# Transparency — legal context bundle > Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/transparency > Sources are cited per item. Verify against the official texts before relying on them. Openness about data processing activities ## Overview ## Legal Framework Transparency is established as a foundational data protection principle under [Article 5(1)(a) GDPR](/laws/gdpr/art-5), requiring that personal data be: This principle operates not in isolation but as an enabling condition: without transparent information provision, other GDPR rights — including consent withdrawal and access — become functionally inaccessible. The EDPB has framed this in stark terms: > "If the controller does not provide accessible information, user control becomes illusory and consent will be an invalid basis for processing." > — [EDPB Guidelines 05/2020 §62](/posts/38053#seg-62) In the employment context, [Article 88(2) GDPR](/laws/gdpr/art-88#par-2) requires member states to adopt specific measures safeguarding the transparency of processing alongside data transfers and workplace monitoring — recognizing that power imbalances in employment demand heightened transparency obligations. The AI Act extends transparency obligations beyond traditional data protection. [Article 1(2)(d)](/laws/ai-act/art-1#par-2-pnt-d) establishes "harmonised transparency rules for certain AI systems," while [Article 112(2)(b)](/laws/ai-act/art-112#par-2-pnt-b) provides for periodic review of which AI systems require additional transparency measures under Article 50 of the AI Act. ## Key Developments The CJEU's jurisprudence reveals that transparency is not an absolute value but must be balanced against competing fundamental rights. In *Client Earth v. EFSA*, the Court established a critical baseline: > "no automatic priority can be conferred on the objective of transparency over the right to protection of personal data" > — [Client Earth ¶51](/posts/5958#seg-51) Yet the same case affirmed transparency's democratic function: > "The transparency of the process followed by a public authority for the adoption of a measure of that nature contributes to that authority acquiring greater legitimacy" > — [Client Earth ¶56](/posts/5958#seg-56) The *Schrems* litigation exposed how transparency deficits in international transfer frameworks — specifically "structural shortcomings related to transparency and enforcement" — can invalidate entire adequacy mechanisms. The *Schecke* ruling grounded transparency obligations in the European Transparency Initiative, linking public fund disclosure to sound financial management. Italian DPA enforcement illustrates practical failure modes: the Garante fined a health authority €20,000 for publishing personal data in a resolution, and €50,000 against an agency whose remote work policy lacked adequate transparency. ## Status of the Debate This topic is actively contested in court. The core tension — transparency versus data protection — has been addressed at the principle level in *Client Earth*, but operational boundaries remain unresolved. Courts diverge on how to weigh transparency interests when disclosure would expose personal data, particularly in institutional decision-making involving expert advisors with vested interests. No definitive court split is on record, but the balancing test lacks granular criteria. Resolution will likely require further CJEU guidance on proportionality assessment — specifically, whether the necessity test for transparency disclosure should require consideration of anonymization alternatives before raw personal data is exposed. ## Practical Guidance - **Implement layered information architecture**: EDPB guidance endorses "layered and granular information" to reconcile completeness with accessibility — provide concise summaries with drill-down capability for full details. - **Conduct transparency-by-design assessments**: For each processing activity, document what information is provided, when, and through what channel, mapping directly to [Article 5(1)(a)](/laws/gdpr/art-5#par-1-pnt-a) requirements. - **Apply heightened transparency in employment contexts**: Under [Article 88(2)](/laws/gdpr/art-88#par-2), implement specific measures addressing workplace monitoring, data transfers within corporate groups, and employee dignity — go beyond generic privacy notices. - **Assess AI system transparency obligations early**: With the AI Act's harmonised transparency rules under [Article 1(2)(d)](/laws/ai-act/art-1#par-2-pnt-d) and periodic review under [Article 112(2)(b)](/laws/ai-act/art-112#par-2-pnt-b), classify AI systems proactively and prepare disclosure mechanisms for affected individuals. - **Document the transparency–privacy balance**: When transparency obligations intersect with personal data protection, record the proportionality analysis — including consideration of anonymization or partial disclosure — to demonstrate compliance with the *Client Earth* balancing standard. ## Legislation (full text of key provisions) ### Transparency obligations for providers and deployers of certain AI systems *Source: AI Act, aiact-art-50-en, 2024-06-12 — https://overview.legal/posts/92746* ### Transparency reporting obligations for providers of online platforms *Source: DSA, dsa-art-24-en, 2022-10-19 — https://overview.legal/posts/94410* ### Transparency reporting obligations for providers of intermediary services *Source: DSA, dsa-art-15-en, 2022-10-19 — https://overview.legal/posts/94226* ### Transparency reporting obligations *Source: DSA, dsa-art-42-en, 2022-10-19 — https://overview.legal/posts/94760* ### Transparency and provision of information to deployers *Source: AI Act, aiact-art-13-en, 2024-06-12 — https://overview.legal/posts/92180* ### Additional online advertising transparency *Source: DSA, dsa-art-39-en, 2022-10-19 — https://overview.legal/posts/94672* ### Recommender system transparency *Source: DSA, dsa-art-27-en, 2022-10-19 — https://overview.legal/posts/94451* ### Recital 137 — transparency compliance not implying lawfulness *Source: AI Act, aiact-rec-137-en, 2024-06-12 — https://overview.legal/posts/93956* Compliance with the transparency obligations for the AI systems covered by this Regulation should not be interpreted as indicating that the use of the AI system or its output is lawful under this Regulation or other Union and Member State law and should be without prejudice to other transparency obligations for deployers of AI systems laid down in Union or national law. ### Recital 132 — transparency obligations for deceptive AI *Source: AI Act, aiact-rec-132-en, 2024-06-12 — https://overview.legal/posts/93946* Certain AI systems intended to interact with natural persons or to generate content may pose specific risks of impersonation or deception irrespective of whether they qualify as high-risk or not. In certain circumstances, the use of these systems should therefore be subject to specific transparency obligations without prejudice to the requirements and obligations for high-risk AI systems and subject to targeted exceptions to take into account the special need of law enforcement. In particular, natural persons should be notified that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect taking into account the circumstances and the context of use. When implementing that obligation, the characteristics of natural persons belonging to vulnerable groups due to their age or disability should be taken into account to the extent the AI system is intended to interact with those groups as well. Moreover, natural persons should be notified when they are exposed to AI systems that, by processing their biometric data, can identify or infer the emotions or intentions of those persons or assign them to specific categories. Such specific categories can relate to aspects such as sex, age, hair colour, eye colour, tattoos, personal traits, ethnic origin, personal preferences and interests. Such information and notifications should be provided in accessible formats for persons with disabilities. ### Recital 101 — General-purpose AI model provider transparency obligations *Source: AI Act, aiact-rec-101-en, 2024-06-12 — https://overview.legal/posts/93884* Providers of general-purpose AI models have a particular role and responsibility along the AI value chain, as the models they provide may form the basis for a range of downstream systems, often provided by downstream providers that necessitate a good understanding of the models and their capabilities, both to enable the integration of such models into their products, and to fulfil their obligations under this or other regulations. Therefore, proportionate transparency measures should be laid down, including the drawing up and keeping up to date of documentation, and the provision of information on the general-purpose AI model for its usage by the downstream providers. Technical documentation should be prepared and kept up to date by the general-purpose AI model provider for the purpose of making it available, upon request, to the AI Office and the national competent authorities. The minimal set of elements to be included in such documentation should be set out in specific annexes to this Regulation. The Commission should be empowered to amend those annexes by means of delegated acts in light of evolving technological developments. ## Case law ### Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V *Source: Court of Justice of the European Union, C-757/22, 2024-07-11 — https://overview.legal/posts/132250 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0757* In a preliminary ruling requested by the German Federal Court of Justice (Bundesgerichtshof), the Court of Justice of the European Union interpreted Article 80(2) GDPR in the context of proceedings between Meta Platforms Ireland Ltd and the Bundesverband der Verbraucherzentralen und Verbraucherverbände (Consumer Association). The core issue is whether a consumer protection association may bring a representative action under Article 80(2) GDPR without a mandate from specific data subjects and independently of an actual infringement of a data subject's rights, based on a controller's alleged violation of its transparency obligations under Articles 12(1) and 13(1)(c) and (e). The Court held that such an action is permissible, finding that an infringement of the controller's information obligations constitutes an "infringement of the rights of data subjects as a result of the processing" within the meaning of Article 80(2), and that Member States may allow representative actions without requiring a specific data subject's mandate or an actual infringement of individual rights. ### WebGroup Czech Republic a.s. v European Commission *Source: Court of Justice of the European Union, C-620/24, 2025-02-25 — https://overview.legal/posts/132148 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CO0620* In Case C-620/24 P(R), WebGroup Czech