Lawful Basis

Artikel 54

Citeertitel wet

Artikel 5

Toestemming van wettelijk vertegenwoordiger

Artikel 6

Oprichting en aanwijzing als toezichthoudende autoriteit

Artikel 7

Samenstelling

Artikel 14

Taken en bevoegdheden

Artikel 17

Boete bij onrechtmatige verwerking persoonsgegevens strafrechtelijke aard

Artikel 53

Inwerkingtreding

Artikel 48

Overgangsrecht

Artikel 50

Evaluatie

Artikel 51

Intrekking Wet bescherming persoonsgegevens

Artikel 52

Citeertitel verordening

Recital 168

Recital 38

Recital 40

Recital 155

Recital 158

Recital 42

Recital 161

Recital 171

Article 7

Conditions for consent

Raad van State - grondslag - 202004638/1/A3

Raad van State - Bestuursrecht

Bij besluit van 31 oktober 2018 heeft de minister van Landbouw, Natuur en Voedselkwaliteit het verzoek van de maatschap om haar gegevens niet door te geven aan de Brancheorganisatie Akkerbouw afgewezen. De minister heeft de maatschap gemeld dat haar naam, adresgegevens en zogenoemde KvK-nummer zullen worden doorgegeven aan de Brancheorganisatie Akkerbouw en dat de maatschap daartegen bezwaar kan maken op grond van de Algemene Verordening Gegevensverwerking. De minister wil deze gegevens van de m

Rechtbank Rotterdam - rechten van betrokkenen - C/10/613404 / HA ZA 21-150

Rechtbank Rotterdam - Civiel recht

Internationale zaak. Bevoegdheidsincident en incident ex artikel 843a en artikel 15 AVG. Eiseres is via gedaagde gaan beleggen in CfD-trading. In de hoofdzaak vordert eiseres (onder meer) een verklaring voor recht dat de overeenkomst is vernietigd, althans om deze te vernietigen, althans een verklaring voor recht dat gedaagde onrechtmatig heeft gehandeld; Eiseres stelt dat gedaagde door in strijd met het verbod van de AFM CfD’s aan te bieden met een leverage boven 1:30 onrechtmatig heeft gehande

Rechtbank Rotterdam - recht op schadevergoeding en aansprakelijkheid - ROT 20/3286

Rechtbank Rotterdam - Bestuursrecht

Naar het oordeel van de rechtbank heeft verzoekster recht op toekenning van een vergoeding voor immateriële schade nu verweerder door het bewaren en verwerken van de rapporten met persoonlijke gegevens van verzoekster in strijd heeft gehandeld met de AVG en daardoor het recht op eerbiediging van de persoonlijke levenssfeer van verzoekster heeft geschonden. Ten aanzien van de hoogte van de vast te stellen schadevergoeding is van belang dat de privacygevoelige persoonsgegevens gedurende een period

Rechtbank Midden-Nederland - grondslag - UTR 20/2315

Rechtbank Midden-Nederland - Bestuursrecht

VoetbalTV is een platform op internet waarop amateurvoetbalwedstrijden worden uitgezonden. Verweerder vindt dat eiseres voor het maken van opnames en het uitzenden van voetbalwedstrijden geen geldige grondslag heeft en zij verwerkt daarmee dus onrechtmatig persoonsgegevens. Volgens verweerder maakt eiseres door de opnames inbreuk op de privacy een groot aantal betrokkenen, onder wie veel minderjarige voetballers en rechtvaardigt dit een boete van € 575.000,-.Eiseres stelt dat het opnemen en uitz

Data Protection Commissioner v. Facebook Ireland Ltd, and Maximillian Schrems

Schrems II

“[…] the standard data protection clauses adopted by the Commission on the basis of Article 46(2)(c) of the GDPR are solely intended to provide contractual guarantees that apply uniformly in all third countries to controllers and processors established in the European Union and, consequently, independently of the level of protection guaranteed in each third country. In so far as those standard data protection clauses cannot, having regard to their very nature, provide guarantees beyond a contrac

Data Protection Commissioner v. Facebook Ireland Ltd, and Maximillian Schrems

Schrems II

“the national supervisory authorities are responsible for monitoring compliance with the EU rules concerning the protection of natural persons with regard to the processing of personal data. Each of those authorities is therefore vested with the power to check whether a transfer of personal data from its own Member State to a third country complies with the requirements laid down in that regulation” / “The exercise of that responsibility is of particular importance where personal data is tra

