Resources

Standard contractual clauses for EU-EEA by EU

Standard Contractual Clauses (SCC)

Standard contractual clauses for international transfers by EU

Data Transfers, Standard Contractual Clauses (SCC)

Proof of concept Blockchain and the right to erasure by AEPD

Right to Erasure

Decision by German Federal Court of Justice (BGH) on case against Facebook for data scraping incident (german)

Civil Liability and Damages, Data scraping, Liability and Remedies

Mobile Applications recommendations for better privacy protection by CNIL (french)

Product Privacy Design

Polish National Personal Data Protection Office (UODO)-Committee (4/24/2024)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Austrian Data Protection Authority (dsb)-Website operator (1/4/2024)

Administratives Measures, Data Subjects Rights, Liability and Remedies, Right to Erasure

Italian Data Protection Authority (Garante)-Enel Energia SpA (2/8/2024)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Hellenic Data Protection Authority (HDPA)-Greek Ministry of Immigration and Asylum (4/2/2024)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Privacy by Design

Spanish Data Protection Authority (aepd)-Open Bank, S.A. (7/28/2023)

Data Subjects Rights, Principles, Privacy by Design

Polish National Personal Data Protection Office (UODO)-Disciplinary officer (4/20/2023)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Italian Data Protection Authority (Garante)-Azienda socio sanitaria territoriale nord Milano, C.F. (12/7/2023)

Lawfulness of Processing, Principles, Privacy by Design, Sensitive Data

Polish National Personal Data Protection Office (UODO)-Polish Minister of Health (12/20/2023)

Data Subjects Rights, Principles, Privacy by Design

Norwegian Supervisory Authority (Datatilsynet)-Norwegian Labor and Welfare Administration (11/27/2023)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Polish National Personal Data Protection Office (UODO)-Company (7/18/2023)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Spanish Data Protection Authority (aepd)-BANCO BILBAO VIZCAYA ARGENTARIA, S.A. (10/20/2023)

Data Subjects Rights, Principles, Privacy by Design

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Uipath SRL (8/21/2023)

Data Subjects Rights, Principles, Privacy by Design

Polish National Personal Data Protection Office (UODO)-Company (5/31/2023)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Hellenic Data Protection Authority (HDPA)-Piraeus Bank (6/12/2023)

Lawfulness of Processing, Principles, Privacy by Design, Representative

Polish National Personal Data Protection Office (UODO)-Municipality (5/16/2023)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Polish National Personal Data Protection Office (UODO)-Municipality (5/5/2023)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Italian Data Protection Authority (Garante)-Sorgenia S.p.a. (4/14/2023)

Accountability, Principles, Privacy by Design

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-AUTOMOBILE BAVARIA SRL (5/18/2023)

Controllers and Processors, Principles, Privacy by Design, Sensitive Data, Technical and Organisational Measures (TOMs)

Croatian Data Protection Authority (azop)-Sports betting operator (5/18/2023)

Consent, Lawfulness of Processing, Principles, Privacy by Design

Polish National Personal Data Protection Office (UODO)-Company (2/8/2023)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Polish National Personal Data Protection Office (UODO)-Szczecin-Centrum District Court (1/19/2023)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Data Protection Authority of Ireland-Meta Platforms Ireland Limited (11/25/2022)

Privacy by Design

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-OTP LEASING ROMANIA IFN SA (11/25/2022)

Data Subjects Rights, Principles, Privacy by Design

Italian Data Protection Authority (Garante)-Azienda Usl Valle d’Aosta (11/10/2022)

Lawfulness of Processing, Principles, Privacy by Design, Sensitive Data

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Casa Rusu S.R.L. (12/9/2022)

Data Subjects Rights, Principles, Privacy by Design

Polish National Personal Data Protection Office (UODO)-Mayor (11/2/2022)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Raiffeisen Bank SA (11/16/2022)

Data Subjects Rights, Principles, Privacy by Design

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Banca Comercială Română SA (9/19/2022)