Republic a.s., the operator of the adult content platform XVideos, appealed to the Court of Justice seeking to set aside a General Court order that denied interim suspension of a European Commission decision designating XVideos as a very large online platform (VLOP) under the Digital Services Act. WebGroup sought to suspend the Article 39 obligation to make publicly available an advertising transparency repository, arguing that compliance would jeopardize the platform's advertising-based business model and financial viability. The Vice-President of the Court dismissed the appeal, upholding the General Court's finding that while prima facie case and urgency conditions were met, the interests defended by the EU legislature in protecting online advertising transparency prevailed over the appellant's interests. ### WhatsApp Ireland Ltd v European Data Protection Board *Source: General Court, T-709/21, 2022-12-07 — https://overview.legal/posts/132302 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021TO0709* WhatsApp Ireland Ltd sought annulment of EDPB Binding Decision 1/2021, which resolved disputes among supervisory authorities regarding the Irish DPC's draft decision on WhatsApp's compliance with GDPR transparency obligations. The General Court dismissed the action, finding that the EDPB's binding decision under Article 65(1)(a) GDPR was not a challengeable act against which WhatsApp could bring annulment proceedings, as WhatsApp lacked individual concern and the decision was a preparatory act in the GDPR cooperation mechanism. The underlying Irish DPC final decision, adopted pursuant to the EDPB's binding decision, had found WhatsApp in breach of multiple GDPR transparency provisions and imposed corrective measures including a reprimand and compliance orders. ### Personvernnemnda (Norway) - 2018-14 (15/01355) *Source: PVN, 2019-01-21 — https://overview.legal/posts/125646 — original: https://gdprhub.eu/index.php?title=Personvernnemnda_(Norway)_-_2018-14_(15/01355)* Facts — In 2017, the Norwegian DPA Datatilsynet found that a company "Legelisten", running an anonymous review website of healthcare personnel, lacked a legal basis for processing and instructed them to allow said personnel to opt out of being listed and reviewed, in addition to several other instructions. Both the initial complainant and Legelisten responded to the DPA's decision with complaints. The DPA considered both complaints, but did not find any grounds to change their decision. Consequently, the case was submitted to the Norwegian Privacy Appeals Board, who considered comments from the initial complainant, Legelisten, the Norwegian Consumer Council, and the DPA. The Board focused their assessment on the lawfulness of processing of personal data on the website Legelisten.no. First, they considered the applicable law, as the GDPR had entered into force since the initial complaints dating back to 2012. They found that the GDPR would indeed apply. Holding — The Board reviewed several aspects relating to the case in question, summarised below. Controller responsibility — The Board agreed with the DPA's finding that Legelisten is the controller for all processing of personal data related to their site (as listed above), for both users and the healthcare personnel, because they in all these instances determine how the personal data will be processed (the purpose) and the means (technical platform, layout, which processors to use). The relationship to freedom of speach and processing for journalistic purposes — The Board agreed with the DPA's finding that there were no exemptions or derogations for processing carried out for journalistic purposes in this case. Legal grounds for processing personal data about the users — The DPA found that Legelisten lacked a legal basis for processing contact information (email address) of users submitting reviews, because they could not rely on consent as this was not found to have been provided voluntarily. The Board agreed that email addresses will often reveal the identity of a person and is, as such, personal data, and that information related to visits to or contact with specialist healthcare personnel, will reveal special category personal data and thus requires a legal ground for processing as per Article 9(2) GDPR, in addition to Article 6(1). However, the Board were split in their view of consent being a valid legal basis for processing in this specific case. The majority disagreed with the DPA and found that Legelisten could rely on consent for processing contact information of users, because they provided sufficient sufficient information in their terms and privacy notice, and required users to provide their consent through a clear affirmative act. The Board's decision here effectively reverted the DPA's initial decision item 8. Legal grounds for processing personal data about healthcare personnel — Processing of personal data about healthcare personnel on Legelisten relates to two categories: objective vs. subjective personal data. The Board noted that the relevant legal basis in both cases is Article 6(1)(f), legitimate interest, and made a thorough assessment relating to the three-part test (the purpose test, the necessity test and the balancing test). The Board first assessed the legal basis relating to the users' subjective reviews of healthcare personnel. In the balancing test, the Board were split in their views. First, the majority found that the subjective expressions of the individual patient in principle are expressions protected by the right of freedom of speech, cf. the Norwegian Constitution § 100 and the European Convention on Human Rights Article 10, and that most healthcare personnel on Legelisten can be seen as public figures, cf. the Article 29 Data Protection Working Party guidelines 225, number 2: «Does the data subject play a role in public life? Is the data subject a public figure?». Next, the majority emphasised that patients' subjective reviews of their experiences with healthcare personnel is of public interest and Legelisten's services contributes to safeguarding important consumer interests. Hence, they concluded that a general right to opt out of being reviewed on the website, would reduce the value of Legelisten as a source of information on the quality of health-related services in Norway. They pointed to the almost immediate reservation requests from about 20% of general practicioners following the DPA's decision. In conclusion, the majority of the Board held that the various legitimate interests of Legelisten outweighed the rights and freedoms of the healthcare personnel, that the processing of their personal data is necessary for the purpose and, consequently, lawful as per Article 6(1)(f). For the objective personal data, an unanimous Board agreed that Legelisten had a legitimate interest in processing these. The Board's decision — Legelisten is the controller for all personal data published on their website. Legelisten's publishing of reviews of healthcare personnel is not subject to the exemptions or derogations for processing carried out for journalistic purposes. Legelisten has legal grounds for processing user contact information, cf. Article 6(1)(a), cf. Article 9(2)(a). Legelisten is not instructed to publish the identity of the users submitting reviews of healthcare personnel. Legelisten has legal grounds for collecting and publishing subjective reviews of healthcare personnel, cf. Article 6(1)(f), and does not have to provide healthcare personnel with the right to opt out. Legelisten has legal grounds for collecting and publishing objective personal data of healthcare personnel, cf. Article 6(1)(f), and does not have to provide healthcare personnel with the right to opt out. ### CJEU - C-798/24 - Jautiva *Source: CJEU, C-798/24, 2026-09-03 — https://overview.legal/posts/353788 — original: https://gdprhub.eu/index.php?title=CJEU_-_C-798/24_-_Jautiva* Facts — Seventeen natural persons, who were minority shareholders of a public limited liability company, brought proceedings before the Satversmes tiesa (the Constitutional Court of Latvia). They challenged national legislation requiring information on shareholders to be included in the public companies register. The information made publicly available included shareholders’ identity and contact details, as well as information concerning the class, number and nominal value of their shares and the number of votes attached to them. The information could be accessed online and downloaded in bulk by any person without identification or the need to demonstrate a legitimate interest. The data subjects argued that such disclosure constituted an unjustified and disproportionate interference with their rights, particularly because they were neither beneficial owners nor members of the company’s management bodies and did not exercise control over the company. The national legislation pursued several objectives, including ensuring transparency and protecting third parties, combating money laundering and terrorist financing, and facilitating the implementation of sanctions. The Constitutional Court stated the proceedings and referred questions to the CJEU. In particular, whether Directive 2017/1132 required such disclosure and whether Articles 5 and 6 GDPR permitted national legislation providing unrestricted public access to that personal data. Holding — Directive 2017/1132 The Court first held that Article 14(d) Directive 2017/1132 does not require the disclosure of information relating to all shareholders, including minority shareholders. Shareholders do not, merely by holding shares, participate in the administration, supervision or control of a company within the meaning of that provision. In particular, minority shareholders are generally not authorised to represent or bind the company or perform management or supervisory functions. Legal basis The Court recalled that any processing must comply with the principles under Article 5 GDPR and satisfy one of the lawful bases under Article 6 GDPR. (i) The purposes must be sufficiently determined by law Since the disclosure of the shareholders’ personal data was required by national law, the Court considered that the processing had to be assessed under Article 6(1)(c) GDPR, which permits processing where it is necessary for compliance with a legal obligation to which the controller is subject. (ii) The purpose limitation and minimisation principles The Court recalled that, pursuant to Article 6(3) GDPR, the legal basis must determine the purpose of the processing, pursue an objective of public interest and be proportionate to the legitimate aim pursued. First, regarding the determination of the purpose, the Court held that the national court must verify whether the purposes of the processing could be identified with sufficient certainty from the wording of the legislation or its legislative context. This assessment