# Retention Period — legal context bundle

> Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/retention-period
> Sources are cited per item. Verify against the official texts before relying on them.

The duration for which personal data may be stored

## Overview

## Legal Framework

The primary governing provision for retention periods is [Article 5(1)(e) GDPR](/laws/gdpr/art-5#par-1-pnt-e), which establishes the storage limitation principle. Personal data must be kept in a form permitting identification of data subjects only for as long as necessary for the purposes of processing. This is complemented by [Article 5(1)(c)](/laws/gdpr/art-5#par-1-pnt-c) (data minimisation), which requires that data be "adequate, relevant and limited to what is necessary," and by [Article 25(2) GDPR](/laws/gdpr/art-25#par-1), which extends data-protection-by-default to "the period of their storage."

The core requirement is purpose-bound: the retention period must be calibrated to the specific purpose for which data are processed. Once that purpose is exhausted, erasure or anonymisation must follow.

> "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed"
> — [GDPR Art. 5(1)(e)](/laws/gdpr/art-5#par-1-pnt-e)

Article 5(1)(e) also carves out a narrow exception: longer retention is permitted solely for archiving in the public interest, scientific or historical research, or statistical purposes, provided [Article 89(1)](/laws/gdpr/art-89#par-1) safeguards apply. [Article 47(2)(d) GDPR](/laws/gdpr/art-47#par-2-pnt-d) reinforces this by requiring that binding corporate rules specify "limited storage periods."

## Key Developments

The CJEU's ruling in *Digital Rights Ireland* established that blanket retention periods — undifferentiated across data categories or user types — fail to meet proportionality requirements. The Court criticised Directive 2006/24 for imposing a minimum six-month retention period without distinguishing between categories based on usefulness.

> "Article 6 of Directive 2006/24 requires that those data be retained for a period of at least six months, without any distinction being made between the categories of data"
> — [Digital Rights Ireland, ¶63](/posts/6161#seg-63)

The Court further found that the directive failed to "ensure the irreversible destruction of the data at the end of the data retention period," underscoring that retention limits are meaningless without enforceable erasure obligations.

The Dutch Council of State (*Raad van State*) addressed retention in the context of government email preservation, holding that a municipality could safeguard a mayor's deleted emails to prevent premature destruction under the Archiefwet — illustrating how sectoral archival legislation interacts with data-protection storage limits.

The EDPB's breach notification guidelines confirm that even documentation of personal data breaches has no fixed retention period under the GDPR; controllers must self-determine an appropriate period "in accordance with the principles in relation to the processing of personal data."

## Status of the Debate

Retention period is actively contested in litigation. Courts have diverged on how to calibrate storage limits across contexts — from telecommunications metadata to government emails to breach records. The fundamental principle (purpose-bound, minimised retention) is settled, but its application to specific sectors and data categories remains in flux. No uniform court-driven threshold exists for how long particular categories of data may be kept. What would resolve the open questions is further CJEU guidance on proportionality testing for sector-specific retention mandates, particularly where national archival laws intersect with GDPR storage limitation.

## Practical Guidance

- **Define purpose-specific retention schedules.** Map each processing purpose to a maximum retention period, grounded in [Article 5(1)(e)](/laws/gdpr/art-5#par-1-pnt-e). Avoid blanket periods that fail to distinguish between data categories or user types, as criticised in *Digital Rights Ireland*.
- **Implement automated erasure or anonymisation.** Configure technical measures under [Article 25(2)](/laws/gdpr/art-25#par-1) so that default storage periods are enforced systemically, not left to ad hoc human decision-making.
- **Document the rationale for each retention period.** Record why a specific duration is necessary for the stated purpose — this is essential for demonstrating compliance and defending against regulatory challenge.
- **Ensure irreversible destruction at end of period.** As the CJEU stressed, retention limits require enforceable erasure; partial or reversible deletion is insufficient.
- **Check sectoral archival laws.** Where national legislation (e.g., the Archiefwet) mandates longer retention, confirm that the [Article 89(1)](/laws/gdpr/art-89#par-1) safeguards — particularly pseudonymisation and data minimisation — are applied to the extended retention.

## Legislation (full text of key provisions)

### Recital 156 — safeguards for archiving research processing

*Source: GDPR, gdpr-rec-156-en, 2016-04-27 — https://overview.legal/posts/91827*

The processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be subject to appropriate safeguards for the rights and freedoms of the data subject pursuant to this Regulation. Those safeguards should ensure that technical and organisational measures are in place in order to ensure, in particular, the principle of data minimisation. The further processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is to be carried out when the controller has assessed the feasibility to fulfil those purposes by processing data which do not permit or no longer permit the identification of data subjects, provided that appropriate safeguards exist (such as, for instance, pseudonymisation of the data). Member States should provide for appropriate safeguards for the processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. Member States should be authorised to provide, under specific conditions and subject to appropriate safeguards for data subjects, specifications and derogations with regard to the information requirements and rights to rectification, to erasure, to be forgotten, to restriction of processing, to data portability, and to object when processing personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. The conditions and safeguards in question may entail specific procedures for data subjects to exercise those rights if this is appropriate in the light of the purposes sought by the specific processing along with technical and organisational measures aimed at minimising the processing of personal data in pursuance of the proportionality and necessity principles. The processing of personal data for scientific purposes should also comply with other relevant legislation such as on clinical trials.

### Recital 69 — privacy and data protection lifecycle

*Source: AI Act, aiact-rec-69-en, 2024-06-12 — https://overview.legal/posts/93820*

The right to privacy and to protection of personal data must be guaranteed throughout the entire lifecycle of the AI system. In this regard, the principles of data minimisation and data protection by design and by default, as set out in Union data protection law, are applicable when personal data are processed. Measures taken by providers to ensure compliance with those principles may include not only anonymisation and encryption, but also the use of technology that permits algorithms to be brought to the data and allows training of AI systems without the transmission between parties or copying of the raw or structured data themselves, without prejudice to the requirements on data governance provided for in this Regulation.

### Recital 94 — law enforcement biometric data processing compliance

*Source: AI Act, aiact-rec-94-en, 2024-06-12 — https://overview.legal/posts/93870*

Any processing of biometric data involved in the use of AI systems for biometric identification for the purpose of law enforcement needs to comply with Article 10 of Directive (EU) 2016/680, that allows such processing only where strictly necessary, subject to appropriate safeguards for the rights and freedoms of the data subject, and where authorised by Union or Member State law. Such use, when authorised, also needs to respect the principles laid down in Article 4 (1) of Directive (EU) 2016/680 including lawfulness, fairness and transparency, purpose limitation, accuracy and storage limitation.

### Recital 71 — protection of minors online

*Source: DSA, dsa-rec-71-en, 2022-10-19 — https://overview.legal/posts/95539*

The protection of minors is an important policy objective of the Union. An online platform can be considered to be accessible to minors when its terms and conditions permit minors to use the service, when its service is directed at or predominantly used by minors, or where the provider is otherwise aware that some of the recipients of its service are minors, for example because it already processes personal data of the recipients of its service revealing their age for other purposes. Providers of online platforms used by minors should take appropriate and proportionate measures to protect minors, for example by designing their online interfaces or parts thereof with the highest level of privacy, safety and security for minors by default where appropriate or adopting standards for protection of minors, or participating in codes of conduct for protecting minors. They should consider best practices and available guidance, such as that provided by the communication of the Commission on A Digital Decade for children and youth: the new European strategy for a better internet for kids (BIK+). Providers of online platforms should not present advertisements based on profiling using personal data of the recipient of the service when they are aware with reasonable certainty that the recipient of the service is a minor. In accordance with Regulation (EU) 2016/679, notably the principle of data minimisation as provided for in Article 5(1), point (c), thereof, this prohibition should not lead the provider of the online platform to maintain, acquire or process more personal data than it already has in order to assess if the recipient of the service is a minor. Thus, this obligation should not incentivize providers of online platforms to collect the age of the recipient of the service prior to their use. It should be without prejudice to Union law on protection of personal data.