Rechtbank Amsterdam - recht op schadevergoeding en aansprakelijkheid - C/13/677172 / HA RK 19-435

Rechtbank Amsterdam - Civiel recht

AVG rekest.Verzoek verwijdering persoonsgegevens en materiële en immateriële schadevergoeding ex art. 82 AVG ogv onrechtmatige verwerking persoonsgegevens.Geen belang meer bij verwijderingsverzoek wegens minnelijke regeling. Afwijzing schadevergoeding.

BUNDESVERBAND DER VERBRAUCHERZENTRALEN UND VERBRAUCHERVERBANDE —BERBRAUCHERZENTRALE BUNDESVERBAND V. PLANET49 GmbH (“PLANET49”)

Planet49

The restrictions of Article 5(3) of the ePrivacy Directive apply to any information stored in a terminal equipment, regardless of whether or not it is persona. (¶70)

BUNDESVERBAND DER VERBRAUCHERZENTRALEN UND VERBRAUCHERVERBANDE —BERBRAUCHERZENTRALE BUNDESVERBAND V. PLANET49 GmbH (“PLANET49”)

Planet49

Cookie data is personal data where the cookies likely to be placed on the terminal equipment of a user participating in the promotional lottery contained a number assigned to the registration data of that user (who must enter his/her name+address in the registration form.) By linking that number with that data, a connection between a person and the data stored by the cookies arises. Therefore, the data is not anonymous data. (¶45)

BUNDESVERBAND DER VERBRAUCHERZENTRALEN UND VERBRAUCHERVERBANDE —BERBRAUCHERZENTRALE BUNDESVERBAND V. PLANET49 GmbH (“PLANET49”)

Planet49

Consent is “not validly constituted if the storage of information, or access to information already stored in an website user’s terminal equipment, is permitted by way of a checkbox pre-ticked by the service provider which the user must deselect to refuse his or her consent.” The indication of the data subject’s wishes must, inter alia, be ‘specific’ in the sense that “it must relate specifically to the processing of the data in question and cannot be inferred from an indication of the data subj

FASHION ID GmbH & Co. KG v. VERBRAUCHERZENTRALE NRW eV

Fashion ID

ePrivacy Directive: The ECJ did not determine whether the Facebook “Like” button involves such storing or access subject to the ePrivacy Directive, but left it to the national court to make this assessment and determine whether such consent would be required under the e-Privacy rules. The ECJ did not state whether such consent should be obtained by the website operator, by the third-party plugin, or by both.

FASHION ID GmbH & Co. KG v. VERBRAUCHERZENTRALE NRW eV

Fashion ID

Consent: It is the duty of the operator to obtain prior consent from the data subject. The consent given to the operator relates only to the operation or set of operations involving the processing of personal data in respect of which the operator actually determines the purposes and means. (¶¶100–102 and ¶106)

FASHION ID GmbH & Co. KG v. VERBRAUCHERZENTRALE NRW eV

Fashion ID

Duty to inform: It is the duty of the operator to inform, but the information that must be provided to the data subject need “relate only to the operation or set of operations involving the processing of personal data in respect of which that operator actually determines the purposes and means”. The information must be given by the controller immediately, that is to say, when the data are collected. (¶¶100–101 and ¶¶103–106)

SERGEJS BUIVIDS v. THE AUGSTĀKĀ TIESA

Buivids

Processing: A video recording of persons which is stored on a continuous recording device — the hard disk drive of that system — constitutes automatic processing of personal data (see, Ryneš). (¶34). Also, loading personal data onto an internet page constitutes processing since placing information on an internet page entails the operation of loading that page onto a server and the operations necessary to make that page accessible to people who are connected to the internet which are performed, a

Peter Puškár v Finančné riaditeľstvo Slovenskej republiky and Kriminálny úrad finančnej správy

Puškár

Lawful Basis (Public Interest): Article 7(e) Directive 95/46 must be interpreted as not precluding the processing of personal data by the authorities of a Member State for the purpose of collecting tax and combating tax fraud such as that effected by drawing up the contested list in the main proceedings, without the consent of the data subjects, “provided that, first, those authorities were invested by the national legislation with tasks carried out in the public interest within the meaning of t

