# Public Authority — legal context bundle > Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/public-authority > Sources are cited per item. Verify against the official texts before relying on them. Government bodies and their data processing activities ## Overview ## Legal Framework The GDPR treats public authorities as a distinct category of controller, subject to specific obligations and exemptions. [Article 4(7)](/laws/gdpr/art-4) defines a controller broadly to include any "natural or legal person, public authority, agency or other body," meaning government bodies at every level fall within scope. [Article 37(1)(a)](/laws/gdpr/art-37#par-1-pnt-a) mandates that public authorities designate a Data Protection Officer, with one notable carve-out: > "the processing is carried out by a public authority or body, except for courts acting in their judicial capacity" > — [GDPR Art. 37(1)(a)](/laws/gdpr/art-37#par-1-pnt-a) [Article 37(3)](/laws/gdpr/art-37#par-3) further permits a single DPO to serve multiple public authorities, reflecting the practical reality of governmental organisational structures. [Article 27(2)(b)](/laws/gdpr/art-27#par-2-pnt-b) exempts public authorities from the requirement to designate an EU representative when they are established outside the Union — a recognition that sovereign functions differ from commercial data processing. [Article 86](/laws/gdpr/art-86) provides the critical reconciliation mechanism between transparency obligations and data protection rights, allowing disclosure of personal data in official documents where Union or Member State law permits public access. ## Key Developments The Court of Justice has begun shaping the boundaries of Article 86, particularly in *L. H. v Ministerstvo zdravotnictví*, where the Court addressed whether public authorities must inform and consult data subjects before disclosing official documents containing personal data. The Court held that such a prior consultation obligation is compatible with the GDPR, provided it does not impose disproportionate burdens: > "Article 6(1)(c) and (e) of the GDPR does not preclude, in principle, national case-law which lays down an obligation to inform and consult the data subject before any disclosure of personal data concerning him or her" > — [L. H. v Ministerstvo zdravotnictví ¶45](/posts/132145#seg-45) The Court further specified that this obligation must be implementable and must not result in a disproportionate restriction on public access (¶48). This establishes a proportionality test that public authorities must apply on a case-by-case basis. On the enforcement side, the Dutch DPA (AP) has acted decisively against municipalities that processed special category data without a legal basis. In the Municipality of Ede, Gooise Meren, Haarlemmermeer, and Hilversum cases, the AP found that force field analysis methods mapping social structures and key figures constituted unlawful processing of religious and political beliefs under Article 9 without an adequate legal basis under Article 6(1). ## Status of the Debate This topic is actively contested. The GDPR provides no definition of "public authority or body," leaving the concept to be determined under Member State law — a gap the EDPB has acknowledged. The boundaries are particularly unclear for hybrid entities that exercise public authority functions while operating with private-law characteristics, as illustrated by the Dutch *Waterschapsbedrijf Limburg* case involving a public body with tax-collection powers. The Article 86 reconciliation mechanism remains underdeveloped: courts have established a proportionality framework for pre-disclosure consultation, but the specific thresholds — when consultation becomes "impossible to implement" or requires "disproportionate effort" — await further judicial clarification. No court split is on record yet, but the tension between national transparency regimes and GDPR data subject rights will generate continued litigation. ## Practical Guidance - **Mandatory DPO designation**: Every public authority must appoint a DPO under [Article 37(1)(a)](/laws/gdpr/art-37#par-1-pnt-a); leverage the shared-DPO mechanism in [Article 37(3)](/laws/gdpr/art-37#par-3) for smaller or structurally linked bodies. - **Article 86 disclosure protocol**: Before disclosing official documents containing personal data, implement a proportionality assessment — inform and consult the data subject unless doing so is impossible or requires disproportionate effort, per *L. H. v Ministerstvo zdravotnictví*. - **Special category data prohibition**: Do not use analytical methods (such as force field analysis) that infer religious, political, or other special category data without an explicit Article 9 legal basis — the AP has enforced this against multiple municipalities. - **Legal basis specificity**: Ensure each processing activity by a public authority is anchored in a specific Member State law authorising the processing under Article 6(1)(c) or (e), not merely a general institutional mandate. - **Hybrid entity classification**: For entities exercising delegated public authority (e.g., water boards, quasi-governmental bodies), document the legal basis for "public authority" status under national law, as this determines DPO obligations, representative exemptions, and applicable transparency rules. ## Legislation (full text of key provisions) ### Designation of national competent authorities and single points of contact *Source: AI Act, aiact-art-70-en, 2024-06-12 — https://overview.legal/posts/93141* ### Competent authorities and Digital Services Coordinators *Source: DSA, dsa-art-49-en, 2022-10-19 — https://overview.legal/posts/94884* ### Competent authorities and single points of contact *Source: NIS2, nis2-art-8-en, 2022-12-14 — https://overview.legal/posts/95893* ### Cooperation with competent authorities *Source: AI Act, aiact-art-21-en, 2024-06-12 — https://overview.legal/posts/92304* ### Right to lodge a complaint *Source: DSA, dsa-art-53-en, 2022-10-19 — https://overview.legal/posts/94952* Recipients of the service and any body, organisation or association mandated to exercise the rights conferred by this Regulation on their behalf shall have the right to lodge a complaint against providers of intermediary services alleging an infringement of this Regulation with the Digital Services Coordinator of the Member State where the recipient of the service is located or established. The Digital Services Coordinator shall assess the complaint and, where appropriate, transmit it to the Digital Services Coordinator of establishment, accompanied, where considered appropriate, by an opinion. Where the complaint falls under the responsibility of another competent authority in its Member State, the Digital Services Coordinator receiving the complaint shall transmit it to that authority. During these proceedings, both parties shall have the right to be heard and receive appropriate information about the status of the