### Recital 51 — Innovative technology for cybersecurity

*Source: NIS2, nis2-rec-51-en, 2022-12-14 — https://overview.legal/posts/96630*

Member States should encourage the use of any innovative technology, including artificial intelligence, the use of which could improve the detection and prevention of cyberattacks, enabling resources to be diverted towards cyberattacks more effectively. Member States should therefore encourage in their national cybersecurity strategy activities in research and development to facilitate the use of such technologies, in particular those relating to automated or semi-automated tools in cybersecurity, and, where relevant, the sharing of data needed for training users of such technology and for improving it. The use of any innovative technology, including artificial intelligence, should comply with Union data protection law, including the data protection principles of data accuracy, data minimisation, fairness and transparency, and data security, such as state-of-the-art encryption. The requirements of data protection by design and by default laid down in Regulation (EU) 2016/679 should be fully exploited.

## Case law

### Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság

*Source: Court of Justice of the European Union, C-77/21, 2022-10-20 — https://overview.legal/posts/132306 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0077*

In this preliminary ruling, the CJEU interpreted Articles 5(1)(b) and 5(1)(e) GDPR in proceedings between Digi Távközlési és Szolgáltató Kft. and the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) concerning a personal data breach. The Court held that creating a new database from an existing one for testing and error-correction purposes constitutes further processing requiring compatibility assessment under the purpose limitation principle, and that the storage limitation principle applies such that data must be deleted once the testing purpose is fulfilled. No fine was imposed at the EU level, as the matter was remitted to the referring Hungarian court.

### Maximilian Schrems v Meta Platforms Ireland Limited

*Source: Court of Justice of the European Union, C-446/21, 2024-10-04 — https://overview.legal/posts/132159 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0446*

In a preliminary ruling arising from proceedings between Maximilian Schrems and Meta Platforms Ireland Limited, the Court of Justice of the European Union interpreted GDPR Articles 5(1)(b), 5(1)(c), 6(1), and 9 concerning the lawfulness of processing user personal data for personalised advertising on online social networks. The Court addressed whether such processing can be deemed compatible with the original purpose of data collection under a platform's terms of use, the applicability of the data minimisation principle, and the conditions under which special categories of personal data, including data concerning sexual orientation made public by the data subject, may be processed. No fine was imposed, as the ruling provides interpretative guidance to the Austrian Supreme Court for resolution of the underlying dispute.

### SIA 'SS' v Valsts ieņēmumu dienests

*Source: Court of Justice of the European Union, C-175/20, 2022-02-24 — https://overview.legal/posts/132316 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0175*

In Case C-175/20, the Court of Justice of the EU interpreted GDPR Articles 5 and 6 in response to a preliminary ruling from the Latvian Regional Administrative Court concerning a request by the Latvian State Tax Authority for SIA 'SS' to disclose personal data from online vehicle sale advertisements for tax enforcement purposes. The Court held that national law may require controllers to provide personal data to tax authorities under Article 6(1)(c) and (e), provided the request complies with data minimisation and purpose limitation principles, meaning authorities must limit requests to what is necessary and proportionate for the specific tax investigation. No fine was imposed as this was a preliminary ruling proceeding.

### US Zagreb - Us I-4772/2023-10

*Source: Administrative Court of Zagreb, 2026-07-22 — https://overview.legal/posts/291262 — original: https://gdprhub.eu/index.php?title=US_Zagreb_-_Us_I-4772/2023-10*

Facts — A utility and municipal services enterprise, Zagrebački Holding d.o.o. (the controller) provided users of its services with the option to request a copy of their bill via email. Where the name appearing in the email address differed from the user’s name, the controller requested a copy of an identification document as part of the process of verifying the identity of its users. It treated that discrepancy as an indication of possible identity fraud. According to the controller, users were asked to redact any information on the document that was not necessary for identification. In addition, the copies were deleted once the relevant purpose had been fulfilled and access to them was limited to a small number of authorised employees. The Croatian DPA (AZOP) found that the controller had not adequately informed users of the legal basis for collecting copies of identification documents, the applicable retention period, or whether providing such a copy was mandatory and what the consequences of not providing it would be. It held that the controller had infringed Article 13(1)(c) GDPR, Article 13(2)(a) GDPR and Article 13(2)(e) GDPR. Furthermore, it found that the company had not implemented appropriate technical and organizational measures for the process of verifying the identity of users who requested copies of bills via email, in violation of Article 25(2) GDPR. It fined the controller €25,000. The controller challenged the decision before the Administrative Court of Zagreb. It argued that it had published information on its website regarding the processing of personal data. It claimed that the information had been modelled on guidelines published by the EDPB. The controller further alleged that users had been informed that the data would not be retained for longer than was necessary for the purpose of the processing. It also argued that it did not collect an excessive amount of data, as it asked users to redact unnecessary information and that copies were deleted after verification was completed. The DPA pointed out that the information regarding data retention was contradictory or open to different interpretations, and that the controller’s deficiencies were not corrected even when a user requested clarification directly from the controller. Regarding the identification process, the DPA argued that the controller could have achieved the same objective without requesting copies of identification documents, for example by using previously verified email addresses. It considered that a discrepancy between a user’s name and the name associated with an email address did not constitute a reliable criterion for detecting potential identity fraud. According to the DPA, the procedure was not designed with sufficient consideration of the nature, context, and risks of the specific processing, and the mere instruction to users to redact parts of their identification document did not constitute a sufficient safeguard. Holding — The court held that the controller had not transparently provided users with the legal basis for collecting copies of identification documents. It found that this information was neither available in the controller’s published documents nor provided when users requested it directly via email. The court therefore upheld the finding of an infringement of Article 13(1)(c) GDPR. The court further found that the information concerning the retention period could be interpreted in different ways. In response to a specific inquiry, the controller should have provided clear information on the duration of the storage. It ruled that this amounted to an infringement of Article 13(2)(a) GDPR. The court also noted that one user had been told that the requested data could not be provided without an identification document, while the controller later stated before the DPA that users unwilling to send a copy could instead present it in person at the Holding Centre in Zagreb. In light of the lack of clear information as to whether providing the identification document was mandatory and the consequences of not providing it, the court upheld the finding of an infringement of Article 13(2)(e) GDPR. Moreover, the court agreed with the DPA that the controller had not implemented appropriate technical and organisational measures for the identification procedure. It determined that the format or name of an email address did not provide sufficient assurance that a request actually originated from the user concerned, while the procedure effectively required certain users to provide a copy of an identification document in order to communicate remotely. The court pointed out that processing such copies could pose a high risk to individuals’ rights, such as identity theft. The court considered that the controller could instead have established a secure email-verification procedure, allowing users to verify an email address for communications and the delivery of bills, while ensuring that the identification procedure applied consistently regardless of the structure of the email address. It therefore upheld the finding that the controller had failed to implement appropriate safeguards in breach of Article 25(2) GDPR. Furthermore, the court rejected the controller’s reliance on the EDPB’s practice, noting that it concerned a different context, namely the verification of the identity of individuals exercising their rights under the GDPR. It acknowledged that an ID copy may be justified in higher-risk situations, such as certain GDPR rights requests involving sensitive or extensive data, or where the controller has no ongoing relationship with the requester. However, it held that this did not affect the infringements established in relation to the controller’s procedure for issuing copies of bills. The court upheld the DPA’s €25,000 fine.

### Norra Stockholm Bygg AB v Per Nycander AB

*Source: Court of Justice of the European Union, C-268/21, 2023-03-02 — https://overview.legal/posts/132293 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0268*

In Case C-268/21, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Swedish Supreme Court in proceedings between Norra Stockholm Bygg AB and Per Nycander AB concerning the disclosure of an electronic staff register in civil litigation. The Court held that the production of documents containing personal data in civil court proceedings may constitute lawful processing under GDPR Article 6(3) and (4) where Member State law provides a suitable legal basis, and that such processing must comply with the data minimisation principle under Article 5, requiring a proportionate balancing of the parties' interests in judicial protection against the data subjects' rights to privacy and data protection. No fine was imposed.