Peter Puškár v Finančné riaditeľstvo Slovenskej republiky and Kriminálny úrad finančnej správy

Puškár

Admissibility of illegally obtained evidence: Article 47 of the Charter of Fundamental Rights of the EU precludes national court from rejecting, as evidence of an infringement of the protection of personal data, a list, such as the contested list, submitted by the data subject and containing personal data relating to him, “if that person had obtained that list without the consent, legally required, of the person responsible for processing that data, unless such rejection is laid down by national

Peter Puškár v Finančné riaditeľstvo Slovenskej republiky and Kriminálny úrad finančnej správy

Puškár

Lawful basis (in general): Subject to the exceptions permitted under Article 13 of the Data Protection Directive, all processing of personal data must comply, first, with the principles relating to data quality (in Article 6 of that directive) and, have lawful basis (by complying with one criteria for making data processing legitimate listed in Article 7 of that directive) (see, Bara). The list of lawful basis in Article 7 is an exhaustive and restrictive list of cases in which the processing of

Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības SIA ‘Rīgas satiksme’

Rigas

setting out a test based on three criteria to decide whether a processing operation can rely on this ground. The Court reached a surprising conclusion, stating that while there is legitimate interest to process (disclose) data in the case at hand, the controller (a public authority) would also need a legal obligation to lawfully disclose the data.

Data Protection Commissioner v. Schrems and Facebook

Schrems I

Safe harbour: US public authorities are not required to comply with safe harbor principles. Decision 2000/520 specifies that safe harbor principles may be limited to the extent necessary to meet national security, public interest or law enforcement requirements, or statute, regulation or caselaw. Self-certified US organizations receiving personal data from the EU are thus bound to disregard safe harbor principles when they conflict with US legal requirements. Decision 2000/520 does not contain s

Data Protection Commissioner v. Schrems and Facebook

Schrems I

Independence of DPA: The Directive seeks to ensure an effective, complete, and high level of protection of the fundamental rights and freedoms of natural persons. The guarantee of a DPA’s independence is intended to ensure effectiveness and reliability of the monitoring of compliance, and is an essential component of data protection. DPAs powers extend to their own Member State, but not to processing in third countries. However, DPAs are responsible for monitoring transfers from a Member State t

Richtsnoeren 8/2022 voor het bepalen van de leidende toezichthoudende autoriteit van de verwerkingsverantwoordelijke of de verwerker

guidelines bepalen leidende toezichthouder

Richtsnoeren 1/2019 voor gedragscodes en toezichthoudende organen in de zin van Verordening 2016/679

guidelines gedragscodes en toezichthoudende organen

Versiegeschiedenis

guidelines meldplicht datalekken

Richtsnoeren 3/2022 betreffende het herkennen en vermijden van misleidende ontwerppatronen in de interfaces van socialemediaplatforms

guidelines misleidende ontwerppatronen

Deze richtsnoeren bieden praktische aanbevelingen aan aanbieders van sociale media als verwerkingsverantwoordelijken van sociale media, ontwerpers en gebruikers van socialemediaplatforms, over het beoordelen en vermijden van zogenaamde 'misleidende ontwerp patronen' in de interfaces van sociale media die inbreuk maken op de vereisten van de AVG. Daartoe beveelt de EDPB aan dat verwerkingsverantwoordelijken gebruikmaken van interdisciplinaire teams, bestaande uit onder meer ontwerpers, func...

Richtsnoeren 07/2020 over de begrippen 'verwerkingsverantwoordelijke' en 'verwerker' in de AVG

guidelines over de begrippen 'verwerkingsverantwoordelijke' en 'verwerker' in de AVG

De begrippen 'verwerkingsverantwoordelijke', 'gezamenlijke verwerkingsverantwoordelijke' en 'verwerker' spelen een cruciale rol bij de toepassing van de algemene verordening gegevensbescherming (AVG, Verordening (EU) 2016/679), aangezien ermee wordt bepaald wie verantwoordelijk is voor de naleving van verschillende gegevensbeschermingsregels en op welke wijze betrokkenen hun rechten in de praktijk kunnen uitoefenen. De precieze betekenis van deze begrippen en de criteria voor de jui...