complaint, in accordance with national law. ### Professional secrecy *Source: DSA, dsa-art-84-en, 2022-10-19 — https://overview.legal/posts/95314* Without prejudice to the exchange and to the use of information referred to in this Chapter, the Commission, the Board, Member States’ competent authorities and their respective officials, servants and other persons working under their supervision, and any other natural or legal person involved, including auditors and experts appointed pursuant to Article 72(2), shall not disclose information acquired or exchanged by them pursuant to this Regulation and of the kind covered by the obligation of professional secrecy. ### Processing and public access to official documents *Source: GDPR, gdpr-art-86-en, 2016-04-27 — https://overview.legal/posts/91431* Personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public interest may be disclosed by the authority or body in accordance with Union or Member State law to which the public authority or body is subject in order to reconcile public access to official documents with the right to the protection of personal data pursuant to this Regulation. ### Recital 112 — competent authorities independence and accountability *Source: DSA, dsa-rec-112-en, 2022-10-19 — https://overview.legal/posts/95621* The competent authorities designated under this Regulation should also act in complete independence from private and public bodies, without the obligation or possibility to seek or receive instructions, including from the government, and without prejudice to the specific duties to cooperate with other competent authorities, the Digital Services Coordinators, the Board and the Commission. On the other hand, the independence of those authorities should not mean that they cannot be subject, in accordance with national constitutions and without endangering the achievement of the objectives of this Regulation, to proportionate accountability mechanisms regarding the general activities of the Digital Services Coordinators, such as their financial expenditure or reporting to the national parliaments. The requirement of independence should also not prevent the exercise of judicial review, or the possibility to consult or regularly exchange views with other national authorities, including law enforcement authorities, crisis management authorities or consumer protection authorities, where appropriate, in order to inform each other about ongoing investigations, without affecting the exercise of their respective powers. ### Recital 153 — national competent authorities designation *Source: AI Act, aiact-rec-153-en, 2024-06-12 — https://overview.legal/posts/93988* Member States hold a key role in the application and enforcement of this Regulation. In that respect, each Member State should designate at least one notifying authority and at least one market surveillance authority as national competent authorities for the purpose of supervising the application and implementation of this Regulation. Member States may decide to appoint any kind of public entity to perform the tasks of the national competent authorities within the meaning of this Regulation, in accordance with their specific national organisational characteristics and needs. In order to increase organisation efficiency on the side of Member States and to set a single point of contact vis-à-vis the public and other counterparts at Member State and Union levels, each Member State should designate a market surveillance authority to act as a single point of contact. ### Recital 154 — independent impartial national competent authorities *Source: AI Act, aiact-rec-154-en, 2024-06-12 — https://overview.legal/posts/93990* The national competent authorities should exercise their powers independently, impartially and without bias, so as to safeguard the principles of objectivity of their activities and tasks and to ensure the application and implementation of this Regulation. The members of these authorities should refrain from any action incompatible with their duties and should be subject to confidentiality rules under this Regulation. ## Case law ### CE upholds CNIL competence to fine Google €100M for cookies despite no lead authority role *Source: CE, 2021-03-04 — https://overview.legal/posts/125660 — original: https://gdprhub.eu/index.php?title=CE_-_449212* Facts — On December, 7 2020, the French DPA imposed a financial penalty of 60 Million euros fine against Google LLC and a 40 million euros against Google Ireland Limited in accordance with the General Data Protection Regulation (GDPR) and ePrivacy Directive 2002/58/EC, for lack of transparency, inadequate information and lack of valid consent regarding for violating the regulation on cookies while operating the website google.fr. The sanction was accompanied by an order to comply with article 82 of the French Law on data protection (Law Informatique et Libertés), under three months on penalty of a €100,000 fine per day of delay. The companies appealed to the Conseil d’État in interim procedure against the CNIL's decision, arguing that the French DPA was not the competent authority because it was not the lead supervisory authority for Google LLC or Google Ireland Limited. Dispute — Is the CNIL territorially competent to investigate and sanction a company for violating the information principle when depositing cookies if it is not the lead supervisory authority of the company? The CNIL considered that Google does have EU headquarters in Ireland, but that this Irish entity ‘did not have a decision making power’ in relation to the relevant cross-border data processing activities to which the complaints related. For that reason the CNIL decided that the One Stop Shop mechanism did not apply and that the CNIL, like any other European supervisory authority, was therefore competent to make a decision. Holding — The Conseil d’État rejected the request made by Google and ruled that the French DPA was territorially competent on this matter even though it is not the lead supervisory authority. The court stated that Article 82 of the Law Informatique et Libertés was a transposition of Article 5(3) ePrivacy Directive 2002/58/EC into French Law when dealing with cookies and that the CNIL is charged with enforcing this Directive. As such, the one-stop shop mechanism provided for in Article 56 GDPR does not apply in the present case. ### Judgment of the Court (Grand Chamber), 8 April 2014.#European Commission v Hungary.