was also relevant under the purpose limitation principle in Article 5(1)(b) GDPR. Second, regarding necessity and proportionality, the Court referred to the data minimisation principle under Article 5(1)(c) GDPR. It considered that making shareholders’ identity, contact details and information about their shareholdings publicly accessible constituted a serious interference with their rights. Such information could reveal aspects of their financial situation and investments and was accessible to a potentially unlimited number of persons. The possibility of downloading the information in bulk further increased the risk of retention, dissemination and misuse. As regards transparency and the protection of third parties, the Court found that disclosing the personal data of all shareholders, particularly minority shareholders, was neither appropriate nor necessary because those shareholders generally cannot represent or bind the company. The Court also acknowledged that public access could contribute to combating money laundering and terrorist financing. However, unrestricted access was not strictly necessary, since those objectives could be achieved through less intrusive measures, such as limiting access to persons demonstrating a legitimate interest. Practical difficulties in verifying such an interest could not justify a broader interference with fundamental rights. Similarly, although public access could facilitate the implementation of sanctions, unrestricted disclosure was not necessary. Less intrusive alternatives included limiting disclosure to persons subject to sanctions or granting access to other shareholders’ information only where a legitimate interest was demonstrated. Finally, the Court noted that the legislation lacked sufficient safeguards against abuse because the data were accessible online and could be downloaded in bulk by unidentified users. Consequently, the Court held that Articles 5 and 6 GDPR, read in light of Articles 7 and 8 CFR, preclude national legislation requiring the personal data of all shareholders, including minority shareholders, to be publicly accessible without conditions such as demonstrating a legitimate interest. ### Court of Justice of the European Union - Case C-422/24 - AB Storstockholms Lokaltrafik. *Source: CJEU, 2026-01-07 — https://overview.legal/posts/51955* A new page has been created with the following information: "" ### High Court rules on burden of proof and pleading duties in ICCL v Microsoft GDPR *Source: High Court, 2026-09-25 — https://overview.legal/posts/449831 — original: https://gdprhub.eu/index.php?title=High_Court_-_2026_IEHC_640* Facts — The Irish Council for Civil Liberties (ICCL), a qualified entity, brought a representative action against Microsoft Ireland Operations Limited concerning the processing of personal data through the Xandr real-time bidding platform. ICCL alleged that personal data broadcast during real-time bidding auctions could include highly personal information and that the processing infringed several GDPR requirements, including transparency, data minimisation, security and consent obligations. It sought injunctive relief requiring Microsoft to cease, amend or restrict the processing. A dispute subsequently arose concerning the burden of proof and the parties' pleading obligations. ICCL argued that Articles 5(2) and 24(1) GDPR required the controller to demonstrate its compliance with the GDPR. Microsoft disputed that it was the relevant controller and argued that the ordinary rules of civil procedure placed the burden of establishing the alleged infringements on ICCL. The parties also disagreed about the information that had to be provided in the representative action. Microsoft sought further information concerning, among other things, the alleged infringements, the consumers affected and the funding of the proceedings. The court therefore determined several preliminary questions relating to the burden of proof, pleading requirements and access to information before the underlying GDPR allegations were decided. Holding — The court held that Articles 5(2) and 24(1) GDPR do not create a general reversal of the legal or evidential burden of proof. The claimant must first establish the matters for which it bears the burden, including that the defendant is a controller and that processing takes place which engages the relevant GDPR obligations. However, once those matters are established and compliance with a relevant GDPR obligation is at issue, the controller bears the legal and evidential burden of demonstrating compliance. In particular, where compliance with the principles in Article 5(1) GDPR or with the requirements covered by Article 24(1) GDPR must be determined, it is for the controller to prove that the relevant processing complies with those obligations. The Court considered this to follow from the accountability obligations. The court further held that the ordinary national rules on pleadings continue to apply to both parties. Each party must plead the material facts supporting the matters it is required to prove. Consequently, where the controller wishes to advance a positive case that it complied with the GDPR, it must plead the material facts on which that claim of compliance is based. Regarding the representative action, the court held that Sections 19(10) and 19(11) of the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 do not give the controller a standalone right to require the claimant to provide further information. However, the controller may rely on ordinary procedural mechanisms, including requests for particulars, discovery or disclosure under Section 34(2), where the applicable requirements are met, and may challenge the admissibility of the representative action. The court did not determine whether the processing through the Xandr platform actually infringed the GDPR. It also declined to determine certain additional questions, including the application of the "peculiar knowledge principle", because the necessary facts had not been agreed. No fine or corrective measure was imposed. ### Austrian FAC: DPA rightly found loyalty program consent for profiling invalid under GDPR *Source: Federal Administrative Court, 2023-09-28 — https://overview.legal/posts/125664 — original: https://gdprhub.eu/index.php?title=BVwG_-_W256_2227693-1* Facts — On 05.09.2019, the Austrian DPA (DSB) notified the controller of a customer loyalty program that they were initiating an ex officio investigation. The controller responded by answering the provided questionnaire and submitting further documents. On 23.10.2019, the DPA ruled that the investigation was justified and that the declaration of consent for profiling using certain registration methods (website, app, partner company store, flyer) did not comply with the requirements of Article 4(11) GDPR and Article 7 GDPR, nor were they provided in an intelligible way. If a contract covers several aspects, the declaration of consent must be clearly distinguishable. Regarding the website and flyer, the following was found: The website says 'Enjoy your personal benefits' without providing clear information that 'personal benefits' involves profiling. In an embedded box, the relevant points were merely referred to. Information regarding profiling was only accessible by scrolling down further. Concerning the flyer, the following information was provided under the signature field: 'This signature only applies to the declaration of consent and is voluntary. Your registration [...] is also valid without a signature.' Thus, it conveyed the impression that a signature was required to confirm the registration. Consequently, the controller was required to amend the declaration and to cease using any obtained consents for the purpose of profiling prior to 01.05.2020. The controller lodged a complaint. In addition to other information, the controller stated that the data processing was in accordance with Article 6(1)(a) GDPR, and that they had a legitimate interest under Article 6(1)(f) GDPR. The DPA ruled a preliminary decision on the complaint, thereby changing the ruling that the website and flyer did not meet the requirements under Article 6(1)(a) GDPR, and thus, the processing of personal data, collected in that cases, was forbidden. The other methods ensured that the consent was clearly separated from the rest of the registration process. The controller then filed a request for referral to the court, arguing that the DPA had exceeded their corrective powers by prohibiting the processing of the data. Furthermore, the data processing for profiling would be used to manage customer memberships under Article 6(1)(b) GDPR. Following their view, processing under Article 6(4) GDPR was applicable. Additionally, the controller denied the DPA's view that a violation of the principle of good faith would foreclose a weighing of interests under Article 6(1)(f) GDPR. The court quashed the preliminary decision as the DPA had not examined the other grounds of justification for data processing under Article 6(1) GDPR in their initial decision. The DPA then lodged an appeal to the Austrian Supreme Administrative Court (Verwaltungsgerichtshof), which overturned the court's ruling (VwGH 08.02.2022, Ro 2021/04/0033). It was the court's responsibility to examine the potential legal bases, rather than overturning the DPA's decision. Therefore, the case was returned to the court. In the meantime, the controller complied with the preliminary decision by deleting the affected personal data in 2021 and changing their registration process in 2020. Holding — First, the court found that they had to formally rule on whether the DPA's decision was lawful at the time it was ruled. It is not to be considered that the controller complied with the administrative decision and fulfilled the required steps (VwGH 28.04.2022, Ra 2022/06/0056). Second, the court held that the controller did not comply with the transparency requirements regarding the layout of their declaration of consent under Article 7(2) GDPR in both cases (website, flyer). Third, the court ruled that they could not agree with DPA's view, that an invalid declaration of consent always constitutes unlawful data processing and that a review of other grounds of justification would not be necessary (CLEU in 'Meta Platforms and Others' (C-252/21) ECLI:EU:C:2023:537). Further on, the Supreme Administrative Court ruled that both, the DPA and the court are required to examine the presence of other grounds (VwGH 08.02.2022, Ro 2021/04/0033). Fourth, the court held that the controller could not base their appeal on Article 6(4) GDPR as the data processing did not satisfy the grounds of justification, nor were other grounds apparent. Inter alia, following the CLEU's preliminary ruling in 'Meta Platforms and Others' (C-252/21) ECLI:EU:C:2023:537, three cumulative requirements must be met for data processing under