnings under the graduated response procedure. However, the court distinguished the third access to such data. At that stage, the authority is no longer dealing with an isolated identification request: it has already linked the same person’s identity twice with alleged unlawful online activity and with the protected works concerned. A third access therefore allows the authority to build a more detailed picture of the person’s conduct and may reveal sensitive aspects of their private life. It also marks a more serious procedural stage, since it may lead to a registered letter and ultimately to referral to the public prosecutor. For that reason, EU law requires prior authorisation by a court or an independent administrative body before this third access takes place. The decree did not provide for such prior review, so the court held that it was unlawful to that extent. For this third access, EU law requires prior authorisation by a court or an independent administrative body. The decree did not provide for such prior review. The court therefore held that the decree was unlawful to that extent. The court annulled the Prime Minister’s refusal to repeal the unlawful parts of the decree and ordered their repeal. It also held that the French authority must stop applying the unlawful provisions. However, the French authority may still access identity data for the first and second warnings, and may request access in serious copyright offence cases under the conditions set out in the judgment. ### HvJ EU 9 januari 2025, C‑394/23 (Mousse). *Source: CJEU, 2025-01-09 — https://overview.legal/posts/50377 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0394* HvJ EU 9 januari 2025, C‑394/23 (Mousse). Artikelen: 5(1)(c), 6(1), en 21 AVG Onderwerp : Beginsel van minimale gegevensverwerking Gek genoeg verwijst het HvJ EU zelf niet naar HvJ EU 1 augustus 2022, C‑184/20 (Vyriausioji tarnybinės etikos komisija), maar dat had hier ook heel logisch geweest. ### French Conseil d'État strikes down GendNotes police app decree for excessive special data *Source: CE, 2021-04-13 — https://overview.legal/posts/125663 — original: https://gdprhub.eu/index.php?title=CE_-_439360* Facts — In February 2020 the French minister of the interior enacted the Decree No. 2020-151 of 20 February 2020 authorising the automated processing of personal data known as "mobile note-taking application" (Décret n° 2020-151 du 20 février 2020 portant autorisation d'un traitement automatisé de données à caractère personnel dénommé «application mobile de prise de notes» (GendNotes)). The app should be used on the occasion of preventive actions, investigations or interventions necessary for the exercise of judicial or administrative police missions. Among the data that can be collected is information relating to alleged racial or ethnic origin, political, philosophical or religious opinions, trade union membership, health or sexual activities or orientation. A group of human rights organisations filed a complaint with the French Constitutional Court. Dispute — Is the "GendNotes" App of the French national police force (Gendarmerie nationale) unlawfully processing special category personal data? Holding — The French Highest Administrative Court held that the decree infringed Article 4 of the Law of 6 January 1978, implementing GDPR in France, the Council of Europe Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data and Article 8 CFR, as it excessively infringed upon the right to respect for private life and the correlative right to protection of personal data, without providing appropriate safeguards for their protection in terms of the purpose of the processing and the nature of the data collected, as well as excessive data retention period, data sharing and data security. The Court discussed whether the decree violated Article 4 (a) GDPR, Article 4 (b) GDPR, Article 4 (c) GDPR, and Article 4 (e) GDPR and Article 9 GDPR. According to the Court, the processing of data did not comply with the principle of purpose limitation, as data is collected for future investigations or proceedings. However, the Court did not find a violation on the collect of special category data, given the fact that the decree establishes that this data can only be processed in case of "absolute necessity". Additionally, the Court noted that, even if the decree provides a limitation for the storage of the data, in practice this can be ignored, as the data may be used in different or further investigations, that would impede its erasure. However, they found that the decree was lawful in this regard, given that it clearly stated a retention period of 3 months to 1 year. Taken the above-mentioned into account, the French Highest Administrative Court decided that the data processed by the French national police force can no longer be used "in other data processing, in particular by means of a pre-information system". Therefore, the Court held: In Article 1° of the decree, the words "in other data processing, in particular by means of a pre-information system," are cancelled out. The State will pay €3,000 to every claimant. The rest of the application is rejected. The allowance to collect special category data is not overruled, as the Court argues that the decree only allows it when it is "absolutely necessary". This decision will be notified to the claimants: the Ligue des droits de l'homme, the associations Homosexualités et socialismes and Internet Society France, the associations Mousse, Stop Homophobie, Adheos and Familles A, the association AIDES, the Syndicat de la magistrature, the Syndicat des avocats de France, the Conseil national des barreaux, the Quadrature du Net and the International League against Racism and Anti-Semitism, the Prime Minister and the Minister of the Interior. ### Staatssecretaris van Justitie en Veiligheid v A and Others *Source: Court of Justice of the European Union, C-70/18, 2019-10-03 — https://overview.legal/posts/132337 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0070* The CJEU ruled on a preliminary reference from the Dutch Council of State in Case C-70/18, Staatssecretaris van Justitie en Veiligheid v. A, B, and P, addressing whether the