Search results

margin number 14 (C.H. Beck 2020, 3rd Edition). Buchner/Petri, in Kühling, Buchner, DS-GVO BDSG, Article 6 GDPR, margin number 23 (C.H. Beck 2020, 3rd Edition)

margin number 11 (2nd Edition, C.H. Beck 2018). Boehm, in Kühling, Buchner, DS-GVO BDSG, Article 58 GDPR, margin number 14 (C.H. Beck 2020, 3rd Edition). Ziebarth

margin number 8 (C.H. Beck 2020, 3rd Edition). See e.g. Herbst, in Kühling, Buchner, DS-GVO BDSG, Article 5, margin number 16 (C.H. Beck 2020, 3rd Edition)

to suitable safeguards, so as to protect personal data and other fundamental rights, where it is in the public interest to do so, in particular processing

the infringement; (h) the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the

GDPR, margin number 15 (C.H. Beck 2018). Klar/Kühling, in Kühling, Buchner, DS-GVO BDSG, Article 4 1 GDPR, margin number 14 (C.H. Beck 2020); Eßer, in Auernhammer

12, margin number 11 (C.H. Beck 2020, 3rd Edition). Bäcker, in Kühling, Buchner, DS-GVO BDSG, Article 12, margin number 12 (C.H. Beck 2020, 3rd Edition)

number 35 (C.H. Beck 2018, 2nd Edition). Kamann, Braun in Ehmann, Selmayr, Datenschutz-Grundverordnung, Article 17 GDPR, margin numbers 31-32 (C.H. Beck 2018

number 8 (C.H. Beck 2018, 2nd Edition). Hansen, in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 32 GDPR, margin number 37 (C.H. Beck 2019)

margin numbers 18 (C.H. Beck 2022, 3rd edition). Bäcker, in Kühling, Buchner, DS-GVO BDSG, Article 15 GDPR, margin number 29 (C.H. Beck 2020, 3rd Edition)

margin number 13 (C.H. Beck 2019, 3rd Edition); Schulz, in Gola, Datenschutz-Grundverordnung, Article 21 GDPR, margin number 8 (C.H. Beck 2018, 2nd Edition)

number 20 (C.H. Beck 2020, 3rd Edition). Dix, in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 13 GDPR, margin number 5 (C.H. Beck 2019)

compliance with the GDPR. Article 28(3)(h) GDPR enables such a task in case processors are used. According to Article 28(3)(h) GDPR, the processor should provide

additional measures to demonstrate the effectiveness of their choices. EDPB: To do so, the controller may determine appropriate key performance indicators (KPI)

request is given appropriate prominence so to reduce the risk of consent being inadvertently given or overlooked. To do so, Article 7(2) GDPR sets out certain

monitoring and enforcement activities (points a, f, h and g), investigation and audit activities ( points f and h), advisory activities (points c, d, e and l)

23, margin number 33 (C.H.Beck 2021, 3rd Edition) and Bäcker, in Kühling, Buchner, DS-GVO BDSG, Article 23, margin number 25 (C.H.Beck 2020, 3rd Edition)

number 61 (C.H. Beck 2021, 39th edition). Baumgartner in Ehman, Selmayr, Datenschutz-Grundverordnung, Article 35 GDPR, margin numbers 70-71 (C.H. Beck 2018

GDPR, margin number 3 (C.H. Beck 2020, 36th edition). Bergt, in Kühling, Buchner, DS-GVO BDSG, Article 82 GDPR, margin number 15 (C.H. Beck 2020, 3rd edition)

data subjects that it is doing so in accordance with the law, unless there's a legal prohibition preventing them from doing so. Finally, Member States may

prevention of threats to public security, so that the processing of personal data for those other purposes, in so far as it is within the scope of Union law

margin number 8 (C.H. Beck 2020, 36th edition); Körffer in Paal, Pauly, DS-GVO BDSG, Article 78 GDPR, margin number 2, C.H. (C.H. Beck 2021, 3rd edition)

margin number 6 (C.H. Beck 2020, 3rd edition). Karg in Wolff, Brink, BeckOK DatenschutzR, Article 80 GDPR, margin number 10 (C.H. Beck 2021, 36th edition)

number 8 (C.H. Beck 2021, 36th edition); Boehm in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 81 GDPR, margin number 18 (C.H. Beck 2019);

determined period of time, issue an opinion, if a majority of its members so decides or if so requested by any supervisory authority concerned or the Commission

determined period of time, issue an opinion, if a majority of its members so decides or if so requested by any supervisory authority concerned or the Commission

number 6 (C.H. Beck 2018, 2nd Edition). Kamann, Braun, in Ehmann, Selmayr, Datenschutz-Grundverordnung, Article 16 GDPR, margin number 18 (C.H. Beck 2018

margin number 6 (C.H. Beck 2018, 2nd Edition). Zerdick, in Ehmann, Selmayr, Datenschutz-Grundverordnung, Article 45 GDPR, margin number 6 (C.H. Beck 2018, 2nd

number 30 (C.H. Beck 2020, 3rd Edition). Dix, in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 17 GDPR, margin number 6 (C.H. Beck 2019)

30 GDPR, margin number 14 (C.H. Beck 2019). Hartung, in Kühling, Buchner, DS-GVO BDSG, Article 30, margin number 17 (C.H.Beck 2020, 3rd Edition). Bertermann

GDPR, margin number 1 (C.H. Beck 2018, 2nd edition); Brink, Wilhelm, in BeckOK DatenschutzR, Article 73 GDPR, margin number 2 (C.H. Beck 2020, 36th edition)

GDPR, margin number 1 (C.H. Beck 2020, 3rd Edition). Boehm, in Kühling, Buchner, DS-GVO BDSG, Article 54 GDPR, margin number 2 (C.H. Beck 2020, 3rd Edition)

GDPR, margin number 3 (C.H. Beck 2023, 1st edition). Albrecht in Ehmann, Selmayr, Article 68 GDPR, margin number 1 (C.H. C.H. Beck 2018, 2nd edition).

margin number 4 (C.H. Beck 2018, 2nd Edition). Raum, in Ehmann, Selmayr, Datenschutz-Grundverordnung, Article 31 GDPR, margin number 5 (C.H. Beck 2018, 2nd

determined period of time, issue an opinion, if a majority of its members so decides or if so requested by any supervisory authority concerned or the Commission

prevention of threats to public security, so that the processing of personal data for those other purposes, in so far as it is within the scope of Union law

appropriate, measures to mitigate its possible adverse effects. 4. Where, and in so far as, it is not possible to provide the information at the same time, the

role of directing and coordinating the decision-making procedure. In doing so, the LSA has to cooperate with the other CSA in accordance with the principles

reason to consider a joint appointment as contrary to Article 53(1) GDPR, so long as one of the bodies mentioned above is involved and can effectively

margin number 1 (C.H. Beck 2020, 3rd Edition). Ehmann, in Ehman, Selmayr, Datenschutz-Grundverordnung, Article 93 GDPR, margin number 1 (C. H. Beck 2018, 2nd

10 (C.H. Beck 2020, 3rd edition). Drewes, in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 39 GDPR, margin numbers 7-15 (C.H. Beck

number 15 (C.H. Beck 2020, 3rd Edition). Dix, in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 34 GDPR, margin number 16 (C.H. Beck 2019)

paragraph is provided to the data subjects in addition to Articles 13 and 14; (h) the tasks of any data protection officer designated in accordance with Article

number 8 (C.H. Beck, 2018, 2nd edition). AG Kokott, Opinion in Case -73/07. Pötters in Gola, DS-GVO, Article 85 GDPR, margin number 9 (C.H. Beck, 2018

margin number 3a (C.H. Beck 2020, 3rd Edition). Bergt, Pesch, in Kühling, Buchner, DS-GVO BDSG, Article 42 GDPR, margin number 3a (C.H. Beck 2020, 3rd Edition)

number 7 (C.H. Beck 2018, 2nd Edition). For this and other examles, see Gola, Datenschutz-Grund-verordnung, Article 11 GDPR, margin number 2 (C.H. Beck 2018

GDPR, margin number 7 (C.H. Beck 2018). Selmayr, in Ehmann, Selmayr, DS-GVO Kommentar, Article 56 GDPR, margin number 8 (C.H. Beck 2018). Guidelines 8/2022

the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the

instances such as these, a form of prior compliance can be envisaged, not so much with respect to political or governmental bodies, but rather with respect

Union or Member State law should provide for specific and suitable measures so as to protect the fundamental rights and the personal data of natural persons

specific situations of data processing for which the GDPR is not applicable. So the GDPR is the applicable law if there is no more specific rule in the HmbDSG

consent has been given is in line with the conditions of this Regulation, so as to allow the controller to continue such processing after the date of application

margin number 4 (C.H. Beck 2019). Schantz, in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 46 GDPR, margin number 10 (C.H. Beck 2019).