Article 6(1)(f) GDPR: (1) The controller or a third party must have a legitimate interest, (2) which requires the processing of that personal data, (3) and 'the fundamental rights and freedoms of the data subject' must not outweigh those interests. There were no doubts about the controller's legitimate interest in processing the personal data in question for targeted marketing purposes, as this was both necessary and reasonable. However, the data subject should have been notified about profiling. The wording 'only if the member consents' did not constitute such a notification, and therefore the data subjects were not to be expected that their personal data was used for profiling purposes. Furthermore, the controller explicitly excluded it in their general terms and conditions. Hence, the data subject's right to secrecy overrode the controller's legitimate interest. In summary, the court dismissed the controller's complaint. Last, the court held that an appeal to the Supreme Administrative Court was admissible under Article 133(4) B-VG, as no prevailing case law concerning the implementation of a declaration of consent existed. Hence, the decision relied on a legal question of fundamental importance. ### OLG Köln - 15 W 55/26 *Source: Higher Regional Court Cologne, 2026-06-12 — https://overview.legal/posts/53657 — original: https://gdprhub.eu/index.php?title=OLG_Köln_-_15_W_55/26* Facts — The data subject, a doctor, sought an injunction against the Controller, the operator of an online review platform, requiring the removal of, and prohibiting the future publication of, a notice stating that between six and ten reviews concerning his medical practice had been removed during the previous year following complaints relating to defamation under German law. The Regional Court of Cologne dismissed the application, following which the data subject lodged an immediate appeal before the Higher Regional Court of Cologne. The data subject argued that the notice was inaccurate because the reviews had been challenged on the basis that no genuine patient relationship existed, rather than on the ground of defamation. He submitted that the notice therefore created the false impression that he had complained of defamatory reviews, rendering the processing of his personal data unlawful. The Controller argued that complaints alleging the absence of a genuine customer or patient relationship fell within its internal category of complaints concerning defamation under German law and that publishing the number of removed reviews promoted transparency regarding its review moderation process. Holding — The court held that where a data subject seeks not only the erasure of personal data but also an injunction preventing its future publication, Article 17(1) GDPR provides a basis for both forms of relief. It further held that the journalistic exemption under Article 85(2) GDPR did not apply because the Controller's review platform, including the automated notices relating to removed reviews, did not process data for journalistic purposes. The court also held that the displayed number of removed reviews constituted personal data within the meaning of Article 4(1) GDPR because it related to an identified natural person. By storing and disclosing that information, the Controller processed personal data within the meaning of Article 4(2) GDPR. In assessing the accuracy of the notice under Article 5(1)(d) GDPR, the court considered how an average user would understand the information. It held that a prominently linked information page entitled "Defamation under German law" explained that the platform categorised not only false or reputation-damaging reviews, but also complaints alleging that the reviewer was not a genuine customer, as complaints concerning defamation. As the data subject did not dispute that he had successfully requested the removal of between six and ten reviews on the basis that the reviewers had not been genuine patients, the court concluded that users could readily understand the platform's use of the term and that the notice was factually accurate. The court also rejected the data subject's reliance on the Festzins Plus judgment (BGH, judgment of 21 September 2017 – I ZR 53/16), distinguishing that case because the corrective information there appeared only at the end of a lengthy and unclear text, whereas the notice in the present case contained a clearly highlighted hyperlink directing users to explanatory information specifically addressing the platform's categorisation of review removals. The court held that the Controller had legitimate interests in promoting transparency regarding its handling of review-removal requests and that publication of the notice was necessary for that purpose. These interests outweighed the data subject's rights because the notice related only to his professional activity, was presented in a factual manner, contained no criticism of his behavior and was not prominently displayed, appearing only after users selected the "Reviews" tab. Accordingly, the court concluded that the processing was lawful under Article 6(1)(f) GDPR and that the data subject was not entitled to erasure or an injunction preventing the future publication of the notice under Article 17(1) GDPR. ### BVwG - W214 2235505-1 *Source: BVwG, 2024-03-11 — https://overview.legal/posts/291152 — original: https://gdprhub.eu/index.php?title=BVwG_-_W214_2235505-1* Facts — On 02.06.2020, the complaining journalist requested information from the controller on the names and sums of all companies that received financial aid in the form of tax deferrals, grants or loan guarantees during the COVID-19 pandemic under § 2 Auskunftspflichtgesetz and § 3 Auskunftspflichtgesetz. On 26.08.2020, the controller rejected the journalist's request, arguing that it cannot provide the requested information due to a statutory duty of confidentiality coming from data protection (§ 1 DSG) and related tax laws (§ 48a BAO). Accordingly, the disclosure of the names of all companies including the concrete amounts of their respective COVID-19 support services would reveal too concrete and detailed information on the businesses earnings situation, profitability and competitiveness. Moreover, the collection and preparation of the requested information would require a significant administrative work, and the requested criteria for the information would exceed the scope of the Auskunftspflichtgesetz. The journalist lodged a complaint with the court against the controller's decision and and "modified" their initial information request in a submission on 01.02.2020 so that only those companies not falling within the bottom 10% of all those granted aid were to be requested. In a further submission, the controller stated that this was not permitted during the proceedings as only the application and not the information request could be amended under § 13(8) AVG. On 08.06.2021, the journalist "clarified" their application in another statement, as if their "modified" information request were going to be dismissed. In this case, it should be held that all companies must be named. On 28.07.2021, the court ruled in favour of the amended information request, that the controller had unlawfully refused the information in the requested scope. The court also dismissed the other parts of the complaint, and held that an appeal under Article 133(4) B-VG was admissible (BVwG 28.07.2021, W214 2235505-1). The controller lodged an appeal with the Austrian Supreme Administrative Court. On 02.02.2023, the court held that the BVwG should not have based their decision on the "modified" information request, that was "clarified" later on, as this was unlawful due to the court's lack of competence pursuant to § 42(2)(2) VwGG (VwGH 02.02.2023, Ro 2023/13/0001). On 11.03.2024, a new decision was made by the court. Holding — First, the court held that the "modified" or "clarified" information request during the proceedings must be denied. However, the controller unlawfully refused the initial information request. Second, the court ruled that the controller was required to provide the names of the companies that were subject to disclose in the database "Transparency Award Module" under Regulation (EU) No 651/2014 and for which subsidies for fixed costs or guarantees for loans were granted during the COVID-19 pandemic. Third the court held that the controller was also required to provide the names and the respective sums of the aids granted of the corporations that have an obligation to disclosure under §277 to 280a UGB and for which subsidies for fixed costs or loan guarantees were issued during the COVID-19 pandemic by COVID-19 Finanzierungsagentur des Bundes GmbH (COFAG), Austria Wirtschaftsservice Gesellschaft mbH (aws), Österreichische Hotel- und Tourismusbank Gesellschaft m.b.H. (ÖHT), and Österreichische Kontrollbank (OeKB). The court argued, that the complainant’s work as a journalist fulfills the social role of a "public watchdog" to prevent financial abuse during the exceptional COVID-19 pandemic. In line with European principles, publications of financial beneficiaries are of great social interest and strengthen both the control and contribution of the public to the appropriate use of funds by the administration. Moreover, the journalist is itself bound by the legal framework of his employment and respective obligations to protect companies affected by the reporting. The court therefore held that the authority has to provide the journalist with access to the information on financial aid issued on corporate companies. On the other hand, as far as individual entrepreneurs are concerned, the court finds a more serious interference with the fundamental rights of the individual. Accordingly, in situations where the information issued refers to an individual entrepreneur, the balance of interest shifts to overriding interest of the individual behind the business (§ 1(2) DSG, Article 6(4) GDPR). The Information on financial aid for individual entrepreneurs therefore may not be provided to the journalist. However, this does not apply where union law provides legal exceptions to these provisions (e.g. in the case for aid higher than €500,000€ according to Article 9(1)(c) Regulation (EU) No 651/2014). The court finally held that no appeal to the Austrian Supreme Administrative Court (Verwaltungsgerichtshof) was admissible pursuant to Article 133(4) B-VG, as no indications of legal questions of fundamental importance, were raised, including the balancing of individuals' interests under the GDPR. ### LG Rostock: Pre-ticked cookie consent boxes invalid under Art 6(1)(a) GDPR *Source: LG Rostock, 2020-09-15 — https://overview.legal/posts/122848 — original: https://gdprhub.eu/index.php?title=LG_Rostock_-_3_O_762/19* Facts — The German consumer organisation Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv, the claimant) filed a lawsuit