Netherlands' obligation for Turkish nationals to provide biometric data for residence permits constitutes a "new restriction" under the standstill clauses of Article 7 of Decision No. 2/76 and Article 13 of Decision No. 1/80 of the EEC-Turkey Association Agreement. The Court held that requiring the collection, registration, and retention of biometric data in a central filing system does amount to a new restriction within the meaning of those provisions, but may be justified by the overriding public interest objective of preventing identity and document fraud, provided the measure is proportionate and complies with Articles 7 and 8 of the Charter of Fundamental Rights regarding respect for private life and protection of personal data. No fine was imposed, as the ruling was limited to interpretive guidance for the referring national court. ## Guidance ### Opinion 11/2024 on the use of facial recognition to streamline airport passengers’ flow (compatibility with Articles 5(1)(e) and(f), 25 and 32 GDPR) *Source: EDPB, opinion-112024-on-the-use-of-facial-recognition-to-streamline-en, 2024-05-24 — https://overview.legal/posts/125750 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-112024-on-the-use-of-facial-recognition-to-streamline_en* A dopted Opinion 11/2024 on the use of facial recognition to streamline airport passengers’ flow (compatibility with Articles 5(1)(e) and(f), 25 and 32 GDPR Version 1.1 Adopted on 23 May 20 24 Adopted 1 Version 1.1 28 May 2024 Grammatical correction in the E xecutive summary (pages 3 and 4) and paragraphs 77 and 90 of the Opinion Version 1.0 23 May 2024 Adoption of the Opinion Adopted 2 Executive summary The French Supervisory Authority requested the European Data Protection Board to issue an… ### EDPB-EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) *Source: EDPB, edpb-edps-joint-opinion-52021-on-the-proposal-for-a-regulation-of-the-en, 2021-06-18 — https://overview.legal/posts/126016 — original: https://www.edpb.europa.eu/documents/legislative-opinion/edpb-edps-joint-opinion-52021-on-the-proposal-for-a-regulation-of-the_en* 1 Adopted EDPB - EDPS Joint Opinion 5 /2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmo nised rules on artificial i ntelligence (Artificial Intelligence Act) 18 June 2021 2 Adopted Executive Summary On 2 1 April 2021, the European Commission presented its Proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (hereinafter “the Proposal”) . The EDPB and the EDPS welcome… ### Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement *Source: EDPB, edpb-guidelines-on-the-use-of-facial-recognition technology-in-the-area-of-law-enforcement, 2023-05-17 — https://overview.legal/posts/38075 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-052022-on-the-use-of-facial-recognition-technology-in-the-area-of_en* More and more law enforcement authorities (LEAs) apply or intend to apply facial recognition technology (FRT). It may be used to authenticate or to identify a person and can be applied on videos (e.g. CCTV) or photographs. It may be used for various purposes, including to search for persons in police watch lists or to monitor a person's movements in the public space. FRT is built on the processing of biometric data , therefore, it encompasses the processing of special categories ... ### Guidelines 3/2019 on processing of personal data through video devices *Source: EDPB, edpb-guidelines-on-processing-of-personal-data-through-video-devices, 2020-01-30 — https://overview.legal/posts/38059 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-32019-on-processing-of-personal-data-through-video-devices_en* The European Data Protection Board (EDPB) adopted Guidelines 3/2019 to provide comprehensive guidance on the processing of personal data through video devices,including CCTV and smart camera systems, under the GDPR. The guidelines address key issues such as the scope of application, the household exemption, lawfulness of processing under Article 6(1)(f) GDPR (legitimate interests), data subjects' rights, and obligations of controllers, while also clarifying the boundary with the Law Enforcement Directive (EU 2016/680). The guidelines were adopted on 29 January 2020 following public consultation and do not impose fines but serve as interpretative guidance for controllers and supervisory authorities. ### EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( *Source: EDPB, edpb-edps-joint-opinion-22026-proposal-en, 2026-02-11 — https://overview.legal/posts/53739 — original: https://www.edpb.europa.eu/our-work-tools/our-documents/edpbedps-joint-opinion/edpb-edps-joint-opinion-22026-proposal_en* EDPB, EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus) ### Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive *Source: EDPB, edpb-guidelines-on-technical-scope-of-art-53-of-eprivacy-directive, 2024-10-16 — https://overview.legal/posts/38063 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-22023-on-technical-scope-of-art-53-of-eprivacy-directive_en* The European Data Protection Board (EDPB) issued Guidelines 2/2023 to clarify the technical scope of Article 5(3) of the ePrivacy Directive, focusing on its application to emerging tracking technologies that operate as alternatives to cookies. The guidelines establish three key elements—information, terminal equipment, and gaining access/storage—to determine whether specific technical operations require user consent. The document applies this framework to common use cases such as URL and pixel tracking, local processing, IP-based tracking, intermittent IoT reporting, and the use of unique identifiers. ### Opinion 26/2018 on the draft list of the competent supervisory authority of Luxembourg regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) *Source: EDPB, opinion-262018-on-the-draft-list-of-the-competent-supervisory-en, 2018-12-04 — https://overview.legal/posts/126264 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-262018-on-the-draft-list-of-the-competent-supervisory_en* 1 Adopted EDPB Plenary meeting, 04/05.12.2018 Opinion 26 /2018 on the draft list of the competent supervisory authority of Luxembourg regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Adopted on 4 December 2018 2 Adopted TABLE OF C ONTENTS 1 Summary of the Facts ................................ ................................ ................................ ..................... 4 2 Assessment… ### Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision *Source: EDPS, 2026-01-09-opinion-22026-directive-amending-directives-eu-20162341-and-201697-regards-strengthening-, 2026-02-11 — https://overview.legal/posts/51418 — original: https://www.edps.europa.eu/data-protection/our-work/publications/opinions/2026-01-09-opinion-22026-directive-amending-directives-eu-20162341-and-201697-regards-strengthening-framework-occupational-retirement-provision_en* EDPB - EDPS JOINT OPINION 2 /2026 On the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus) Adopted on 1 0 February 2026 2 4 Executive summary On 19 November 2025, the European Commission (the ‘Commission’) issued a Digital Omnibus p roposal 1 amending a large corpus of the EU digital legislation, including the GDPR, the Single Digital Gateway Regulation, the EUDPR, the Data Act, the ePrivacy Directive, the Cybersecurity Directive, NIS… ## Enforcement decisions ### Finnish DPA: requesting address, ID number and strong authentication for access request *Source: Tietosuojavaltuutetun toimisto (Finland), 2026-07-22 — https://overview.legal/posts/184713 — original: https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_TSV/4630/2023* Facts — A company that provides comparison services for loans and financial products (the controller) received a loan application submitted on the data subject’s behalf in October 2022. The data subject made an access request in November 2022 – they suspected the misuse of their personal data as they had not submitted the loan application themselves. The data subject provided their name, phone number, and email address as identifying information in connection with the access request. The controller did not provide the requested information; instead, it asked the data subject to disclose their residential address and personal identification number as well as to sign the access request electronically using strong authentication in order to verify their identity. The data subject refused to comply with this request and filed a complaint with the DPA, stating that the controller’s procedure for verifying the identity of the data subject in connection with an access request violated Articles 5(1)(c), 12(2) and (6), and 25(2) GDPR. The controller considered the additional information necessary to identify the correct individual and avoid providing the data subject’s information to an unauthorised third party. Holding — The DPA found no GDPR violation and held that the controller was entitled to request the data subject to provide additional information necessary to verify their identity pursuant to Article 12(6) GDPR. The controller’s procedure was also in line with the principle of data minimisation laid down in Article 5(1)(c) GDPR. According to the DPA, the personal data originally provided by the data subject when making the access request could not be considered sufficient identifying information since several people might have the same name and the email address and the phone number of the data subject could also be known to third parties. The DPA considered that the controller had a legitimate reason to request that the data subject provide additional information to verify their identity, as the controller processes personal data concerning the financial status of its customers. ### AEPD sanctions Iberdrola Clientes for improper identity verification and unauthorized *Source: AEPD (Spain), 2026-09-16 — https://overview.legal/posts/353975 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_EXP202406239* Facts — Iberdrola Clientes, S.A.U., an electricity retailer of the Iberdrola group (the controller), verified the identity of customers calling its call centres under an internal guide dated 19 March 2023. Under this protocol, a caller passed the identity check (PSI) by providing 4 out of 9 possible categories of data, such as surname, national ID number (DNI), contract reference, address, telephone number, e-mail address, bank account or supply point code (CUPS). According to the controller, on 20 January 2023 the data subject called to request a copy of an invoice and provided an e-mail address, which the controller then linked to the contract as a permanent contact address. The e-mail address belonged to the data subject's daughter. No recording of the call was kept, nor any record of the data requested to verify the caller's identity. On 22 November 2023, the distributor of the group sent an e-mail concerning a request to modify the technical conditions of the data subject's contract to that address. On 17 January 2024, the distributor informed the data subject that the controller had provided the address. The data subject denied ever having given it as a contact address and filed a complaint with the DPA. The DPA initially declared the complaint inadmissible, but admitted it after the data subject successfully appealed that decision internally. On 17 January 2025, the DPA opened sanctioning procedure PS/00459/2024 against the controller for a violation of Article 32 GDPR. On 14 January 2026, the DPA imposed a fine of €1,000,000 under Article 83(4)(a) GDPR and, under Article 58(2)(d) GDPR, ordered the controller to demonstrate within three months the adoption of security measures adequate to the risk, including protocols guaranteeing identity verification. On 16 February 2026, the controller filed an internal appeal (recurso de reposición, file EXP202406239). It argued that (i) the DPA had ignored its submissions to the proposed resolution, causing a violation of its right to be heard and the nullity of the decision; (ii) the DPA had violated the presumption of innocence by imposing the fine without sufficient evidence or reasoning; (iii) the DPA had applied impermissible strict liability, since no intent or negligence had been established; (iv) the fine was disproportionate, in particular compared with a €500,000 fine imposed on a bank in file EXP202500113 for an incident the controller considered more serious; (v) the DPA had not considered