This information must be structured in an accessible and intelligible manner, so that both the data subject themselves and any controllers who may receive

to safeguard the professional or other equivalent secrecy obligations, in so far as necessary to reconcile the right to the protection of personal data

Conversely, in high-risk cases, it may be appropriate to ask for more proof, so that the controller is able to verify and retain the information pursuant

supervisory authority in order to allow it to exercise its powers pursuant to point (h) of Article 58(2) where necessary, issue and renew certification. Member States

assist each other in performing their tasks and provide mutual assistance, so as to ensure the consistent application and enforcement of this Regulation

Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined

it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Union. In order to determine

of the holders of parental responsibility over children is to be obtained; (h) the measures and procedures referred to in Articles 24 and 25 and the measures

or a combination of the aforementioned, to halt its sharing of data where so required. In consequence, Grindr failed to control and take responsibility

reading Article 5(3) of the ePrivacy directive in conjunction with Article 2(h) of Directive 95/46/EC, and noting that active consent is now regulated under

is not the first language for most readers. Provide the necessary context, so that a foreign reader (that may not know the local procedure or facts) can

including, in addition, the information referred to in Article 15(1)(a) to (h) of the GDPR? b. If question 4.a. is also answered in the negative: Is the

the case of processing based on subparagraph (h). However, there is no reason to assume that subparagraph (h) is limited to cases of processing by independent

are being processed and, if so, the right to obtain access to those personal data and the following information: [...] (h) the existence of automated decision-making

discretion. So got - what on factual level is undisputed - the C.bank AG with inquiries from 22.07.2019 in the plaintiff's database the sh H. AG requested

(hereinafter LOPDGDD), Said claim was transferred to the claimed party on 12/23/2021, so that it could proceed to its analysis and inform this Agency within a period

generated by a system of cameras or camcorders are data of personal nature, so its treatment is subject to the protection regulations of data. It is, therefore

capturing images of the data subject's home, without being authorized to do so. The controller affirmed that the cameras were installed in his own property

Internet was encrypted. The CNIL reminds that the medical records concerned are so-called sensitive data within the meaning of article Article 9 GDPR. This data

subject in the context of an access requests, to comply with Article 15(1)(h) GDPR. The Datatilsynet conducted some investigations at Udbetaling Danmark

That on August 4, 2019, Mr. H.H.H. contacted me. of the fraudulent transfer department of my bank EVO BANC. The Mr. H.H.H. informed me that in the early

C/EX/3906-1/11-07-2019 (for complaints under (g) and (h)) and C/EX/4560-1/27-07-2020 (for complaints under (g) and (h))). i' and j' complaints), requesting its views

protection violations in H&M's service centre 01.10.2020 - H&M In the case of the monitoring of several hundred employees of the H&M service centre in Nuremberg

for the measures contemplated in the Article 58, paragraph 2, letters a) to h) and j). When deciding to impose a fine administration and its amount in each

digital rights (in forward LOPDGDD), said claim was transferred to Holaluz, so that proceed to its analysis and inform this Agency within a month of the

these advertising cookies, the CNIL has issued an injunction under penalty so that the companies proceed to inform people in accordance with Article 82

that the facts presented do not comply with the provisions of article 6.1, so it could involve the commission of the infraction classified in article 83

lieu of the measures contemplated in Article 58, paragraph 2, letters a) to h) and j). When deciding to impose a fine administration and its amount in each

&cv=11&fst=1672747200000&bg=fffff&guid=ON&async=1&gtm=2oabu0&u_w=1920 &u_h=1080&frm=0&url=https%3A%2F%2Fwww.telekom.de%2Fstart &tiba=Telekom%20%7C%20

the registrar, the call records contain the personal data of the employees, so it does not send the records to the data subject in order to protect the privacy

party requests to know the entire range of data processed by the owner (so much so that art. paragraph 3 of the Regulations provides for the extension of

the DSB went on to assert a violation of Article 12 GDPR and Article 15(1)(h) GDPR, acting beyond the scope of Article 77 GDPR. Hence, the BVwG annulled

LOPDGDD), on 02/11/2022 said claim was communicated to the party claimed, so that it could proceed with its analysis and inform this Agency within the

councilors C.E. du Perron, M.J. Kroeze, H. M. Wattendorff and G. C. Makkink, and pronounced in public by Counsel H.M. Wattendorff on December 3, 2021. 1

information about processing of personal data. The controller failed to do so and shared with him only a general data protection notice. The DPA found out

art. 24 sec. 1, art. 25 sec. 1, art. art. 28 sec. 1, art. 28 sec. 3 lit. h, 32 sec. 1 lit. b and lit. d, art. 32 sec. 2, art. 33 paragraph. 1, art. 34

inadmissible C. Concerning the alleged lack of formal reasoning for t h e opening of t h e investigation on the merits Mayen 2: The "decision to deal with

address, which however, due to an administrative error, the so-called campaign management system so that the Applicant again received newsletters to his old

green, military with a background image of a hangar with an airplane (photo H hereinafter), three different ones, up close inside a vehicle dressed for the

6(1)(b) GDPR as the lawful basis for processing of personal data. In order to do so, the controller has to demonstrate that such “processing is necessary for

noticeboards so that everyone can use the recorded personal data . 10. In the conducted procedure, it was determined that the residential building in A.V.H. 12

they send her the full report of new??" - Sent by "Prevention" to "G.G.G., H.H.H., Human Resources..." on 19/11/2018: "As A.A.A. comments in the mail, it

use of the electronic mail system by the Applicant was not regulated, so the so-called “corporate e-mail account” used by the Applicant In the event that

LOPDGDD), on October 5, 2021, said claim was transferred to the party claimed, so that it proceeded to its analysis and inform this Agency in the period of

security of the data processed by the processor under Article 28(3)(a) and (h) GDPR. For these reasons, the responsibility of the security incident cannot

claimants 6). B.B.B. (hereinafter claimant 7). G.G.G. (hereinafter claimant 8). H.H.H. (hereinafter claimant 9). I.I.I. *** CHARGE.1 (hereinafter claimant 10)

change in address. The employer claimed that the complainant had failed to do so until he filed the complaint before the Hungarian DPA. Any requests by email

no guarantee that this way It is ... I beg you to take action on your part so that these SMS. " And, among other things, it provides the following documentation:

that they had verified that the data of claimants 1 and 2 had been canceled so the incidents as resolved. On July 22, 2020, a new claim is received for them

requirement by the claimant, but the defendant did not answer nor made any action, so the AEPD started the corresponding sanction procedure. Without prejudice to

personal data of its customers in a notebook without having a legal basis to do so, and did not inform its data subjects of this data processing. A client of

dining rooms in relation to others such as showers, changing rooms, etc.). So there could be a need to monitor those places and even people's belongings

company for having processed personal data without having the legal basis to do so (Article 6(1) GDPR). The complainant stated that he called Naturgy's commercial

elections of 11/10/2019; that that chargeThey only offer it to affiliates so it follows that they still keep all theirdata.SECOND: Upon receipt of the

notification on the public notice board was authorised by virtue of Article 9(1)(h) of the Law on Horizontal Properties ("Ley de Propiedad Horizontal"). However

Appeal. (see, in any case, where there is reason to do so, a review or, where there is reason to do so, a re-investigation (cf. Naziris v. Naziris, n. 1. R