### EWCA (UK) - 2026 EWCA Civ 1130

*Source: Court of Appeal (Civil Division), 2026-09-02 — https://overview.legal/posts/353650 — original: https://gdprhub.eu/index.php?title=EWCA_(UK)_-_2026_EWCA_Civ_1130*

Facts — Three persons who had brought personal injury claims arising from road traffic accidents and whose personal and health data were included in a spreadsheet prepared for use in related litigation concerning alleged fraud and fundamental dishonesty, the data subjects, challenged the processing of their data by DWF Law LLP, the controller. As part of the defence of those claims, the controller analysed 372 road traffic accident claims and prepared a spreadsheet identifying patterns considered relevant to the allegations of dishonesty. The spreadsheet contained claimants' names and information concerning their personal injury claims, including health information. It was exhibited to a witness statement and used in related litigation. The data subjects argued that the controller had unlawfully processed their personal data by using and disclosing the spreadsheet without pseudonymising their identities. They relied, inter alia, on the principles of lawfulness, fairness, purpose limitation, data minimisation and storage limitation, as well as the rules applicable to special-category data. The controller subsequently replaced the claimants' names with reference numbers in a pseudonymised version of the spreadsheet. The High Court dismissed the claims. It found that the processing was lawful under Article 6(1)(c), (e) and (f) UK GDPR and that the processing of health data was permitted under Article 9(2)(f) UK GDPR because it was necessary for the establishment, exercise or defence of legal claims. It also found that the initial use of names was justified and proportionate, although pseudonymisation was adopted later. The data subjects appealed. By the end of the appeal hearing, they argued principally that there remained a risk that the controller could use the non-pseudonymised spreadsheet in future proceedings and that such processing would be disproportionate and contrary to the UK GDPR. Holding — The Court dismissed the appeal. It held that the case ultimately advanced on appeal was materially different from the one pleaded and decided before the High Court. While the original claim concerned past processing, the data subjects sought on appeal declarations concerning a possible future use of the non-pseudonymised spreadsheet. This new claim had not been pleaded, fell outside the permitted grounds of appeal and would have required further factual findings. The Court also found no sufficient factual basis for a risk of future non-pseudonymised processing. Following a March 2023 order, the controller had used a pseudonymised version of the spreadsheet for future purposes. As regards proportionality, the Court rejected the attempt to introduce a stricter "least restrictive means" test at the appeal stage. It considered that existing case law supported the High Court's approach that necessity under the UK GDPR requires more than desirability, but not absolute indispensability. Accordingly, the High Court's findings remained undisturbed. The initial use of the data subjects' names was considered necessary and proportionate in the litigation context. The processing of health data was permitted under Article 9(2)(f) UK GDPR, and no breach of the data minimisation or storage limitation principles was established. Although pseudonymisation was desirable where feasible, its absence at the initial stage did not render the processing unlawful. No fine or corrective measure was imposed.

### Cass.Civ. - 15625/2026

*Source: Supreme Court, 2026-05-21 — https://overview.legal/posts/53097 — original: https://gdprhub.eu/index.php?title=Cass.Civ._-_15625/2026*

Facts — Istituto nazionale della previdenza sociale (INPS, the controller) is the Italian National Institute for Social Security. In 2021, the DPA fined the controller €300,000 for its data processing activities linked to a subsidy given during the pandemic (also called “the COVID bonus”). The DPA found that the controller had postponed its second screening of verifying the eligibility of data subjects to a later stage, on the grounds that there was a need to immediately pay the subsidy. The controller considered that politicians did not fall under the scope of eligible data subjects, as they were already enrolled in a mandatory social security scheme. The controller processed their personal data from databases to cross reference them with data subjects who had applied for the subsidy. The DPA found a violation of several GDPR principles: the principle of lawfulness (Article 5(1)(a) GDPR), data minimisation (Article 5(1)(c) GDPR), accuracy (Article 5(1)(d) GDPR) and accountability (Articles 5(2) and 24 GDPR). According to the DPA, the controller had not limited the cross referencing to data subjects that had received the allowance, but to those whose applications had already been rejected. In addition, the DPA found a violation of Articles 25 and 35 GDPR, as the controller failed to conduct a data protection impact assessment (DPIA). The DPA ordered the controller to erase all personal data that had been processed unlawfully and to carry out a DPIA before resuming its processing activities. The controller appealed the decision to the Court of Rome, and argued that the DPA’s decision was unfounded. The court upheld the appeal and dismissed the DPA’s decision. The court considered that the controller had processed data subjects’ data lawfully, as it had limited the amount of data to what was necessary to verify data subjects’ eligibility. The court also considered that the processing posed a low risk for data subjects’ rights, as the data subjects’ names were not disclosed. The DPA appealed this decision to the court. Holding — The court dismissed the appeal. The court first stated that the controller processed the data lawfully under Article 6(1)(e) GDPR (public interest) and Article 6(3)(b) GDPR. While the controller processed data of specific data subjects (politicians), the court stated that national law allowed the controller to check the eligibility of all data subjects applying for the subsidy. The controller had also obtained the personal data through public databases provided by the Chambers of Parliament and Ministry of the Interior. The court also dismissed the DPA’s arguments on data minimisation (Article 5(1)(c) GDPR). The court stated that the principle of data minimisation is not absolute, and must be balanced with other interests at stake. The court took into consideration the fact that the data was publicly available and the need to quickly verify a high number of applications during a state of emergency. According to the court, there was also no other way to check applications still under review, and concluded that there was an overriding public interest in carrying out the verification process quickly. Finally, the court considered that the controller complied with Article 25 GDPR, as it processed data lawfully and in compliance with Article 5(1)(c) GDPR. In terms of data accuracy (Article 5(1)(d) GDPR), the court dismissed the DPA’s argument that the controller’s system did not eliminate the risk of “homocodes” (identical tax numbers between two or more people). The court considered that the data collected by the Chambers of Parliament and Ministry of Interior were presumed to be accurate. The court also noted that national law foresees the risk of “homocodes” and sets specific procedures in such cases, and that no actual inaccuracies were found in the controller’s verification process. Finally, the court did not find a violation of Article 35 GDPR. The court stated that the controller did not have the obligation to conduct a DPIA, as it did not meet all the necessary criteria. According to the court, the DPA failed to explain the potential high risks of large scale processing that would have justified the need for a DPIA. Given the previous dismissed arguments, the court considered that the controller had also complied with the principle of accountability (Articles 5(2) and 24 GDPR).

### French Conseil d'État strikes down GendNotes police app decree for excessive special data

*Source: CE, 2021-04-13 — https://overview.legal/posts/125663 — original: https://gdprhub.eu/index.php?title=CE_-_439360*

Facts — In February 2020 the French minister of the interior enacted the Decree No. 2020-151 of 20 February 2020 authorising the automated processing of personal data known as "mobile note-taking application" (Décret n° 2020-151 du 20 février 2020 portant autorisation d'un traitement automatisé de données à caractère personnel dénommé «application mobile de prise de notes» (GendNotes)). The app should be used on the occasion of preventive actions, investigations or interventions necessary for the exercise of judicial or administrative police missions. Among the data that can be collected is information relating to alleged racial or ethnic origin, political, philosophical or religious opinions, trade union membership, health or sexual activities or orientation. A group of human rights organisations filed a complaint with the French Constitutional Court. Dispute — Is the "GendNotes" App of the French national police force (Gendarmerie nationale) unlawfully processing special category personal data? Holding — The French Highest Administrative Court held that the decree infringed Article 4 of the Law of 6 January 1978, implementing GDPR in France, the Council of Europe Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data and Article 8 CFR, as it excessively infringed upon the right to respect for private life and the correlative right to protection of personal data, without providing appropriate safeguards for their protection in terms of the purpose of the processing and the nature of the data collected, as well as excessive data retention period, data sharing and data security. The Court discussed whether the decree violated Article 4 (a) GDPR, Article 4 (b) GDPR, Article 4 (c) GDPR, and Article 4 (e) GDPR and Article 9 GDPR. According to the Court, the processing of data did not comply with the principle of purpose limitation, as data is collected for future investigations or proceedings. However, the Court did not find a violation on the collect of special category data, given the fact that the decree establishes that this data can only be processed in case of "absolute necessity". Additionally, the Court noted that, even if the decree provides a limitation for the storage of the data, in practice this can be ignored, as the data may be used in different or further investigations, that would impede its erasure. However, they found that the decree was lawful in this regard, given that it clearly stated a retention period of 3 months to 1 year. Taken the above-mentioned into account, the French Highest Administrative Court decided that the data processed by the French national police force can no longer be used "in other data processing, in particular by means of a pre-information system". Therefore, the Court held: In Article 1° of the decree, the words "in other data processing, in particular by means of a pre-information system," are cancelled out. The State will pay €3,000 to every claimant. The rest of the application is rejected. The allowance to collect special category data is not overruled, as the Court argues that the decree only allows it when it is "absolutely necessary". This decision will be notified to the claimants: the Ligue des droits de l'homme, the associations Homosexualités et socialismes and Internet Society France, the associations Mousse, Stop Homophobie, Adheos and Familles A, the association AIDES, the Syndicat de la magistrature, the Syndicat des avocats de France, the Conseil national des barreaux, the Quadrature du Net and the International League against Racism and Anti-Semitism, the Prime Minister and the Minister of the Interior.

