Resources

Data Broker Sells Voter Data on Support for QAnon and January 6

Data Sharing

Data Sharing Toolkit Tracker

Data Sharing

Records Management Toolkit Tracker

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Data Sharing Toolkit Tracker – more information about the Toolkit by UK ICO

Data Sharing

Records Management Toolkit Tracker – more information about the Toolkit by UK ICO

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Data Protection Authority of Brandenburg-Operator of a swimming pool (7/14/1905)

Lawfulness of Processing, Legal Obligation

Data Protection Authority of Hamburg-Covid-19 test center (7/14/1905)

Lawfulness of Processing, Legal Obligation

Belgian Data Protection Authority (APD)-Brussels Airport Charleroi (4/4/2022)

Lawfulness of Processing, Legal Obligation, Principles, Sensitive Data

Data Protection Authority of Hamburg-Company (7/12/1905)

Definitions, Joint Controllers

Hellenic Data Protection Authority (HDPA)-Municipal Organization for Pre-School Education and Social Solidarity (DOPAKA) of the municipality of Tavros Moschato (5/17/2021)

Legal Obligation

New data protection audit framework launched to help organisations improve compliance by UK ICO

Controllers and Processors, Data Sharing, Data Subjects Rights

Telegram’s New Policy: User Data to Be Shared with Authorities in Criminal Cases

Data Sharing, Data Subjects Rights

LinkedIn Used User Data for AI Training Before Updating Its Terms

AI, Data Sharing, Data Subjects Rights, Lawfulness of Processing

Report and Guidance on Privacy in Social Network Services – ”Rome Memorandum” by International Working Group on Data Protection in Telecommunications

Definitions, Processing of personal data

Recommendations 01/2021 on the adequacy referential under the Law Enforcement Directive |EPDB

Adequacy Decisions, Data Transfers

Opinion 04/2024 on the notion of main establishment of a controller in the Union under Article 4(16)(a) GDPR |EPDB

Definitions, Main Establishment

Case C‑740/22

Definitions, Personal Data

Case C‑604/22

Joint Controllers, Personal Data

Report on the first review of the functioning of the adequacy decisions adopted pursuant to Article 25(6) of Directive 95/46/EC

Adequacy Decisions, Data Transfers

Case C 683-2021

Data Controller, Data Processors, Joint Controllers

Press Release No 184-23 by the CJEU

Controllers and Processors, Joint Controllers, Liability and Remedies, Supervisory Authorities

Recommendations 1-2022 on the Application for Approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR)

Code of Conduct, Controllers and Processors

Case C-101/01

Data Transfers, Definitions, Principles, Processing of personal data, Sensitive Data

C-272/19

Access Requests (DSAR), Data Controller, Data Subjects Rights, Definitions

Case C-60/22

Accountability, Controllers and Processors, Joint Controllers, Principles

Frequently Asked Questions (FAQs) on the Data Act by the EU Commission

Controllers and Processors, Data Sharing

Data protection code of practice for digital identity schemes in Afrtica

Code of Conduct, Controllers and Processors

Meta Platforms Ireland v EDPB (Case T-319/24)

Controllers and Processors, Data Sharing, Data Subjects Rights

Case C‑461/22 CURIA

Data Controller, Definitions

Case C-394/23, Mousse: Request for a preliminary ruling from the Conseil d’État (France) lodged on 28 June 2023 — Association Mousse v Commission nationale de l’informatique et des libertés (CNIL), SNCF Connect

Definitions, Processing of personal data

Today’s and tomorrow’s means of payment facing the challenge of data protection by CNIL

Definitions, Processing of personal data

EditorsTrends in Data Protection and Encryption Technologies by SpringerProfessional

Definitions, New technology, Processing of personal data

Case 2:24-cv-05140 by the attorney general of California

Consent, Controllers and Processors, Data Sharing, Lawfulness of Processing

Information note by EDPB on data transfers under the GDPR to the United States after the adoption of the adequacy decision on 10 July 2023

Adequacy Decisions, Data Transfers

Opinion 20/2021 on Tobacco Traceability System |EDPB

Controllers and Processors, Data Sharing

Opinion 14/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the United Kingdom |EPDB

Adequacy Decisions, Data Transfers

Opinion 15/2021 regarding the European Commission Draft Implementing Decision pursuant to Directive (EU) 2016/680 on the adequate protection of personal data in the United Kingdom |EDPB

Adequacy Decisions, Data Transfers

Opinion 32/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the Republic of Korea |EDPB