(art. 83.2 h) RGPD). - The continuing nature of the offence. The respondent had already received with Prior to the claim notices by the claimant so that adopt

private non-corporate phones. The data controller claimed that he did this so that employees could check whether their data were correct. A worker, whose

authority in this case, as they only examined the practice of Google Ireland in so far as it had an impact on the rights of data subjects residing in Hungary

rights (in hereinafter LOPDGDD), said claim was transferred to the Community, so that proceed to its analysis and inform this Agency within a period of one

period of ten days. The defendant did not answer any requirements of the AEPD, so the AEPD started the corresponding sanction procedure. Thus, the AEPD understood

the infringement; h) the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the

investigation or coordination with another supervisory authority is necessary; (…) (h) conduct investigations into the application of these classification, including

LOPDGDD), on January 25, 2022, said claim was transferred to the party claimed, so that it proceeded to its analysis and inform this Agency in the period of

when they have not been designated, transferred the claim to the two entities so that they could proceed with their analysis and respond to the complaining

call to the line on which certain requests are made sensitive operations, so that the owner client can authorize or not said operation before its execution

€) and acknowledging of guiltiness (36,000€). The defendant agreed to both, so it paid 36,000 € and the sanction procedure was closed by the AEPD. Share

28001 - Madrid sedeagpd.gob.es 3/14 They state that: “said error was solved, so the claimant will not return to receive any communication regarding electronic

in a common area, without following the mandatory legal requirements to do so, violating Article 6(1) and Article 13 GDPR. A resident has installed, without

property, more specifically at the swimming pool, without being authorized to do so. The Spanish DPA considered that the data subject provided a photograph without

aware of the infringement, which was reported by the complainant (paragraph h). Account has also been taken of Article 76 (2) (b) LOPDGDD concerning the

citizen (relating to the supply of electricity) without a legal basis for doing so. A citizen filed a complaint with the AEPD after he was disconnected from

had knowledge of the facts, it made available to the claimant all the tools so that the current creditor was properly informed of the situation, being able

outside the locality, with an excess speed exceeding 60 km / h and less than 80 km / h, sanctioned with an accessory sanction of disqualification from

defendant company carried out the treatment without having any legitimacy to do so. The personal data were incorporated into the company's information systems

administrator of the company for which the bank was claiming the debt. Even so, the claimant was receiving mail and calls from the company hired by BBVA

community's notice board. The publication was allegedly justified by Article 9 (h) of the Ley 49/1960 de Propriedad Horizontal. Is the public displaying of a

adds that with this publication, your personal data has been transferred, so that any neighbor of Nules has identified him as one of the expelled for having

systems without proving that the complainant had legitimately contracted to do so, or that the complainant had given her consent for the collection or subsequent

in violation of Article 29 GDPR, and without being expressly obliged to do so by law. As a consequence, the data of 4,515 natural persons insured at the

processed the complainant's personal data without having any legitimacy to do so. Aggravating circumstances were taken into account when setting the amount

included an information message ("This phone number is related to a real client, so any unlawful use is forbidden"). The AEPD started the corresponding sanction

order. No procedural costs were incurred during the official proceedings, so the Authority did not order them to be borne. I, II., III. There is no administrative

had included the personal data of the claimant without his/her consent), and so it has been “a victim” of the bad practices of the agency; the defendant also

from the receiving operator informing of the cancellation of the portability so that on April 4 carried out portability. 5. That the complainant contacted

owner is managed in the store, and they have been responsible for the mistake, so they're the ones who have to correct it. We can't do anything from here. “

intervention. However, this temporary blocking had no long-term or permanent effect, so that the automated decision had no legal consequences or significantly affected

hereinafter LOPDGDD), on 06/16/2022 said claim was transferred to the party claimed, so that it could proceed with its analysis and inform this Agency within the

provider Naturgy to Flip Energy without obtaining consent or a contract for doing so. The complainant filed an action against Alterna Operador Integral SL (Flip

the infringement; h) the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the

S.L. and the EDITORIAL COMFORT what has been expressed by the respondent, so that within a month from the receipt of such written submissions, whether

been allocated and so no CCMC had been listed (assuming allocation justified such a hearing), the Claimant's solicitors filed a Precedent H Form confirming

processing. The aforementioned agreement granted the defendant a hearing process, so that within a period of fifteen business days, submit the allegations that

these communications".They point out that: "this error has been resolved, so the claimant will not receive any further communication regarding electronic

processed personal data without accrediting that it had the legal basis to do so. Furthermore, it was not aligned with the principle of proactive liability

containing the data subject's personal data without authorisation for doing so, and decided to impose a fine of €10,000 on the defendant. The fine imposed

use, disclosure by transmission, h dissemination or any other form of disposal, association or combination, restriction, h erasure or destruction", while

on November 29, 2021, said communication was claim to the claimed party, so that it proceeded to its analysis and inform the this Agency within a month

claimant of the decision adopted in this regard. Likewise, he is required so that within a month it sent to the determined Agency information: - Copy of

date processes are improving, upgrading and evolving over time technology. (h) From May 2018, the Bank fully complies with the Regulation. Specifically,

conflict with the right to a fair trial in Article 6 ECHR. However, in doing so, the national court must take into account the principle of proportionality

claimant's number involved in the commercial call produced, which [sic]: “(…) so it seems that this is a specific error in our filtering system. " FOUNDATIONS

communicate with each other automatically so that the DSPs can bid on bid requests from SSPs. E. In addition, there are so-called "Data Management Platforms"

sent to the online shop informing of the incident but received no answer, so they filed a complaint with the AEPD describing the incident. Did Comercio

as it were, especially since the defendant - unlike, for example, H in the case of so-called 1-star ratings - specifically specifies the rating categories

the time of the presentresolution has not submitted a brief of allegations, so it is applicableindicated in article 64 of Law 39/2015, of October 1, on the

processed the claimant's personal data without having any legitimacy to do so. The respondent has recognized this error and has indicated that one of the

would not be introduced as a rule by article 6 par. 1 GCP h ban on the processing of personal data so that it is required to one of the legal bases provided

from being included on the list "if compelling reasons so require". The scheme is practiced so that it is assumed that the disadvantages must be greater

account can be published in a media. [...] The consent of the owner of the image so that the general public, or a certain number of people, can see his photograph

the email address, reveling personal information was sent for non-members, so the Article 9 of the GDPR does not apply. Share your comments here! Share

the time of this resolution tion has not submitted a brief of allegations, so the aforementioned is applicable in article 64 of Law 39/2015, of October

with the complainant's rights of access and erasure, or it could refuse to do so provided they gave reasons why complying with the request would be inappropriate

and upheld [the applicant's] objection. In so doing, the Minister revoked the decision of 7 May 2018 in so far as it concerned the data of [the applicant]

December 29, 2021, said information was transferred claim to the claimed party, so that it proceeded to its analysis and inform the this Agency within a month

without the legitimacy to do so. The respondent carried out the change of ownership of the claimant's line without legitimacy to do so, because the commercial

the time of the present resolution has not submitted a brief of allegations, so it is applicable indicated in article 64 of Law 39/2015, of October 1, on

have not been designated, the claim presented by the claimant to the claimed, so that it could proceed to its analysis and respond to this Agency within a

access to the recordings of phone conversations between him and the company, so it imposed the airline a fine of 40000 EUR which was reduced to 24000 EUR

original for more details. Case number: NAIH / 2020/2546/15. Subject: Decision H A T Á R O Z A T Before the National Authority for Data Protection and Freedom

the ordering of a foreign currency required the collection of identity data so that the necessary cash deposit as Credit can be assigned to the collective

having robbed them of all the cash out of the register, and last but not least so sees accusation, they attach a photograph taken of the aforementioned person

credibility. N e lla re s is te n z a d e l G a ra n te, a d ito trib u n a le h a The appeal was partially accepted. In particular it canceled the provision

complaint ***REFERENCE.1, considered that initially there was no known author, so the proceedings to the corresponding Court.” Requested information again from

aforementioned inspection, it was found that: - the model of care approach of the so-called "Healthcare initiative", followed throughout Tuscany, is based on the

referred to as the "Act", in connection with with art. 57 sec. 1 lit. a and lit. h, art. 58 sec. 1 lit. b, lit. e and lit. f of the Regulation 2016/679, in order

be considered. There was no other suitable place for it. VR: So why wasn't the camera set so that you could see less of the gas station? Z: You could see

