News

Facts |EU_Law_Link_2=|EU_Law_Link_2= |National_Law_Name_1=f|National_Law_Name_1=Article 19(2) Constitution of the Slovak Republic |National_Law_Link_1=|National_Law_Link_1=https://www.prezident.sk/upload-files/46422.pdf |National_Law_Name_2=|National_Law_Name_2=Article 29(1) Constitution of the Slovak Republic |National_Law_Link_2=|National_Law_Link_2=https://www.prezident.sk/upload-files/46422.pdf |National_Law_Name_3=|National_Law_Name_3=Article 8 European Convention on Human Rights |National_

Created page with "{{DPAdecisionBOX |Jurisdiction=Finland |DPA-BG-Color= |DPAlogo=LogoFI.png |DPA_Abbrevation=Tietosuojavaltuutetun toimisto |DPA_With_Country=Tietosuojavaltuutetun toimisto (Finland) |Case_Number_Name=TSV/112/2022 (9079/152/22) |ECLI= |Original_Source_Name_1=Finlex |Original_Source_Link_1=https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2025/2487#OT0_OT0 |Original_Source_Language_1=Finnish |Original_Source_Language__Code_1=FI |Original_Source_Name_2= |Origina..." New

Corrected and added some links, removed duplicate in short summary. }}}} An DPA denied a complaint against a public body under Articles 9 and 77 GDPR, holding that publication of a data subject’s political donation did not violate the GDPR because the controller had a lawful basis.An DPA denied a complaint against a public body under [[Article 9 GDPR|Articles 9]] and [[Article 77 GDPR|77 GDPR]], holding that publication of a data subject’s political donation did not violate them because the cont

Created page with "{{COURTdecisionBOX |Jurisdiction=Slovakia |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=ÚS SR |Court_Original_Name=Ústavný súd Slovenskej republiky |Court_English_Name=Constitutional Court of the Slovak Republic |Court_With_Country=ÚS SR (Slovakia) |Case_Number_Name=PL. ÚS 11/2025-116 |ECLI= |Original_Source_Name_1=ÚS SR |Original_Source_Link_1=https://www.ustavnysud.sk/en/rozhodnutia |Original_Source_Language_1=Slovak |Original_Source_Languag..." New page{{C

Created page with "{{DPAdecisionBOX |Jurisdiction=Austria |DPA-BG-Color= |DPAlogo=LogoAT.png |DPA_Abbrevation=DSB |DPA_With_Country=DSB (Austria) |Case_Number_Name=2024-0.199.724 |ECLI=ECLI:AT:DSB:2024:2024.0.199.724 |Original_Source_Name_1=RIS |Original_Source_Link_1=https://www.ris.bka.gv.at/Dokument.wxe?Abfrage=Dsk&Entscheidungsart=Undefined&Organ=Undefined&SucheNachRechtssatz=True&SucheNachText=True&GZ=&VonDatum=01.01.1990&BisDatum=&Norm=&ImRisSeitVonDatum

Created page with "{{COURTdecisionBOX |Jurisdiction=Germany |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=LG Hildesheim |Court_Original_Name=Landgericht Hildesheim |Court_English_Name=Regional Court Hildesheim |Court_With_Country=LG Hildesheim (Germany) |Case_Number_Name=3 O 26/24 |ECLI= |Original_Source_Name_1=VORIS |Original_Source_Link_1=https://voris.wolterskluwer-online.de/browse/document/3127a423-2bba-4db6-a6e8-001e4189e040 |Original_Source_Language_1=German |Ori..." New

Created page with "{{DPAdecisionBOX |Jurisdiction=Estonia |DPA-BG-Color= |DPAlogo=LogoEE.png |DPA_Abbrevation=AKI |DPA_With_Country=AKI (Estonia) |Case_Number_Name=2.1.-4/25/1239-2660-6 |ECLI= |Original_Source_Name_1=AKI |Original_Source_Link_1=https://www.aki.ee/sites/default/files/documents/2026-01/Ettekirjutus-hoiatus%20isikuandmete%20kaitse%20asjas%20nr%202.1.-4%2025%201239-2660-6%20Zu%20Disain%20O%C3%9C.pdf |Original_Source_Language_1=Estonian |Original_Source_Language__Code_1=ET |..." New

|Appeal_From_Case_Number_Name=16.07.2025|Appeal_From_Case_Number_Name=16.07.2025 |Appeal_From_Status=|Appeal_From_Status= |Appeal_From_Link=https://www.dataprotection.ro/?page=Comunicat_Presa_16.07.2025|Appeal_From_Link=https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_a_Romanian_politician |Appeal_To_Body=|Appeal_To_Body= |Appeal_To_Case_Number_Name=|Appeal_To_Case_Number_Name= A politician, the operator of a website (the controller), appealed a DPA decision sanctioning him fo