mitigating factors; and (vi) the corrective measures had lost effect because, in the controller's view, the final resolution had not included them. Holding — The DPA rejected all grounds of appeal and confirmed the fine of €1,000,000 and the corrective order. First, on the alleged violation of the right to be heard, the DPA held that no submissions to the proposed resolution had ever been received, neither around the date claimed by the controller (14 November 2025) nor under the registry number it cited, and that the controller had not even attached the alleged proof of filing to its appeal. Since the controller had been able to make submissions at every stage of the procedure, no violation of its right of defence had occurred. The DPA also recalled, under Article 118 LPACAP, that facts and documents which a party could have submitted during the hearing phase but did not cannot be taken into account when deciding an appeal. Second, on the presumption of innocence, the DPA held that the sanctioning resolution had established, on the basis of the documents in the file, that the verification protocol did not meet the requirements of Article 32 GDPR. The guide listed nine categories of data but did not specify which four an agent had to request in each case or according to which criteria. The data used were static and, in many cases, easily accessible to third parties, and allowing verification with any 4 of 9 categories widened the combinations an unauthorised third party could know or deduce. The DPA held that this did not amount to multi-factor verification, since the system combined only personal data of the holder without any additional authentication factor such as passwords or one-time codes. It also held that the guide itself allowed agents to update a customer's telephone number or e-mail address when these appeared spontaneously during a conversation, without asking for the customer's confirmation, which could compromise future authentication and the accuracy of the database. Finally, the lack of any record of which data were requested and provided during verification made it impossible to reconstruct the process in case of an incident or audit, contrary to Article 32(1)(b) GDPR and the accountability duty in Article 24 GDPR. Third, on strict liability, the DPA held that the infringement had been committed at least negligently. Citing the CJEU judgment of 5 December 2023, C‑807/21 (Deutsche Wohnen), and Spanish case law, it noted that a controller can be fined under Article 83 GDPR when it could not have been unaware of the infringing nature of its conduct. Although Article 32 GDPR imposes an obligation of means rather than of result, an entity of the controller's size could not be considered to have adopted measures adequate to the risk when its verification, traceability and database update procedures showed clear deficiencies. Fourth, on proportionality, the DPA held that the fine was calculated under the GDPR's own system, which applies as lex specialis over the general rules of administrative law. Starting from a turnover of €11,353,755,000, the maximum fine under Article 83(4) GDPR was €227,075,100. To set the level of seriousness under Article 83(2) GDPR and the EDPB Guidelines 04/2022 on the calculation of administrative fines, the DPA considered that all of the controller's customers were potentially affected (contextualised with the figure of 7,146,778 supply points), that the infringement lasted more than 18 months, and that the data at stake, including DNI and bank account numbers, qualified as sensitive within the meaning of the Guidelines even though they were not special categories under Article 9 GDPR. Negligence was assessed as neutral. As aggravating factors, the DPA applied Article 83(2)(e) GDPR, given a previous infringement in PS/00398/2021, and Article 76(2)(b) LOPDGDD in relation to Article 83(2)(k) GDPR. It rejected the comparison with the €500,000 fine in EXP202500113, since that bank had a turnover more than ten times lower, an infringement lasting less than six months and no prior sanctions. Fifth, the DPA rejected the mitigating factors invoked, holding that circumstances which the law defines as aggravating cannot be applied as mitigating, and that cooperation with the supervisory authority is an obligation under the GDPR rather than a mitigating factor. Sixth, the DPA dismissed the claim that the corrective measures had lost effect, pointing out that both the legal reasoning and the operative part of the sanctioning resolution expressly ordered the controller to demonstrate, within three months, the adoption of technical and organisational security measures adequate to the risk, including identity verification protocols. ### DPC (Ireland) - 06/SIU/2018 *Source: DPC (Ireland), 2023-08-22 — https://overview.legal/posts/125614 — original: https://gdprhub.eu/index.php?title=DPC_(Ireland)_-_06/SIU/2018* Facts — The Irish DPC started an own volition inquiry into processing operations carried out by the Galway County Council (the controller), focusing mainly into the surveillance technologies deployed by state authorities, including the Galway County Council and by the An Garda Síochána (the Irish police). More specifically, the Galway County Council Officials make use of CCTV systems, body-worn cameras and automated number plate recognition (ANPR) technologies for various purposes including law enforcement purposes. The DPC carried out its assessment both on the basis of the GDPR and of the Law Enforcement Directive (LED) for activities meant to prevent, investigate, detect and prosecute crime or for the execution of criminal penalties. Holding — In its inquiry, the DPC assessed the legitimacy of processing activities by the controller in light of both the GDPR and the Irish Data Protection Act and the LED, as different processing activities pursued different purposes. The DPC held with respect to body-worn cameras and ANPR systems that the GDPR applies to these processing activities as they mainly serve health and safety and traffic management purposes respectively, thus no law enforcement purposes. Making reference to the strict interpretation in CJEU jurisprudence, the DPC held