### BVwG - W137 2334047-1

*Source: Federal Administrative Court, 2026-08-03 — https://overview.legal/posts/353599 — original: https://gdprhub.eu/index.php?title=BVwG_-_W137_2334047-1*

Facts — The data subject did not pay for items ordered and collected from a pharmacy (controller). After several reminders, the controller commissioned a debt collection agency, which pointed to several enforcement proceedings against the data subject. The controller then reported the data subject for fraud and provided the police with a record of the enforcement proceedings. The data subject lodged a complaint with the Austrian DPA (DSB) regarding the violation of their right to confidentiality, claiming the disclosure of the record constitutes a violation of § 427 EO in conjunction with § 1 DSG. On 13. January 2026, the DPA dismissed the data subject's complaint and requests. The data subject subsequently appealed against the DPA's decision arguing that the provisioning of the record would violate the principle of data minimisation under Article 5(1)(c) GDPR, since handing over bills and reminders would have been sufficient. They also argued that the disclosure of the record would constitute a significant interference with their rights and, therefore, the conducted balancing of interests under Article 6(1)(f) GDPR was incorrect. Additionally, some of the listed enforceable titles were no longer current, thus violating the right to accuracy under Article 5(1)(d) GDPR. Holding — First, the court held that the controller had not violated the data subject's right to confidentiality under § 1(1) DSG, as the provision of the record of enforcement proceedings to the police was in the legitimate interest of the controller under Article 6(1)(f) GDPR and did not violate the right to data minimisation pursuant to Article 5(1)(c) GDPR. The record was necessary as it provided a substantive evidence of the alleged fraud - providing only bills and reminders would not have been sufficient - as well as for the collection of outstanding debts. Thus, the record was also the least intrusive means. Given their prior history, the data subject should have reasonably anticipated such legal action. Consequently, the data subject's rights were found not to outweigh the controller's competing interests. Secondly, the court held that the professional and ethical confidentiality obligations of a pharmacist do not prevent them from reporting (potential) criminal offences or pursuing civil causes of action. Therefore, the court dismissed the appeal, as the DPA's decision was not found to be unlawful.

### Court of Justice of the European Union - Case C-422/24 - AB Storstockholms Lokaltrafik.

*Source: CJEU, 2026-01-07 — https://overview.legal/posts/51955*

A new page has been created with the following information: ""

### CJEU - C-798/24 - Jautiva

*Source: CJEU, C-798/24, 2026-09-03 — https://overview.legal/posts/353788 — original: https://gdprhub.eu/index.php?title=CJEU_-_C-798/24_-_Jautiva*

Facts — Seventeen natural persons, who were minority shareholders of a public limited liability company, brought proceedings before the Satversmes tiesa (the Constitutional Court of Latvia). They challenged national legislation requiring information on shareholders to be included in the public companies register. The information made publicly available included shareholders’ identity and contact details, as well as information concerning the class, number and nominal value of their shares and the number of votes attached to them. The information could be accessed online and downloaded in bulk by any person without identification or the need to demonstrate a legitimate interest. The data subjects argued that such disclosure constituted an unjustified and disproportionate interference with their rights, particularly because they were neither beneficial owners nor members of the company’s management bodies and did not exercise control over the company. The national legislation pursued several objectives, including ensuring transparency and protecting third parties, combating money laundering and terrorist financing, and facilitating the implementation of sanctions. The Constitutional Court stated the proceedings and referred questions to the CJEU. In particular, whether Directive 2017/1132 required such disclosure and whether Articles 5 and 6 GDPR permitted national legislation providing unrestricted public access to that personal data. Holding — Directive 2017/1132 The Court first held that Article 14(d) Directive 2017/1132 does not require the disclosure of information relating to all shareholders, including minority shareholders. Shareholders do not, merely by holding shares, participate in the administration, supervision or control of a company within the meaning of that provision. In particular, minority shareholders are generally not authorised to represent or bind the company or perform management or supervisory functions. Legal basis The Court recalled that any processing must comply with the principles under Article 5 GDPR and satisfy one of the lawful bases under Article 6 GDPR. (i) The purposes must be sufficiently determined by law Since the disclosure of the shareholders’ personal data was required by national law, the Court considered that the processing had to be assessed under Article 6(1)(c) GDPR, which permits processing where it is necessary for compliance with a legal obligation to which the controller is subject. (ii) The purpose limitation and minimisation principles The Court recalled that, pursuant to Article 6(3) GDPR, the legal basis must determine the purpose of the processing, pursue an objective of public interest and be proportionate to the legitimate aim pursued. First, regarding the determination of the purpose, the Court held that the national court must verify whether the purposes of the processing could be identified with sufficient certainty from the wording of the legislation or its legislative context. This assessment was also relevant under the purpose limitation principle in Article 5(1)(b) GDPR. Second, regarding necessity and proportionality, the Court referred to the data minimisation principle under Article 5(1)(c) GDPR. It considered that making shareholders’ identity, contact details and information about their shareholdings publicly accessible constituted a serious interference with their rights. Such information could reveal aspects of their financial situation and investments and was accessible to a potentially unlimited number of persons. The possibility of downloading the information in bulk further increased the risk of retention, dissemination and misuse. As regards transparency and the protection of third parties, the Court found that disclosing the personal data of all shareholders, particularly minority shareholders, was neither appropriate nor necessary because those shareholders generally cannot represent or bind the company. The Court also acknowledged that public access could contribute to combating money laundering and terrorist financing. However, unrestricted access was not strictly necessary, since those objectives could be achieved through less intrusive measures, such as limiting access to persons demonstrating a legitimate interest. Practical difficulties in verifying such an interest could not justify a broader interference with fundamental rights. Similarly, although public access could facilitate the implementation of sanctions, unrestricted disclosure was not necessary. Less intrusive alternatives included limiting disclosure to persons subject to sanctions or granting access to other shareholders’ information only where a legitimate interest was demonstrated. Finally, the Court noted that the legislation lacked sufficient safeguards against abuse because the data were accessible online and could be downloaded in bulk by unidentified users. Consequently, the Court held that Articles 5 and 6 GDPR, read in light of Articles 7 and 8 CFR, preclude national legislation requiring the personal data of all shareholders, including minority shareholders, to be publicly accessible without conditions such as demonstrating a legitimate interest.

### HvJ EU 9 januari 2025, C‑394/23 (Mousse).

*Source: CJEU, 2025-01-09 — https://overview.legal/posts/50377 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0394*

HvJ EU 9 januari 2025, C‑394/23 (Mousse). Artikelen: 5(1)(c), 6(1), en 21 AVG Onderwerp : Beginsel van minimale gegevensverwerking Gek genoeg verwijst het HvJ EU zelf niet naar HvJ EU 1 augustus 2022, C‑184/20 (Vyriausioji tarnybinės etikos komisija), maar dat had hier ook heel logisch geweest.