"public authorities and public bodies" in Article 83(7) cannot be interpreted so broadly as to include legal persons under private law that perform a task

cost order enforceable in stock. This judgment was delivered by A.W.H. Vink, W.A.H. Melissen and J.M. de Jongh and publicly pronounced by the court on

company; - «the communication to the interested parties has not been prepared so far as, pursuant to art. 34 GPDR, the risk for the rights and freedoms of

agreement with the defendant. The defendant did not answer the AEPD request, so the AEPD started the corresponding sanction procedure. Thus, the AEPD understood

early voluntary payment (18,000 €). The defendant agreed to both concepts, so it paid 18,000 € and the sanction procedure was closed by the AEPD. Share

of the necessary measures so that records of access to personal data remain, and also the granting of profiles to officials so that each one can only access

2020/AR/1160 Not to be offered to the Recipient Interim opening practicability H o w F o f b o a r d s Treatment round: 27/01/2021,(1 B ru ssel Section Market

have to search for information, but should have to immediate access to it. So the French DPA held that there was a violation of the obligation of transparency

Therefore, by not appreciating fraud or guilt on the part of the defendant, nor so even as a mere non-observance, in relation to the facts that give rise to

(iii) that the banking information on the invoices was provided by a bank, so there was no breach of the lawfulness principle. The AEPD started the corresponding

corrected]. B E S C H E I D S P R U C H The data protection authority decides on the data protection complaint of A***pharma GmbH (complainant) from ****

properly fulfilled, in spite of being properly attended after claim admission, so it decided not to impose any fine nor warning to the defendant. Share your

RGPD, and thus cannot be punished twice. 116. According to the Defendant, so much so that the Draft Deliberation describes the same relevant fact to consider

of offenses by its employees and third parties, within the framework of the so-called whistleblowing discipline. In particular, the University has notified

following instructions of the person in charge, unless it is obliged to do so by virtue of the Law of the Union or of the Member States. From the documentation

request. However, neither of the two entities informed the respondent about it, so the inclusion of the data implies an illegitimate processing of personal data

The Obligatory Authority did not comply with the provisions of the summons, so the Infotv. Pursuant to Section 58 (2) (b), the Infotv. As a result of the

5, lett. 1.3 above). point 1.5., letter h. above) to the general principles of lawfulness and minimisation, so as to prevent the processing (including

was confirmed that the contract ***CONTRACT.1 did not generate any billing so it is "no action pending". When asked about the status of the legal proceedings

the electoral census, (vi) the union is concerned about data protection, and so it contracted the corresponding law firm in order to ensure a full compliance

Username 1 97 82 142 fred 2 23 9 57 inder-kahlon 3 18 8 32 mgrd 4 11 3 18 so.h 5 8 3 10 INKG 6 8 5 7 teresa.lopez 7 6 4 5 Martin Baumann 8 6 4 5 nikolaos

infraction in Article 72.1.h) of the LOPDGDD, as follows: Page 9 of 12 PS 49/2019 Carrer Rosselló, 214, esc. A, 1r 1a 08008 Barcelona “H) The omission of the

of the old version of the Federal Data Protection Act (BDSG), on which the so-called "spick-me" decision of the Federal Court of Justice (judgment of 23

complainant for their processing, or that he has the legal authorization to do so. However, and this is the essential point, the respondent does not prove the

data breach within the time limits set out in Article 34 GDPR (Article 82(2)(h)). However, these factors were not considered to be either aggravating or mitigating

and 5). SECOND: On 06/25/20, the claim is TRANSFERRED to the entity denounce so that it manifests in law what it deems appropriate, without any allegation

your particular situation gives rise to reasons for doing so. If you wish to object, you can do so on our homepage at www.post.aVkontaktformular, telephone

in so far as the orders to pay the costs referred to herein are concerned. This judgment was rendered by mrs. S.B. Boorsma, H.C. Frankena and C.J.H.G.

for the measures contemplated in the Article 58, paragraph 2, letters a) to h) and j). When deciding to impose a fine administrative and its amount in each

should be configured so as to Similarly, outdoor cameras installed in the vicinity of or around a building should be configured so as not to capture the

entityThe complainant sent him a contract for gas and electricity services so that he could return itsigned. And he adds that in that document -of which

partner grants this authorization with a wide territorial and temporal scope, so the company may use the images, or part of them, in all the Spanish territory

authority procedure in order to clarify the facts. Those who actually did so supported the Data Controller campaign as volunteers / activists. The distinction

digital rights (in hereinafter LOPDGDD), said claim was transferred to ORI, so that proceed to its analysis and inform this Agency within a period of one

Online-Services Gesellschaft mbH & Co KG (respondent) from **** D***stadt, represented by R*** T*** Rechtsanwälte Ges.m.b.H. from **** B***, for violation

infringement relates; h) the manner in which the supervisory authority became aware of the infringement, in particular whether, and if so, to what extent, the

free version of Google Analytics. In doing so, it had agreed to both the terms of use and the SDK. In doing so, neither the Google Analytics 4 version had

restriction.In doing so, the controller must consider, inter alia, that the data subject is concernedwhether it is a public actor (if so, this strengthens

personal impact (further) prosecution is undesirable (a so-called policy dismissal). T he M arket h o w a t w a ck both respect the orm e le and the material

the fact that criminals have not managed to obtain personal data from Digi, so there can be no talk of breach of protection measures, point out that access

to design, implement and generally take the necessary measures and policies so that data processing is in line with the relevant legislative provisions.

*** URL.1 is not ownedof FORMACIÓN UNIVERSITARIA, SL, nor has it ever been, so it does not knowC / Jorge Juan, 6www.aepd.es28001 - Madridsedeagpd.gob.es

to collaborate with the AEPD, and so it has facilitated the right to erasure whenever it has been requested to do so. Additionally, the AEPD also received

the complete administrative file); and "it is corrected formally said error, so that said Agreement is rectified in the file”. On 02/07/2022, the defendant

remote access to the medical images stored on the hard drive of their home PC, so they opened the ports of their home router in order to make a VPN work. The

previously transcribed, it is an optional procedure, so that formalized only if this Agency deems it so, without any legal consequence of the fact that this

did not receive any information about the mishandling of our personal data, so fearing that the recording would be deleted to cover up the incident of the

illegality of its procedure in force between 1 August 2006 in so far as it did not do so appropriate technical and organizational measures to enable camera

correspondence, so that the principles set out under 3.4 apply. The Senate can leave it open whether particularly highlighted messages (e.g. the so-called "green

to the extent that you do so. And it must be given to all treatment activities carried out for the same purpose or purposes, so that, where processing is

platform in charge of managing the change of the SIM card fails in such a way so that the SIM change cannot be made in our stores; (ii) if the client is company

occurred through several complaints filed by the complainant, Article 83(2)(h) GDPR - The existence of a prior complaint. Aggravating factors in accordance

notification in a preliminary way to provide the information that is available so far. o That a series of technical measures were adopted that were carried

rate. This decision was made by Mrs. L.J. de Kerpel-van de Poel, H. de Hek and Chr.H. van Dijk, and was pronounced in the public hearing on 9 November

claimed, for violation of article 13 of the RGPD. For its part, article 72.1.h) of the LOPDGDD, considers very serious, for the purposes of prescription,

the municipality's system. h) in what way the supervisory authority became aware of the infringement, in particular if and if so the extent to which the data

subject without being able to demonstrate that it had the legal authority to do so. Therefore, the controller would have to prove that the data subject had actually

without prior authorisation to do so. The DPA found that the supply contract was only between the complainant and the company, so that the tenant was a third

person is identifiable. With reference to Article 83, paragraph 2, letter h "In what way did the supervisory authority become aware of the infringement

Chambre Contentieuse de l'Autorité de protection des données, composed of Mr H. Hijmans, President, and Mr Y. Chicken and F. De Smet, Members ;Having regard

be based on recital 63 of the GDPR. The right to information relates to the so-called "master data" of the person entitled to receive information. In the