that in order for a processing activity to fall under the scope of the LED, it must be specifically and concretely used for law enforcement purposes and it does not suffice that the data could potentially (emphasis added) be processed for law enforcement purposes. Firstly, as regards ANPR cameras used for traffic management, the DPC held that the latter enable identification of data subjects within the vehicle and thus constitutes processing of personal data. The legal basis referred to by the Council is Article 6(1)(e) GDPR. The DPC held that processing ex Article 6(1)(e) GDPR, read in light of Article 6(3) GDPR and Recital 41 GDPR requires a legal basis to set out the conditions for processing clearly, precisely and in a foreseeable way. In this case, the DPC held that the use of ANPR cameras does aid to the traffic management function of officials but it may also have significant impacts on the rights and freedoms of data subjects. The DPC concluded that the national provisions relied on by the controller to make use of such cameras are too broad and cannot constitute a legal basis for the Council to deploy APNR cameras for traffic management purposes. Hence, the DPC found the Council had acted in violation of Article 5(1)(a) GDPR. In addition to this, the DPC considered whether the controller complied with its Article 24(1) GDPR obligation to adopt appropriate technical and organizational measures to ensure and demonstrate GDPR-compliant processing activities, also by means of a data protection policy as per Article 24(2) GDPR. The DPC held that the controller failed to comply with its obligation under Article 24(1) GDPR with respect to the use of ANPR cameras for traffic management purposes as it failed to demonstrate compliance with the GDPR. Further, the DPC also found the controller had failed to comply with its obligation to carry out a Data Protection Impact Assessment by virtue of Article 35(1) GDPR for the use of APNR cameras for the systematic monitoring, tracking and observing of individuals. Secondly, the DPC considered the use of a body-worn camera by a Housing Tenacy Officer who had been threatened while conducting official activities. The legal basis relied upon by the Council in this case was Article 6(1)(d) GDPR, which allows for processing activities that are necessary to protect the vital interest of an individual. Further the Council also relied on Article 6(1)(e) GDPR as it is required to comply with health and safety obligations towards its employees set out in two specific Acts. As regards the use of body-worn cameras on the basis of Article 6(1)(d) GDPR, the DPC held that the controller failed to carry out a test for proving the necessity of the use of such cameras before their actual use. Hence, the controller failed to prove that such measure was necessary to protect the vital interest of the officer or to perform a task in the public interest. As for the use of such cameras on the basis of Article 6(1)(e) GDPR, the DPC held that again the controller did not rely on a clear, precise and foreseeable provision in the law allowing specifically for the body-worn cameras to be used. In this case too, the DPC held that the Council had infringed Article 5(1)(a) GDPR. Lastly, the DPC held that the controller infringed Article 24(1) GDPR to the extent that it failed to raise staff awareness on the principles of data processing, which counts as an organizational measure to be adopted by the controller under Article 24(1) GDPR. With respect to all the above mentioned violations, the DPC decided to adopt the following corrective powers: it provisionally banned the use of body-worn cameras and APNR cameras until a valid legal basis is identified and issued a reprimand concerning the violation of Article 24 GDPR. The rest of the activities carried out by the Galway County Council were assessed in light of the provisions of the LED, and the DPC found several violations in that respect too. ### AEPD fines El Español for publishing video of minor assailant without anonymization *Source: AEPD (Spain), 2026-09-16 — https://overview.legal/posts/184546 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_PS-00304-2024* Facts — El León de El Español Publicaciones, S.A., the controller, operates the Spanish digital newspaper „El Español“. It published an article concerning an assault and embedded a video showing both the victim and the assailant, who was a minor. Their image and voice were disclosed without applying techniques to prevent their direct or indirect identification. The controller also published the video through its accounts on two social media platforms. The DPA initiated preliminary investigations ex officio after becoming aware of the dissemination of the video. It ordered the controller, as a precautionary measure, to immediately remove the content from the relevant URLs. The controller subsequently informed the DPA that it had removed the article and prevented access through both external links and its internal search engine. The DPA verified that the video was no longer available through the identified web addresses. The DPA subsequently initiated disciplinary proceedings for a potential infringement of Article 5(1)(c) GDPR. The controller argued that the incident was newsworthy, the video had already gone viral and the publication was protected by freedom of information. It also claimed that the video was necessary to understand the news and that the assailant’s status as a minor should be assessed in light of his apparent maturity and awareness that he was being recorded. Holding — The DPA found that the controller violated the data minimisation principle under Article 5(1)(c) GDPR. The DPA clarified that the proceedings did not concern whether the incident was newsworthy or whether the controller could report on it. Instead, the relevant question was whether publishing the identifiable image and voice of the individuals was necessary and proportionate for that purpose. According to the DPA, freedom of information and the right to data protection are not absolute. Under Article 85 GDPR, they must be reconciled on a case-by-case basis. In this case, the controller could have informed