Austria
The Austrian Federal Adminstrative Court reversed another decision by the Austrian DPA because it failed to establish essential facts. The Court ordered the DPA to investigate whether the data subject's neighbor had actually surveilled their property. Read more or edit on GDPRhub...
Denmark
The Danish DPA proposed a €6,700 fine against a municipality for not preventing its employees from manually disabling access codes on their mobile phones that contained citizens' personal data, thereby exposing them to unnecessary risk. The police will investigate the case before a final decision is made in the courts. Read more or edit on GDPRhub...
Written with the support of Rie Aleksandra Walle
Germany
The DPA of Lower Saxony fined Volkswagen €1,100,000 for violating Articles 13, 28, 35 and 30 GDPR by, among others, conducting test-drives of its vehicle with cameras attached without informing the other road users. Read more or edit on GDPRhub...
The Procurement Chamber of Baden-Württemberg held that a company had to be excluded from a public procurement procedure, as its offer violated the GDPR. This is because compliance with data protection law was a requirement of the tender. The Chamber held that the offer contained an unlawful transfer of customer data to a third country (their parent company located in the U.S.), as it could be accessed by the parent company. Read more or edit on GDPRhub...
Written with the support of Eva Lu
The District Court of Pforzheim held that a controller fulfilled an access request under Article 15 GDPR due to its belief that the data provided was complete. Furthermore, it held that insults and harassment make a request abusive in the sense of Article 12(5) GDPR. Read more or edit on GDPRhub...
Greece
The Greek DPA partially revoked its previous decision and recuded the fine from €20,000 to €5,000 on a company that sells sports clothing in light of new evidence revealing that the violation of the right to object was due to an isolated error and not to malicious intent. Read more or edit on GDPRhub...
Netherlands
The Dutch Council of State confirmed the lower court's annulment of the Dutch DPA's decision in the VoetbalTV case. The DPA's decision, which both courts found insufficiently motivated, had received attention because of its strict interpretation of legitimate interest. Read more or edit on GDPRhub...
Written with the support of Eva Lu
The District Court Oost-Brabant held that T-Mobile violated a customer's right to access by failing to provide additional information on the existence of automated decision-making and profiling. Read more or edit on GDPRhub...
Norway
The Norwegian DPA fined a property management company €30,500 for two unlawful credit ratings, in violation of Article 6(1)(f) GDPR, of two people they had no relationship with, but that a linked company had a dispute with. Read more or edit on GDPRhub...
Written with the support of Rie Aleksandra Walle
Spain
The Spanish Supreme Court ruled that the exercise of data protection rights from Articles 15 to 22 GDPR is not a prerequisite for filing a complaint with a data protection authority, so the latter may act even if the data subject has not addressed the data controller beforehand. Read more or edit on GDPRhub...
Written with the support of Carmen Villarroel