1) Ensure that the body subject to the obligation to appoint a DPO has done so; 1The guidelines concerning DPOs were adopted by the “Article 29” working

did not notify the audit of the infringement, cf. Article 83 no. 2 letter h. With reference to Article 83 no. 2 letter k «any other aggravating or mitigating

inquiries. Hereby we exercise our power to terminate the aforementioned contract so that from On the date of receipt, no amount will be accrued for the provision

the fact that criminals have not managed to obtain personal data from DIGI, so there can be no talk of breach of protection measures, point out that access

breach. After this, the controller unlinked the Excel sheet from its website, so that it would not be available when navigating the controller website. There

complainant's right of access within the legal period allotted to it to do so (Article 15.1 combined with Article 12.3. of GDPR as well as Article 12.2

based on an advertisement of November 2019 make the claim on 04/01/2020, so late and nonsense since only discounts can be reported to favor our most loyal

compliance with the Law? BUT H.2 Are the employees who receive and process such requests aware of that process? YES DO NOT H.3 Does the process have all

apply. Are these magnetic cards personal data within Article 4(1) GDPR? If so, did the MCP infringe on the data subject's Article 14 right? The AEPD decided

employment social networks and told him that his email was going to be deleted so that he would not receive more emails. TO To this, the complaining party responded

account and through other means and include in particular the tools of the so-called target group selection and searchability settings. 4As part of the

been corrected.] B E S C H E I D S P R U C H The data protection authority decides on the basis of the A ** Verkehrsbetriebe GmbH (Responsible), represented

Language: 24 EU Languages Original Source: Judgement Initial Contributor: so.h

an aggravating direction. h) in what way the supervisory authority became aware of the infringement, in particular if and if so the extent to which the data

data and the necessary protective measures, so that they can be included as part of the processing and so that the processing complies with the requirements

Sometimes it is also necessary to capture the accesses, doors or entrances, so that even if the camera is located inside the building, it is impossible not

of the granted conclusion periods, both the complainant (Ms. H.J.M.) and the parties (Ms. H.J.M.) submitted new elements that were not relevant to the subject

10/29/21, this Agency transferred the claim to the party complained against so that it could respond to it, in accordance with the provisions of article

has acted on his behalf, including whether any individual is punished and h) the offender's financial capacity. " Section 46 of the Personal Data Act 2000

lieu of the measures contemplated in Article 58, paragraph 2, letters a) to h) and j). When deciding to impose a fine administration and its amount in each

the time of the present resolution has not submitted a brief of allegations, so it is applicable indicated in article 64 of Law 39/2015, of October 1, on

that he will not represent them, to provide us with their contact details so that in case we need to contact them directly. 2.5 On March 17, 2022, following

controller had stopped using Google Analytics short after the Schrems II ruling, so there was no violation of Chapter V of the GDPR. About a month after the "Schrems

article 65.4 of the LOPDGDD, a transfer of said claim to the claimed party, so that he proceeded to analyze it and inform this Agency within a month, of

controller did not answer to AEPD's first requirement, but it finally did so during the allegations phase and admitted a technical “mistake” on the wrong

provide reliable information at any time, the defendant should keep records so that they do not forget who was using the vehicle and when. Most importantly

understood by responsible for the treatment and in charge of the treatment. So we have, like: “7) “responsible for the treatment” or “responsible” is the

the complainant received an SMS from the defendant with advertising content, so the data subject filed a new complaint with the AEPD. After a request for

Claimant 8.- E / 07821/2020 G.G.G. - *** NIF.6 Claimant 9.- E / 07825/2020 H.H.H. - *** NIF.7 C / Jorge Juan, 6 www.aepd.es 28001 - Madrid sedeagpd.gob.es

Database (Basisregistratie Personen) even though he was not authorized to do so; the candidate notary did not dedicate enough care to correct this and limit

fine of a fixed and objective nature for the commission of an infraction, so that only It corresponds to the accused to debate the effective concurrence

Laws of 2019, item 1781, as amended), as well as art. 57 sec. 1 lit. a) and h), Art. 58 sec. 2 lit. e) and i), Art. 83 sec. 1-3, art. 83 sec. 4 lit. a) in

DPID, the iADID and the identifiers relating to the segments concerning him, so that they can determine the targeted advertisement to be displayed first (all

any investigation requests (neither from the claimant nor from the AEPD), so the AEPD started the sanction procedure. In this procedure, the data controller

reference to the case of the present one plaintiff. A claim for payment arises i.H.v. EUR 1,916.70. It should be noted that 11 the premium amount caused by these

by the infringement, (h) the manner in which the supervisory authority became aware of the infringement, in particular: and, if so, to what extent the data

received proof that the range of vision of the two cameras have been modified so that they no longer target the public highway. Regarding Article 13 GDPR,

the measures contemplated in article Article 58, section 2, letters a) to h) and j). When deciding to impose an administrative fine and its amount in each

founded, Reform the decision appealed from, In doing so, refer the complaint to the Contentious Chamber so that it adopts a new decision which would take into

they ordered Abanca to implement the adequate modifications on their websites so they will not use cookies before obtaining consent from the user. Share your

finally answered the right of access, but the AEPD considered it not enough, so the defendant sent a second email to the claimant including (i) the origins

protection regulations, at the time it did not comply with the law and it does so when this Agency requires it, but it is not complete, it still does not provide

outline The Data Inspectorate's task is to control the personal data regulations so that individuals are not violated through the use of information that can

co-ownership and, as such, under the co-owners' supervision. For the co-owner to do so, it was crucial to disclose the debtors details. He therefore considered that

unless storage of the personal data is required by Union or Member State law; h) make available to the controller all information necessary to demonstrate

data be deleted from their database. Company X confirmed that they would do so. Company X sent a request on the same day to Company A (Company B’s processor)

To justify this, PSI mentioned that the contact form was not operational, so an email address was provided instead. The Spanish DPA encountered many errors

made by D. AAA and urge DIRECTORATE GENERAL OF THE POLICE with NIF S2816015H, so that, within ten days following the notification of this resolution, refer

made by D. AAA and urge DIRECTORATE GENERAL OF THE POLICE with NIF S2816015H, so that, within ten days following the notification of this resolution, refer

always made myself available (...). Next Sunday you are called to vote (...). So, I would like to ask for your support to allow me to continue to invest myself

Guerra, in the capacity of authorized representative, –       V. Bottka and H. Kranenborg, in the capacity of authorized representative, on behalf of the

for the implementation of appropriate technical and organizational measures so that the processing meets the requirements of Regulation 2016/679 and protects

saidpersonal data as well as a series of information listed in Article 15.1 a) - h)such as the purpose of the processing of his data, the possible recipients

context of the procedure and submitted to a contradictory debate. In doing so, the company was aware that this information was taken into account and was

rights (hereinafter LOPDGDD), the claim was forwarded to the claimed party, so that they proceed to analyze it and inform this Agency within a month of the

claim was admitted for processing and the claimed entity was granted hearing, so that within fifteen business days the allegations that deemed convenient.

privacy, honour and reputation. This request was denied by the State Secretary, so the data subject requested from the judge to order deletion. The data subject

the defendant, they are the subject of transfer to the complaining party, so that, within fifteen business days, it can formulate allegations it deems

to whether or not personal data concerning him are being processed and, if so, the right of access to the personal data and to the following information:(c)

different privacy policies of each of the 1,522 companies that appear in the so-called “List of suppliers”, for which if a URL link appears within the dropdown

to whether or not personal data concerning you are being processed and, if so case, right of access to personal data and to the following information: a)

templates that, in principle, they are supposed to belong to the same person; so, the two templates are are compared to determine if the person in the two

for the measures contemplated in the Article 58, paragraph 2, letters a) to h) and j). Notwithstanding the foregoing, the aforementioned Regulation provides

view of the events denounced, on 02/21/2020, the the claim to the claimed so that “it analyzes said claim and communicates to the the claimant the decision

Rechtsanwälte GmbH, against N *** Steuerberatungsgesellschaft mbH on December 13, 2018. (Respondent), represented by Z *** Rechtsanwälte GmbH, due to violation

subject’s request is assured by the right to Access of his medical records, so the controller could not let him with no answers, even if it claimed there

the case, that the Legal Registry Center has already changed its procedure so that it will no longer hand over cases resolved with the resolution code "36"