against advocado GmbH (advocado, the defendant), a German-based company that runs an online platform where attorneys can offer their services. The defendant's website had used a cookie banner with pre-ticked boxes for the use of marketing and analytics cookies. This included the use of tools such as Google Analytics that entail a data transfer to third countries. The claimant argued that the data processing in connection with the placed cookies was unlawful under Article 6(1) GDPR: A user's consent under Article 6(1)(a) GDPR could not be considered valid under Articles 4(11) and 7 GDPR, especially since the boxes were pre-ticked. Moreover, the claimant claimed that the defendant had violated Articles 5(1)(a), 13/14, 26 and 44 et seqq. GDPR as it had failed to properly inform users of the scope of intended processing activities, joint controllers and international data transfers in connection with the use of cookies. The defendant stated that it had based the use of cookies on legitimate interests under Article 6(1)(f) GDPR until the CJEU issued its decision C-673/17 on 01.10.2019 ("Planet 49"). Afterwards, the defandent argued that they changed the legal basis for processing to consent under Article 6(1)(a) GDPR, which it considered valid under Articles 4(11) and 7 GDPR. The defendant also stated that it was the sole controller for the processing activities - there were no joint controllers involved, only processors. (Furthermore, the claimant had also argued that some provisions in the defendant's general terms and conditions were unlawful from a civil law / consumer protection law perspective. This will not be discussed further in this summary.) Dispute — Was it necessary to ask for the users' consent under Article 6(1)(a) GDPR or could the processing activities in connection with the use of marketing and analytics cookies be based on legitimate interest under Artilce 6(1)(f)? Was the consent given by users' when interacting with the defendant's cookie banner valid under Articles 6(1)(a), 4(11) and 7 GDPR? Did the defendant violate GDPR provisions on transparency? Was the defendant the sole controller regarding the processing activities in connection with the use of marketing and analytics cookies or were there any joint controllers? Holding — Legal basis and validity of consent — The court held that the marketing and analytics cookies used by the defendant c an only be placed with the users' consent under Article 6(1)(a) GDPR : § 15(3) Telemediengesetz that deals with such cookies must be interpreted in light of Article 5(3) e-Privacy Directive, which requires consent for cookies not strictly necessary for technical reasons. Taking into consideration the design of the cookie banner and the lack of information provided to a website user, the court held that consent given could not be considered valid under Articles 6(1)(a), 4(11) and 7 GDPR. The banner featured pre-ticked boxes and a big "OK" button. The option "use only necessary cookies" was designed to not look like an interactive button but rather a link. Consent could therefore not be considered "freely given" and was invalid. Transparency — The court further held that the defendant violated Article 13 GDPR by mentioning an incorrect transfer mechanism under Articles 44 et seqq. GDPR for data transfers in connection with the use of cookies. Sole or joint controllership when using Google Analytics? — Lastly, the court held that the use of Google Analytics results in joint controllership of the website provider using this tool and Google . Google does not qualify as the website provider's processor under Article 4(7). This is because Google does not process the data solely for the purpose of use by the website provider. Rather, Google, like other third-party providers, expressly reserves the right to process the data for its own purposes as well. The fact that the defendant and Google entered into a data processing agreement under Article 28 GDPR does not change this assessment. The court's legal view is in line with the official opinion of the "Datenschutzkonferenz", a gathering of all German DPAs. ### Inteligo Media SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) *Source: CJEU, 2025-03-27 — https://overview.legal/posts/50682 — original: https://curia.europa.eu/juris/document/document_print.jsf?pageIndex=0&docid=297249&doclang=EN* Het Hof van Justitie van de EU (Eerste Kamer) beantwoordt een prejudiciële vraag over de uitleg van artikel 13 van Richtlijn 2002/58/EC (ePrivacy) en de verhouding tot de GDPR, specifiek of een dagelijkse nieuwsbrief per e-mail kwalificeert als communicatie "met het oog op direct marketing" en of de contactgegevens hiervoor "in de context van de verkoop van een product of dienst" zijn verkregen. Het Hof oordeelde dat een nieuwsbrief met inhoud ter bevordering van de verkoop van producten of diensten onder direct marketing valt, en dat de uitzondering van artikel 13(2) van de ePrivacy-richtlijn slechts van toepassing is wanneer de contactgegevens daadwerkelijk in de context van een concrete verkooptransactie zijn verkregen — een algemene registratie op een online platform die enkel toegang geeft tot aanvullende content volstaat hiervoor niet, zodat voor de nieuwsbrief voorafgaande toestemming vereist is. ## Guidance ### Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) *Source: EDPB, edpb-guidelines-on-transparency, 2018-04-11 — https://overview.legal/posts/38076 — original: https://www.edpb.europa.eu/system/files/2023-09/wp260rev01_en.pdf* The Article 29 Data Protection Working Party issued these guidelines (WP260 rev.01), adopted on 29 November 2017 and last revised on 11 April 2018, to provide interpretive and practical guidance on the transparency requirements under the GDPR (Articles 12–14). The document addresses the form, timing, content, and modalities of information provided to data subjects, including issues such as plain language, layered privacy notices, information for children, and exceptions to the obligation to provide information. No fines or enforcement actions are imposed, as this is a guidance document rather than an enforcement decision. ### Article 29 Working Party - Guidelines on transparency under Regulation 2016/679 *Source: EDPB, article-29-working-party-guidelines-on-transparency-under-regulation-2016679-en, 2018-04-11 — https://overview.legal/posts/126340 — original: https://www.edpb.europa.eu/documents/guideline/article-29-working-party-guidelines-on-transparency-under-regulation-2016679_en* ARTICLE 29 DATA PROTECTION WORKING PARTY This Working Party was set up under Article 29 of Directive 95/46/EC. It is an independent European advisory body on data protection and privacy. Its tasks are descr bed in Article 30 of Directive 95/46/EC and Article 15 of Directive 2002/58/EC. The secretariat is provided by Directorate C (Fundamental Rights and Union Citizenship) of the Europe an Commission, Directorate General Justice, B - 1049 Brussels, Belgium, Office No MO - 59 02/013. Website:… ### Guidelines 3/2025 on the interplay between the DSA and the GDPR *Source: EDPB, edpb-guidelines-202503-interplay-dsa-gdpr-v1-en, 2026-09-17 — https://overview.legal/posts/51175 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-32025-on-the-interplay-between-the-dsa-and-the-gdpr_en* G uidelines 3/2025 on the interplay between the DSA and the GDPR Version 2.0 Adopted on 17 September 2026 1 | Adopted Version history Version Date Adoption information Version 2.0 17 September 2026 Adoption of the Guidelines after public consultation Version 1.1 12 September 2025 Minor corrections in the executive summary Version 1.0 11 September 2025 Adoption of the Guidelines for public consultation 3 | Adopted of special categories of data to present advertisements based on profiling.… ### Guidelines 8/2020 on the targeting of social media users *Source: EDPB, edpb-guidelines-on-the-targeting-of-social-media-users, 2021-04-13 — https://overview.legal/posts/38073 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-82020-on-the-targeting-of-social-media-users_en* The EDPB adopted Guidelines 8/2020 on the targeting of social media users to clarify the roles, responsibilities, and legal obligations of the various actors involved in social media targeting, including social media providers, targeters, and users. The guidelines analyze different targeting mechanisms—based on provided, observed, and inferred data—and address controller determinations, legal bases, transparency requirements, DPIAs, and the processing of special categories of data. No fines are imposed, as this is interpretive guidance intended to assist stakeholders in achieving GDPR compliance. ### EDPB Annual Report 2024 *Source: EDPB, edpb-annual-report-2024-en, 2025-04-23 — https://overview.legal/posts/50818 — original: https://www.edpb.europa.eu/documents/reports-statements-and-letters/edpb-annual-report-2024_en* De EDPB heeft het Jaarraport van 2024 gepubliceerd. Met ook een handzame samenvatting voor degene die geen tijd hebben. Er wordt ook een lijst met zaken van enkele DPAs uitgekozen, waaruit ook het volgende tabelletje met cijfers kan worden gedestilleerd. ↓ (dit leest het beste op de website, mind... ### Opinion 26/2024 on the draft decision of the DE Bremen Supervisory Authority regarding the “Catalogue of Criteria for the Certification of IT-supported processing of Personal Data pursuant to art 42 GDPR (‘GDPR – information privacy standard’)” presented *Source: EDPB, opinion-262024-on-the-draft-decision-of-the-de-bremen-en, 2024-12-02 — https://overview.legal/posts/125701 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-262024-on-the-draft-decision-of-the-de-bremen_en* Adopted 1 Opinion 26 / 2024 on the draft decision of the DE Bremen Supervisory Authority regarding the “Catalogue of Criteria for the Certification of IT - supported processing of Personal Data pursuant to art 42 GDPR (‘GDPR – information privacy standard’)” presented by datenschutz c ert GmbH Adopted on 2 December 2024 Adopted 2 Adopted 3 The European Data Protection Board Having regard to Article 63, Article 64(1)(c) and Article 42 of the Regulation 2016/679/EU of the European Parliament and… ### Opinion 18/2024 on the draft decision of the Austrian Supervisory Authority regarding DSGVO-zt GmbH certification criteria *Source: EDPB, opinion-182024-on-the-draft-decision-of-the-austrian-en, 2024-07-18 — https://overview.legal/posts/125721 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-182024-on-the-draft-decision-of-the-austrian_en* Adopted 1 Opinion 18/2024 on the draft decision of the Austrian Supervisory Authority regarding DSGV O - zt GmbH certification criteria Adopted on 16 July 2024 Adopted 2 Adopted 3 The European Data Protection Board Having regard to Article 63, Article 64(1)(c) and Article 42 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free mo vement of such data, and… ### Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria *Source: EDPB, opinion-152023-on-the-draft-decision-of-the-dutch-supervisory-en, 2023-09-19 — https://overview.legal/posts/125831 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-152023-on-the-draft-decision-of-the-dutch-supervisory_en* Adopted 1 Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria Adopted on 19 09 2023 Adopted 2 Adopted 3 The European Data Protection Board Having regard to Article 63, Article 64(1)(c) and Article 42 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and… ## Enforcement decisions ### NAIH (Hungary) - NAIH-450-7-2026 *Source: NAIH (Hungary), 2026-05-12 — https://overview.legal/posts/184727 — original: https://gdprhub.eu/index.php?title=NAIH_(Hungary)_-_NAIH-450-7-2026* Facts — The DPA initiated an investigation into the processing of personal data of customers (the data subjects) by the operator of an online store (the controller) in April 2025. The period under review extended from January 2020 to November 2025. During this time, the company had multiple privacy notices in force, as well as other documents that contained relevant information on the processing of personal data. Holding — The DPA found the controller guilty of multiple GDPR violations and issued it a fine of HUF 15,000,000 (€41,500). In addition, it ordered the controller to bring its processing operations in compliance with the GDPR by amending the information system used on its website, in particular the data processing provisions of the general terms and conditions and the data processing notices related to prize contests. First, the DPA held that the controller had violated the principle of transparency laid down in Article 5(1)(a) GDPR: several separate documents contained partially conflicting, irrelevant, and incomplete information regarding the processing of personal data. The information was not organised within a uniform, transparent system. Second, the DPA determined that the controller had failed to provide concise, transparent, and intelligible information regarding the purposes and the legal basis for each processing activity and therefore infringed Article 12(1) GDPR. Finally, the DPA found infringements of Articles 13(1) and 13(2) GDPR – the controller had not provided the data subjects all information necessary when personal data is collected from data subjects. In particular, the controller had failed to adequately distinguish the purposes and the legal bases for each processing operation, recipients of personal data, and retention periods. The controller’s website also contained contradictory information on whether or not personal data was transferred to the United States. ### NAIH (Hungary) - NAIH-4462-5-2026 *Source: NAIH (Hungary), 2026-04-30 — https://overview.legal/posts/262255 — original: https://gdprhub.eu/index.php?title=NAIH_(Hungary)_-_NAIH-4462-5-2026* Facts — The DPA initiated an investigation into the processing of the personal data of customers (the data subjects) by the operator of an online store (the controller) in April 2025. The controller’s main business activity was the wholesale distribution of beverages. The personal data of the data subjects was processed on the website of the online store for registration, placing orders, billing, communication, delivery, creation of user accounts, and newsletter subscription. During the period under review, i.e. between January 2020 and October 2025, no standalone privacy notice was available on the website. The previously archived privacy notice and the data processing section included in the general terms and conditions described the processing operations in a rather brief and general manner. The controller argued that the inaccessibility of the privacy notice followed from a technical error that was corrected upon discovery. Holding — The DPA found that the controller had violated Articles 5(1)(a), 5(2), 12(1), 13(1)(a), (c), and (e) as well as 13(2)(a)–(e) GDPR and issued it a fine of HUF 10,000,000 (€27,300). When issuing the fine, the DPA took into account that the identified infringements followed from systemic inadequacies of the privacy notice and were of continuous nature. In addition, the DPA ordered the controller to develop and publish a uniformly structured privacy notice that is aligned with its actual processing operations. First, the DPA identified a violation of the principle of transparency laid down in Article 5(1)(a) GDPR: the information provided to data subjects about the processing of their personal data was either incomplete or completely absent, and changes could not be tracked. Second, the DPA held that the controller had violated the principle of accountability set forth in Article 5(2) GDPR, as it had failed to submit appropriate documentation covering the period under review. In addition, the controller’s data processing practices could not be continuously monitored or subsequently verified based on the documentation it had provided. Finally, the DPA confirmed that the controller had not complied with the requirements laid down in Articles 12(1), 13(1)(a), (c) and (e), and 13(2)(a)–(e) GDPR. Due to the lack of a privacy notice, the controller could not demonstrate that it had provided data subjects with the information required under Article 13 GDPR apart from brief, general statements in the archived privacy notice and the general terms and conditions. The controller had thus failed to provide the data subjects clear and differentiated information regarding the purpose and legal basis for each processing operation. Furthermore, the controller had not adequately identified the recipients or the storage period of personal data or information on the data subjects' rights. Due to the form and scope of the information provided, the controller had also infringed Article 12(1) GDPR. ### WhatsApp Ireland Ltd.: Insufficient fulfilment of information obligations *Source: Data Protection Authority of Ireland, 2021-09-02 — https://overview.legal/posts/46935 — original: https://www.enforcementtracker.com/ETid-820* The Irish DPA (DPC) has imposed a fine of EUR 225,000,000 on WhatsApp Ireland Ltd. The DPA had started extensive investigations into the messaging service's compliance with transparency obligations back in December 2018. In this context, the DPC investigated whether WhatsApp complied with its obligations under the GDPR regarding the provision of information and the transparency of this information to users and non-users of WhatsApp. In the course of the investigation, the DPC found that WhatsApp ### AEPD: CaixaBank requested excessive inheritance documentation from heirs *Source: AEPD (Spain), 2026-09-10 — https://overview.legal/posts/353958 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_ps-00028-2025* Facts — A data subject and other heirs were handling the inheritance of a deceased customer through CaixaBank, S.A., the controller. In the course of the inheritance procedure, the controller obtained a complete notarised deed of acceptance, partition and allocation of the inheritance. The data subject considered that the controller had obtained substantially more personal and financial information than necessary to distribute the funds held with the controller. In particular, the deed contained information concerning the deceased's entire estate and personal and financial information relating to the heirs, including assets unrelated to the controller. The data subject subsequently complained to the controller and asked for the legal basis for requesting the complete deed. The controller replied that it had not required the submission of a complete public deed and claimed that the heirs could have provided only the relevant parts or used a private document. It also stated that its inheritance guidance informed customers of the available alternatives. The data subject lodged a complaint with the DPA. During its investigation, the DPA established that the controller's internal inheritance guide generally instructed heirs to submit a public deed of acceptance of the inheritance. The guide did not adequately inform heirs that the inheritance could instead be partitioned through a private document containing only the information necessary for the distribution of the relevant bank assets. The investigation also concerned whether the controller had complied with its transparency obligations. The controller argued that its general privacy policy and a specific inheritance form provided the information required under Article 13 GDPR. However, it could not demonstrate that the relevant form or equivalent privacy information had actually been provided to the data subject when the personal data were collected. The DPA initially investigated a possible infringement of Article 5(1)(c) GDPR concerning data minimisation. Following the investigation, it considered that the systemic design of the controller's inheritance procedure was more appropriately assessed under Article 25 GDPR. The DPA also investigated a possible infringement of Article 30 GDPR. During the proceedings, the controller provided the complete version of its record of processing activities and demonstrated that inheritance-related processing was included in it. Holding — The DPA found that the controller infringed Article 25 GDPR because its inheritance procedure was not designed in accordance with the principle of data minimisation. The controller's internal process generally contemplated the collection of a complete notarised inheritance deed, although this could contain extensive personal and financial information unrelated to the specific banking assets concerned. The DPA considered that the controller could have relied on documentation limited to the information necessary to establish the heirs' rights over the relevant assets. Since this resulted from the design of the controller's general procedure, the DPA assessed the conduct under Article 25 GDPR rather than Article 5(1)(c) GDPR. The DPA also found an infringement of Article 13 GDPR. The controller could not demonstrate that the data subject had been provided with the required information when the personal data were collected. Its general privacy policy did not clearly cover inheritance-related processing and the specific information form submitted during the investigation was unsigned. The DPA imposed fines of €500,000 for the infringement of Article 25 GDPR and €10,000 for the infringement of Article 13 GDPR. The alleged infringement of Article 30 GDPR was archived after the controller demonstrated that inheritance-related processing was included in its record of processing activities. Following voluntary payment, the total fine of €510,000 was reduced by 20% to €408,000 according to Spanish Administrative Law (39/2015). The DPA also ordered the controller, within six months, to adopt measures ensuring compliance with Article 25 GDPR, provide the information required under Article 13 GDPR to