Data Subjects Rights, Principles, Privacy by Design

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Bitfactor SRL (9/22/2022)

Data Subjects Rights, Principles, Privacy by Design

Data Protection Authority of Niedersachsen-Company (7/13/1905)

Data Subjects Rights, Principles, Privacy by Design

Croatian Data Protection Authority (azop)-Telecommunications company (7/21/2022)

Data Subjects Rights, Principles, Privacy by Design

Italian Data Protection Authority (Garante)-Azienda sanitaria universitaria Friuli Centrale (5/26/2022)

Lawfulness of Processing, Principles, Privacy by Design, Sensitive Data

Italian Data Protection Authority (Garante)-Azienda sanitaria universitaria Friuli Occidentale (5/26/2022)

Lawfulness of Processing, Principles, Privacy by Design, Sensitive Data

Polish National Personal Data Protection Office (UODO)-Fortum Marketing and Sales Polska S.A. (1/19/2022)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Integrity and confidentiality, Principles, Privacy by Design

Deputy Data Protection Ombudsman-Travel agency (12/16/2021)

Controllers and Processors, Data Subjects Rights, Integrity and confidentiality, Principles, Privacy by Design, Technical and Organisational Measures (TOMs)

Polish National Personal Data Protection Office (UODO)-Warsaw University of Technology (12/9/2021)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

French Data Protection Authority (CNIL)-FREE MOBILE (12/28/2021)

Data Subjects Rights, Principles, Privacy by Design, Right to Object

Spanish Data Protection Authority (aepd)-ASOCIACIÓN ESPAÑOLA PARA LA ENSEÑANZA ONLINE (11/30/2021)

Data Subjects Rights, Right to Erasure

Spanish Data Protection Authority (aepd)-ASOCIACIÓN ESPAÑOLA PARA LA ENSEÑANZA ONLINE (11/30/2021)

Data Subjects Rights, Right to Erasure

Italian Data Protection Authority (Garante)-La Prima S.r.l. (9/16/2021)

Controllers and Processors, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Italian Data Protection Authority (Garante)-Roma Capitale (7/22/2021)

Data Subjects Rights, Principles, Privacy by Design

Spanish Data Protection Authority (aepd)-UNIVERSIDAD A DISTANCIA DE MADRID, S.A. (7/29/2021)

Data Subjects Rights, Right to Erasure

Hellenic Data Protection Authority (HDPA)-KARIERA A.E. (5/12/2021)

Access Requests (DSAR), Data Subjects Rights, Principles, Privacy by Design

Italian Data Protection Authority (Garante)-Fondazione Policlinico Tor Vergata di Roma (4/21/2021)

Data Subjects Rights, Lawfulness of Processing, Principles, Privacy by Design, Sensitive Data

Data Protection Authority of Ireland-Irish Credit Bureau DAC (3/23/2021)

Accountability, Data Subjects Rights, Principles, Privacy by Design

Spanish Data Protection Authority (aepd)-Pagamastarde S.L. (4/27/2021)

Data Subjects Rights, Right to Erasure

Italian Data Protection Authority (Garante)-Istituto Nazionale Previdenza Sociale (INPS) (2/25/2021)

Lawfulness of Processing, Principles, Privacy by Design, Sensitive Data

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Robinson Tours Ltd. (Robinson Tours Idegenforgalmi és Szolgáltató Kft.) (12/16/2020)

Controllers and Processors, Data Breaches, Lawfulness of Processing, Performance of Contract, Principles, Privacy by Design

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Deichmann Cipőkereskedelmi Korlátolt Felelősségű Társaságnak (10/23/2020)

Data Subjects Rights, Principles, Privacy by Design

Data Protection Commision of Bulgaria (KZLD)-T.K. EOOD (2/20/2020)

Data Subjects Rights, Principles, Privacy by Design

Data Protection Commision of Bulgaria (KZLD)-L.E. EOOD (2/20/2020)

Data Subjects Rights, Lawfulness of Processing, Principles, Privacy by Design

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-UNICREDIT BANK SA (6/27/2019)

