Resources

AEPD (Spain) – EXP202315853 against Ibercaja Banco

Lawfulness of Processing, Performance of Contract

Data Broker Sells Voter Data on Support for QAnon and January 6

Data Sharing

Data Sharing Toolkit Tracker

Data Sharing

Records Management Toolkit Tracker

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Data Sharing Toolkit Tracker – more information about the Toolkit by UK ICO

Data Sharing

Records Management Toolkit Tracker – more information about the Toolkit by UK ICO

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Rețele Electrice Muntenia SA. (6/25/2024)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Rețele Electrice Dobrogea SA (6/25/2024)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-IRIDEX GROUP SALUBRIZARE SRL (5/9/2024)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-MEDICOVER SRL (5/9/2024)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-CENTRUL MEDICAL UNIREA SRL (5/8/2024)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-VESTA CEU ROMÂNIA SRL. (2/26/2024)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Veranda Obor S.A. (12/11/2023)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Cez Vânzare S.A. (10/2/2023)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-ING Bank NV Amsterdam Sucursala București (7/18/2023)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Artima S.A. (6/15/2023)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Data Protection Commissioner of Malta-Unknown (7/12/1905)

Lawfulness of Processing, Performance of Contract

Data Protection Commissioner of Malta-Unknown (7/12/1905)

Lawfulness of Processing, Performance of Contract

Data Protection Commissioner of Malta-Unknown (7/12/1905)

Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Tinmar Energy SA (3/14/2023)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Centrul Medical dr. Furtună Dan (3/16/2023)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Med Life S.A. (3/16/2023)

Controllers and Processors, Data Subjects Rights, Lawfulness of Processing, Performance of Contract, Technical and Organisational Measures (TOMs)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Apă Canal Ilfov SA (1/4/2023)

Controllers and Processors, Data Subjects Rights, Lawfulness of Processing, Performance of Contract, Technical and Organisational Measures (TOMs)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-BRISTOL LOGISTICS SA (1/12/2023)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Medicover S.R.L. (11/24/2022)

Controllers and Processors, Data Subjects Rights, Lawfulness of Processing, Performance of Contract, Technical and Organisational Measures (TOMs)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Realmedia Network SA (9/8/2022)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-S.C. Wine Point S.R.L. (6/15/2022)

Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-SC Interactions Marketing SRL (6/20/2022)

Lawfulness of Processing, Performance of Contract

Norwegian Supervisory Authority (Datatilsynet)-Lillestrøm Municipality (2/2/2022)

Controllers and Processors, Lawfulness of Processing, Performance of Contract, Principles, Representative

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Vodafone România SA (11/14/2021)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Spanish Data Protection Authority (aepd)-Creator Energy S.L. (6/4/2021)

Performance of Contract

Norwegian Supervisory Authority (Datatilsynet)-Asker Municipality (3/15/2021)

Controllers and Processors, Lawfulness of Processing, Performance of Contract, Principles, Representative, Technical and Organisational Measures (TOMs)

Norwegian Supervisory Authority (Datatilsynet)-Ålesund Municipality (3/15/2021)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Spanish Data Protection Authority (aepd)-I-DE Redes Eléctricas Inteligentes, S.A.U (3/2/2021)

Performance of Contract, Principles, Purpose limitation, Sensitive Data

Spanish Data Protection Authority (aepd)-Alterna Operador Integral S.L. (1/21/2021)

Performance of Contract

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Robinson Tours Ltd. (Robinson Tours Idegenforgalmi és Szolgáltató Kft.) (12/16/2020)

Controllers and Processors, Data Breaches, Lawfulness of Processing, Performance of Contract, Principles, Privacy by Design

New data protection audit framework launched to help organisations improve compliance by UK ICO

Controllers and Processors, Data Sharing, Data Subjects Rights

Telegram’s New Policy: User Data to Be Shared with Authorities in Criminal Cases

Data Sharing, Data Subjects Rights

LinkedIn Used User Data for AI Training Before Updating Its Terms

AI, Data Sharing, Data Subjects Rights, Lawfulness of Processing

THE NEW STANDARD CONTRACTUAL CLAUSES – QUESTIONS AND ANSWERS

Data Transfers, Standard Contractual Clauses (SCC)