affected data subjects and include inheritance-related processing in its privacy policy. ### Garante per la protezione dei dati personali (Italy) - 487/2026 *Source: Garante per la protezione dei dati personali (Italy), 2026-07-03 — https://overview.legal/posts/108999 — original: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_487/2026* Facts — Character Technologies, Inc (the controller) is a company established in the US that operates the site Character.AI. Character.AI is a generative AI service that allows users to create and interact through chat with virtual characters that already exist or are created at the moment. The controller made this available to data subjects in Italian, and had a specific version for children. The DPA initiated an ex-officio investigation in 2024. The DPA requested information related to the LLM models used by the controller, the provision of the service, and data transfers. The controller provided a DPIA, and stated that it introduced an age verification system that required data subjects to register their date of birth. In 2025, the controller announced it would prevent underage data subjects from accessing open chat rooms, and would begin processing personal data of data subjects in the EEA to post-train its generative AI systems. Holding — The DPA first clarified that the GDPR is applicable even if the controller was established outside of the EU, in accordance with Article 3(2) GDPR. The DPA took into account the fact that the service was available in Italy and in Italian, as well as the privacy policy also applying to EEA residents. Given that the controller did not have an establishment in the EU, the one-stop-shop mechanism did not apply and the DPA was competent. The DPA found a violation of Articles 12(1), 13(1) and (2), and 14(1) and (2) GDPR. The DPA considered that the controller had failed to meet its information obligations. In terms of the controller’s privacy policy, the DPA considered that the controller had not provided data subjects’ with clear information regarding its processing activities, data transfers, or data subjects’ right to object and opt out. In addition, the controller failed to designate a representative in the EU, and included misleading and inaccurate statements on the processing of personal data for purposes of post-training LLMs for the service. However, the DPA also took into consideration that the controller had updated its privacy policy to make its language clearer. In terms of its pre-training activities, the DPA stated that the controller had failed to provide adequate information and therefore violated Articles 14(1) and (2) GDPR. The DPA dismissed the controller’s argument that it did not have the obligation to provide this information due to the data being collected by third parties from open sources. The DPA stated that the controller had the obligation to verify whether personal data was present. In addition, the exemption under Article 14(5)(b) GDPR does not exempt the controller from having the obligation to implement appropriate measures to protect data subjects’ rights. However, the DPA did not find a violation of Articles 21(1) and (4). The DPA referred to the EDPB opinion on processing personal data in relation to AI systems. The EDPB recommended controllers to adopt measures for data subjects to exercise their rights, including providing the option to provide data subjects with the option to object unconditionally before the processing takes place. The DPA considered that this opinion went beyond the literal wording of Articles 14 and 21 GDPR. This interpretation could not, in the DPA’s view, be interpreted retroactively to the controller’s processing activities. The DPA found a violation of Articles 24(1) and 25(2) GDPR. The DPA considered that the controller had failed to implement adequate technical and organisational measures to verify data subjects’ age. During its investigations, the DPA found that the controller’s age verification systems were not effective, as they allowed data subjects’ to access the service even after self declaring to be younger than the minimum age limit set by the controller. The DPA also found that the accounts were set to public by default. Therefore, the controller had failed to implement appropriate measures to protect underage data subjects, even if the GDPR does not set a harmonised and binding standard in relation to age verification. The DPA also found a violation of Articles 5(2) and 35 GDPR. Under Article 5(2) GDPR, the controller has the obligation to proactively demonstrate compliance with the GDPR. The DPA stated that a key tool to do this is through data protection impact assessments (DPIAs). Controllers are obliged to carry out a DPIA under Article 35 GDPR if the processing is likely to result in a high to the rights and freedoms of data subjects. The controller failed to do a DPIA on time in relation to providing the service to underage data subjects, as well as in relation to its processing activities for the purpose of pre-training its LLM. The DPA stated that the controller should have done this before launching the service in 2022, as the processing activities had a presumed high risk to freedoms and rights of data subjects (e.g. the use of large scale processing or processing data of vulnerable data subjects). However, the DPA acknowledged that the controller progressively improved its compliance by doing a (late) DPIA and updating it. Finally, the DPA found a violation of Article 27(1) GDPR, as the controller belatedly designated a representative in the EU. The DPA stated that the exemption under Article 27(2) GDPR did not apply. The DPA fined the controller €158,000. The DPA also ordered the controller to bring its privacy policy and storage of personal data for purposes of pre-training its LLM into compliance with the GDPR. The DPA also ordered the controller to implement effective age verification mechanisms. ### AKI (Estonia) - No. 2.1-1/24/397-890-38 *Source: AKI (Estonia), 2026-04-16 — https://overview.legal/posts/53882 — original: https://gdprhub.eu/index.php?title=AKI_(Estonia)_-_No._2.1-1/24/397-890-38* Facts — OÜ Dr Mõttus Hambaravi, the controller, is a Dental Clinic. On March 2024, the DPA received a complaint from a data subject regarding the fact that the controller had failed to provide all personal data requested. The controller only partially complied after several requests from the DPA. Although the DPA closed the part of the case concerning the access request, it continued investigating the controller’s processing of patients’ personal data when providing Invisalign treatment. The service required the controller to collect and transfer patients’ health data to Align Technology, Inc. However, the contractual documents did not clearly establish whether Align Technology acted as a processor, an independent controller or a joint controller. The controller stated that Align Technology largely determined the conditions of the service, including the consent form and the processing arrangements, and that individual clinics could not unilaterally amend these conditions. The DPA also found that the information provided to patients was incomplete and fragmented. The consent form and privacy information did not clearly explain the legal basis and purposes of processing, the parties involved, data recipients, retention periods, transfers outside the European Union or the safeguards applied to such transfers. Parts of the information were only available in English on external websites. Holding — The DPA held that the controller had failed to demonstrate that the processing carried out in connection with the Invisalign service was lawful and transparent under Articles 5(1)(a) and 5(2) GDPR. First, the DPA found that the parties’ roles had not been properly determined. Under Article 4(7) GDPR, the assessment had to be based on which party actually determined the purposes and means of processing, rather than solely on the contractual description of the relationship. The controller decided whether Invisalign treatment was suitable for a patient and collected the relevant health data. It therefore acted as a controller in relation to the treatment. However, Align Technology exercised significant control over the subsequent processing, including the data collected, the recipients, retention arrangements, the use of other service providers and transfers outside the European Union. The DPA therefore considered that Align Technology could not simply be regarded as a processor acting only on documented instructions under Article 28(3)(a) GDPR. On the available evidence, it was at least a joint controller under Article 26 GDPR. The DPA ordered the controller to review the contractual relationship. If Align Technology acted as a processor, the agreement had to comply with Article 28 GDPR, including the requirements concerning subprocessors under Article 28(2). If the parties were joint controllers, they had to allocate their respective responsibilities under Article 26 GDPR. Second, the DPA found that the consent obtained from patients was invalid. The consent form did not provide sufficient information for patients to understand the processing and therefore did not meet Articles 4(11), 6(1)(a), 7 and 9(2)(a) GDPR. The DPA also noted that healthcare processing may, depending on the operation concerned, rely on Article 6(1)(b) GDPR together with Article 9(2)(h) GDPR. However, the controller had not clearly identified the applicable legal bases for the different processing activities. The privacy information also failed to comply with Articles 12, 13 and 14 GDPR. Patients were required to consult several documents and external websites, some of which contained incomplete or inconsistent information. The controller had therefore not ensured that the information was easily accessible, understandable and available in Estonian. The DPA further referred to Article 25 GDPR when emphasising that the controller had to ensure that the processing arrangements and safeguards complied with the GDPR. Under Article 58(2)(d) GDPR and § 56(1) of the Estonian Personal Data Protection Act, the DPA ordered the controller to clarify the parties’ roles, conclude an Article 26 arrangement or Article 28 agreement, amend the consent form and privacy policy, and publish the required information in Estonian. No administrative fine was imposed. However, failure to comply could result in a penalty payment of €1,000 for each unfulfilled point or subpoint of the order, imposed repeatedly until compliance. ### Meta Platforms Ireland Limited: Non-compliance with general data processing principles *Source: Data Protection Authority of Ireland, 2023-01-04 — https://overview.legal/posts/47658 — original: https://www.enforcementtracker.com/ETid-1543* The Irish DPA (DPC) has fined Meta Platforms Ireland Limited EUR 390 million. The DPA has imposed a fine of