Denmark
The Danish DPA reprimanded a fashion brand because its lack of sufficient technical and organisational measures allowed hackers to gain access to the customers' payment information. Read more or edit on GDPRhub...
Written with the support of lou_schda
Germany
The Regional Court of Itzehoe (LG Itzehoe) held that the data subject had to accept images of his property being shown on Google Maps and Google Earth because Google had a legitimate interest under Article 6(1)(f) GDPR. Read more or edit on GDPRhub...
Written with the support of Marieta Gencheva, LL.M.
The Regional Labour Court of Schleswig-Holstein (LAG Schleswig-Holstein) ordered the controller to pay €2,000 in non-material damages for publishing a promotional video featuring the data subject without their informed, written consent. Read more or edit on GDPRhub...
Written with the support of pau_see
Italy
The Italian DPA issued warnings to three media outlets for unlawfully publishing the personal data of a data subject in news articles while he was in police detention. The DPA also prohibited further processing of the personal data. Read more or edit on GDPRhub...
Written with the support of Samuel Uzoigwe
The Italian DPA also fined a municipality €3,000 for publishing the names of an excluded candidate of a competition procedure on its website without a legal basis and for rejecting the candidate's request for erasure. Read more or edit on GDPRhub...
Written with the support of Carloc
Netherlands
The District Court of Limburg held that a data subject's right of access does not include each individual instance of personal data processing. An overview of the specific processing operations can be sufficient. It is also not necessary to include details regarding the investigation that was done to create this overview. Read more or edit on GDPRhub...
Written with the support of Giel Ritzen
The District Court of Zeeland-West-Braband held that the unlawful processing of a taxpayer's personal data did not affect the legality of the Dutch Tax Authority's decision to audit his tax returns for other reasons. Read more or edit on GDPRhub...
Written with the support of Giel Ritzen
Norway
The Norwegian Privacy Appeals Board agreed that an acquiring company assumes the prior controller's responsibility and upheld the DPA's decision to fine them about €12,000 for an unlawful credit rating in violation of Article 6(1) GDPR. Read more or edit on GDPRhub...
Written with the support of Rie Aleksandra Walle
Spain
The Spanish DPA ordered a bank to answer a customer's request to access personal financial documents, reversing its previous assessment that the GDPR's right of access did not apply to the data under the principle of lex specialis. Read more or edit on GDPRhub...
Written with the support of sofi.gk
In another decision, the Spanish DPA declined to sanction a local pub for failing to post signage warning of video surveillance. The pub's signs had been stolen and replaced at least three times, including once on the same day the complaint was filed. Read more or edit on GDPRhub...