## Guidance

### Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020

*Source: EDPB, edpb-guidelines-on-data-protection-by-design-and-by-default, 2020-10-20 — https://overview.legal/posts/38054 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-42019-on-article-25-data-protection-by-design-and-by-default_en*

The European Data Protection Board (EDPB) adopted these guidelines (Version 2.0) to provide interpretive guidance on Article 25 of the GDPR, which mandates data protection by design and by default. The guidelines address controllers' obligations to implement appropriate technical and organizational measures and necessary safeguards into processing operations, including the dimensions of data minimization required by default. No fines or enforcement actions are at issue, as this is a guidance document intended to assist controllers in complying with their Article 25 obligations.

### Opinion 11/2024 on the use of facial recognition to streamline airport passengers’ flow (compatibility with Articles 5(1)(e) and(f), 25 and 32 GDPR)

*Source: EDPB, opinion-112024-on-the-use-of-facial-recognition-to-streamline-en, 2024-05-24 — https://overview.legal/posts/125750 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-112024-on-the-use-of-facial-recognition-to-streamline_en*

A dopted Opinion 11/2024 on the use of facial recognition to streamline airport passengers’ flow (compatibility with Articles 5(1)(e) and(f), 25 and 32 GDPR Version 1.1 Adopted on 23 May 20 24 Adopted 1 Version 1.1 28 May 2024 Grammatical correction in the E xecutive summary (pages 3 and 4) and paragraphs 77 and 90 of the Opinion Version 1.0 23 May 2024 Adoption of the Opinion Adopted 2 Executive summary The French Supervisory Authority requested the European Data Protection Board to issue an…

### Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications

*Source: EDPB, edpb-guidelines-on-processing-personal-data-in-the-context-of-connected-vehicles-and-mobility-rel, 2020-01-28 — https://overview.legal/posts/38135*

The EDPB adopted Guidelines 1/2020 to provide guidance on the application of the GDPR to the processing of personal data in connected vehicles and mobility-related applications. The guidelines address key issues including data minimisation, data protection by design and by default, transparency obligations, data subjects' rights, security, third-party data sharing, and international transfers, with practical case studies covering services provided by third parties, eCall, accidentology, anti-theft measures, and rental car information. The document does not impose fines but offers recommendations to help controllers and processors in the automotive ecosystem comply with their GDPR obligations.

### Study on the secondary use of personal data in the context of scientific research

*Source: EDPB, 20250401-study-on-the-secondary-use-of-personal-data-in-the-context-of-scientific-research-23102020-, 2025-04-03 — https://overview.legal/posts/50717 — original: https://www.edpb.europa.eu/documents/legal-study-by-external-providers/study-on-the-secondary-use-of-personal-data-in-the_en*

2 This study has been prepared by Milieu under Contract No EDPS/2019/02 - 04 for the benefit of the EDPB. The study has been carried out by researchers from KU Leuven (CiTiP) and University of Namur (CRIDS), with the support of researchers from Milieu and Leiden University (eLaw). The authors of the study are Teodora Lalova, Els Kindt, Eleftherios Chelioudakis, Griet Verhenneman, Antoine Delforge andJean Herverg. National level input was provided by Carla Barbosa, Elisabetta Biasin, Gauthier…

### EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research

*Source: EDPB, edpb-document-on-response-to-the-request-from-the-european-commission-for-en, 2021-02-02 — https://overview.legal/posts/126069 — original: https://www.edpb.europa.eu/documents/other-guidance/edpb-document-on-response-to-the-request-from-the-european-commission-for_en*

EDPB Document on r esponse to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research Adopted on 2 February 2021 2 Adopted 3 Adopted The European Data Protection Board Having regard to Article 70.1.b of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and…

### Guidelines 02/2025 on processing of personal data through blockchain technologies

*Source: EDPB, edpb-guidelines-202502-blockchain-en, 2026-07-07 — https://overview.legal/posts/50755 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-022025-on-processing-of-personal-data-through-blockchain_en*

EDPB, Guidelines 02/2025 on processing of personal data through blockchain technologies, 2025.

### Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak

*Source: EDPB, guidelines-032020-on-the-processing-of-data-concerning-health-for-the-purpose-en, 2020-04-21 — https://overview.legal/posts/126170 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-032020-on-the-processing-of-data-concerning-health-for-the-purpose_en*

Adopted 1 Guidelines 03 /2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID - 19 outbreak Adopted on 21 April 2020 Adopted 2 Version history Version 1.1 30 April 2020 Minor corrections Version 1. 0 21 April 2020 Adoption of the Guidelines Adopted 3 Adopted 4 The European Data Protection Board Having regard to Article 70 (1) (e) of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the…

### Guidelines 10/2020 on restrictions under Article 23 GDPR

*Source: EDPB, edpb-guidelines-on-restrictions-under-article-23-gdpr, 2021-10-13 — https://overview.legal/posts/38062 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-102020-on-restrictions-under-article-23-gdpr_en*

The European Data Protection Board (EDPB) issued these guidelines to clarify the scope and application of Article 23 of the GDPR, which allows Member States to restrict certain data subject rights and controller obligations. The guidelines outline the necessary conditions and safeguards, emphasizing that any restrictions must respect the essence of fundamental rights and be implemented via foreseeable, proportionate legislative measures. This document serves as authoritative guidance for interpreting the specific grounds and requirements under which Member States may legally impose such limitations.

## Enforcement decisions

### AEPD: Continuous workplace audio recording violates GDPR data minimisation principle

*Source: AEPD (Spain), 2025-04-22 — https://overview.legal/posts/353483 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_PS-00637-2025*

Facts — On 22 April 2025, a data subject lodged a complaint with the DPA against BODENSE ESTRUCTURAS Y CALDELERÍA, S.L., the controller. The data subject claimed that the controller had installed cameras recording both images and audio in workplace areas and had relied on the recordings in disciplinary proceedings against them. The controller confirmed that its video surveillance system, installed in 2019, consisted of seven cameras and was capable of recording both images and sound. Recordings were stored for seven days and could be accessed by the controller's security manager. The controller stated that the system pursued both security and employee-monitoring purposes. The controller argued that audio recording was necessary because of a previous burglary and because of the data subject's alleged inappropriate behaviour towards colleagues and management. According to the controller, the audio recordings had been used to substantiate the disciplinary proceedings. Holding — The DPA found that the continuous recording of workplace audio violated the data minimisation principle under Article 5(1)(c) GDPR. It considered audio recording particularly intrusive because it could capture private conversations and interfere with the workers' private sphere. The existence of information signs did not make such processing proportionate. The DPA rejected the controller's justification that audio recording was necessary for security and disciplinary purposes. In relation to the employee's conduct, the DPA considered that less intrusive evidence, such as statements from colleagues or supervisors, could have been used. Similarly, the previous burglary did not justify permanent audio recording, since video images alone could have been sufficient to establish the relevant facts. Therefore, the measure was neither necessary nor proportionate to the purposes pursued. The DPA also referred to Article 89(3) LOPDGDD, under which workplace audio recording is permitted only where risks to the security of installations, assets or persons arising from the activity carried out at the workplace make it necessary, and subject to proportionality and minimum-intervention requirements. The DPA considered that audio recording should be limited to exceptional situations rather than operate permanently. Consequently, the DPA imposed a €4,000 fine for infringement of Article 5(1)(c) GDPR. In addition, it ordered the controller, within one month after the decision became final and enforceable, to disable the audio functionality of the video-surveillance system, where applicable, and adapt its data protection policy accordingly.