the public about the incident while using technical measures, such as blurring the individuals’ faces or altering the audio, to prevent their identification. Showing the individuals in an identifiable manner was therefore not necessary to achieve the journalistic purpose. The DPA also rejected the argument that the previous virality of the video justified its republication. Each additional publication contributed to the further dissemination of the personal data and amplified the risks and adverse effects for the data subjects. Similarly, the fact that the affected individuals had not submitted a complaint did not prevent the DPA from exercising its supervisory powers ex officio. The DPA gave particular weight to the vulnerability of the victim and to the fact that the assailant was a minor. It held that the best interests and enhanced protection of minors had to be taken into account irrespective of the minor’s alleged maturity or awareness of being recorded. The age at which a minor may consent under Article 7 LOPDGDD did not reduce the controller’s obligation to assess whether the disclosure was necessary. The DPA further noted that, pursuant to Articles 5(2) and 25 GDPR, the controller was required to assess and document the risks of the processing and implement data protection by design and by default. As a professional media organisation regularly processing personal data, the controller was expected to apply a particularly high standard of diligence and to consider less intrusive methods of publication. When determining the sanction, the DPA considered the unrestricted online dissemination of the data, the potentially unlimited audience, the controller’s negligence, the sensitive circumstances surrounding the victim and the minor, and the impact of the infringement on the rights of a minor. It therefore imposed a €20,000 fine. Under Article 58(2)(d) GDPR, the DPA also ordered the controller to demonstrate, within three months after the decision became enforceable, that it had adopted measures to prevent the excessive publication or dissemination of personal data, particularly data concerning minors. It made the earlier precautionary measure definitive and required the permanent removal of the content, while allowing its restricted preservation where necessary as evidence for administrative, police or judicial proceedings. ### UAB VS FITNESS: Non-compliance with general data processing principles *Source: Lithuanian Data Protection Authority (VDAI), 2021-06-21 — https://overview.legal/posts/46847 — original: https://www.enforcementtracker.com/ETid-732* The Lithuanian DPA (VDAI) has imposed a fine of EUR 20,000 on UAB VS FITNESS. After receiving a notification from an individual stating that scanning a fingerprint was necessary to use the services of a sports club owned by the controller, the DPA started an investigation against the controller. The DPA's review found that the consent given by customers to have their fingerprint patterns processed was not voluntary as there were no other identification measures. In addition, the DPA found that t ### Merchant: Non-compliance with general data processing principles *Source: Belgian Data Protection Authority (APD), 2019-09-17 — https://overview.legal/posts/46195 — original: https://www.enforcementtracker.com/ETid-80* The Belgian data protection authority has imposed a fine of 10,000 euros on a merchant who wanted to use an electronic identity card (eID) to create a customer card. The DPA's investigation revealed that the merchant required access to personal data located on the eID, including the photo and barcode which is linked to the data subject's identification number. In the meantime, the decision of the data protection authority has been annulled by a court: link ### HDPA (Greece) - 12/2026 *Source: HDPA (Greece), 2026-05-13 — https://overview.legal/posts/144044 — original: https://gdprhub.eu/index.php?title=HDPA_(Greece)_-_12/2026* Facts — The complainant, a foreign national, submitted a complaint to the Hellenic DPA through his authorized attorney, seeking his deletion from the Hellenic the National Registry of Undesirable Aliens. In response to the Authority's request for clarifications, the competent Directorate of the Ministry of Citizen Protection informed the DPA that: • By a decision dated 27-07-2017, an entry ban and registration in the National Registry of Undesirable Aliens were imposed on the complainant for reasons of national security. • Following temporary 48-hour lifts of the measure for humanitarian reasons in 2019, the entry ban was re-imposed. • Subsequent decisions in 2020, 2023, and 2025 maintained the entry ban and renewed his registration in the National Registry of Undesirable Aliens for successive three-year periods, as the grounds for registration remained active. • The explicit grounds and documentation behind the registration were not disclosed to the complainant because the competent Directorate classified the file as restricted/classified service material. The complainant and his attorney attended a DPA hearing on 22-04-2026, arguing that the registration lacked specific, adequate, or definitive justification regarding any threat to public order or national security. They noted that the complainant has no criminal convictions, poses no threat, and possesses strong ties, residency, and business operations in the region of Northern Epirus and Greece, meaning the entry ban severely disrupts his professional and family life. Holding — According to the provisions of Article 82(1) of Law 3386/2005, foreign nationals whose presence in Greek territory constitutes a threat to national security, public safety, or public order can be registered in the National Registry of Undesirable Aliens, with registrations subject to an ex officio review every three years. Furthermore, pursuant to the provisions of Article 54(2) and Article 55(4) of Law 4624/2019 (the Greek law implementing the GDPR), the data controller is legally empowered to restrict or omit the provision of information and to deny a data subject access to their personal data when dictated by reasons of national security or public order. These national provisions are explicitly