Dienstleistungen GmbH, - HKS Rettungsdienst A-Stadt GmbH, - Medical Service A-Stadt GmbH, - District Hospital W. gGmbH, - Palliativnetzwerk Vorpommern GmbH, - Health

have carried out a data protection impact assessment but had failed to do so. In response, the defendant (the schoolboard) contended that: -sufficient

or laptop or a printer), it should be noted that these costs are so-called "so-and-so" costs associated with the use of the Internet. The complainant's

from the data subject, all available information concerning their source; h) the existence of automated decision-making, including the profiling referred

installation of cookies, but cookies are loaded without any prior action. III So, the known facts, about the privacy policy of the website denounced, constitute

of the resolution estimating the appeal and a hearing process was opened, so that within a period of ten business days present the allegations that it

place on [...] June 2020. So, from the first day after becoming aware of the data breach , the Company took action remedial actions so that the risk of violating

on her regarding her application to a job. The job offer was a blind offer, so the claimant did not know which company was behind the offer. The job portal

fined 700.000 HUF and instructed to change the angle of view of the camera so that it doesn't monitor workers' activities. Share your comments here! Share

their access request unlawful. This is the case even if the data subject does so in hope of getting compensation. The requester has submitted an access request

they have not been designated, transferred the claim to the claimed entity so that it could proceed with its analysis and respond to the complaining party

other holder who was associated with the contracted services so it currently appears unlinked so that you can no longer access the information associated with

the Burgos City Council summoned the conflicting parties via email. In doing so, the Council did not use the BCC option therefore disclosing the email address

presented by the claimant against the respondent and agreed to postpone the claim, so that within fifteen working days he could present the allegations that he

data and the necessary protective measures, so that they can be included as part of the processing and so that the processing complies with the requirements

determination of the competence of a lead supervisory authority in the context of the so called one-stop-shop mechanism. According to the Conseil d'Etat, the concept

the right by the complainant, (ii) the complainant was not its customer (and so there was no possibility of erasing his/her data), (iii) it answered the complainant

processing of personal data is carried out in accordance with the GDPR. In doing so, the GDPR requires, among other things, that the nature and scope of the processing

the court which declares the decisions of This Agency, previously indicated, so that the Spanish Agency for the Protection of Data agrees to the initiation

bonuses are optional and voluntary for the borrower, not being mandatory, so, if you wish, you can cancel and not maintain the indicated health insurance

these actions by the C. Ges .m.b.H. or now the D. Ges.m.b.H., FN ..., had to be prescribed. or now by the D. Ges.m.b.H., FN ..., actions owed (within the

made by A.A.A. and urge SERVICE GALLEGO DE SALUD (SERGAS) with CIF Q6550006H, so that, within the ten business days following notification of this resolution

and early voluntary payment (900 €). The defendant agreed to both concepts, so it paid 900 € and the sanction procedure was closed by the AEPD. Finally,

whether or not the plaintiff's personal data have been transferred and, if so, the recipient(s) to whom the plaintiff's personal data have been or will

website of the Data Protection Authority. However, it is not necessary for this so that the identification data of the parties are directly communicated. FOR

your files. It provides data on a sheet of paper that does not match reality, so, they make it up, and the data, with the documents that support that alleged

appear to have been taken into account, so there is no question of the applicant being prevented from doing so at this stage. , the allegation under consideration

erasure request, since they did not have any document proving that they did so. The DPA ordered the processor to give an adequate answer to the data subject's

including, where appropriate, by electronic means. Where the data subject so requests, the information may be provided orally, provided that the identity

that on the website of the Ministry of Justice the so-called captcha mechanism is used to prevent the so-called bots from filling in forms and downloading

the applicant has not explained the latter activities in any further detail, so that it remains unclear what activities are involved and, for example, what

complaint with her name, coincides with the partial copy of the one she provides, so XX/XX/2019, who "found threatening notes in the car", had to "rent a parking"

they have not been designated, transferred the claim to the claimed entity so that it could proceed with its analysis and respond to the complaining party

arguments presented by the defendant, they were transferred to the claimant so that she could formulate arguments that could be considered appropriate. In

verify that they are accurate and processed in accordance with that Directive, so that the applicant may, where appropriate, exercise the rights conferred on

document was sent, 2. the unauthorised recipient has informed the Company, so it can be concluded that he was aware of the regulations and importance of

1) Ensure that the body subject to the obligation to appoint a DPO has done so; 2) Make sure that the organization has published the contact details of its

with the same content as the active ones, so inactivity in this sense does not involve actual data deletion, so the e-mail and IP addresses of these subscribers

him/her. The defendant did not answer to any AEPD investigation requests, so the AEPD started the corresponding sanction procedure. Without prejudice to

claimants request. Furthermore, the claim was transferred to the respondent so that the entity could proceed with its analysis and provide a response to

1) Ensure that the body subject to the obligation to appoint a DPO has done so; 2) Make sure that the organization has published the contact details of its

case, the Greek DPA found the following violations: violation of Article 9(2)(h) GDPR (processing of special categories of data): according to the applicable

receives the refusal not to contact the claimant again, he proceeds to delete it so that no further connection is made. It provides a description of the conversion

History: NAIH-6936/2021. Subject: decision establishing a violation of law F H A T A R O Z A T The National Data Protection and Freedom of Information Authority

infringement fines. (h) the manner in which the supervisory authority became aware of the infringement, in particular whether and, if so, to what extent the

related to the activity of the claimant as candidate for different public jobs, so erasing it would not be compliant with the legitimate public interests. After

that the treatment is necessary to provide or manage health services (letter h). 4. Obtaining medical certificates BKP states in its report that it has been

discrepancy arose as a consequence of the Customs Act § 13-12 being amended so that «information obtained by sign recognition system, can be stored up to

sanctioning procedure started) on the need to comply with the data protection laws, so, considering that the law [Article 58(2) and Whereas 148 GDPR] also makes

substantially correct, adequate for the purposes of obtaining and adequately secured, so that their processing does not violate the rights and freedoms of natural

prudence, informed the data subjects concerned on 22 August 2019 of the data leak so that they could take possible precautionary measures, if necessary. Thus,

obtained from the interested party, any information available on its origin; h) the existence of automated decisions, including profiling, to referred to

responding to this but for various reasons it has been impossible for us to do so more promptly. Likewise, we appreciate the consideration of sending a copy

of Law 3/2018 of December 5, which should have been done earlier, but, like so many other things, had not been done. SIXTH: On June 2, 1920, a motion for

the compilation of personal data, and, if so, on the logic applied and on the relevance and files, and, if so, on the logic applied and on the significance

2020/66/21 Subject: Ex officio decision data protection authority Clerk: pending H A T Á R O Z A T The National Data Protection and Freedom of Information Authority

interested parties with the necessary information so that know what happens when you activate these boxes, so that with all the information in your hand, decide

Article 15(1)(h) only relates to the form of automated decision making referred to in Article 22(1) to (4). This implied that under Article 15(1)(h), there is

information regarding the occurrence of the calculated probabilities. H. Art. 15 para. 1 lit. h GDPR provides that if there is automated decision-making including

legem interpretations about"consent" means the basis of the contested decision.so serve drtt. 72 ePR and 133 WEC do indeed act as lex speciolis with regard

processing the purpose is to deal with incidents and safety hazards clarification so that a third party can take legal action or legitimate interests in defense

be issued were reviewed, so that currently the conditions in the application have been modified legal entity of the AEAT, so that a negative certificate

voluntary payment of the proposed fine before the resolution of the procedure, so an additional reduction of 20% was applied as provided in Article 85 (2) LPACAP