Case C 683-2021

Data Controller, Data Processors, Joint Controllers

Recommendations 1-2022 on the Application for Approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR)

Code of Conduct, Controllers and Processors

C-272/19

Access Requests (DSAR), Data Controller, Data Subjects Rights, Definitions

C-319/20

Representation of data subjects

C-252/21

Lawfulness of Processing, Performance of Contract, Principles, Sensitive Data

Frequently Asked Questions (FAQs) on the Data Act by the EU Commission

Controllers and Processors, Data Sharing

Data protection code of practice for digital identity schemes in Afrtica

Code of Conduct, Controllers and Processors

Meta Platforms Ireland v EDPB (Case T-319/24)

Controllers and Processors, Data Sharing, Data Subjects Rights

Case C‑461/22 CURIA

Data Controller, Definitions

Case 2:24-cv-05140 by the attorney general of California

Consent, Controllers and Processors, Data Sharing, Lawfulness of Processing

Opinion 20/2021 on Tobacco Traceability System |EDPB

Controllers and Processors, Data Sharing

Opinion 18/2021 on the draft Standard Contractual Clauses submitted by the LT SA (Article 28(8) GDPR) |EDPB

Controllers and Processors, Data Transfers, Standard Contractual Clauses (SCC)

Opinion 23/2021 on the draft decision of the competent supervisory authority of Czech Republic regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EDPB

Code of Conduct, Controllers and Processors

Opinion 24/2021 on the draft decision of the competent supervisory authority of Slovakia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EDPB

Code of Conduct, Controllers and Processors

Opinion 16/2021 on the draft decision of the Belgian Supervisory Authority regarding the “EU Data Protection Code of Conduct for Cloud Service Providers” submitted by Scope Europe |EDPB

Code of Conduct, Controllers and Processors

Opinion 17/2021 on the draft decision of the French Supervisory Authority regarding the European code of conduct submitted by the Cloud Infrastructure Service Providers (CISPE) |EDPB

Code of Conduct, Controllers and Processors

Data Sharing Code of Practice by UK ICO [Controller to Controller]

Controllers and Processors, Data Sharing

Opinion 39/2021 on whether Article 58(2)(g) GDPR could serve as a legal basis for a supervisory authority to order ex officio the erasure of personal data, in a situation where such request was not submitted by the data subject |EPDB

Data Controller, Data Subjects Rights, Definitions

Opinion 14/2022 on the draft decision of the competent supervisory authority of Bulgaria regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 15/2022 on the draft decision of the competent supervisory authority of Luxembourg regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 16/2022 on the draft decision of the competent supervisory authority of Slovenia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 1/2023 on the draft decision of the competent supervisory authority of Croatia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to Article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 02/2023 on the draft decision of the competent supervisory authority of Latvia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to Article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 03/2023 on the draft decision of the competent supervisory authority of Romania regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Joint statement on data scraping and the protection of privacy

Personal Data Collection

Fashion ID, 29 July 2019, C-40/17, ECLI:EU:C:2019:629

Data Controller, Data Processors

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH, in the presence of Facebook Ireland Ltd (Case C-210/16).

Data Controller

Records of Processing Activities under Article 30 GDPR | Irish DPC

Records of processing Activities (ROPA)

WORKING PARTY 29 POSITION PAPER on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR

Records of processing Activities (ROPA)

Joint Guide to ASEAN MCC and EU SCC

Data Transfers, Standard Contractual Clauses (SCC)

Records of processing activities template by the CNIL

Records of processing Activities (ROPA)

Members of the Code of Conduct for Cloud Infrastructure Service Providers

Code of Conduct

Guidelines 07/2020 on the concepts of controller and processor in the GDPR

Data Controller, Data Processors, Definitions

Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects

Performance of Contract

Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679

Code of Conduct

Telegram CEO’s Arrest Sparks Debate on Privacy vs. Regulation

Personal Data Collection, Technical and Organisational Measures (TOMs)

Salvatore Manni Case C 398/15

Data Retention, Legitimate Interest, Storage limitation

ANAF Case C‑201/14, 1 October 2015

Automated Decision-making, Data Sharing, Data Transfers, Public Administrative Body

A Guide to Lawful Basis | UK ICO

Consent, Lawfulness of Processing, Legal Obligation, Legitimate Interest, Performance of Contract, Public Interests, Vital Interests