#Failure of a Member State to fulfil obligations — Directive 95/46/EC — Protection of individuals with regard to the processing of personal data and the free movement of such data — Article 28(1) — National supervisory authorities — Independence — National legislation prematurely bringing to an end the term served by the supervisory authority — Creation of a new supervisory authority and appointment of another per *Source: Court of Justice of the European Union, C-288/12, 2014-04-08 — https://overview.legal/posts/132371 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0288* The European Commission brought an infringement action against Hungary before the Court of Justice (Grand Chamber) under Article 258 TFEU, alleging that Hungary violated Article 28(1) of Directive 95/46/EC by adopting national legislation that prematurely terminated the term of its existing data protection supervisory authority and appointed a new head. The Court ruled that Hungary had failed to fulfil its obligations, holding that the independence of supervisory authorities under Article 28(1) requires that their term of office cannot be brought to an end without legitimate justification, and that a Member State may not reduce the originally established term of office through general legislation without respecting the conditions previously governing the termination of that term. No fine was imposed in this judgment. ### CJEU Bara: Tax data transferred between public bodies constitutes personal data *Source: CJEU, 2015-10-01 — https://overview.legal/posts/6148 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0201&ref=6148* Personal data: Tax data transferred are personal data, since they are “information relating to an identified or identifiable natural person.” (¶ 29) ### CJEU - C-473/12 - IPI *Source: Court of Justice of the European Union, 2013-11-07 — https://overview.legal/posts/158436 — original: https://gdprhub.eu/index.php?title=CJEU_-_C-473/12_-_IPI* Facts — The Belgian Professional Institute of Real Estate Agents (IPI) had used private detectives to collect information on a real estate company that allegedly breached regulatory rules. The admissibility of the private detectives’ evidence in court was questioned on the grounds that the company’s agents had not been informed that their personal data would be processed by third parties in accordance with Article 11(1) of the Data Protection Directive 95/46. IPI argued that the use of private detectives fell within the exception under Article 13(1)(d) of Directive 95/46, which permits the collection of data without consent for the prevention, investigation, detection and prosecution of breaches for regulated professions. Belgian law had specified exceptions for journalistic purposes, artistic or literary expression, public authorities exercising judicial police duties, police services and the European Centre for Missing and Sexually Abused Children. The Belgian Constitutional Court considered that the Belgian law did not strictly transpose exceptions comparable to Article 13 of Directive 95/46/EC. It referred three questions to the ECJ for clarification on the obligations for Member States to implement Article 13 in national law: Does Article 13(1)(d) of Directive 95/46 leave Member States free to choose whether or not to provide for an exception to the immediate obligation to inform under Article 11(1) to protect others’ rights and freedoms? Do professional activities of private detectives (governed by national law) come within an exception referred to in Article 13(1)(d) and (g) of Directive 95/46? If they do not, is Article 13(1)(d) and (g) of Directive 95/46 compatible with Article 6(3) TEU – specifically, with the principle of equality and non-discrimination? Holding — With regard to the first question, the Court ruled that Member States have the option, but not an obligation, to transpose the list of exceptions provided under Article 13 of the Data Protection Directive 95/46/EC. Article 13 permits Member States to adopt exemptions allowing the collection and processing of personal data without notifying the data subject in seven circumstances: To safeguard national security. For defence. For public security. For the prevention, investigation, detection and prosecution of criminal offenses or breaches of ethics for regulated professions. For an important economic or financial interests of a Member State. For monitoring, inspection or regulatory functions. For the protection of the data subject or the rights and freedoms of others. The CJEU based its interpretation on the emphasis on a high level of protection found in recitals 3, 8 and 10 of Directive 95/46. In provisions such as these, Directive 95/46's aim of harmonisation must be balanced against the applicability of the Directive's general language in specific situations and the need to afford Member States some flexibility in this regard. With regard to the second question, the CJEU considered that the activity of a private investigator on behalf of a regulated body – in this case, the IPI – falls within the scope of Article 13(1)(d) of Directive 95/46. Thus, if a Member State has chosen to implement an exception pursuant to Article 13(1)(d) of Directive 95/46, the professional body concerned and the private detectives acting on its behalf may rely on it. Accordingly, they need not inform the data subject pursuant to Article 10 and 11 of Directive 95/46. ### VG Düsseldorf: data subjects challenge district's sharing of personal data in water-law *Source: Administrative Court Düsseldorf, 2026-06-22 — https://overview.legal/posts/108992 — original: https://gdprhub.eu/index.php?title=VG_Düsseldorf_-_29_K_3490/24* Facts — A district (the controller), acting as the lower water authority, initiated administrative proceedings after identifying unauthorised riverbank works and a private jetty on two riverside properties. One property belonged to a water utility company, while the other belonged to a municipality and was leased to the data subjects. During those proceedings, the controller shared the data subjects' personal data with various participants, including the owners of the affected properties, other public authorities and a lawyer who claimed to represent the data subjects. The data subjects lodged a complaint with the competent supervisory authority (LDI NRW), alleging that the controller had unlawfully processed and disclosed their personal data. They argued that their personal data had been shared with uninvolved third parties, that the controller had communicated with a lawyer whom they had not authorised, recorded a telephone conversation with an unknown person, and transmitted personal data by unencrypted email. The controller's data protection officer addressed each allegation and provided additional factual information concerning the disputed processing operations. The DPA initially informed the data subjects that no GDPR infringement was apparent, invited them to provide any additional factual information, and explained that it would obtain extracts from the controller's administrative file if there were concrete indications that it contained relevant facts not already available. The data subjects did not identify any additional facts and instead reiterated their legal position that the controller had breached its GDPR accountability obligations. The DPA rejected the complaint, concluding that no GDPR infringement could be established. The data subjects then brought an action before the