Spanish DPA tried to contact the company in question and there was no response so the sanctioning procedure was initiated. Is the processing of personal and

builds on the ruling in K.H. et al./Slovakia (see paragraph 73), but does so in a somewhat different context. Where it is in K.H. et al./Slovakia concerned

not point out that OLVG was not obliged to provide information if by doing so it would provide evidence of a violation of the GDPR. This means that also

defendant about all aspects of the data processing covered by Art. 15(1)(a)-(h) GDPR, including the purpose of the processing, the duration of the processing

region) but this is no longer within the scope of the right of access request. So, I have obtained satisfaction concerning my complaint and I thank you for

the same date the complaining party accedes to the Notification Electronic, so that within a period of fifteen days the allegations that they consider appropriate

made on 06/03/2021, 07/03/2021 and 08/09/2021 of said claim to the defendant, so that he could proceed with its analysis and inform the this Agency within

them being on the Robinson List was because Adigital had a software error so the Robinson List was no accessible to be checked by Avilon Center prior to

ADDRESS.1 *** LOCALITY.1 (*** PROVINCE.1) that the owner is Mrs. H.H.H. - Dated 08/03/2021, H.H.H. sends this Agency the following information and statements:

Brussels-Capital Region. - During a period of transition, the two structures coexisted so that the relay of the mission legal process can switch from FAMIFED to the

October 2019, among other things, the so-called In paragraphs 42 and 63 of its judgment in the Planet49 case (Planet49 GmbH, C-673/17, EU: C: 2019: 246 (judgment

even adopt a new decision in so far as all facts and legal issues were already discussed in front of the APD. The Court can do so in case of a manifest factual

coerced to give the information, but they were given the possibility to do so. The University does not process the personal data of the students without

on Article 15(1)(h) GDPR, for information about the existence of automated decision-making within the meaning of that provision, in so far as that request

with the obligation of Article 15(1)(h) GDPR. The BVwG held in this respect that even though under Article 15(1)(h) GDPR it can be understood that a controller

appropriate procedural steps had been taken, a transfer was granted to the plaintiff so that, within twenty days, formalize the claim, which was carried out by means

41 of the GDPR Implementation Act (UAVG), more specifically Article 41(1)(h) UAVG. The Minister was also entitled to refuse the other documents, insofar

subject receives a copy of the information specified in Art. 15 (1) (a) to (h) GDPR. Further information is not required (OLG Stuttgart GRUR-RS 2021, 20480;

transmitted from animals to humans or from humans to animals (so-called "zoonoses"), so that in some cases, conclusions could be drawn about the health

Article 15(1)(h) GDPR is not limited to cases of Article 22 GDPR but also applies in other cases of purely automated processing, as Article 15(1)(h) GDPR uses

afterwards and it understood that they do not comply yet with the legislation, so it started the corresponding sanction procedure. Without prejudice to the

and Rio Tajo Health Centres, so that, following the established protocol, it is sent to all the members of the teams, so that all the workers at the Health

accused (Annex I), the obtaining-images of the width of the public sidewalk , so that it is observed evencars parked on public roads, without any kind of masking

similar case previously conducted by him. 1.1. The court sees no reason to do so. In its ruling of 17 October 2019 (judgment no. 135/2019), the Constitutional

G79196614, in accordance with the provisions of Article 58.2 d) of the RGPD, so that within a period of ten days it proceeds to order the person responsible

referred to in Article 13 of the GDPR fell on Giessegi” (note cit., p. 11); h. "the standard features of the Device are described below, specifying - where

29), so this is not convincing. If the data is still stored at the time of the oral hearing, the person responsible is still processing the data, so that

Administrator (H) / Advanced User (D): with this role you can perform the configuration of all options (always configurable by the Super user). - Operator (H) / Normal

article 13 of the GDPR. The claiming party made a request to the claimed party so that it They sent this information and they have not responded. Along with

following instructions of the person in charge, unless it is obliged to do so by virtue of the Law of the Union or of the Member States ”. The violation

service, edited in a different way from what actually happened in his clinic, so as to attribute to him statements that do not correspond to reality; ─ to

carried out the voluntary payment of the proposed fine before the resolution, so it benefited from an additional reduction of 20% (Article 85 (2) LPACAP).

service. Obligation to provide personal data and consequences of not doing so. "The provision of personal data requires a minimum age of 13 years or, where

just as I have access to this information that I should not be able to see so freely, the same thing happens with my personal data and the from other clients

members of his family and b) from the information systems "AMKA-EMAES" of H.D.I.K.A. SA and the Citizens' Register of the Ministry of Interior: i. Current

by Attorney H... A. G... | Category: Labor law ... so this is correct, but it doesn't go any further, since already .. .- Appendix 9 52 H. District Court

for a political party" qualify as personal data under Article 4(1) GDPR? If so, do they also qualify as special categories of personal data? Did the Austrian

of the collective body (here: the Appeals Body) G. H. (mistakenly referred to by the applicant as G. H.). This member of the appellate body did not participate

and early voluntary payment (600 €). The defendant agreed to both concepts, so it paid 600 € and the sanction procedure was closed by the AEPD. Share your

prevent data concerning customer vehicles – which identify these customers so that these data are in fact personal data – to be provided does not constitute

a request for information, related to the claim outlined in section First, so that within ten business days, the information and documentation indicated

processing is necessary prevent further deterioration of health; • Article 9(2)(h), where research involving persons who have survived COVID-19 patients is necessary

common law and equitable rights, it might have been expected to say so expressly. So far as concerns misuse of private information, Ms Proops submitted

and Article 9(2)(h) GDPR. Article 6(1)(c) GDPR entitles a controller to process data due to a legal obligation whereas Article 9(2)(h) justifies the processing

whether personal data has been processed and, if so, a specific set of information (Article 15(1)(a)-(h) GPDR) to be provided. Second, concerning the request

An Austrian court held that, under Article 15(1)(h) GDPR, and in order to describe a decision-making process, it is sufficient to disclose the data involved

controller refused D.-H.T’s request for information, relying on Article 23(1)(e)&(j) GDPR and Paragraph 32 German Tax Code. D.-H.T successfully challenged

external DPO could not voluntarily intervene but only acted when requested to do so by the controller. The fact that the controller decided, in the course of

for the address to be changed so that between January 1, 1988 and October 31, 1988 he was not “B. N.-Straße 00 ”in C. H., but lived in L. in the“ I .-------------------

user-turned-shares shows, among other things, that H: \ is the GIS team's dedicated network drive. About the H-drive, Høje-Taastrup Municipality has stated that

the infringement; (h) the manner in which the infringement became known to the supervisory authority, including whether, and if so to what extent, the

decision was automated within the scope of Article 22 and therefore Article 15(1)(h) applies. They also claimed to have a right to data portability under Article

to govern access to the computerised archive of patients' health data, so much so that in two cases a complaint was also filed with the competent Judicial

further argued 193 email addresses did not contain references to any names, so they were not personal data. The controller also stated that it happened due

access requests, Spotify provides information required by Article 15(1)(a)-(h) and 15(2) GDPR via an online function. When Spotify provides a copy of personal

controller) of a physical inspection as per Article 57(1)(a) GDPR, Article 57(1)(h) GDPR, cf. Article 58(1)(a) GDPR, Article 58(1)(b) GDPR, Article 58(1)(e) GDPR

question of whether information is owed pursuant to Art. 15 para. 1 lit. h GDPR and, if so, whether the BF has already provided this information sufficiently

              00.00.0000 28Responsible Creditreform                          H. 29b) 30Type of procedure                            Completed commercial.

personal data, purposes and treatments of which you wish to have information, so if he had specifically requested it, it would have been provided to through

on November 13, 2020, the claimed has not submitted a brief of allegations, so what is indicated in the Article 64 of Law 39/2015, of October 1, on Administrative

shared on the dark web. 7h) in what way the supervisory authority became aware of the infringement, in particular if and if so the extent to which the data

we want to make it clear that our database only contains e-mail addresses, so there is no data processing nor is it put the confidentiality of the recipients

means including, where appropriate, electronically. When the data subject so requests, the information may be provided orally, provided that the identity

the aggravating direction. h) in what way the supervisory authority became aware of the infringement, in particular if and if so the extent to which the data

addresses a specific issue relating to the link between the protection of so-called sensitive data (health data) and the administrative requirements for