Richtsnoeren 02/2021 inzake virtuele spraakassistenten

guidelines over virtuele spraakassistenten

Een virtuele spraakassistent ( virtual voice assistant , of VVA) betreft een dienst die spraakgestuurde opdrachten begrijpt en uitvoert, of indien nodig als tussenschakel optreedt naar andere IT-systemen. Tegenwoordig is een VVA als optie beschikbaar op de meeste smartphones, tablets en reguliere computers en sinds enkele jaren zelfs op losse apparaten zoals smartspeakers. Een VVA functioneert als schakel tussen de gebruiker en zijn apparaat of een online dienst zoals een zoekmachine...

Richtsnoeren 4/2019 inzake artikel 25 Gegevensbescherming door ontwerp en door standaardinstellingen

guidelines privacy by design en default

Richtsnoeren 01/2022 over de rechten van betrokkenen Recht van inzage

guidelines recht op inzage

Het recht van inzage van betrokkenen is vastgelegd in artikel 8 van het Handvest van de grondrechten van de Europese Unie. Het maakt al sinds het begin deel uit van het Europese wettelijke kader voor gegevensbescherming en wordt nu verder ontwikkeld met specifiekere, preciezere regels in artikel 15 AVG.

Guidelines 3/2019 on processing of personal data through video devices

Guidelines on processing of personal data through video devices

Richtsnoeren 8/2020 betreffende de targeting van gebruikers van sociale media

guidelines targeting gebruikers sociale media

Richtsnoeren 2/2023 over het technische topassingsgebied van artikel 5, lid 3, van de eprivacyrichtlijn

guidelines technische toepassingsgebied van artikel 5(3) e-privacyrichtlijn

Richtsnoeren 3/2018 over het territoriale toepassingsgebied van de AVG (artikel 3)

guidelines territoriaal toepassingsgebied AVG

GROEP GEGEVENSBESCHERMING ARTIKEL 29

guidelines transparantie

Versiegeschiedenis

guidelines uitvoeren overeenkomst

Richtsnoeren 03/2021 voor de toepassing van artikel 65, lid 1, punt a), AVG

guidelines voor de toepassing van artikel 60 AVG

Richtsnoeren 06/2020 inzake de wisselwerking tussen de tweede richtlijn betalingsdiensten en de AVG

guidelines wisselwerking toepassing artikel 3 en hoofdstuk V AVG

Richtsnoeren 07/2022 voor certificering als doorgifte-instrument

Op grond van artikel 46 van de algemene verordening gegevensbescherming (AVG) moeten gegevensexporteurs passende waarborgen bieden voor de doorgifte van persoonsgegevens aan derde landen of internationale organisaties. Daarom worden in de AVG de verschillende passende waarborgen aangegeven die gegevensexporteurs overeenkomstig artikel 46 kunnen gebruiken als kader voor de doorgifte aan derde landen, onder meer door certificering in te voeren als nieuw doorgiftemechanisme (artikel 42, lid 2, en a...

Versiegeschiedenis

Richtsnoeren 01/2021

Guidelines 07/2022 on certification as a tool for transfers

Guidelines on certification and identifying certification criteria

The GDPR requires in its Article 46 that data exporters shall put in place appropriate safeguards for transfers of personal data to third countries or international organisations. To that end, the GDPR diversifies the appropriate safeguards that may be used by data exporters under Article 46 for framing transfers to third countries by introducing, amongst others, certification as a new transfer mechanism (Articles 42 (2) and 46 (2) (f) GDPR). These guidelines provide guidance as to the applicati...