### Finnish DPA finds 12-year retention of rental applicant data violates minimisation

*Source: Tietosuojavaltuutetun toimisto (Finland), 2026-08-07 — https://overview.legal/posts/354165 — original: https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_TSV/1319/2025*

Facts — The DPA began investigating the storage periods of the personal data of housing applicants (the data subjects) contained in rental housing applications during a previous proceeding against the a real estate agency (the controller). This proceeding was initiated in December 2022 and concluded in February 2025. The controller stated in its submissions connected to the aforementioned case that it collected e.g. the personal identification number, information relating to employment, financial information, and other information needed to assess the applicants' ability to pay rent from the data subjects. The data subjects could also additionally choose to provide the controller a wide range of sensitive personal information about themselves. The controller retained the housing application data for 12 years in total in order to avoid potential liability for damages. In the present case, the DPA investigated whether the storage periods complied with the principles of data minimisation and storage limitation as well as the requirements for data protection by design and default. The controller estimated that there had usually been from a few to half a dozen damages claims per year, none of which had processed to a lawsuit filed in court in the past 12 years. In the year preceding the DPA investigation, the controller had received approximately 82,000 housing applications. National law requires real estate agencies to retain information related to housing applications for five years. According to the controller, data collected more than five years ago was only used to file or defend legal claims, or to comply with anti-money laundering legislation. Holding — The DPA held that the controller had violated the principles of data minimisation and storage limitation by systematically retaining all personal data contained in housing applications for 12 years. Furthermore, it found that the controller had failed to comply with the requirements of data protection by design and default laid down in Article 25(1) GDPR. The DPA issued the controller a reprimand for these GDPR violations and ordered the controller to define storage periods for personal data in accordance with Articles 5(1)(c), 5(1)(e), and 25(1) GDPR. First, the DPA held that the storage period specified for rental housing applications infringed Article 5(1)(c) GDPR, as the controller was systematically storing all housing application data. According to the DPA, the controller should generally delete the housing application data at the end of the five-year storage period specified in national law. If the personal data is retained beyond this period, the controller must be able to demonstrate that there is a genuine need for such retention. Second, the DPA concluded that the controller had stored the personal data for longer than necessary to fulfill the purposes of processing and therefore violated Article 5(1)(e) GDPR. The DPA considered retaining the data of tens of thousands of data subjects disproportionate compared to the low number of damages claims. It also pointed out that housing applications may contain data falling within the special categories of personal data, such as information related to the applicant's health.

### CZECH REPUBLIC DPA: Non-compliance with general data processing principles

*Source: Czech DPA (UOOU), 2019-03-21 — https://overview.legal/posts/46133 — original: https://www.enforcementtracker.com/ETid-18*

Data was not only processed if adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation') and not only kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ('storage limitation').

### ANSPDCP (Romania) - TIP TOP FOOD INDUSTRY SRL

*Source: ANSPDCP (Romania), 2026-10-01 — https://overview.legal/posts/354768 — original: https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_TIP_TOP_FOOD_INDUSTRY_SRL*

Facts — TIP TOP FOOD INDUSTRY SRL (controller) used a time-and-attendance and access-control system on its employees at its premise. This system was using personal data in the form of the employees’ fingerprints. An individual lodged a complaint with the DPA. Holding — The DPA held that the system used by the controller violated the principles of data minimisation (Article 5(1)(c) GDPR) and lawfulness because the controller could not rely on a legal basis for processing biometric data pursuant to Article 9 GDPR. According to the DPA, the controller could have used less intrusive means for the objectives of access control and time tracking and therefore violated Article 5(1)(c) GDPR. The DPA stressed that when processing biometric data, the controller must pay specific attention to the principles of lawfulness, necessity, data minimisation and proportionality. This is because of the significant risks arising from the processing of biometric data in case of unauthorized access and the possibility to link biometric data to the identity of the data subject. The DPA fined the controller RON 26,236 (€5,000). Additionally, the DPA ordered the controller to replace the access control and time-keeping system with an alternative system that is less intrusive and does not rely on the processing of biometric data, and thus complies with the principle of data minimisation.

### Italian DPA sanctions Top Secret Investigazioni for unjustified email forwarding after

*Source: Garante per la protezione dei dati personali (Italy), 2026-09-10 — https://overview.legal/posts/353919 — original: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_554/2026*

Facts — The data subjects filed a complaint claiming that Top Secret Investigazioni e sicurezza s.r.l. (the controller) violated the protection of personal data, as a result of failing to deactivate individualised company accounts following termination of employment, and not providing adequate information as to the controller’s processing operations. The DPA initiated an investigation and found that a union settlement agreement was signed between the data subjects and the controller establishing that the accounts would be deactivated, and an automated reply would be set up redirecting the emails to another account which was not to be linked with the data subjects themselves. The controller’s engineer, tasked with investigating the validity of the complaints, stated that the accounts were merely placeholders used to respond to specific requests, not active email accounts, and confirmed that no processing was being undertaken by the controller. The engineer further clarified that whilst messages sent to the accounts were meant to be forwarded by a server to an auto responder subsystem, due to a configuration error, the automatic responder was not functioning as intended and forwarding was not happening. Holding — In light of its investigation the DPA held as regards the forwarding which took place over a period of 8 months the controller was not able to sufficiently justify the retention or forwarding of the emails. The DPA found that these operations were deemed incompatible with the principles of lawfulness, data minimisation and storage limitation. Furthermore, the DPA held that the controller violated its transparency obligations as it did not adequately update the privacy policy signed by the data subjects, and internal regulations which addressed what would happen with email addresses after employees are terminated. The DPA held the controller in violation of Articles 5(1)(a), (c) and (e) GDPR and Article 13 GDPR and thus imposed a €6.500 fine on the controller.

### HDPA investigates Greek Infrastructure Ministry for SMS sent without consent or

*Source: HDPA (Greece), 2026-09-15 — https://overview.legal/posts/354164 — original: https://gdprhub.eu/index.php?title=HDPA_(Greece)_-_17/2026*

Facts — The DPA started an investigation, after receiving 83 complaints from data subjects, against the Ministry of Infrastructure and Transportation (the controller). Particularly, regarding the sending of an SMSs, prior to the national holiday on October 28th, to mobile phone subscribers (the data subjects) without prior information or consent. The complaints included: The violation by the controller of Article 14 GDPR as the data subjects were not priorly informed that their phone numbers would be processed for this purpose, leaving them without information and the subsequent right to object. The processing of all mobile phone subscriber’s data regardless of whether they are drivers. Contrary to the principle of purpose limitation and data minimisation. The wrong application by the controller of legal basis, that is, processing for the public interest. Claiming that the controller lacks the jurisdiction for the purpose of raising awareness to also process personal data. The fact that the controller should have initiated the procedure through the Ministry of Digital Governance, which applies to the citizens which have consented to the sending of messages by public agencies. The data subjects claimed that the controller actually was the Ministry of Data Governance, and the mobile phone companies which ultimately sent out the message acted as processors. In that regard, such a relationship should have been governed by contract, however the controller (in the present case) was unable to present such to the DPA. The controller clarified that the purpose of this campaign was as a preventative/awareness-raising tool within its broader safety strategy, and based in accident statistics. The transmission of the SMSs was carried out by mobile phone operators, in cooperation with the controller, without disclosing the data to the controller. Such communication was authorised by national law which allowed for processing beyond the purpose for which the data was collected when necessary to protect national security and public safety. In that regard, processing was carried out in accordance with Article 6(1)(e) GDPR. The controller deemed sending SMSs as the appropriate communication method which is non-intrusive, immediate and universally accessible. Finally, in light of the national holiday on the 28th of October there was an increased risk, rendering the implementation of such SMSs necessary and proportionate to protect human life. Holding — The DPA held the processing activities of the controller in compliance with the principles of lawful processing pursuant to Article 5(1) GDPR. Particularly, as a result of the increased risk posed by the national holiday, the DPA found it necessary to take action raise awareness for drivers regarding road safety, and deemed the means, immediately through SMS, appropriate. The DPA further found that in light of proportionality and data minimisation, the one-time notification without the controller gaining access to the data subject’s personal data was compliant. As regards the legal basis, the DPA agreed with the controller, that they were pursuing a public interest, namely to promote road safety and safe mobility. Similarly, the DPA held that national law permits private entities to process data for purposes beyond that for what it was originally collected, provided it prevents threats to public safety and is made at the request of a public authority. Therefore, the DPA held that the sending of this SMS was lawful and in compliance with the GDPR. Nonetheless, it advised the controller, for future initiatives, to inform data subjects in accordance with Article 14 GDPR, provide them an option to opt-out. Furthermore, when such messages are outsourced to processors, to ensure such is established through a contract (defining nature and purpose of processing, and type of data and categories of data subjects) in accordance with Article 28 GDPR, and to subsequently inform data subjects of such.