Adequacy Decisions, Data Transfers

Information Note by EDPB on the redress mechanism for EU/EEA individuals in relation to alleged violations of U.S. law with respect to their data collected by U.S authorities competent for national security

Adequacy Decisions, Data Transfers

EU-US Data Privacy Framework Template Complaint Form for Submitting Commercial Related Complaints to EU DPAs by EDPB

Adequacy Decisions, Data Transfers

Opinion 23/2021 on the draft decision of the competent supervisory authority of Czech Republic regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EDPB

Code of Conduct, Controllers and Processors

Opinion 24/2021 on the draft decision of the competent supervisory authority of Slovakia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EDPB

Code of Conduct, Controllers and Processors

Opinion 16/2021 on the draft decision of the Belgian Supervisory Authority regarding the “EU Data Protection Code of Conduct for Cloud Service Providers” submitted by Scope Europe |EDPB

Code of Conduct, Controllers and Processors

Opinion 17/2021 on the draft decision of the French Supervisory Authority regarding the European code of conduct submitted by the Cloud Infrastructure Service Providers (CISPE) |EDPB

Code of Conduct, Controllers and Processors

Data Sharing Code of Practice by UK ICO [Controller to Controller]

Controllers and Processors, Data Sharing

PRACTICE GUIDE SECURITY OF PERSONAL DATA Version 2024 by CNIL

Definitions, Personal Data

Opinion 39/2021 on whether Article 58(2)(g) GDPR could serve as a legal basis for a supervisory authority to order ex officio the erasure of personal data, in a situation where such request was not submitted by the data subject |EPDB

Data Controller, Data Subjects Rights, Definitions

Opinion 32/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the Republic of Korea |EPDB

Adequacy Decisions, Data Transfers

Opinion 14/2022 on the draft decision of the competent supervisory authority of Bulgaria regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 15/2022 on the draft decision of the competent supervisory authority of Luxembourg regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 16/2022 on the draft decision of the competent supervisory authority of Slovenia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU-US Data Privacy Framework |EPDB

Adequacy Decisions, Data Transfers

Opinion 1/2023 on the draft decision of the competent supervisory authority of Croatia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to Article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 02/2023 on the draft decision of the competent supervisory authority of Latvia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to Article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 03/2023 on the draft decision of the competent supervisory authority of Romania regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Fashion ID, 29 July 2019, C-40/17, ECLI:EU:C:2019:629

Data Controller, Data Processors

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH, in the presence of Facebook Ireland Ltd (Case C-210/16).

Data Controller

Nowak (C-434/16, EU:C:2017:994)

Personal Data

Patrick Breyer v. Germany Case C-582/14, 12 May 2016

Consent, Personal Data

Weltimmo s.r.o. v. Nemzeti Adatvédelmi és Információszabadság Hatóság [2015] Case C-230/14, 1 October 2015

Main Establishment

What is Personal Data | UK ICO

Personal Data

COMMISSION IMPLEMENTING DECISION of 10.7.2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework

Adequacy Decisions, Data Transfers

Members of the Code of Conduct for Cloud Infrastructure Service Providers

Code of Conduct

Guidelines 07/2020 on the concepts of controller and processor in the GDPR

Data Controller, Data Processors, Definitions

Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679

Code of Conduct

Guidelines 02/2021 on virtual voice assistants

Voice Assistants

Addictive patterns in the processing of personal data Implications for data protection by AEPD

Definitions, Processing of personal data

Rules of Procedure by EDPB on the cooperation and respective roles of national SAs and the EDPB Secretariat regarding the submission of complaints in the redress mechanism available to EU individuals in relation to alleged violations of U.S law with respect to their data collected by U.S. authorities competent for national security

Adequacy Decisions, Data Transfers, Risk Management

Rules of Procedure for the “Informal Panel of EU DPAs”according to the EU-US Data Privacy Framework by EDPB

Adequacy Decisions, Data Transfers

Template Complaint Form to the U.S. Office of the Director of National Intelligence’s Civil Liberties Protection Officer (CLPO) by EDPB

Adequacy Decisions, Data Transfers

Salvatore Manni Case C 398/15

Data Retention, Legitimate Interest, Storage limitation

ANAF Case C‑201/14, 1 October 2015

Automated Decision-making, Data Sharing, Data Transfers, Public Administrative Body

A Guide to Lawful Basis | UK ICO

Consent, Lawfulness of Processing, Legal Obligation, Legitimate Interest, Performance of Contract, Public Interests, Vital Interests