Created page with "{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=EXP202410843 |ECLI= |Original_Source_Name_1=AEPD |Original_Source_Link_1=https://www.aepd.es/documento/ps-00476-2024.pdf |Original_Source_Language_1=Spanish |Original_Source_Language__Code_1=ES |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code..." Show

Created page with "{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=EXP202408793 |ECLI= |Original_Source_Name_1=AEPD |Original_Source_Link_1=https://www.aepd.es/documento/ps-00279-2024.pdf |Original_Source_Language_1=Spanish |Original_Source_Language__Code_1=ES |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code..." Show

Created page with "{{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color=background-color:#095d7e; |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=10213894 |ECLI= |Original_Source_Name_1=Garante per la protezione dei dati personali |Original_Source_Link_1=https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10213894 |Original_Source_Language_1=I..." New p

Fixeed category after visual edit <references /><references /> [[index.php?title=Category:GDPR Articles]][[Category:GDPR Articles]]

The controller claimed it relied on the soft opt-in in Regulation 22(3) of the Privacy and Electronic Communications Regulations 2003 (PECR), where an organisation may send direct marketing communications to its customers even if they did not specifically consent to electronic mail. However, only the organisation that collected the contact details can rely on the soft opt-in rule. The controller claimed it relied on the soft opt-in in Regulation 22(3) of the Privacy and Electronic Communications

Fixed CJEU quote While the CJEU has yet to rule on the interaction between Article 31 GDPR and the right against self-incrimination, similar lines of reasoning were taken by the Court in relation to the duty to cooperate in the context of competition law.<ref>''Kotschy,'' in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 31 GDPR, p. 628 (Oxford University Press 2020).</ref> The leading case in this regard, ''Orkem,'' es

Created page with "{{DPAdecisionBOX |Jurisdiction=United Kingdom |DPA-BG-Color=background-color:#023868; |DPAlogo=LogoUK.png |DPA_Abbrevation=ICO |DPA_With_Country=ICO (UK) |Case_Number_Name=Allay Claims Ltd |ECLI= |Original_Source_Name_1=ICO |Original_Source_Link_1=https://ico.org.uk/media2/mrwhxwoe/monetary-penalty-notice-allay-claims-ltd.pdf |Original_Source_Language_1=Estonian |Original_Source_Language__Code_1=ET |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Lan..." New

Created page with "{{COURTdecisionBOX |Jurisdiction=Romania |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=TI |Court_Original_Name=Tribunalul Ilfov |Court_English_Name=Ilfov Tribunal |Court_With_Country=TI (Romania) |Case_Number_Name=9/2026 |ECLI= |Original_Source_Name_1=Rejust |Original_Source_Link_1=https://www.rejust.ro/juris/84284d3g4 |Original_Source_Language_1=Romanian |Original_Source_Language__Code_1=RO |Original_Source_Name_2= |Original_Source_Link_2= |Original..." Show

Created page with "{{DPAdecisionBOX |Jurisdiction=Belgium |DPA-BG-Color= |DPAlogo=LogoBE.png |DPA_Abbrevation=APD/GBA |DPA_With_Country=APD/GBA (Belgium) |Case_Number_Name=28/2026 |ECLI= |Original_Source_Name_1=APD |Original_Source_Link_1=https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-28-2026.pdf |Original_Source_Language_1=French |Original_Source_Language__Code_1=FR |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Lan..." New

Created page with "{{DPAdecisionBOX |Jurisdiction=Romania |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoRO.jpg |DPA_Abbrevation=ANSPDCP |DPA_With_Country=ANSPDCP (Romania) |Case_Number_Name=03.02.2026 |ECLI= |Original_Source_Name_1=ANSPDCP |Original_Source_Link_1=https://www.dataprotection.ro/?page=Comunicat_Presa_03_02_2026&lang=ro |Original_Source_Language_1=Romanian |Original_Source_Language__Code_1=RO |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language..."

Facts }}}} The AEPD fined a right-wing political party €500 for publishing a proof of delivery on Facebook that showed a person’s name, ID number and signature without a legal basis under [[Article 6 GDPR]].The AEPD fined a political party €500 for publishing a document on Facebook that showed a person’s name, ID number and signature without a legal basis under [[Article 6 GDPR]]. == English Summary ==== English Summary ==

Created page with "{{COURTdecisionBOX |Jurisdiction=European Union |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=ECtHR |Court_Original_Name=European Court of Human Rights |Court_English_Name=European Court of Human Rights |Court_With_Country=ECtHR (European Union) |Case_Number_Name=GREEN ALLIANCE v. BULGARIA - 6580/22 |ECLI= |Original_Source_Name_1=Bailii |Original_Source_Link_1=https://www.bailii.org/cgi-bin/format.cgi?doc=/eu/cases/ECHR/2026/30.html&query=(GDPR)#_Toc..."

