Resources

FTC decision against IntelliVision Technologies

Facial Recognition

Decision of 19 October 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Andorra

Adequacy Decisions

Decision of 30 June 2003 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Argentina

Adequacy Decisions

Decision of 20 December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act

Adequacy Decisions

Decision of 5 March 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data

Adequacy Decisions

Decision of 21 November 2003 on the adequate protection of personal data in Guernsey

Adequacy Decisions

Decision of 31 January 2011 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data

Adequacy Decisions

Decision of 28 April 2004 on the adequate protection of personal data in the Isle of Man

Adequacy Decisions

Decision (EU) 2019/419 of 23 January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information

Adequacy Decisions

Decision of 8 May 2008 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Jersey

Adequacy Decisions

Decision of 19 December 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by New Zealand

Adequacy Decisions

Decision (EU) 2022/254 of 17 December 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the Republic of Korea under the Personal Information Protection Act

Adequacy Decisions

Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland

Adequacy Decisions

Decision (EU) 2021/1772 of 28 June 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom (notified under document C(2021)4800)

Adequacy Decisions

Decision (EU) 2021/1773 of 28 June 2021 pursuant to Directive (EU) 2016/680 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom

Adequacy Decisions

Decision EU 2023/1795 of 10 July 2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework

Adequacy Decisions

Decision pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data

Adequacy Decisions

Decision pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data

Adequacy Decisions

Decision pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data

Adequacy Decisions

Assessing Potential Future AI Risks, Benefits, and Policy Imperatives OECD

AI, Risk Management, Technical and Organisational Measures (TOMs)

Reducing Risks Posed by Synthetic Content by NIST

AI, Risk Management, Technical and Organisational Measures (TOMs)

CAIDP Responds to Outcome of U.S. Convening of AI Safety Institutes

AI, Risk Management, Technical and Organisational Measures (TOMs)

AEPD (Spain) – EXP202315853 against Ibercaja Banco

Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Rețele Electrice Muntenia SA. (6/25/2024)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Rețele Electrice Dobrogea SA (6/25/2024)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-IRIDEX GROUP SALUBRIZARE SRL (5/9/2024)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-MEDICOVER SRL (5/9/2024)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-CENTRUL MEDICAL UNIREA SRL (5/8/2024)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-VESTA CEU ROMÂNIA SRL. (2/26/2024)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Veranda Obor S.A. (12/11/2023)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Cez Vânzare S.A. (10/2/2023)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-ING Bank NV Amsterdam Sucursala București (7/18/2023)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Artima S.A. (6/15/2023)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Data Protection Commissioner of Malta-Unknown (7/12/1905)

Lawfulness of Processing, Performance of Contract

Data Protection Commissioner of Malta-Unknown (7/12/1905)

Lawfulness of Processing, Performance of Contract

Data Protection Commissioner of Malta-Unknown (7/12/1905)

Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Tinmar Energy SA (3/14/2023)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Centrul Medical dr. Furtună Dan (3/16/2023)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Med Life S.A. (3/16/2023)

Controllers and Processors, Data Subjects Rights, Lawfulness of Processing, Performance of Contract, Technical and Organisational Measures (TOMs)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Apă Canal Ilfov SA (1/4/2023)

Controllers and Processors, Data Subjects Rights, Lawfulness of Processing, Performance of Contract, Technical and Organisational Measures (TOMs)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-BRISTOL LOGISTICS SA (1/12/2023)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Medicover S.R.L. (11/24/2022)

Controllers and Processors, Data Subjects Rights, Lawfulness of Processing, Performance of Contract, Technical and Organisational Measures (TOMs)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Realmedia Network SA (9/8/2022)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-S.C. Wine Point S.R.L. (6/15/2022)

Lawfulness of Processing, Performance of Contract

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-SC Interactions Marketing SRL (6/20/2022)

Lawfulness of Processing, Performance of Contract

Norwegian Supervisory Authority (Datatilsynet)-Lillestrøm Municipality (2/2/2022)

Controllers and Processors, Lawfulness of Processing, Performance of Contract, Principles, Representative

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Vodafone România SA (11/14/2021)

Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Spanish Data Protection Authority (aepd)-Creator Energy S.L. (6/4/2021)

Performance of Contract

Norwegian Supervisory Authority (Datatilsynet)-Asker Municipality (3/15/2021)

Controllers and Processors, Lawfulness of Processing, Performance of Contract, Principles, Representative, Technical and Organisational Measures (TOMs)

Norwegian Supervisory Authority (Datatilsynet)-Ålesund Municipality (3/15/2021)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Spanish Data Protection Authority (aepd)-I-DE Redes Eléctricas Inteligentes, S.A.U (3/2/2021)

Performance of Contract, Principles, Purpose limitation, Sensitive Data

Spanish Data Protection Authority (aepd)-Alterna Operador Integral S.L. (1/21/2021)

Performance of Contract

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Robinson Tours Ltd. (Robinson Tours Idegenforgalmi és Szolgáltató Kft.) (12/16/2020)

Controllers and Processors, Data Breaches, Lawfulness of Processing, Performance of Contract, Principles, Privacy by Design

Guidelines on Securing AI Systems by The Cyber Security Agency of Singapore (CSA)

AI, Risk Management, Specific processing situations

Case C‑21/23 CJEU (full text in german)

Controllers and Processors, Data Breaches, Health Data, Lawfulness of Processing, Principles, Sensitive Data

Press Release No 159/24 on Judgment of the Court in Case C-21/23 CJEU

Controllers and Processors, Data Breaches, Health Data, Lawfulness of Processing, Principles, Sensitive Data