anchored in Article 23 GDPR (specifically Article 23(1)(a)GDPR and Article 23(1)(c) GDPR), which permits Member State law to restrict the scope of the obligations and data subject rights (such as the right to be informed under Article 13 GDPR - Article 14 GDPR and the right of access under Article 15 GDPR) to safeguard national security and public security. In the present case, the evidence demonstrated that the complainant's initial registration and subsequent renewals in the National Registry of Undesirable Aliens were executed lawfully for reasons of national security. The Ministry of Citizen Protection, acting as the data controller, exercised its legal discretion under these frameworks to weigh these interests and correctly determined that the underlying operational decision constitutes classified material that cannot be disclosed to the data subject. Consequently, the fundamental principles of data protection law were not breached, and the Hellenic DPA rejected the complaint as unfounded. ### AEPD (Spain) - EXP202306354 (PS/00312/2024) *Source: AEPD (Spain), 2026-02-11 — https://overview.legal/posts/52464 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_EXP202306354_(PS/00312/2024)* Facts — The Spanish Data Protection Agency (AEPD) investigated Vodafone España, S.A.U. as controller after a SIM swapping incident. On 21 September 2021, an unknown third party requested a duplicate SIM card for the mobile line of a data subject. The request was made through Vodafone’s internal telephone support channel for retail stores. The caller impersonated staff and provided several data elements, including the store user code, the data subject’s identification number, the mobile phone number and digits of the ICC number of the new SIM card. Vodafone processed the request and activated the duplicate SIM card. On the same day, the data subject’s phone stopped working. Shortly afterwards, four unauthorised transactions totalling €1,996 were carried out from their bank account. The data subject contacted Vodafone, their bank and the police. Vodafone confirmed that a duplicate SIM card had been issued through a physical point of sale. After the data subject presented a complaint, during the investigation, Vodafone explained that its internal policy required store staff to call a dedicated support channel and provide identifying information before a duplicate SIM could be issued. Vodafone stated that the fraudster had provided the required information and that the security protocol in force at the time had been followed. The controller also informed the AEPD that it later adopted additional measures to reinforce the security of the duplicate SIM procedure. On the basis of these facts, the AEPD opened sanctioning proceedings against Vodafone for an alleged infringement of Article 6(1) GDPR. Holding — The AEPD found that Vodafone infringed Article 6(1) GDPR by processing the personal data of the data subject without a valid legal basis. The AEPD held that the issuance and activation of a duplicate SIM card involved the processing of personal data. Vodafone carried out this processing without the knowledge or consent of the data subject and without any other legal basis under Article 6(1) GDPR. As a result, the processing was unlawful. The AEPD rejected the controller’s argument that it had complied with its internal security protocols. The DPA stated that the existence of internal procedures did not remove the obligation to ensure that processing had a valid legal basis. The intervention of a criminal third party did not exempt the controller from responsibility where the unlawful processing occurred within its own systems and procedures. The AEPD considered that Vodafone acted at least negligently. It took into account the nature of the infringement and the link between the processing and the controller’s core business activity. The DPA imposed an administrative fine of €150,000 on Vodafone for the infringement of Article 6(1) GDPR. ## Recent developments ### AZOP (Croatia) - Croatian Gambling Operator *Source: GDPRhub, 2026-10-11 — https://overview.legal/posts/595693 — original: https://gdprhub.eu/index.php?title=AZOP_(Croatia)_-_Croatian_Gambling_Operator* The DPA fined a gambling operator €2.59 m for processing biometric data without valid consent and beyond the necessary scope, bundling multiple purposes into single consent, and providing incomplete and inconsistent processing information. English Summary. Facts. The DPA initiated an ex officio investigation against a gambling operator (controller) regarding the identification and registration of players (data subjects) visiting its casino. The controller verified data subjects' identities ### ANSPDCP (Romania) - Fine against GLOBAL CUSTOMER CARE SERVICES S.R.L *Source: GDPRhub, 2026-10-09 — https://overview.legal/posts/593306 — original: https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_GLOBAL_CUSTOMER_CARE_SERVICES_S.R.L* The DPA fined a controller RON 26,294 (€5,000) for failing to implement adequate security measures, which led to a breach affecting the confidentiality and availability of personal data following a cyberattack. English Summary. Facts. A personal data breach occurred because of a cyberattack on of a call centre service provider (the controller). Thus, the confidentiality and availability of personal data were compromised and unauthorised parties gained access to the personal data of a significant ### Hellenic DPA decision on a data breach involving E.E.T.A.A. S.A. as processor for the Ministry of Social Cohesion and Family Affairs *Source: European Data Protection Board, 2026-10-08 — https://overview.legal/posts/593252 — original: https://www.edpb.europa.eu/news/hellenic-dpa-decision-on-a-data-breach-involving-eetaa-sa-as-processor-for-the-ministry-of_en* Background informationDate of final decision: 28/07/2026National caseController: Ministry of Social Cohesion and Family AffairsLegal Reference(s): Article 25 (Data protection by design and by default), Article 28 (Processor), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority) and Article 34 (Communication of a personal data breach to the data subject)Decision: Administrative fine, Compliance