Controllers and Processors, Principles, Privacy by Design, Representative

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Unnamed financial institution (3/4/2019)

Controllers and Processors, Data Subjects Rights, Principles, Purpose limitation, Representative, Right to Erasure

Opinion 04/2024 on the notion of main establishment of a controller in the Union under Article 4(16)(a) GDPR |EPDB

Definitions, Main Establishment

National Strategy to Advance Privacy-Preserving Data Sharing and Analytics by the EO by the US President

Anonymisation, Controllers and Processors, Technical and Organisational Measures (TOMs)

THE NEW STANDARD CONTRACTUAL CLAUSES – QUESTIONS AND ANSWERS

Data Transfers, Standard Contractual Clauses (SCC)

PRESS RELEASE No 20/24 | Case C-118-22

Data Subjects Rights, Right to Erasure

Case C 683-2021

Data Controller, Data Processors, Joint Controllers

Guidelines for evaluating differential priavacy gurantees by NIST

Anonymisation, Controllers and Processors, Technical and Organisational Measures (TOMs)

Exceeding customer expectations by Google

Principles, Privacy by Design

Practice Guide to Anonymising Personal Data

Anonymisation, Controllers and Processors

C-460/20

Data Subjects Rights, Right to Erasure, Search Engines, Specific processing situations

One-Stop-Shop thematic case digest: RIGHT TO OBJECTAND RIGHT TO ERASURE

Data Subjects Rights, Right to Erasure, Right to Object

C-272/19

Access Requests (DSAR), Data Controller, Data Subjects Rights, Definitions

C-507/17

Data Subjects Rights, Right to Erasure, Territorial Scope

C-136/17

Data Subjects Rights, Principles, Right to Erasure, Search Engines, Sensitive Data, Specific processing situations

C-129/21

Consent, Data Subjects Rights, Lawfulness of Processing, Right to Erasure

Case C‑461/22 CURIA

Data Controller, Definitions

Guideline on the massive collection of personal data from the web for the training of generative artificial intelligence (GenAI) models by the Italian Data Protection Authority (Garante)

AI, Data scraping, Specific processing situations

Opinion 18/2021 on the draft Standard Contractual Clauses submitted by the LT SA (Article 28(8) GDPR) |EDPB

Controllers and Processors, Data Transfers, Standard Contractual Clauses (SCC)

Opinion 39/2021 on whether Article 58(2)(g) GDPR could serve as a legal basis for a supervisory authority to order ex officio the erasure of personal data, in a situation where such request was not submitted by the data subject |EPDB

Data Controller, Data Subjects Rights, Definitions

Practice Guide to Anonymising Personal Data by Stiftung Dateschutz

Anonymisation

Fashion ID, 29 July 2019, C-40/17, ECLI:EU:C:2019:629

Data Controller, Data Processors

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH, in the presence of Facebook Ireland Ltd (Case C-210/16).

Data Controller

GUIDE TO BASIC ANONYMISATION | PDPC Singapore

Anonymisation

Guidance on Anonymisation and Pseudonymisation | Irish DPC

Anonymisation

Opinion 05/2014 on Anonymisation Techniques | WP216

Anonymisation

Weltimmo s.r.o. v. Nemzeti Adatvédelmi és Információszabadság Hatóság [2015] Case C-230/14, 1 October 2015

Main Establishment

UK MRC Identifiability, anonymisation and pseudonymisation

Anonymisation

Joint Guide to ASEAN MCC and EU SCC

Data Transfers, Standard Contractual Clauses (SCC)

Guidelines 07/2020 on the concepts of controller and processor in the GDPR

Data Controller, Data Processors, Definitions

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default

Privacy by Design

Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR

Right to Erasure

Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them

Privacy by Design

Privacy, seriously by the UK ICO

AI, Privacy by Design, Product Privacy Design

Anonymisation: managing data protection risk code of practice | UK ICO

Anonymisation

Spanish AEPD: 10 MISUNDERSTANDINGS RELATED TO ANONYMISATION

Anonymisation