Austrian court: Der Standard broke GDPR with pay-or-consent model
The Austrian Federal Administrative Court confirmed that newspaper Der Standard breached the EU’s data protection rules by using a “pay […]
compliance
Spains DPA fines hotels over scanning guest identity documents
AEPD fines Iberostar unit €70,000 for requiring full ID copies at booking; authority stresses GDPR data minimisation and that copies are unnecessary and risky for guest registration.
EDPS closes proceedings after Commission fixes Microsoft 365 data protection issues
EDPS finds the European Commission’s Microsoft 365 use compliant with Regulation (EU) 2018/1725 after contractual, technical and organisational measures addressed purpose limitation, transfers and disclosures.
IMY reprimands Flightradar24 for unlawful handling of aircraft owners’ data
IMY reprimanded Flightradar24 for GDPR breaches after routinely demanding aircraft registration certificates, requiring improved erasure procedures and proportional identity verification.
Ireland’s DPA Launches Toolkit to Safeguard Vulnerable Adults’ Data
New DPC Adult Safeguarding Toolkit guides organisations on GDPR-compliant collection, storage and sharing of vulnerable adults’ personal data with practical templates and sector collaboration.
German Court Restricts Police Use of Spyware
German high court restricts law enforcement use of spyware to cases with at least a three-year maximum sentence, citing severe interference with fundamental rights.
EDPB announces forthcoming unified GDPR breach reporting form
EDPB will publish an EU-wide GDPR breach notification template to standardize reporting, aid cross-border compliance, and support accompanying guidance and tools.
Microsoft Admits U.S. Access Risk to EU Citizen Data
Microsoft France admits it cannot guarantee French citizen data in EU datacenters is fully protected from U.S. government access, highlighting digital sovereignty challenges.
Noyb Targets Chinese Apps TikTok, AliExpress and WeChat Over GDPR Violations
Noyb filed GDPR complaints against TikTok, AliExpress, and WeChat for failing to properly respond to European users’ data access requests.
EU Commission Launches Review of UK’s Adequacy Decision
The EU Commission begins adopting new adequacy decisions confirming UK data protection safeguards for free and safe personal data flows between the EU and UK.
McDonald’s in Poland Fined €3.6 million for Employee Data Exposure and Security Failures
Polish Data Protection Authority fined McDonald’s and its processor over €3.6 million for GDPR violations after employee data exposure due to poor security and oversight.
DPC Opens GDPR Inquiry into TikTok’s Transfers of EEA Data to China
The DPC has launched an inquiry into TikTok’s transfer of EEA user data to China, focusing on GDPR compliance and the legality of cross-border data transfers.