Verwaltungsgericht Düsseldorf (Administrative Court Düsseldorf), seeking a fresh decision on their complaint on the basis that the DPA had failed to adequately investigate the complaint because it had not obtained the controller's administrative file before reaching its decision. Holding — The court held that Articles 57(1)(f) and 77(1) GDPR give rise to an enforceable right requiring a supervisory authority to investigate a complaint to the extent appropriate in the circumstances before determining whether a GDPR infringement has occurred. Recital 141 GDPR requires the investigation to extend as far as is appropriate in light of the circumstances of the individual case, including the significance of the complaint and the seriousness of the alleged infringement. Applying these principles, the court held that the DPA had adequately investigated the complaint. It had considered each allegation together with the detailed response provided by the controller's data protection officer, invited the data subjects to provide any additional factual information, and explained that it would obtain extracts from the administrative file if concrete indications emerged that further relevant facts required clarification. As the data subjects did not provide any additional facts and there were no objective indications that the information already available was inaccurate or incomplete, the court held that the DPA was not required to obtain the controller's administrative file or undertake further investigations in the absence of concrete indications that additional factual clarification was necessary. The court further held that the DPA had correctly concluded that no GDPR infringement had occurred. The court held that the disputed processing was lawful under Article 6(1)(e) GDPR, read together with Article 6(3) GDPR and § 88 of the German Water Resources Act (WHG), which provided the legal basis for the processing. The court also held that the transmission of personal data by email did not infringe Article 5(1)(f) GDPR because, in the circumstances of the case, transport encryption provided an appropriate level of security. ### Amt der Tiroler Landesregierung v Datenschutzbehörde *Source: Court of Justice of the European Union, C-638/23, 2025-02-27 — https://overview.legal/posts/132147 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0638* In Case C-638/23, the Court of Justice interpreted Article 4(7) GDPR in response to a preliminary reference from the Austrian Verwaltungsgerichtshof in proceedings between the Amt der Tiroler Landesregierung (Office of the Provincial Government of Tyrol) and the Datenschutzbehörde (Austrian Data Protection Authority). The core issue was whether an auxiliary administrative entity lacking legal personality and legal capacity, operating in the service of a regional government, qualifies as a "controller" under the GDPR when national law directly designates it to determine the purposes and means of personal data processing. The Court held that such an entity may be designated as a controller by Member State law provided it in fact determines the purposes and means of the processing, with the concept of "other body" in Article 4(7) not requiring the entity to possess legal personality or its own legal capacity. ### Data Protection Commission v European Data Protection Board *Source: General Court, T-70/23, 2025-01-29 — https://overview.legal/posts/132152 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023TJ0070* The Irish Data Protection Commission (DPC) challenged provisions of EDPB Binding Decisions 3/2022, 4/2022, and 5/2022, arguing the EDPB exceeded its competence under Article 65(1)(a) GDPR by requiring the DPC to broaden its investigation into Facebook, Instagram, and WhatsApp and issue new draft decisions. The core legal issue was whether the EDPB, in the consistency mechanism context, can compel a lead supervisory authority to conduct additional investigations and produce new draft decisions beyond addressing the specific relevant and reasoned objections raised by concerned supervisory authorities. The General Court dismissed the DPC's actions, upholding the EDPB's authority to issue binding decisions instructing the lead supervisory authority to carry out further investigation and issue new draft decisions. ### Criminal proceedings against HP *Source: Court of Justice of the European Union, C-724/19, 2021-12-16 — https://overview.legal/posts/132318 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62019CJ0724* In Case C-724/19, the Court of Justice of the European Union interpreted Directive 2014/41/EU (the European Investigation Order Directive) in response to a preliminary reference from the Bulgarian Specialised Criminal Court in criminal proceedings against HP, where four EIOs issued by a Bulgarian public prosecutor sought traffic and location data from other Member States. The Court held that a public prosecutor designated as an "issuing authority" under national transposition law qualifies as such under Article 2(c)(i) of the Directive, even where domestic law reserves the exclusive competence to order the same investigative measure to a judge in analogous domestic cases. The Court further ruled that the executing State must recognize and execute such an EIO, as differences in national rules governing the designation of competent authorities cannot justify refusal of recognition under the Directive's mutual recognition framework. ### Xabier Ormaetxea Garai and Bernardo Lorenzo Almendros v Administración del Estado *Source: Court of Justice of the European Union, C-424/15, 2016-10-19 — https://overview.legal/posts/132352 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62015CJ0424* The CJEU ruled on a preliminary reference from the Spanish Tribunal Supremo concerning Xabier Ormaetxea Garai and Bernardo Lorenzo Almendros, who challenged their dismissal as President and board member of the Comisión del Mercado de las Telecomunicaciones following an institutional merger, against the Administración del Estado. The core issue was whether Article 3 of the Framework Directive (Directive 2002/21/EC), as amended, precludes the dismissal of the head or board members of a national regulatory authority before the expiry of their terms of office on grounds not provided for in national law at the time of their appointment. The Court held that EU law requires that grounds for dismissal be laid down in advance in national law, ensuring the independence and impartiality of national regulatory authorities. ### CE - N. 433539 *Source: Supreme Administrative Court, 2026-04-30 — https://overview.legal/posts/122869 — original: https://gdprhub.eu/index.php?title=CE_-_N._433539* Facts — Several digital rights organisations asked the Prime Minister to repeal Decree No. 2010-236 of 5 March 2010. The decree regulated an automated personal data processing system used by the French authority for freedom of communications (ARCOM, hereinafter the French authority) for France’s