Spanish DPA Fines Supermarket Chain 2,520,000 EUR for Unlawful Use of Facial Recognition System
Spanish Data Protection Authority imposed a €2,520,000 fine on Spanish supermarket chain Mercadona, S.A. for unlawful use of a facial recognition system.
GDPR
EDPB Publishes Guidelines on Codes of Conduct for Data Transfers
European Data Protection Board (EDPB) published draft guidelines on codes of conduct for personal data transfers for consultation.
Amazon Faces 746 Million EUR Fine for Data Privacy Breach
Amazon.com Inc. faces 746 million-euro (888 million USD) penalty for violating the European Union’s tough data protection rules.
Dutch DPA Fines TikTok 725,000 EUR for Transparency Violations
Dutch DPA imposed a €725,000 fine on TikTok for violating the privacy of young children namely for the company’s alleged lack of transparency.
Insights into the Future of Data Protection Enforcement
The FPF released a report “Insights into the future of data protection enforcement: Regulatory strategies of European Data Protection Authorities for 2021-2022”
Austrian Supreme Court asks CJEU if Facebook “undermines” GDPR since 2018
The Austrian Supreme Court referred fundamental questions about Facebook’s GDPR compliance to Court of Justice of European Union.
EDPB adopts urgent binding decision: Irish SA not to take final measures but to carry out statutory investigation
The EDPB adopted its first urgent binding decision pursuant to Art. 66(2) GDPR.
Lithuanian DPA Imposes Fine on a Sports Club for Use of Fingerprints
Lithuanian DPA fined sports club 20.000€ for improper use of fingerprints for identification.
Commission opens an infringement procedure against Belgium on the independence of its Data Protection Authority
The Commission sent formal notice to Belgium for violating Article 52 of the GDPR, which states that the DPA shall be independent.
Norwegian DPA fines company for accessing former employee’s e-mail inbox
The manager of the enterprise had changed the password and logged on to the complainant’s e-mail account every day for a period of six weeks after the employment had ended. Norwegian DPA found that the enterprise lacks a legal basis for accessing e-mail in this manner.
Digital ad industry accused of huge data breach
Legal action filed over volume of data shared by digital advertising firms during ad space sales.
CNIL releases draft recommendation on retention of traceability data
France’s data protection authority, the Commission nationale de l’informatique et des libertés, launched a public debate over its draft recommendation relating to terms of retention and use of data logs.