order, Summary of the DecisionOrigin o ### Data brokers: Identification possible to sell ads, not to exercise fundamental rights *Source: noyb - European Center for Digital Rights, 2023-02-28 — https://overview.legal/posts/53249 — original: https://noyb.eu/en/data-brokers-identification-possible-sell-ads-not-exercise-fundamental-rights* Today, noyb filed a series of complaints against websites and data brokers that did not correctly address access requests using cookies as an authentication factor. The companies had shown obstructive approaches when authenticating users; ranging from denying the right to access, to requiring additional information, unnecessary to authenticate the user. Complaint against data broker: machine translated EN [PDF] Complaint against website: machine translated EN [PDF] Exercising fundamental rights ### Délégué à la protection des données : identifier et gérer les conflits d’intérêts liés à la fonction de DPO *Source: CNIL, 2026-08-10 — https://overview.legal/posts/262248 — original: https://www.cnil.fr/fr/dpo-identifier-gerer-conflits-interets* Le RGPD autorise les organismes à confier d’autres missions à leur délégué à la protection des données (DPO). Ces missions ne doivent néanmoins pas faire obstacle à ses missions de DPO ou le placer en situation de conflit d’intérêts. Comment reconnaître un conflit d’intérêts ? Comment y remédier ? ## Literature ### Use of Artificial Intelligence Tools by Law Enforcement Services in Light of the Artificial Intelligence Act *Source: Zeszyt Prawniczy UAM, 2025-12-22 — https://overview.legal/posts/132565 — original: https://doi.org/10.14746/zpuam.2025.15.4* Celem artykułu jest wskazanie przestępstw, w przypadku których służby państwowe mogą korzystać z systemów zdalnej identyfikacji biometrycznej w czasie rzeczywistym w przestrzeni publicznej. Zostanie to uczynione przez analizę przesłanek umożliwiających posługiwanie się tą technologią oraz przyrównanie ich do czynów zabronionych przez polski kodeks karny. Rezultatem powyższego jest stworzenie katalogu przestępstw, odnośnie do których służby mogą zastosować system zdalnej identyfikacji biometryczn ### The Artificial Intelligence Act (AI Act) as the basis for legal regulation of artificial intelligence in the EU: review of the main provisions *Source: Analytical and Comparative Jurisprudence, 2025-07-12 — https://overview.legal/posts/132431 — original: https://doi.org/10.24144/2788-6018.2025.03.3.44* This article reviews the main provisions of the Artificial Intelligence Act (AI Act), which entered into force as an EU Regulation in 2014. It is indicated that one of the main global trends in recent years is the active development of artificial intelligence and its application, and it is argued that since the AI Act is one of the first legal acts in the world designed to regulate artificial intelligence, and also taking into account Ukraine’s course towards European integration, it is importan ### GDPR bypass by design? Transient processing of data under the GDPR *Source: International Data Privacy Law, 2019-09-20 — https://overview.legal/posts/132576 — original: https://doi.org/10.1093/idpl/ipz017* In search of privacy-friendly facial detection and autonomous driving software, data controllers are discovering that processing data merely transiently might not only be in compliance with the data minimization principle, but also exclude their activities from the General Data Protection Regulation (GDPR) altogether. The argument can be made that since transient data does not allow for re-identification it is not personal data in a legal sense. However, effect-oriented or output-based interpretations of the notion ‘personal data’ have been proposed, which in turn could lead transient data processing technologies to fall within the scope of the GDPR. An effect-oriented interpretation of the regulation would ensure that in cases where transient data... ### Artificial Intelligence in Decision-making: A Test of Consistency between the “EU AI Act” and the “General Data Protection Regulation” *Source: Athens Journal of Law, 2025-01-02 — https://overview.legal/posts/132443 — original: https://doi.org/10.30958/ajl.11-1-3* The recent Regulation that sets down harmonised rules on Artificial Intelligence in the European Union, known as the "AI Act," includes a significant requirement for human oversight in high-risk AI systems during their use (art. 14). This requirement embodies the "human-in-command" approach, ensuring both legal and ethical compliance. The AI Act is intended to complement the General Data Protection Regulation (hereinafter GDPR), thereby forming a consistent and comprehensive legal framework. Thi ### HOW GDPR TREATS AUTOMATED DECISION-MAKING *Source: Journal Scientific and Applied Research, 2025-11-14 — https://overview.legal/posts/132599 — original: https://doi.org/10.46687/jsar.v28i1.435* This article examines how the General Data Protection Regulation (GDPR) regulates automated decision-making, including profiling, in the context of personal data processing. It analyzes the main provisions of Article 22 of the Regulation, as well as the conditions under which fully automated decisions that produce legal effects or significantly affect data subjects are permitted. The article highlights the rights of data subjects – the right to human intervention, the right to express their poin ## Related topics - **Personal Data** — https://overview.legal/topics/personal-data Information relating to identified or identifiable natural persons - **Controllers** — https://overview.legal/topics/controllers Entities that determine purposes and means of processing - **Processing** — https://overview.legal/topics/processing Any operation performed on personal data - **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities National data protection authorities and their powers - **Public Authority** — https://overview.legal/topics/public-authority Government bodies and their data processing activities - **Supervision** — https://overview.legal/topics/supervision Oversight and enforcement by supervisory authorities --- Generated by overview.legal · https://overview.legal/topics/identification · 2026-10-13