online copyright enforcement mechanism, known as the graduated response procedure. Under this system, the French authority could receive IP addresses linked to alleged copyright infringements and request the corresponding subscriber identity data from electronic communications operators. This data could then be used to send warnings to subscribers and, in repeated cases, refer the matter to the public prosecutor. The applicants argued that the decree allowed the French authority to access personal data linked to IP addresses without sufficient safeguards under EU law. The court had previously referred questions to the CJEU, which ruled in Case C-470/21 that such access may be allowed, but only under strict conditions. Following the CJEU judgment, the court reviewed whether the French decree complied with EU law. Holding — The court partly upheld the action. First, the court held that EU law allows the general and indiscriminate retention of IP addresses for combating criminal offences in general only where serious interference with private life is effectively excluded. This requires strict separation between different categories of retained data, secure technical safeguards and regular monitoring by an independent public authority. The court found that French law did not require electronic communications operators to retain subscriber identity data and IP-related data under these conditions. Therefore, the decree was unlawful insofar as it allowed the French authority to process data that had not necessarily been retained in compliance with EU-law safeguards. Second, the court held that the French authority may access subscriber identity data linked to IP addresses in order to identify persons suspected of online copyright infringements and send the first two warnings under the graduated response procedure. However, the court distinguished the third access to such data. At that stage, the authority is no longer dealing with an isolated identification request: it has already linked the same person’s identity twice with alleged unlawful online activity and with the protected works concerned. A third access therefore allows the authority to build a more detailed picture of the person’s conduct and may reveal sensitive aspects of their private life. It also marks a more serious procedural stage, since it may lead to a registered letter and ultimately to referral to the public prosecutor. For that reason, EU law requires prior authorisation by a court or an independent administrative body before this third access takes place. The decree did not provide for such prior review, so the court held that it was unlawful to that extent. For this third access, EU law requires prior authorisation by a court or an independent administrative body. The decree did not provide for such prior review. The court therefore held that the decree was unlawful to that extent. The court annulled the Prime Minister’s refusal to repeal the unlawful parts of the decree and ordered their repeal. It also held that the French authority must stop applying the unlawful provisions. However, the French authority may still access identity data for the first and second warnings, and may request access in serious copyright offence cases under the conditions set out in the judgment. ### La Quadrature du Net and Others v Premier ministre and Ministère de la Culture *Source: Court of Justice of the European Union, C-470/21, 2024-04-30 — https://overview.legal/posts/132259 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0470* In Case C-470/21, the CJEU addressed a preliminary reference from the French Conseil d'État concerning La Quadrature du Net and others v. Premier ministre and Ministre de la Culture, which challenged France's "graduated response" system allowing public authorities to access civil identity data associated with IP addresses retained by ISPs for the purpose of combating online copyright infringement. The Court ruled that while such access may be justified under Article 15(1) of Directive 2002/58/EC (the ePrivacy Directive) for intellectual property protection, it requires strict safeguards including prior review by a court or independent administrative body, and must be limited to what is strictly necessary, proportional, and subject to substantive and procedural protections against abuse. No fine was imposed as this was a preliminary ruling. ### Budapest Főváros IV. Kerület Újpest Önkormányzat Polgármesteri Hivatala v Nemzeti Adatvédelmi és Információszabadság Hatóság *Source: Court of Justice of the European Union, C-46/23, 2024-03-14 — https://overview.legal/posts/132267 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0046* In a preliminary ruling requested by the Budapest High Court, the Court of Justice interpreted whether Article 58(2)(d) and (g) of the GDPR permits a national supervisory authority to order a controller to erase unlawfully processed personal data without a prior request from the data subject. The case arose from a dispute between the Budapest District IV (Újpest) municipal administration and the Hungarian National Data Protection and Freedom of Information Authority (NAIH), which had ordered the municipality to erase unlawfully processed data. The Court held that GDPR provisions do not require a prior data subject request for a supervisory authority to exercise its corrective power to order erasure of unlawfully processed personal data, as such a requirement would undermine the consistent and effective protection of fundamental rights under the GDPR. ## Guidance ### Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies *Source: EDPB, guidelines-22020-on-articles-46-2-a-and-46-3-b-of-regulation-2016679-for-en, 2020-12-15 — https://overview.legal/posts/126098 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-22020-on-articles-46-2-a-and-46-3-b-of-regulation-2016679-for_en* Adopted 1 Guidelines 2/2020 on a rticles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non - EEA public authorities and bodies Version 2 .0 Adopted on 1 5 December 2020 Adopted 2 Version history Version 2.0 15 December 2020 Adoption of the Guidelines after public consultation Version 1.0 18 February 2020 Adoption of the Guidelines for public consulation Adopted 3 Adopted 4 The European Data Protection Board Having regard to Article 70 (1e) of… ### Overview on resources made available by Member States to the Data Protection Authorities and on enforcement actions by the Data Protection Authorities *Source: EDPB, overview-on-resources-made-available-by-member-states-to-en, 2021-08-11 — https://overview.legal/posts/125988 — original: https://www.edpb.europa.eu/documents/reports-statements-and-letters/overview-on-resources-made-available-by-member-states-to_en* 1 Overview on resources made available by Member States to the Data Protection Authorities and on enforcement actions by the Data Protection Authorities 05 August 2021 2 Table of co n tent Background ................................ ................................ ................................ ................................ ......... 3 Introduction ................................ ................................ ................................ ................................ ........ 3… ### Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities *Source: EDPB, opinion-52019-on-the-interplay-between-the-eprivacy-directive-en, 2019-03-12 — https://overview.legal/posts/126232 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-52019-on-the-interplay-between-the-eprivacy-directive_en* adopted 1 Opinion 5 / 2019 on the i nterplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities Adopted on 12 March 2019 adopted 2 adopted 3 The European Data Protection Board Having regard to article 63 and article 64 (2) of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free… ### Template for Cross-Regulatory Cooperation Agreements *Source: EDPB, template-for-cross-regulatory-cooperation-agreements-en, 2026-07-07 — https://overview.legal/posts/125669 — original: https://www.edpb.europa.eu/documents/other-guidance/template-for-cross-regulatory-cooperation-agreements_en* 1 | Adopted Template for Cross-Regulatory Cooperation Agreements Adopted by the EDPB on July 7 th 2026 2 | Adopted Explanatory note Cross-regulatory cooperation between data protection supervisory authorities (DPAs) and other national and EU competent authorities has become increasingly important as legal and practical challenges emerge at the intersection of different regulatory fields. Cooperation agreements can be an important basis to organise and strengthen cooperation and dialogue between… ### Opinion 8/2019 on the competence of a supervisory authority in case of a change in circumstances relating to the main or single establishment *Source: EDPB, opinion-82019-on-the-competence-of-a-supervisory-authority-in-en, 2019-07-12 — https://overview.legal/posts/126208 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-82019-on-the-competence-of-a-supervisory-authority-in_en* Adopted 1 Opinion 8 /2019 on the competence of a supervisory authority in case of a change in circumstances relating to the main or single establishment Adopted on 9 July 2019 Adopted 2 Table of c ontents 1 SUMMARY OF THE FACTS ................................ ................................ ................................ ................ 3 2 ON THE COMPETENCE OF THE BOARD TO ADOPT AN OPINION UNDER ARTICLE 64.2 ON THIS TOPIC ................................ ................................… ### Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework *Source: EDPB, statement-32024-on-data-protection-authorities-role-in-the-en, 2024-07-16 — https://overview.legal/posts/125732 — original: https://www.edpb.europa.eu/documents/reports-statements-and-letters/statement-32024-on-data-protection-authorities-role-in-the_en* Final 1 Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework Adopted on 16 July 2024 The European Data Protection Board has adopted the following statement: 1 BACKGROUND AND PURPO SE OF THIS STATEMENT 1. On 12 July 2024, Regulation (EU) 2024/1689 laying down harmonised rules on a rtificial i ntelligence (Artificial Intelligence Act, hereinafter the “ AI Act ”) and amending certain Union Legislative Acts was published in the Official Journal 1 . 2.… ### Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation *Source: EDPB, edpb-opinion-202507-epo-adequacydecision-en, 2025-05-06 — https://overview.legal/posts/50823 — original: https://www.edpb.europa.eu/documents/adequacy/opinion-072025-regarding-the-european-commission-draft-implementing-decision_en* EDPB, Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation, 2025. ### Opinion 4/2019 on the draft AA between EEA and non-EEA Financial Supervisory Authorities *Source: EDPB, opinion-42019-on-the-draft-aa-between-eea-and-non-eea-en, 2019-02-12 — https://overview.legal/posts/126248 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-42019-on-the-draft-aa-between-eea-and-non-eea_en* adopted 1 Opinion 4 / 2019 on the draft Administrative Arrangement for the transfer of personal data between European Economic Area (“EEA”) Financial Supervisory Authorities and non - EEA Financial Supervisory Authorities Adopted on 12 February 2019 adopted 2 4 Final remarks ................................ ................................ ................................ ................................ ... 8 adopted 3 The European Data Protection Board Having regard to Article 63, Article 64… ## Enforcement decisions ### Maddaloni municipality: Insufficient involvement of data protection officer *Source: Italian Data Protection Authority (Garante), 2024-12-14 — https://overview.legal/posts/48639 — original: https://www.enforcementtracker.com/ETid-2524* The Italian DPA has imposed a fine of EUR 2,000 on Maddaloni municipality for failing to provide the DPA with the contact details of their data protection officer in good time. ### Torre Annunziata municipality: Insufficient involvement of data protection officer *Source: Italian Data Protection Authority (Garante), 2024-12-14 — https://overview.legal/posts/48640 — original: https://www.enforcementtracker.com/ETid-2525* The Italian DPA has imposed a fine of EUR 2,000 on Torre Annunziata municipality for failing to provide the DPA with the contact details of their data protection officer in good time. ### Kourou municipality: Insufficient cooperation with supervisory authority *Source: French Data Protection Authority (CNIL), 2023-12-12 — https://overview.legal/posts/48270 — original: https://www.enforcementtracker.com/ETid-2155* The French DPA has imposed a fine of EUR 5,000 on Kourou municipality for failing to appoint a data protection officer and to sufficiently cooperate with the DPA. ### Municipality of Siracusa: Insufficient involvement of data protection officer *Source: Italian Data Protection Authority (Garante), 2024-01-31 — https://overview.legal/posts/48336 — original: https://www.enforcementtracker.com/ETid-2221* The Italian DPA has imposed a fine of EUR 5,000 on the municipality of Siracusa for failing to provide the DPA with the contact details of their data protection officer in good time. ### Italian DPA sanctions Municipality of Policoro for CCTV signage, retention and DPO *Source: Garante per la protezione dei dati personali (Italy), 2022-06-09 — https://overview.legal/posts/6314 — original: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_9794895* Facts — The Municipality of Policoro (Basilicata), implemented the use of CCTV cameras to monitor and fight waste abandonment within its territory. A data subject complained the Municipality had breached their data protection right of fair, transparent and lawful processing under art. 5(1)(a) as the sign signaling the CCTV monitoring referred to an outdated legislative decree. They also alleged a breach of art. 5(1)(e) and art. 13 GDPR, in so far the municipality never defined a data retention period for each processing