EUR 210 million for violations related to the provision of its Facebook service and EUR 180 million for violations related to the provision of its Instagram service. The Austrian organization 'None of Your Business' (NOYB) had filed a complaint with the DPA on behalf of two individuals. Meta had updated its terms of service shortly before the GDPR came into force. In its new terms of servi ### Francesco Gagliardi: Non-compliance with general data processing principles *Source: Italian Data Protection Authority (Garante), 2026-05-14 — https://overview.legal/posts/353792 — original: https://www.enforcementtracker.com/ETid-3218* The Italian Data Protection Authority (Garante) found Francesco Gagliardi, operating as a sole proprietorship, in violation of Articles 5(1)(a) and 14 of the GDPR and Article 130 of the Italian Data Protection Code for sending unsolicited commercial emails to approximately 2,500 contacts whose personal data he purchased from the Apollo.io platform without verifying the lawfulness of the data source, obtaining valid consent, or providing adequate privacy notices. The Garante rejected the controller's reliance on legitimate interest as a legal basis for direct marketing and cited the absence of transparency regarding the origin and processing of the collected data. ## Recent developments ### New Records Reveal Problems with Medicare’s AI Prior Authorization Experiment *Source: Electronic Frontier Foundation, 2026-09-08 — https://overview.legal/posts/353912 — original: https://www.eff.org/deeplinks/2026/09/new-records-reveal-problems-medicares-ai-prior-authorization-experiment* EFF sued the government back in March for information about the Wasteful and Inappropriate Service Reduction (WISeR) model, a new Medicare program that uses AI to evaluate prior authorization requests for certain medical services. Today, we’re releasing approximately 1,000 pages of records obtained from the Centers for Medicare & Medicaid Services (CMS) through this litigation, including contracts with tech companies, internal status reports and providers’ complaints about the program. The docum ### Nieuw voor mkb: praktische sjablonen om aan de privacyregels te voldoen *Source: Autoriteit Persoonsgegevens, 2026-09-03 — https://overview.legal/posts/353742 — original: https://autoriteitpersoonsgegevens.nl/actueel/nieuw-voor-mkb-praktische-sjablonen-om-aan-de-privacyregels-te-voldoen* De Autoriteit Persoonsgegevens (AP) heeft 2 praktische documenten gepubliceerd speciaal voor het mkb. Het gaat om sjablonen voor een verwerkingsregister en een privacyverklaring. Ondernemers kunnen hiermee makkelijker voldoen aan de privacyregels en zo de persoonsgegevens van hun klanten beter beschermen. Ook helpen de sjablonen ondernemers om meer grip te krijgen op wat zij met persoonsgegevens doen en dit goed uit te leggen aan hun klanten. ### Digital Omnibus - First Legal Analysis *Source: noyb - European Center for Digital Rights, 2025-11-22 — https://overview.legal/posts/49181 — original: https://noyb.eu/en/digital-omnibus-first-legal-analysis* GDPR Policy This week the "Digital Omnibus" came out. noyb is right now working on an in-dept written analysis that we hope to publish the next days. As a preview, we brought together team members that worked on the various aspects of the Omnibus proposal by the European Commission in a video, to go into more details on select topics (the new personal data definition, the new research exemption, limitations on transparency rules and the new rules on access to the terminal equipment). We hope thi ### noyb WIN: Austrian authority forbids unlawful credit scoring by KSV1870 *Source: noyb - European Center for Digital Rights, 2025-09-26 — https://overview.legal/posts/53136 — original: https://noyb.eu/en/noyb-win-austrian-authority-forbids-unlawful-credit-scoring-ksv1870* Credit Scoring noyb has scored a win in its complaint proceedings against the Austrian credit information agency KSV1870 and the energy provider Unsere Wasserkraft. The Austrian Data Protection Authority has found KSV1870's fully automated credit rating – which prevented the complainant from concluding an energy supply contract – to be unlawful. The DSB has also prohibited KSV1870 from carrying out such credit checks in future without the complainant's consent. Last but not least, the authority ### Transparantie-eisen AI gelden vanaf 2 augustus: AP adviseert praktijkcode te ondertekenen *Source: Autoriteit Persoonsgegevens, 2026-07-09 — https://overview.legal/posts/83468 — original: https://autoriteitpersoonsgegevens.nl/actueel/transparantie-eisen-ai-gelden-vanaf-2-augustus-ap-adviseert-praktijkcode-te-ondertekenen* Vanaf 2 augustus 2026 zijn aanbieders en gebruikers van AI-systemen verplicht duidelijk te maken wanneer mensen met artificiële intelligentie (AI) te maken hebben. De Europese Commissie heeft op 10 juni een praktijkcode gepubliceerd waarin een deel van deze transparantieverplichtingen verder is uitgewerkt. De Autoriteit Persoonsgegevens (AP) adviseert organisaties die onder deze verplichtingen vallen zich te verdiepen in de praktijkcode en (onderdelen ervan) te ondertekenen. Organisaties die voo ## Literature ### Transparency Discourse on Digital Platforms: A Comparative Textual Analysis of Platform Reports and Regulatory Texts in the EU and Türkiye *Source: Lectio Socialis, 2026-07-16 — https://overview.legal/posts/132111 — original: https://doi.org/10.47478/lectio.1921434* This study examines transparency reporting in digital platform governance through a comparative analysis of platform reports, the European Union’s Digital Services Act (DSA), and Türkiye’s Law No. 7253. Drawing on surveillance capitalism, disciplinary power, and critical platform studies, the research employs systematic qualitative content analysis using MAXQDA software. The analysis covers 65 transparency reports and two regulatory texts published by Meta, X (formerly Twitter), YouTube, and Tik ### Do algorithms rule the world? Algorithmic decision-making and data protection in the framework of the GDPR and beyond *Source: International Journal of Law and Information Technology, 2019-01-01 — https://overview.legal/posts/132624 — original: https://doi.org/10.1093/ijlit/eay017* The purpose of this article is to analyse the rules of the General Data Protection Regulation (GDPR) and the Directive on Data Protection in Criminal Matters on automated decision-making and to explore how to ensure transparency of such decisions, in particular those taken with the help of algorithms. Both legal acts impose limitations on automated individual decision-making, including profiling. While these limitations of automated decisions might come across as a forceful fortress strongly protecting individuals and potentially even hampering the future development of Artificial Intelligence in decision-making, the relevant provisions nevertheless contain numerous exceptions allowing for such decisions. While the Directive on Data Protection in Criminal Matters worryingly does not seem to give the data subject the possibility to familiarize herself with the reasons for such a decision, the GDPR obliges the controller to provide the data subject with ‘meaningful information about the logic involved’ (Articles 13(2)(f), 14(2)(g) and 15(1)(h)), thus raising the much-debated question whether the data subject should be granted a ‘right to explanation’ of the automated decision. This article seeks to go beyond the semantic question of whether this right should be designated as the ‘right to explanation’ and argues that the GDPR obliges the controller to inform the data subject of the reasons why an automated decision was taken. While such a right would in principle fit well within the broader framework of the GDPR’s quest for a high level of transparency, it also raises several queries: What exactly needs to be revealed to the data subject? How can an algorithm-based decision be explained? The article aims to explore these questions and to identify challenges for further research regarding explainability of automated decisions. ### ARTIFICIAL INTELLIGENCE, DATA PROTECTION AND TRANSPARENCY: A COMPARATIVE STUDY OF GDPR AND CCPA *Source: SSRN Electronic Journal, 2025-01-01 — https://overview.legal/posts/132537 — original: https://doi.org/10.2139/ssrn.5216910* ### Automating the Design and Development of Usable, GDPR-Aware Web Forms *Source: SN Computer Science, 2026-07-14 — https://overview.legal/posts/132119 — original: https://doi.org/10.1007/s42979-026-05219-7* Abstract Personal data collection in web applications should follow mandated legislative frameworks such as the EU General Data Protection Regulation (GDPR) principles. Among others, web data collection forms should provide clear and transparent explanations regarding the purposes of the collection. At the same time, for users’ ease, such forms should follow standard usability principles. There have been works studying the merging of usability principles and privacy standards. Building on this l ### Perspectives for Open Source AI *Source: i-lex, 2026-07-07 — https://overview.legal/posts/83512 — original: https://doi.org/10.60923/issn.1825-1927/23382* The world’s first most comprehensive law regulating artificial intelligence, the EU Artificial Intelligence Act, has been enacted in June 2024 and entered into force in August 2024. The AI Act aims to provide transparency and ensure safe use of AI systems by introducing obligations and requirements for developers and deployers based on the risk posed by AI systems. Despite the long legislation process that launched in 2020 and multiple negotiations, the final version of the Act includes a number ## Tools ### DSA Transparency Database (statements of reasons) *Source: European Commission, 2026-07-17 — https://overview.legal/posts/125631 — original: https://transparency.dsa.ec.europa.eu/* The European Commission's database of statements of reasons that online platforms must submit under Article 17 DSA for every content moderation decision — searchable and downloadable, with dashboards on moderation practices across platforms. ## Related topics - **Personal Data** — https://overview.legal/topics/personal-data Information relating to identified or identifiable natural persons - **Processing** — https://overview.legal/topics/processing Any operation performed on personal data - **Controllers** — https://overview.legal/topics/controllers Entities that determine purposes and means of processing - **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities National data protection authorities and their powers - **Supervision** — https://overview.legal/topics/supervision Oversight and enforcement by supervisory authorities - **Consent** — https://overview.legal/topics/consent Freely given, specific, informed indication of data subject wishes --- Generated by overview.legal · https://overview.legal/topics/transparency · 2026-10-13