### Garante per la protezione dei dati personali (Italy) - 484/2026

*Source: Garante per la protezione dei dati personali (Italy), 2026-07-03 — https://overview.legal/posts/184565 — original: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_484/2026*

Facts — EstEnergy S.p.A. (hereinafter, the controller) is an Italian energy company supplying natural gas, electricity and related services. Before entering into contracts, the controller assessed the creditworthiness of potential customers through an internal and an external credit check. The internal assessment involved verifying whether potential customers had outstanding debts not only with the controller but also with Hera Comm S.p.A (hereinafter, the corporate group). The assessment was conducted on behalf of the controller by Hera S.p.A. (hereinafter, the processor), which returned an “OK” or “KO” result. Where the internal assessment returned an “OK”, the controller conducted an external assessment using credit information supplied by Experian Italia S.p.A. and commercial information provided by Cerved Group S.p.A. This information was combined using the “CGS-X” software provided by Major 1 S.r.l. (hereinafter, the software provider and processor). The software generated an integrated creditworthiness score and several underlying sub-scores. On the basis of the result, the controller could refuse to enter into an energy supply contract. The DPA received several complaints from data subjects whose requests for energy supply had been rejected on the basis of their risk profiles. However, when the data subjects contacted the credit and commercial information providers, they were informed that the relevant databases did not contain negative information or adverse events concerning them. The data subjects also submitted access requests under Article 15 GDPR. Although the controller responded within the applicable time limits, it did not provide the CGS-X score, the underlying sub-scores or meaningful information about the logic and criteria used to calculate the profiles. Instead, the controller referred the data subjects to the credit and commercial information providers. Following the complaints, the DPA consolidated the proceedings and initiated an ex officio investigation. It conducted inspections at the premises of the processor, the software provider and processor, and the credit and commercial information providers. The investigation also established that the controller retained the information obtained through the credit checks. Through the processor, the controller subsequently analysed this information to potentially refine the corporate group’s customer rating system. Between 2022 and March 2024, this processing concerned more than one million data subjects. Holding — The DPA held that the controller’s creditworthiness assessment infringed Articles 5(1)(a), (b), (d) and (e), 12, 13, 14, 15 and 28 GDPR. First, the controller failed to provide transparent information about the internal assessment of customers’ previous debts and the sharing of such information within the corporate group. The instructions given to the processor also did not adequately cover these processing operations. The DPA therefore found violations of Articles 5(1)(a), 13, 14 and 28 GDPR. Second, the controller provided incomplete responses to access requests. It did not disclose the CGS-X score, the underlying sub-scores or meaningful information on the logic and criteria used to generate the creditworthiness profile. Referring the data subjects to the credit and commercial information providers did not discharge the controller’s obligations under Articles 12 and 15 GDPR. Third, the controller had not established a justified retention period for the data collected during the external assessment. Applying a general ten-year retention period for accounting records was not shown to be necessary for the creditworthiness assessment, in violation of Article 5(1)(e) GDPR. The DPA also found that reusing credit and commercial information to refine the corporate group’s rating system was incompatible with the original purpose for which the data had been collected. Since the retained information could become outdated, this processing also violated the purpose limitation and accuracy principles under Articles 5(1)(b) and (d) GDPR. The DPA ordered the controller to adopt a compliant access-response template, provide the relevant information to the data subjects involved and establish procedures enabling rectification, human intervention and the possibility to challenge decisions. The controller had six months to demonstrate compliance. Finally, the DPA imposed a €1,400,000 fine, taking into account the seriousness and scale of the infringements, the impact on approximately one million data subjects and the risk of refusal of essential energy services. It also considered the controller’s cooperation, lack of previous relevant infringements and remedial measures as mitigating factors.

### Italian DPA sanctions Municipality of Policoro for CCTV signage, retention and DPO

*Source: Garante per la protezione dei dati personali (Italy), 2022-06-09 — https://overview.legal/posts/6314 — original: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_9794895*

Facts — The Municipality of Policoro (Basilicata), implemented the use of CCTV cameras to monitor and fight waste abandonment within its territory. A data subject complained the Municipality had breached their data protection right of fair, transparent and lawful processing under art. 5(1)(a) as the sign signaling the CCTV monitoring referred to an outdated legislative decree. They also alleged a breach of art. 5(1)(e) and art. 13 GDPR, in so far the municipality never defined a data retention period for each processing purpose pursued. The last complaint moved forward by the data subject was that by being legally represented in Court by the same lawyer, who also acted as DPO of Policoro, the Municipality gave rise to a conflict of interest situation and breached art. 38(6) GDPR. The Municipality argued that the claim had been done in front of the Justice of Peace, who had no competency to decide on issues of privacy. It was also alleged the judgement only pertained an administrative matter, without rising any data protection concerns or a situation of conflict of interest with the Municipality's DPO. The last argument alleged the processing and retention of the CCTV footage was related to illegal dumps within the municipal territory, meaning the filming had been carried out in the course of judicial police investigations and the data retention periods of the GDPR did not apply in this case. Holding — The Italian DPA held that in this case the Municipality was carrying activities of data processing, by surveilling public entities by means of surveillance cameras. It also noted, that in par. 41 of the Guidelines 3/2019 on the Processing of Personal Data by Video Devices, waste management is "among the institutional activities entrusted to local authorities". This means the surveillance done by the Municipality of Policoro, a task carried out in the public interest in connection with the exercise of official authority as per art.6(1)(e) GDPR, was unrelated to public security and/or judicial police and obliging the controller to comply with data protection principles. The DPA found that the information provided in regards to the processing of personal data by means of surveillance cameras, did not meet the requirements of conciseness, transparency, intelligibility and easy readability contained in art. 5(1)(a) GDPR. The Municipality of Policoro had failed to provide suitable first-level information to the data subject, in so far the sign signaling the CCTV surveillance made reference to an outdated legislative decree (d.lgs 196/03) instead of the one currently in force (d.lgs 101/18). Furthermore, the data controller failed to provide the data subject with an adequate notice on second-level processing of their data. The signage did not include information on the most suitable impacts of the processing or an indication of a website, where to consult an extended version of the explanation. The DPA also found a violation of art. 13 GDPR as well as the principles of storage limitation and accountability in art. 5(1)(e) and art. 5(2). It stated that "the longer the intended storage period (especially if longer than 72 hours), the more reasoned the analysis referring to the legitimacy of the purpose and necessity of storage must be". In this case, the data controller not only failed to set a maximum retention period for the images taken for the purpose of combating illegal littering, but also established the administrative fines for the violation two months after the images were recorded. This did not allow for the data controller to respect the principle of accountability. Lastly, the DPA addressed the alleged conflict of interest raised by the involvement of the Policoro's DPO in the legal proceedings brought against the data subject. The DPA ruled DPOs "may perform other duties and functions," with the understanding that "the controller must ensure that such duties and functions do not give rise to a conflict of interest." The DPA also made reference to the Article 29 WP's Guidelines on Data Protection Officers, in which it is urged to not designate DPOs already acting as defense counsel for the same court. In the case at hand, it resulted that the DPO shared with the Municipality an interest in obtaining a rejection of the appeal. Consequently, the Italian Garante held this to be in violation of art. 38(6) GDPR, as well the fact that it undermined the DPO's independence. The Italian DPA held a cumulative breach of art. 5(1)(a) and (e) and (2) (in conjunction with article 24), 12, 13 and 38(6) GDPR. It balanced the fact that the personal data processing affected all other citizens, who passed through the areas under surveillance, against the lack of previous violations committed by the data controller. The DPA issued a fine of €26,000 EUR to the Municipality of Policoro.