purpose pursued. The last complaint moved forward by the data subject was that by being legally represented in Court by the same lawyer, who also acted as DPO of Policoro, the Municipality gave rise to a conflict of interest situation and breached art. 38(6) GDPR. The Municipality argued that the claim had been done in front of the Justice of Peace, who had no competency to decide on issues of privacy. It was also alleged the judgement only pertained an administrative matter, without rising any data protection concerns or a situation of conflict of interest with the Municipality's DPO. The last argument alleged the processing and retention of the CCTV footage was related to illegal dumps within the municipal territory, meaning the filming had been carried out in the course of judicial police investigations and the data retention periods of the GDPR did not apply in this case. Holding — The Italian DPA held that in this case the Municipality was carrying activities of data processing, by surveilling public entities by means of surveillance cameras. It also noted, that in par. 41 of the Guidelines 3/2019 on the Processing of Personal Data by Video Devices, waste management is "among the institutional activities entrusted to local authorities". This means the surveillance done by the Municipality of Policoro, a task carried out in the public interest in connection with the exercise of official authority as per art.6(1)(e) GDPR, was unrelated to public security and/or judicial police and obliging the controller to comply with data protection principles. The DPA found that the information provided in regards to the processing of personal data by means of surveillance cameras, did not meet the requirements of conciseness, transparency, intelligibility and easy readability contained in art. 5(1)(a) GDPR. The Municipality of Policoro had failed to provide suitable first-level information to the data subject, in so far the sign signaling the CCTV surveillance made reference to an outdated legislative decree (d.lgs 196/03) instead of the one currently in force (d.lgs 101/18). Furthermore, the data controller failed to provide the data subject with an adequate notice on second-level processing of their data. The signage did not include information on the most suitable impacts of the processing or an indication of a website, where to consult an extended version of the explanation. The DPA also found a violation of art. 13 GDPR as well as the principles of storage limitation and accountability in art. 5(1)(e) and art. 5(2). It stated that "the longer the intended storage period (especially if longer than 72 hours), the more reasoned the analysis referring to the legitimacy of the purpose and necessity of storage must be". In this case, the data controller not only failed to set a maximum retention period for the images taken for the purpose of combating illegal littering, but also established the administrative fines for the violation two months after the images were recorded. This did not allow for the data controller to respect the principle of accountability. Lastly, the DPA addressed the alleged conflict of interest raised by the involvement of the Policoro's DPO in the legal proceedings brought against the data subject. The DPA ruled DPOs "may perform other duties and functions," with the understanding that "the controller must ensure that such duties and functions do not give rise to a conflict of interest." The DPA also made reference to the Article 29 WP's Guidelines on Data Protection Officers, in which it is urged to not designate DPOs already acting as defense counsel for the same court. In the case at hand, it resulted that the DPO shared with the Municipality an interest in obtaining a rejection of the appeal. Consequently, the Italian Garante held this to be in violation of art. 38(6) GDPR, as well the fact that it undermined the DPO's independence. The Italian DPA held a cumulative breach of art. 5(1)(a) and (e) and (2) (in conjunction with article 24), 12, 13 and 38(6) GDPR. It balanced the fact that the personal data processing affected all other citizens, who passed through the areas under surveillance, against the lack of previous violations committed by the data controller. The DPA issued a fine of €26,000 EUR to the Municipality of Policoro. ### Estonian DPA: website republishing public authority documents independently liable under *Source: AKI (Estonia), 2026-06-19 — https://overview.legal/posts/354297 — original: https://gdprhub.eu/index.php?title=AKI_(Estonia)_-_2.1.-4/26/1106-2333-4* Facts — The controller was a private individual who operated a website that collected documents from public authorities’ document registers and made them easier to search and access online. The DPA found that some documents remained available on the website even after the original authorities had imposed access restrictions. Public authorities and data subjects had also contacted the controller requesting the removal of personal data. The controller relied on Article 6(1)(f) GDPR, arguing that the processing served the legitimate interest of facilitating access to public information. He also argued that continuously checking all republished documents for subsequent access restrictions was technically difficult. Holding — The DPA held that the controller was independently responsible for ensuring that the republication of personal data complied with the GDPR. The fact that personal data had previously been published by a public authority did not automatically provide a legal basis for its further publication. The DPA found that the controller lacked sufficient technical and organisational measures under Articles 5(2), 24 and 25 GDPR to prevent personal data from remaining publicly accessible after the original source had restricted access. Regarding Article 6(1)(f) GDPR, the DPA held that a general legitimate-interest assessment could not justify the republication of all documents containing personal data. The controller had to assess whether a valid legal basis existed for the specific processing, particularly where access restrictions had subsequently been imposed. Where special categories of personal data were involved, Article 9 GDPR also had to be satisfied. The DPA also required the controller to ensure proper handling of requests under Articles 15 to 22 GDPR. Under Article 58(2)(c) and (d) GDPR, the DPA ordered the controller to implement safeguards preventing unlawful publication, stop processing personal data when no legal basis existed, review documents for subsequent access restrictions, and adopt written procedures for data-subject requests. No administrative fine was imposed. However, failure to comply could result in a €500 penalty payment for each unfulfilled requirement. ### Municipality of Palma di Montechiaro: Lack of appointment of data protection officer *Source: Italian Data Protection Authority (Garante), 2025-03-27 — https://overview.legal/posts/48784 — original: https://www.enforcementtracker.com/ETid-2669* The Italian DPA has imposed a fine of EUR 3,000 on the Municipality of Palma di Montechiaro. The controller failed to appoint a DPO and report the DPO to the DPA. ### Municipality of Korou: Insufficient involvement of data protection officer *Source: French Data Protection Authority (CNIL), 2024-07-22 — https://overview.legal/posts/48525 — original: https://www.enforcementtracker.com/ETid-2410* The French DPA has imposed a fine of EUR 6,900 on the municipality of Korou for failing to appoint a data protection officer. ## Recent developments ### Swedish DPA fines Miljödata i Karlskrona approximately EUR 160 000 for insufficient technical and organisational measures to ensure information security *Source: European Data Protection Board, 2026-10-08 — https://overview.legal/posts/593251 — original: https://www.edpb.europa.eu/news/swedish-dpa-fines-miljodata-i-karlskrona-approximately-eur-160-000-for-insufficient-technical_en* Background informationDate of final decision: 22/09/2026National caseLegal Reference(s): Article 32 (Security of processing)Decision: Administrative fineWebsite topics: Cybersecurity, personal data breachesSummary of the DecisionOrigin of the caseIn August 2025, the IT service provider Miljödata was targeted in a cyberattack, during which a malicious actor gained access to a large volume of personal data and subsequently published data on the darknet. According to the company, the incident affec ### Ola Bini Ordered to Leave Ecuador Under Obscure Accusations *Source: Electronic Frontier Foundation, 2026-10-02 — https://overview.legal/posts/449819 — original: https://www.eff.org/deeplinks/2026/10/ola-bini-ordered-leave-ecuador-under-obscure-accusations* In a new blow to Ola Bini’s legal guarantees, Ecuadorean authorities retained the free software developer and security expert yesterday in Quito and ordered his immediate deportation from the country. He is barred from returning to Ecuador for 10 years. According to information released by his lawyer, Bini was intercepted by a car with four people who identified themselves as immigration agents. He was then taken to an immigration office without further information or a formal order from a compe ### Hunton geeft een samenvatting van twee artikelen uit de nieuwe SCC-richtlijnen: het onderdeel over "lokale wetgeving en toegang tot overheidsinstanties". *Source: DataGuidance, 2022-10-18 — https://overview.legal/posts/51831* Volgens artikel 14 van de Standaard Contractuele Bepalingen (SCC's) voor gegevensuitwisseling, moet de partij die de gegevens importeert een risicoanalyse uitvoeren om te verifiëren of de wet- en regelgeving en praktijken van het ontvangende derde land de mogelijkheid van de gegevensimporteur om te voldoen aan de SCC's voor gegevensuitwisseling, kunnen belemmeren. Indien de risicoanalyse aantoont dat de SCC's voor gegevensuitwisseling op zichzelf niet voldoende zijn om een in wezen gelijkwaardig beschermingsniveau te garanderen voor de persoonsgegevens in het ontvangende derde land, moeten aanvullende waarborgen worden geïmplementeerd, zoals end-to-end-versleuteling. ### Het Italiaanse bedrijf SA heeft juridische stappen ondernomen tegen een gemeente vanwege het gebruik van haar videosurveillance systeem en omdat het haar Functionaris Gegevensbescherming (FG) heeft aangesteld om de gemeente in een rechtszaak te vertegenwoordigen. *Source: GDPRhub, 2022-09-28 — https://overview.legal/posts/51807* Tenslotte oordeelde de gegevensbeschermingsautoriteit dat de verantwoordelijke, door de functionaris gegevensbescherming (FG) te betrekken bij de verdediging in rechtszaken, de FG in een positie van belangenconflict bracht, in strijd met artikel 38(6) van de AVG. Dit was met name omdat dit ertoe leidde dat de betrokkene het gevoel had niet in staat te zijn om contact op te nemen met de FG met betrekking tot kwesties die verband houden met de verwerking van hun persoonlijke gegevens en de uitoefening van hun rechten zoals uiteengezet in artikel 38(4) van de AVG. ### In short: *Source: Government, 2025-03-24 — https://overview.legal/posts/52206* Regarding the Data Protection Regulation, it should be noted that: "The Data Protection Authority (AP) is designated as the supervisory body for the section concerning the collection of data by government agencies in situations of exceptional necessity, and for the specific provisions relating to the processing of personal data, as well as for the explanation of audiovisual materials..." ## Literature ### GDPR Implementation Series ∙ Malta: An Overview of the GDPR Implementation *Source: European Data Protection Law Review, 2020-01-01 — https://overview.legal/posts/132480 — original: https://doi.org/10.21552/edpl/2020/4/15* ### GDPR Implementation Series ∙ Belgium: Substantial Reform of Supervisory Authority and Framework Implementing Act Finally Adopted *Source: European Data Protection Law Review, 2018-01-01 — https://overview.legal/posts/132496 — original: https://doi.org/10.21552/edpl/2018/3/14* ### GDPR Implementation Series ∙ Netherlands: The GDPR Implementation Act *Source: European Data Protection Law Review, 2018-01-01 — https://overview.legal/posts/132478 — original: https://doi.org/10.21552/edpl/2018/3/15* ### General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain *Source: Journal of Data Protection Privacy, 2021-09-01 — https://overview.legal/posts/132409 — original: https://doi.org/10.69554/uukl8163* The General Data Protection Regulation (GDPR) of the European Union (EU) does not always make legally binding provisions with unambiguous implications. The implementation of Art. 39(1) GDPR regarding the certification of Data Protection Officers (DPOs) is left to the discretion of Member States. This paper will show what action has been taken by the national data protection authorities (DPAs) of France, Italy, Luxembourg and Spain. Insights gained from examining the four national frameworks, whi ### GDPR Implementation Series ∙ Romania: Overview of the GDPR Implementation *Source: European Data Protection Law Review, 2018-01-01 — https://overview.legal/posts/132479 — original: https://doi.org/10.21552/edpl/2018/3/16* ## Related topics - **Personal Data** — https://overview.legal/topics/personal-data Information relating to identified or identifiable natural persons - **Law Enforcement** — https://overview.legal/topics/law-enforcement Processing for law enforcement purposes - **Processing** — https://overview.legal/topics/processing Any operation performed on personal data - **Controllers** — https://overview.legal/topics/controllers Entities that determine purposes and means of processing - **Supervision** — https://overview.legal/topics/supervision Oversight and enforcement by supervisory authorities - **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities National data protection authorities and their powers --- Generated by overview.legal · https://overview.legal/topics/public-authority · 2026-10-13