The Austrian Data Protection Authority has ordered a Swiss online hotel booking platform to comply with the requirements set forth in the EU General Data Protection Regulation (GDPR), in particular to provide the information according to Art. 13 GDPR to the data subject. The ordinance was based on the following facts: An Austrian citizen living […]
pb-international
Digital marketing as a legitimate interest? Dutch DPA clarifies.
On the first of November the Dutch DPA (Autoriteit Persoonsgegevens) has tried to shed some more light on the subject of the legitimate interest as a lawful ground of processing. Besides reconfirming the common understanding and best practices, the Dutch DPA clarifies the legal basis for direct marketing if and to the extent, that the […]
New Rules for the Protection of Whistleblowers
You’ll find a german version here. The Council of Europe announced through a press release on the 7th of October 2019 that it had formally adopted new rules for the protection of whistle-blowers. With the adoption of the “Whistle-blower Directive” across the EU, European private and public organisations have an obligation to make available safe […]
La Agencia Española de Protección de Datos (AEPD) multa a VUELING con 30.000 euros
La AEPD ha multado a VUELING AIRLINES S.L. con 30.000 euros[1] por no haber obtenido el consentimiento adecuado para el uso de cookies en su página web. Con el fin de proporcionar a los interesados la información requerida a efectos de transparencia de conformidad con el artículo 13 del RGPD, la empresa proporciono la información […]
The Spanish DPA fines VUELING with 30.000 EURO
The Spanish data protection authority fined VUELING AIRLINES S.L. with 30.000 Euro[1] for failing to collect appropriate consent for the use of cookies on their website. In order to provide data subjects with the required information for transparency purposes under article 13 GDPR, the company implemented a 2-layer approach: In the first layer, the wording […]
How Will the German Data Protection Authorities Determine Fines For Companies? – The DSK Publishes a New Concept.
On October 14, 2019, the German Conference of Data Protection Authorities (DSK) published a concept for determining fines in accordance with the GDPR. In some regards, this concept resembles the model of the Berlin Data Protection Authority which was presented in June of this year (we reported in German), but some aspects remain less concrete. […]
News on data protection law
Dear Readers, This is to update you on the latest news and developments in matters of data protection law. If you would like to be provided with more details, you may contact us via the commentary function. We will also link to our blog posts if we have already reported on this topic. What has […]
Hellenic DPA fines for violations of data protection by design and default
The Hellenic Data Protection Authority (“Authority”) issued two decisions on 7 October 2019 based on which it imposed two administrative fines amounting to 200,000 euros each to the Hellenic Telecommunications Provider, “OTE”. According to the decisions, the following violations were identified: breach of the principle of accuracy (Art. 5 (1) c GDPR) and data protection […]
Gläserne Bevölkerung – News vom anderen Ende der Welt
Datenschutz begegnet einem mittlerweile überall, auch am anderen Ende der Welt. So las ich am 16. September während meines Urlaubs in Ecuador, Südamerika, folgende Überschrift auf der Titelseite der nationalen Zeitung: „ Filtración de datos sensibles de millones de ecuatorianos“. Das Zeitungsblatt berichtete über eine massive Datenpanne, bei der zahlreiche vertrauliche personenbezogene Daten von Millionen […]
Türkische Datenschutzaufsichtsbehörde verlängert die Registrierungspflicht in VERBIS für Verantwortliche bis zum 31.12.2019
Die intensiven Wirtschaftsbeziehungen zwischen Deutschland und der Türkei führen dazu, dass viele deutsche Unternehmen Niederlassungen in der Türkei haben. Diese Unternehmen, die ihren Sitz in der Türkei haben, aber auch die, die ihren Sitz im Ausland haben und in der Türkei Daten verarbeiten, stehen vor der Herausforderung, den Datenschutz nach türkischem Recht anzuwenden bzw. umzusetzen. […]
Hellenic DPA Fines PWC for Unlawful Processing of Employee Data
The Hellenic Data Protection Authority has fined PriceWaterhouseCoopers Business Solutions SA 150,000.00 € for unlawful processing of employee data, after the Authority had conducted an ex officio investigation in response to a complaint. The Authority also ordered a series of corrective measures and gave PWC three months’ time for their implementation. Reportedly, the company had […]
La Agencia Española de Protección de Datos multa a “La Liga” con 250.000 Euros
La Asociación Española de Clubes de Fútbol, “La Liga” ha sido la primera organización en recibir una multa ejemplar por incumplimiento del Reglamento General de Protección de Datos (RGPD) en España. La aplicación móvil sujeto de la denuncia y posterior multa, utilizaba el micrófono de los usuarios y su localización por GPS con el fin […]
The Spanish Data Protection Agency fined „La Liga“ with 250,000 Euros
The Spanish Association of Football Clubs, „La Liga“ has been the first organization to receive an exemplary fine for non-compliance with the General Data Protection Regulation (GDPR) in Spain. The mobile application, subject to the complaint and subsequent fine, used the users‘ microphones and their GPS location in order to capture illegal transmissions of football […]
Annual Report of the Finish Data Protection Authority
The Finnish data protection authority (the Office of the Data Protection Ombudsman) has recently published its annual reports on May 17th 2019.[1] This short article summarizes the most interesting fact regarding the English summary report. Major Focus Points of the Finnish Data Protection Authority The authority plans to focus until 2020 on the data subject’s […]
GUIDELINES ON THE PROCESSING OF PERSONAL DATA UNDER ARTICLE 6(1) (B) GDPR: EDPB BEGINS PUBLIC CONSULTATION
As anticipated under the provision of Article 70(4) of the GDPR, the European Data Protection Board (EDPB), on the 12th April 2019 began a public consultation on the Guidelines 2/2019 on the processing of personal data under Article 6(1) (b) GDPR in the context of the provision of online services to data subjects (the Guidelines), with the […]