(Journal of Laws of 2019, item 1781), as well as Art. 57 sec. 1 lit. a) and h), art. 58 sec. 2 lit. e) and lit. i), art. 83 sec. 1-2 and art. 83 sec. 4 lit

by twenty or so companies specializing in personalized advertising, the purpose of which is to track the user's navigation on the Web so that advertising

residence] , claimant (Agent: J.H.P.M. Raaijmakers), and the Minister of Finance, defendant (Agents: J.L. Lam MSc LL.M. and I.H.H.L. Kolthof). Process sequence

affected, so that the information cannot be associated with identified or identifiable persons, will submit that data to an aggregation process, so that the

data and if so, what data, on what legal basis and for what purpose; whether the controller made these data available to third parties and, if so, when, on

basis: Art. 4, Art. 5, Art. 6, Art. 51 Para. 1, Art. 57 Para. 1 lit. a and lit. h, Art. 58 Para. 1 lit. b and Para. 2 lit. d, lit. f, and Art. 77 Para. 1 of

Policy may vary depending on legislative or self-regulatory requirements, so users are advised to visit it periodically. It will be applicable in the event

in any way, so that it cannot be excluded that this amount also includes elements of a fine (r.o. 4.18); - it is not clear whether, and if so in what way

ii.h), this possibility has been specified for possible uses. When a treatment of this type occurs, it will be assessed by the Impact evaluation. h) On

that effective countermeasures exist against such access risks in the form of so-called "technical-organisational measures", which can ultimately exclude any

H&M was fined €50,000 for monitoring its employees with surveillance cameras in violation of the GDPR and of national labor provisions. Following a report

Regulation (a); conduct investigations on the application of this Regulation (h). The instruments for the implementation of tasks referred to Art. 57 of Regulation

provide for a judicial remedy for "pure" requests for information. In doing so, it overlooks the fact that a meritorious settlement of such an objection

claimant was obliged to provide the data, but whether he was entitled to do so (as the defendant correctly pointed out). According to settled case law, notification

defendant of the decision taken in this regard. Likewise, it was required so that within the period of one month send the Agency certain information: -

informed her how the e-mail box would be kept active, for another month or so, in order to redirect e-mail messages from potential customers procured on

of practice of tests, requiring the Command of the Civil Guard of Ourense so that, within 30 days, it would issue the corresponding report where it was

to the early voluntary payment (but it did not acknowledge its liability), so it paid 1,600 € and the sanction procedure was closed by the AEPD. Share your

whose processing was based on consent and had no other purposes of processing, so the data were deleted. The closure of the process was motivated by a risk

of Article 2(h) Directive 95/46/EC or an "informed and unambiguous indication of the data subject's wishes" within the meaning of Article 2(h) GDPR. Therefore

(iv) the employee was taken aback by the deletion request and refused to do so and during their stay in the hotel, the data subject did not the deletion

authority used the application as well as with what legal aid processing in so fall occurred. Statements from the Police Authority in the spring of 2020

digital rights (in forward LOPDGDD), said claim was forwarded to the DGT, so that proceed to its analysis and inform this Agency within a month of the

“@***mail-it.org” is used by H**** Wohnen & IT GmbH, FN 4*4*5*w (hereinafter “H****IT”). This is a 100% subsidiary of the accused. H****IT provides the entire

obtained from the interested party, any information available on its origin; h) the existence of automated decisions, including profiling, to which referred

applicationThe Litigation Chamber of the Data Protection Authority, composed of Mr H. Hijmans, President, and Mr D. Van Der Kelen and F. De Smet, Members ;Having

applicationThe Litigation Chamber of the Data Protection Authority, composed of Mr H. Hijmans, President, and Mr D. Van Der Kelen and F. De Smet, Members ;Having

to Article 7(1) Rv, the Dutch Court had jurisdiction if (i) the cases were so intertwined that they justify a joint hearing for reasons of efficiency, and

constant recording of neighbours private premises cannot be seen ‘relevant’, so processing could certainly not be ‘necessary’ for the legitimate interest

Locatefamily.com, which is aimed at restoring this ongoing infringement. To do so Locatefamily.com has to comply with the obligation as set out in article 27

General Data Protection Regulation) ( for measures according to points b), d), h) of paragraph 2. CXII of 2011 on the right to self-determination of information

the context of the judicial procedures which appear to be ongoing in Poland, so the issuing of the requested decrees against the Hellenic Bank is not necessary

requirements set in Article 28(3) GDPR, and notably points b, c, e, f, g and h. For example, the processing agreement did not contain any information on the

of a data subject to a credit reporting agency without a lawful basis to do so, as the debt was not yet enforceable. A data subject filed a complaint with

particular, she requested the information provided for in Article 15(1)(a) and (h) GDPR, and a copy of the personal data in possession of the controller. The

it basically gives a person a public status in society and exposes them to so-called media exposure for the act in question. The starting point is that

AVG. 25 May 2018, but only in so far as it concerns subjects that are not covered by the AVG but by national law and in so far as the Wbp does not conflict

(Journal of Laws of 2019, item 1781), as well as Art. 57 sec. 1 lit. a) and h), art. 58 sec. 2 lit. e) and i), art. 83 sec. 1 and sec. 2, art. 83 sec. 4

paragraph 70 of his Opinion, even stricter than that laid down in Article 2(h) of Directive 95/46, since it requires a 'free, specific, informed and unambiguous'

of the processing and a balancing test. As regards the first condition (the so-called "purpose test"), the DPA considers that the processing purpose as described

Articles 15 to 22 GDPR is not a prerequisite for filing a complaint with a DPA, so a DPA may act even if the data subject has not addressed the controller beforehand

subjects rights and freedoms. h) in what way the supervisory authority became aware of the infringement, in particular if and if so the extent to which the data

2003 on insider dealing and market manipulation and Article 23(2)(g) and (h) of Regulation (EU) No 596/2014 of the European Parliament and of the Council

[residence], APPLICANT for cassation, hereinafter: [person involved], lawyer: H.J.W. alto, against GOOGLE LLC, based in Mountain View, California, United States

evidence that the Company conducted the above-mentioned analysis whether, and if so in what way, the Company regularly tested, measured, and evaluated the effectiveness

to erasure (Article 17 GDPR) and objection to processing (Article 21 GDPR), so appeal based on these articles was dismissed. When deciding on the necessity

made clear why it was not required to do so, so that the Board believes that the defendant wrongly did not do so. Now, as the preliminary relief judge has

Information GmbH allowed to store data on the insoleveny of an individual beyond the availability of that data in the official insolveny register? If so, for how

the patient so that firm, and that they had ordered the staff not to do it again and although they have measures have been implemented so that this does

hundred and fifty-nine euros). Thus determined by C.H.M. van Altena, chairman, and G.M.H. Hoogvliet and H.C.P. Venema, members, in the presence of S. Langeveld-Mak

to the defendant on 07/19/2019 so that accredit the response to the claimant, the decision and the measures adopted so that no repeat similar incidents

order the Applicant to pay. 6. The Authority shall reject the application in so far as it requires the Authority to: Applicant for the immediate deletion

underwent the modification, if so, what were the measures and when were they taken, and if not, why? 4.Indication of whether, and if so, when and how PIKA regularly

GDPR for unlawful processing of the data without a proven justification to do so. Additionally, the AEPD held that Vodafone had acted with a lack of diligence

data, so on 4 January 2021, the beginning of the administrative period, for the first time it became necessary to clarify the financial issues, so within

cancel both registrations, but the controller denied to do deregister them, so they filed an action before the Court. The Court had to determine whether

lawful bases for processing (depending on the type of data) are: Article 9(2)(h) GDPR (necessary for the purposes of preventive or occupational medicine);

private nature. (h) the manner in which the supervisory authority became aware of the infringement, in particular whether and, if so, in which the degree

of 20% of the amount of the sanction, proceeding to the voluntary payment so that the amount was reduced to EUR 4000. Share blogs or news articles here

the reader compares whether there is an appropriate byte sequence, and if so, it sends only the item number to the program. The position number is assigned

Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter RGPD). So, dated 07/12/19, an informative request is addressed to the claimed entity

to what the providers themselves pointed out, they continued downloading, so it has proceeded to implement additional measures that guarantee the non-use

rather having to show it so that the defendant could certify before the CSD his mandate, existing option of one way or another. "So the students who sent

inhibiting this number automatically so that no can be included as a recipient in any case in these communications; So what will carry out controls periodically