Cyber Threat Modelling for Risk Assessment by CSB

Risk Management, Technical and Organisational Measures (TOMs)

Chief Information Security Officer_ HANDBOOK

Risk Management

“AI & Algorithmic Risks Report” by Dutch Data Protection Authority

AI, Risk Management, Specific processing situations

NIST Special Publication NIST SP 800-221A_Information and Communications Technology (ICT) Risk Outcomes Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio

Risk Management

Artificial Intelligence and Machine Learning in Health Care and Medical Sciences Best Practices by Pitfalls Gyorgy J. Simon Constantin Aliferis Springer

AI, Health Data, Principles, Sensitive Data, Specific processing situations

Recommendations 01/2021 on the adequacy referential under the Law Enforcement Directive |EPDB

Adequacy Decisions, Data Transfers

Case C‑740/22

Definitions, Personal Data

Case C‑604/22

Joint Controllers, Personal Data

DRAFT RISK ASSESSMENT REGULATIONS FOR CALIFORNIA PRIVACY PROTECTION AGENCY

Risk Management

Report on the first review of the functioning of the adequacy decisions adopted pursuant to Article 25(6) of Directive 95/46/EC

Adequacy Decisions, Data Transfers

Public Benefit and Privacy Panel for Health and Social Care (Guidance for applicants)

Health Data, Principles, Sensitive Data

C-252/21

Lawfulness of Processing, Performance of Contract, Principles, Sensitive Data

Effective Cyber Risk Management: A best practice governance guide for digitally secure and resilient organisations by Governance Institute of Australia

Risk Management, Technical and Organisational Measures (TOMs)

Final State of Texas v Meta Order 2024

Facial Recognition, Specific processing situations

Artificial Intelligence and Algorithms in Risk Assessment by the European Labour Authority

Risk Management

Case 4:23-cv-01110-P AHA v. Bacerra

Health Data, Principles, Sensitive Data

Opinion 11/2024 on the use of facial recognition to streamline airport passengers’ flow (compatibility with Articles 5(1)(e) and(f), 25 and 32 GDPR by EDPB

Facial Recognition, Specific processing situations

Information note by EDPB on data transfers under the GDPR to the United States after the adoption of the adequacy decision on 10 July 2023

Adequacy Decisions, Data Transfers

Opinion 14/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the United Kingdom |EPDB

Adequacy Decisions, Data Transfers

Opinion 15/2021 regarding the European Commission Draft Implementing Decision pursuant to Directive (EU) 2016/680 on the adequate protection of personal data in the United Kingdom |EDPB

Adequacy Decisions, Data Transfers

Opinion 32/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the Republic of Korea |EDPB

Adequacy Decisions, Data Transfers

Information Note by EDPB on the redress mechanism for EU/EEA individuals in relation to alleged violations of U.S. law with respect to their data collected by U.S authorities competent for national security

Adequacy Decisions, Data Transfers

EU-US Data Privacy Framework Template Complaint Form for Submitting Commercial Related Complaints to EU DPAs by EDPB

Adequacy Decisions, Data Transfers

Generative Artificial Intelligence Risk Assessment by State of California Department of Technology

AI, Risk Management, Specific processing situations

PRACTICE GUIDE SECURITY OF PERSONAL DATA Version 2024 by CNIL

Definitions, Personal Data

Opinion 32/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the Republic of Korea |EPDB

Adequacy Decisions, Data Transfers

EDPB-EDPS Joint Opinion 1/2022 on the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2021/953 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic |EPDB

Health Data, Principles, Sensitive Data

EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space

Health Data, Principles, Sensitive Data

Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU-US Data Privacy Framework |EPDB

Adequacy Decisions, Data Transfers

Personal data breaches in the health sector: how to avoid them (and how to deal with them when they happen) by the UK ICO

Data Breaches, Health Data

Nowak (C-434/16, EU:C:2017:994)

Personal Data

Patrick Breyer v. Germany Case C-582/14, 12 May 2016

Consent, Personal Data

What is Personal Data | UK ICO

Personal Data

COMMISSION IMPLEMENTING DECISION of 10.7.2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework

Adequacy Decisions, Data Transfers

Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects

Performance of Contract

Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak

Health Data

Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak

Health Data

Rules of Procedure by EDPB on the cooperation and respective roles of national SAs and the EDPB Secretariat regarding the submission of complaints in the redress mechanism available to EU individuals in relation to alleged violations of U.S law with respect to their data collected by U.S. authorities competent for national security

Adequacy Decisions, Data Transfers, Risk Management

Artificial Intelligence Risk Management Framework by NIST: Generative Artificial Intelligence Profile

AI, Risk Management, Specific processing situations

Rules of Procedure for the “Informal Panel of EU DPAs”according to the EU-US Data Privacy Framework by EDPB

Adequacy Decisions, Data Transfers

Template Complaint Form to the U.S. Office of the Director of National Intelligence’s Civil Liberties Protection Officer (CLPO) by EDPB

Adequacy Decisions, Data Transfers

Building a Cybersecurity and Privacy Learning Program | NIST | Initial Public Draft

Data Breaches, Employment, Risk Management, Technical and Organisational Measures (TOMs)

Board of Directors Handbook for Cloud Risk Governance | Google

Risk Management

A Guide to Lawful Basis | UK ICO

Consent, Lawfulness of Processing, Legal Obligation, Legitimate Interest, Performance of Contract, Public Interests, Vital Interests

The EDPB data protection guide for small business

AI, Risk Management

Approach to Data Spaces from GDPR Perspective (AEPD)

Data Spaces, Risk Management