Facts }}}} The Supreme Court upheld rules requiring legal counsels to keep a client register and ensure confidentiality. It held that processing client data to check conflicts of interest is lawful under [[Article 6 GDPR#1c|Article 6(1)(c) GDPR]] as it fulfills a statutory duty.The Supreme Court upheld rules requiring legal counsels to keep a client register and to ensure confidentiality. It held that keeping a client register is necessary to comply with the legal obligation to check for potenti

(a) No consensus on relevant and reasoned objections On 9 November 2020, the EDPB adopted its first decision under the dispute resolution mechanism laid down by Article 65 GDPR.<ref>EDPB, 9 November 2020, Twitter International Company, Decision 01/2020 (available [https://edpb.europa.eu/sites/default/files/files/file1/edpb_bindingdecision01_2020_en.pdf here]).</ref> The binding decision seeks to address the dispute which arose following a draft decision issued by the Irish SA as LSA

English Summary }}}} A court awarded €3,000 to a data subject after finding a news portal violated her privacy under [[Article 5 GDPR]] by publishing her personal data unnecessarily and disproportionately, despite claims of public interest.A court awarded €3,000 in damages to a data subject after finding that a news portal violated her right to privacy by publishing her personal data unnecessarily and disproportionately in two articles, despite the controller’s claims of public interest. == Engl

Contact details: typo The controller's contact details are necessary for the data subjects to get in touch with the controller and to further exercise their rights under the GDPR. The contact details must enable data subjects to easily contact the controller and should include different forms of communications.The controller's contact details are necessary for the data subjects to get in touch with the controller and to further exercise their rights under the GDPR. The contact details

Facts The first article reported on payments related to the football club Dinamo Zagreb and included the data subject’s full name, bank account number, and payment amounts. The second article referred to the first article via a hyperlink but did not mention the data subject directly.The first article reported on payments related to the football club Dinamo Zagreb and included the data subject’s full name, bank account number, and payment amounts. The second article referred to the first article

}}}} The DPA partially upheld a complaint and issued a reprimand against a travel company for unlawful direct marketing, excessive passport copy collection, inaccuracies in travel documents, lack of transparency, and an incomplete access response.The DPA partially upheld a complaint and issued a reprimand against a travel company for unlawful direct marketing, excessive passport copy collection, inaccuracies in travel documents, lack of transparency, and an incomplete response to an access reque

Holding }}}} The court held that the mere automated creation of a score value does not trigger [[Article 22 GDPR|Article 22 GDPR]] unless it directly leads to a legally or similarly significant decision about the data subject.The court held that the mere automated creation of a score value does not trigger [[Article 22 GDPR]] unless it directly leads to a legally or similarly significant decision about the data subject. == English Summary ==== English Summary == The data subject brought multiple

}}}} The DPA ordered a company to erase the data provided by potential tenants after not entering into a lease agreement with them.The DPA ordered a landlord to erase the data provided by potential tenants after not entering into a lease agreement with them. == English Summary ==== English Summary == In 2023 the data subjects intended to enter into a lease agreement with a company (the controller). The controller requested various information from the data subjects, including identity documents,

}}}} A court held that a former employee cannot receive access to their work email correspondence and files based on an access request when the emails and files only contain the employee’s identification information.A court held that a former employee cannot request access to their work email correspondence and other work-related files when the emails and files only contain the employee’s identification information. == English Summary ==== English Summary == Following his dismissal, the data sub

Holding === Holding ====== Holding === The court dismissed the data subject’s appeal in full. The court noticed the parties that it intends to dismiss the data subject’s appeal in full. The court could not produce a declaration of illegality of credit scoring based on automated processing. It reasoned that the mere creation of a score does not constitute a legal decision under Article 22. Also, the rejections faced by the data subject were not exclusively, if at all, based on the credit scoring,