AI-generated imagery and protection of privacy: EDPB supports joint Global Privacy Assembly’s statement

Brussels, 23 February - EDPB Chair Anu Talus has signed a Joint Statement on AI-Generated Imagery and the Protection of Privacy on behalf of the EDPB. The statement, coordinated by the Global Privacy Assembly's (GPA) International Enforcement Cooperation Working Group (IEWG), represents the united position of 61 authorities across the world. This reflects the Board’s commitment to contributing to the global dialogue on data protection as outlined in the fourth pillar of its work programme 2026-2

DSB (Austria) - 2024-0.199.724

Corrected and added some links, removed duplicate in short summary. }}}} An DPA denied a complaint against a public body under Articles 9 and 77 GDPR, holding that publication of a data subject’s political donation did not violate the GDPR because the controller had a lawful basis.An DPA denied a complaint against a public body under [[Article 9 GDPR|Articles 9]] and [[Article 77 GDPR|77 GDPR]], holding that publication of a data subject’s political donation did not violate them because the cont

EU adds ‘innovative solutions’ for migration into €200bn external fund

The term, however, still lacks a clear legal basis

ICO (UK) - Allay Claims Ltd

The controller claimed it relied on the soft opt-in in Regulation 22(3) of the Privacy and Electronic Communications Regulations 2003 (PECR), where an organisation may send direct marketing communications to its customers even if they did not specifically consent to electronic mail. However, only the organisation that collected the contact details can rely on the soft opt-in rule. The controller claimed it relied on the soft opt-in in Regulation 22(3) of the Privacy and Electronic Communications

SN - I NO 14/23

Facts }}}} The Supreme Court upheld rules requiring legal counsels to keep a client register and ensure confidentiality. It held that processing client data to check conflicts of interest is lawful under [[Article 6 GDPR#1c|Article 6(1)(c) GDPR]] as it fulfills a statutory duty.The Supreme Court upheld rules requiring legal counsels to keep a client register and to ensure confidentiality. It held that keeping a client register is necessary to comply with the legal obligation to check for potenti

AEPD (Spain) - EXP202406574

Facts }}}} The AEPD fined a right-wing political party €500 for publishing a proof of delivery on Facebook that showed a person’s name, ID number and signature without a legal basis under [[Article 6 GDPR]].The AEPD fined a political party €500 for publishing a document on Facebook that showed a person’s name, ID number and signature without a legal basis under [[Article 6 GDPR]]. == English Summary ==== English Summary ==

VDAI (Lithuania) - Nr. 3R-219 (2.13-1.E)

}}}} The DPA partially upheld a complaint and issued a reprimand against a travel company for unlawful direct marketing, excessive passport copy collection, inaccuracies in travel documents, lack of transparency, and an incomplete access response.The DPA partially upheld a complaint and issued a reprimand against a travel company for unlawful direct marketing, excessive passport copy collection, inaccuracies in travel documents, lack of transparency, and an incomplete response to an access reque

AEPD (Spain) - EXP202406574

Facts }}}} The AEPD fined a right-wing political party €500 for publishing a proof of delivery on Facebook that showed a person’s name, ID number and signature without a legal basis under [[Article 6 GDPR|Article 6 GDPR]].The AEPD fined a right-wing political party €500 for publishing a proof of delivery on Facebook that showed a person’s name, ID number and signature without a legal basis under [[Article 6 GDPR]]. == English Summary ==== English Summary == VOX had sent a certified letter to a m

LG Kassel - 10 O 81/24

Link fixed. === Facts ====== Facts === The data subject had a mobile contract with the controller, a telecommunications company, starting 17 April 2019. The contract included privacy notices stating that personal data, including contract initiation, execution, and completion (“positive data”), could be sent to a credit scoring agency for credit scoring, under Articles 6(1)(b) and 6(1)(f) GDPR.The data subject had a mobile contract with the controller, a telecommunications company, starting 17 Ap

SN - I NO 14/23

Facts }}}} The Supreme Court of Poland upheld rules requiring legal counsels to keep client data confidential and maintain a client register. The Court held processing was lawful under [[Article 6 GDPR#1c|Article 6(1)(c) GDPR]] to meet legal obligations.The Supreme Court upheld rules requiring legal counsels to keep a client register and ensure confidentiality. It held that processing client data to check conflicts of interest is lawful under [[Article 6 GDPR#1c|Article 6(1)(c) GDPR]] as it fulf

OLG Dresden - Az. 4 U 196/25

ManTechnologist moved page OLG Dresden - Az. 4 U 196/25 to OLG Dresden - 4 U 196/25 Misspelled title New page{{COURTdecisionBOX |Jurisdiction=Germany |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=OLG Dresden |Court_Original_Name=Oberlandesgericht Dresden |Court_English_Name=Higher Regional Court Dresden |Court_With_Country=OLG Dresden (Germany) |Case_Number_Name=Az. 4 U 196/25 |ECLI= |Original_Source_Name_1=beck-aktuell |Original_Source_Link_1=https://rsw.beck.de/aktuell/daily/