## Recent developments

### CJEU clarifies GDPR principles of purpose limitation and storage limitation

*Source: NL EU Court Expert, 2022-10-30 — https://overview.legal/posts/6247 — original: https://ecer.minbuza.nl/-/eu-hof-verduidelijkt-de-beginselen-van-doelbinding-en-opslagbeperking-uit-de-avg?redirect=%2Fecer%2Fnieuws%3Fq%3Dprivacy%2520OR%2520avg%26f%3D%26t%3D#entry-1209*

The purpose limitation principle does not preclude a controller from capturing and storing in a test database established for testing and error correction purposes personal data previously collected and stored in another database. However, such "further processing" of personal data must be compatible with the specific purposes for which the personal data were originally collected. The principle of storage limitation precludes the retention of personal data in that test database for longer than n

### AG at CJEU: Facebook must "minimize" personal data for ads in EU

*Source: noyb - European Center for Digital Rights, 2024-04-25 — https://overview.legal/posts/53196 — original: https://noyb.eu/en/ag-cjeu-facebook-must-minimize-personal-data-ads-eu*

Online Advertising CJEU press releases (look for C-446/21 - Schrems)Full AG OpinionKatharina Raabe-Stuppnig, lawyer representing Mr Schrems: "We are very pleased by the opinion, even though this result was very much expected."Use of data for advertising must be limited by time, type and source. So far, Meta uses all the data it has ever collected for advertising. For example, Facebook user data can go back as far as 2004. To prevent such practices, the GDPR established the principle of "data min

### CJEU: PNR Directive Valid if Limited to the “Strictly Necessary”

*Source: eucrim, 2022-08-04 — https://overview.legal/posts/6292 — original: https://eucrim.eu/news/cjeu-pnr-directive-valid-if-limited-to-the-strictly-necessary/#entry-388*

> In a landmark ruling of 21 June 2022, the CJEU (Grand Chamber), upheld the EU’s regime to collect and use records of travellers, provided that it is strictly interpreted in line with the EU’s fundamental rights. In addition, indiscriminate processing of the data in cases of flights carried out only within the EU is banned unless there is a threat of terrorism. In general, the passengers’ data must also be deleted after six months at the latest.

### A-G: rechtmatig verzamelde en opgeslagen persoonsgegevens mogen onder voorwaarden tijdelijk in een extra interne databank worden bewaard

*Source: NL EU Court Expert, 2022-04-09 — https://overview.legal/posts/6307 — original: https://ecer.minbuza.nl/-/a-g-rechtmatig-verzamelde-en-opgeslagen-persoonsgegevens-mogen-onder-voorwaarden-tijdelijk-in-een-extra-interne-databank-worden-bewaard?redirect=%2Fecer%2Fnieuws%3Fq%3Dprivacy%2520OR%2520avg%26f%3D%26t%3D#entry-306*

Lawfully collected and stored personal data may be retained in an additional internal database, to the extent that it pursues the same data processing purposes as the original data collection. That is the opinion of Advocate General Pikamäe to the EU Court in response to questions from a Hungarian judge.

### ICO: How can Privacy Enhancing Technologies help with data protection compliance?

*Source: ICO, 2025-11-07 — https://overview.legal/posts/6334 — original: https://ico.org.uk/media/about-the-ico/consultations/4021464/chapter-5-anonymisation-pets.pdf#entry-362*

> How can PETs help with data protection compliance?
At a glance
• PETs can help you demonstrate a ‘data protection by design and by
default’ approach to your processing.
• PETs can help you to comply with the data minimisation principle by
ensuring you only process the data you need for your purposes, and
provide an appropriate level of security for your processing.
• You can use PETs to give access to datasets which would otherwise be
too sensitive to share, while ensuring individuals’ data is

## Literature

### GDPR bypass by design? Transient processing of data under the GDPR

*Source: International Data Privacy Law, 2019-09-20 — https://overview.legal/posts/132576 — original: https://doi.org/10.1093/idpl/ipz017*

In search of privacy-friendly facial detection and autonomous driving software, data controllers are discovering that processing data merely transiently might not only be in compliance with the data minimization principle, but also exclude their activities from the General Data Protection Regulation (GDPR) altogether. The argument can be made that since transient data does not allow for re-identification it is not personal data in a legal sense. However, effect-oriented or output-based interpretations of the notion ‘personal data’ have been proposed, which in turn could lead transient data processing technologies to fall within the scope of the GDPR. An effect-oriented interpretation of the regulation would ensure that in cases where transient data...

### HOW GDPR TREATS AUTOMATED DECISION-MAKING

*Source: Journal Scientific and Applied Research, 2025-11-14 — https://overview.legal/posts/132599 — original: https://doi.org/10.46687/jsar.v28i1.435*

This article examines how the General Data Protection Regulation (GDPR) regulates automated decision-making, including profiling, in the context of personal data processing. It analyzes the main provisions of Article 22 of the Regulation, as well as the conditions under which fully automated decisions that produce legal effects or significantly affect data subjects are permitted. The article highlights the rights of data subjects – the right to human intervention, the right to express their poin

### Automating the Design and Development of Usable, GDPR-Aware Web Forms

*Source: SN Computer Science, 2026-07-14 — https://overview.legal/posts/132119 — original: https://doi.org/10.1007/s42979-026-05219-7*

Abstract Personal data collection in web applications should follow mandated legislative frameworks such as the EU General Data Protection Regulation (GDPR) principles. Among others, web data collection forms should provide clear and transparent explanations regarding the purposes of the collection. At the same time, for users’ ease, such forms should follow standard usability principles. There have been works studying the merging of usability principles and privacy standards. Building on this l

### GDPR: A new challenge for personal data protection

*Source: Bankarstvo, 2017-01-01 — https://overview.legal/posts/132473 — original: https://doi.org/10.5937/bankarstvo1704166m*

stručni članak Erne Mraznica Raiffeisen banka ad Beograd erne.mraznica@raiffeisenbank.rs GDPR - NOVI IZAZOV ZAŠTITE PODATAKA O LIČNOSTI Rezime Dana 4. maja 2016. godine objavljena je Opšta Uredba o zaštiti podataka o ličnosti u Sl. glasniku EU, koja će se primenjivati od 25. maja 2018. godine. Cilj propisa je harmonizacija zaštite podataka o ličnosti na nivou EU, veći stepen kontrole za lica čiji se podaci obrađuju i unapređeno upravljanje savremenim rizicima iz ove oblasti. Banke, po prirodi svog poslovanja, spadaju među najveće rukovaoce podataka o ličnosti i u postupku usklađivanja sa obavezama utvrđenih Uredbom biće u prilici da izvrše punu analizu svog postojećeg regulatornog i infrastrukturnog okvira zaštite podataka o ličnosti. Istovremeno, pruža im se prilika da isprave eventualne nedostatke u postojećim procesima, odnosno da značajno povećaju svest organizacije o standardima zaštite podataka o ličnosti, posebno imajući u vidu zaprećene stroge sankcije za slučaj neusklađenosti. Ključne reči : GDPR, podatak o ličnosti, osnovni principi, prava lica, rukovalac, obrada podataka, transfer podataka, sankcije, usklađivanje JEL : F52, G14 doi: 10.5937/bankarstvo1704166M 166 Bankars

### Privacy vs. business convenience: the Mousse judgment and the future of data protection in the EU

*Source: Unio - EU Law Journal, 2025-06-18 — https://overview.legal/posts/53865 — original: https://doi.org/10.21814/unio.11.1.6632*

The Mousse ruling represents a pivotal moment in EU data protection law, reinforcing strict limitations on personal data processing and clarifying the legal standards under the General Data Protection Regulation (GDPR). The Court of Justice of the European Union (CJEU) reaffirmed that data collection must be objectively indispensable for a specified legal basis, rejecting broad interpretations of contractual necessity and legitimate interest. Additionally, the ruling confirms that the right to o

## Tools

### CNIL GDPR guide for developers

*Source: CNIL, 2026-07-04 — https://overview.legal/posts/53810 — original: https://github.com/LINCnil/GDPR-Developer-Guide*

Open-source best-practice guide by the French DPA translating GDPR obligations into concrete development practice: data minimisation in code, managing consent, securing data flows, retention, and preparing for data subject rights — organised in 16 practical sheets.

## Related topics

- **Personal Data** — https://overview.legal/topics/personal-data
  Information relating to identified or identifiable natural persons
- **Processing** — https://overview.legal/topics/processing
  Any operation performed on personal data
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing
- **Storage Limitation** — https://overview.legal/topics/storage-limitation
  Principle that data should not be kept longer than necessary
- **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities
  National data protection authorities and their powers
- **Monitoring** — https://overview.legal/topics/monitoring
  Systematic observation and tracking of individuals

---
Generated by overview.legal · https://overview.legal/topics/retention-period · 2026-10-13