}}}} A court annulled a DPA decision imposing a €150,000 fine on a news programme diffusing personal data of a minister for information purposes. The court concluded that public interest was overriding the right to privacy.A court annulled a DPA’s decision imposing a €150,000 fine on a public broadcaster after airing a private former Minister’s private conversation. The court concluded that public interest in airing the conversation overrode the former Minister’s right to privacy. == English Sum

|Initial_Contributor=lde|Initial_Contributor=lde || }}}}The DPA found that the food delivery company Wolt failed to respond properly and in time to a customer’s access request after their account was blocked. The DPA found that Wolt violated [[Article 12 GDPR|Article 12 GDPR]] by failing to respond properly and in time to a data subject’s access request, thus failing to facilitate the exercise of rights or provide a timely refusal. == English Summary ==== English Summary ==

|Initial_Contributor=lde|Initial_Contributor=lde || }}}}A court held that the DPA insufficiently justified its rejection of a complaint against a cinema that no longer accepted cash payments. According to the court, the DPA failed to assess whether the mandatory card payments pursued a sufficiently concrete and justified purpose under the GDPR. A court held that the DPA insufficiently justified its refusal to act against a cinema that no longer accepted cash payments, failing to demonstrate that

Created page with "{{COURTdecisionBOX |Jurisdiction=Italy |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=Tribunale di Roma |Court_Original_Name=Tribunale di Roma |Court_English_Name=Court of Rome |Court_With_Country=Tribunale di Roma (Italy) |Case_Number_Name=N. R.G. 54031/2025 |ECLI= |Original_Source_Name_1=Il Corriere del Giorno |Original_Source_Link_1=https://www.ilcorrieredelgiorno.it/wp-content/uploads/2026/01/CdG-REPORT_PRIVACY.pdf |Original_Source_Language_1=Ital..." Show

}}}} The court held that the mere automated creation of a score value does not trigger [[Article 22 GDPR]] unless it directly leads to a legally or similarly significant decision about the data subject.A court held that the mere automated creation of a score value by a credit information agency does not trigger [[Article 22 GDPR]] unless it directly leads to a legally or similarly significant decision concerning the the data subject. == English Summary ==== English Summary == === Facts ====== Fa

}}}} The DPA issued a warning to the Federal Public Service for Finances to ensure compliance with security of personal data processing after an employee accessed the address of an individual and visited her at her home.The DPA issued a warning to the Federal Public Service for Finances after an employee unlawfully accessed the address of an individual in the controller’s database and visited her at her home. == English Summary ==== English Summary ==

Created page with "{{COURTdecisionBOX |Jurisdiction=Germany |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=OLG Bamberg |Court_Original_Name=Oberlandesgericht Bamberg |Court_English_Name=Higher Regional Court Bamberg |Court_With_Country=OLG Bamberg (Germany) |Case_Number_Name=10 U 61/25 e |ECLI= |Original_Source_Name_1=REWIS |Original_Source_Link_1=https://rewis.io/urteile/urteil/uaf-21-01-2026-10-u-6125-e/ |Original_Source_Language_1=German |Original_Source_Language__Co..." New

Facts }}}} The AEPD fined a right-wing political party €500 for publishing a proof of delivery on Facebook that showed a person’s name, ID number and signature without a legal basis under [[Article 6 GDPR|Article 6 GDPR]].The AEPD fined a right-wing political party €500 for publishing a proof of delivery on Facebook that showed a person’s name, ID number and signature without a legal basis under [[Article 6 GDPR]]. == English Summary ==== English Summary == VOX had sent a certified letter to a m

Created page with "{{DPAdecisionBOX |Jurisdiction=Lithuania |DPA-BG-Color= |DPAlogo= |DPA_Abbrevation=VDAI |DPA_With_Country=VDAI (Lithuania) |Case_Number_Name=Nr. 3R-219 (2.13-1.E) |ECLI= |Original_Source_Name_1=VDAI |Original_Source_Link_1=https://vdai.lrv.lt/public/canonical/1770722929/1274/2026-02-06%20Sprendimas%20Nr.%203R-219%20(2.13-1.E).pdf |Original_Source_Language_1=Lithuanian |Original_Source_Language__Code_1=LT |Original_Source_Name_2= |Original_Source_Link_2= |Original_Sour..." Show

Created page with "{{COURTdecisionBOX |Jurisdiction=Romania |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=CC |Court_Original_Name=Curtea Constituțională |Court_English_Name=Constitutional Court |Court_With_Country=CC (Romania) |Case_Number_Name=04.02.2026 |ECLI= |Original_Source_Name_1=Constitutional Court |Original_Source_Link_1=https://www.ccr.ro/comunicat-de-presa-iii-4-februarie-2026/ |Original_Source_Language_1=Romanian |Original_Source_Language__Code_1=RO |Orig..." New pa