SN - I NO 14/23

Facts === Facts ====== Facts === In December 2022, the National Council of Legal Counsels (Poland) adopted regulations on the practice of legal counsels. The Minister of Justice challenged parts of the regulations, particularly § 5 and § 6. § 5 required persons cooperating with legal counsels to keep information confidential. § 6 required legal counsels to maintain a client register to identify conflicts of interest. The Minister argued that these rules violated the [[Article 6 GDPR|Article 6]]

“Free” Surveillance Tech Still Comes at a High and Dangerous Cost

Surveillance technology vendors, federal agencies, and wealthy private donors have long helped provide local law enforcement “free” access to surveillance equipment that bypasses local oversight. The result is predictable: serious accountability gaps and data pipelines to other entities, including Immigration and Customs Enforcement (ICE), that expose millions of people to harm. The cost of “free” surveillance tools — like automated license plate readers (ALPRs), networked cameras, face recognit

DSB (Austria) - 2025-0.813.131

}}}} The DPA held that an event organiser’s use of a data subject’s email address, provided for ticket purchase, to send a marketing email without consent and to disclose the address via an open CC field violated the subject’s right to secrecyThe DPA held that an event organiser violated a customer’s right to privacy when it submitted them marketing emails without their prior consent and by sending them those emails in CC, disclosing their address to a large group of third parties. == English Su

AEPD (Spain) - PS-00456-2025

Facts }}}} The DPA fined a business support company with 80,000 euros for transferring personal data from its employees to a third party without the proper legal basis, in violation of Art. 6 (1) GDPR.The DPA fined a customer support provider €80,000 for unlawfully transferring its employees’ private phone numbers to its business customer without a valid legal basis. == English Summary ==== English Summary == === Facts ====== Facts === MAJOREL SP SOLUTIONS, S.A. (the controller) entered into an

AEPD (Spain) - PS-00456-2025

Holding === Holding ====== Holding === The DPA upheld the complaint and found an infringement of [[Article 6 GDPR#1|Article 6(1) GDPR]]. The Authority clarified that the necessity for the performance of a contract must be interpreted strictly and covers only processing that is objectively necessary, not merely useful or convenient.The DPA upheld the complaint and found an infringement of [[Article 6 GDPR#1|Article 6(1) GDPR]]. The DPA clarified that the necessity for the performance of a contrac

CNIL (France) - SAN-2025-017

added links to GDPR articles === Holding ====== Holding === The DPA found that, since the membership form did not contain information on the transmission of members' data to the social media platform, or even on targeted advertising, the consent was not informed nor specific. Therefore, it found the processing to be unlawful, violating Article 6(1)(a) GDPR. The DPA found that, since the membership form did not contain information on the transmission of members' data to the social media

EFFecting Change: Get the Flock Out of Our City

Flock contracts have quietly spread to cities across the country. But Flock ALPR (Automated License Plate Readers) erode civil liberties from the moment they're installed. While officials claim these cameras keep neighborhoods safe, the evidence tells a different story. The data reveals how Flock has enabled surveillance of people seeking abortions, protesters exercising First Amendment rights, and communities targeted by discriminatory policing. This is exactly why cities are saying no. Fr

SO Warszawa - C 310/23

Fixed Link The controller did not respond adequately, providing unclear information or referring the data subject to third parties. As a result, the data subject lodged a complaint with the DPA.The controller did not respond adequately, providing unclear information or referring the data subject to third parties. As a result, the data subject lodged a complaint with the DPA. The DPA issued a final decision warning the controller for violating [[Article 6(1) GDPR|Article 6(1)]] and [[Article 5(1)

OLG Frankfurt am Main - 6 U 81/23

}}}} The Court awarded €100 in non-material damages for the storage and processing of cookies without the data subject’s consent. Although the infringement was considered minor, and the data subject suffered no loss of control over his data, the court held that the feeling of being monitored constituted non-material damage.A Court awarded €100 in non-material damages for the storage and processing of cookies without the data subject’s consent. Although the infringement was considered minor, and