English Summary The Spanish Data Protection Agency (AEPD) investigated Vodafone España, S.A.U. as controller after a SIM swapping incident.The Spanish Data Protection Agency (AEPD) investigated Vodafone España, S.A.U. as controller after a SIM swapping incident. On 21 September 2021, an unknown third party requested a duplicate SIM card for the mobile line of a data subject. The request was made through Vodafone’s internal telephone support channel for retail stores. The caller impersonated staf

Created page with "{{DPAdecisionBOX |Jurisdiction=Romania |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoRO.jpg |DPA_Abbrevation=ANSPDCP |DPA_With_Country=ANSPDCP (Romania) |Case_Number_Name=04.02.2026 |ECLI= |Original_Source_Name_1=ANSPDCP |Original_Source_Link_1=https://www.dataprotection.ro/?page=Comunicat_Presa_04_02_2026&lang=ro |Original_Source_Language_1=Romanian |Original_Source_Language__Code_1=RO |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language..."

Created page with "{{COURTdecisionBOX |Jurisdiction=Netherlands |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=RVS |Court_Original_Name=Raad van State |Court_English_Name=Council of State |Court_With_Country=RVS (Netherlands) |Case_Number_Name=202203874/1/A3 |ECLI=ECLI:NL:RVS:2026:746 |Original_Source_Name_1=Rechtspraak |Original_Source_Link_1=https://uitspraken.rechtspraak.nl/details?id=ECLI:NL:RVS:2026:746&showbutton=true&keyword=avg&idx=7 |Original_Source_Language

Created page with "{{DPAdecisionBOX |Jurisdiction=Finland |DPA-BG-Color= |DPAlogo=LogoFI.png |DPA_Abbrevation=Tietosuojavaltuutetun toimisto |DPA_With_Country=Tietosuojavaltuutetun toimisto (Finland) |Case_Number_Name=TSV/258/2022 |ECLI= |Original_Source_Name_1=Finlex |Original_Source_Link_1=https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2026/2 |Original_Source_Language_1=Finnish |Original_Source_Language__Code_1=FI |Original_Source_Name_2= |Original_Source_Link_2= |Origina..." New

Created page with "{{COURTdecisionBOX |Jurisdiction=France |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=CA Paris |Court_Original_Name=Cour d'appel de Paris |Court_English_Name=Paris Court of Appeal |Court_With_Country=CA Paris (France) |Case_Number_Name=25/04270 |ECLI= |Original_Source_Name_1=Court de Cassation |Original_Source_Link_1=https://www.courdecassation.fr/decision/69450ecb75782d5f06ade99c |Original_Source_Language_1=French |Original_Source_Language__Code_1=F..."

Created page with "{{DPAdecisionBOX |Jurisdiction=Belgium |DPA-BG-Color= |DPAlogo=LogoBE.png |DPA_Abbrevation=APD/GBA |DPA_With_Country=APD/GBA (Belgium) |Case_Number_Name=25/2026 |ECLI= |Original_Source_Name_1=APD |Original_Source_Link_1=https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-en-berisping-nr.-25-2026.pdf |Original_Source_Language_1=French |Original_Source_Language__Code_1=FR |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2=..." New p

Created page with "{{DPAdecisionBOX |Jurisdiction=Belgium |DPA-BG-Color= |DPAlogo=LogoBE.png |DPA_Abbrevation=APD/GBA |DPA_With_Country=APD/GBA (Belgium) |Case_Number_Name=23/2026 |ECLI= |Original_Source_Name_1=APD |Original_Source_Link_1=https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-23-2026.pdf |Original_Source_Language_1=French |Original_Source_Language__Code_1=FR |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Lan..." New

fixed typo in the decision's date |Outcome=Upheld|Outcome=Upheld |Date_Started=|Date_Started= |Date_Decided=18.12.2035|Date_Decided=18.12.2025 |Date_Published=|Date_Published= |Year=2035|Year=2035

Facts: typo The Local Territorial Agency for Residential Housing (Azienda territoriale per l’edilizia residenziale) submitted a complaint to the DPA regarding the installation of security cameras by the business “Macelleria La Costata s.r.l.s.”, a local butcher . The Local Territorial Agency for Residential Housing (Azienda territoriale per l’edilizia residenziale) submitted a complaint to the DPA regarding the installation of security cameras by the business “Macelleria La Costata s.r.l.s.”, a

Link fixed. === Facts ====== Facts === The data subject had a mobile contract with the controller, a telecommunications company, starting 17 April 2019. The contract included privacy notices stating that personal data, including contract initiation, execution, and completion (“positive data”), could be sent to a credit scoring agency for credit scoring, under Articles 6(1)(b) and 6(1)(f) GDPR.The data subject had a mobile contract with the controller, a telecommunications company, starting 17 Ap