Resources

Age-Appropriate Design Toolkit Tracker

Children as data subjects

Records Management Toolkit Tracker

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Age Appropriate Design Toolkit Tracker- more information about the Toolkit by UK ICO

Children as data subjects

Records Management Toolkit Tracker – more information about the Toolkit by UK ICO

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Spanish Data Protection Authority (aepd)-Website operator (6/5/2024)

Principles, Storage limitation

Italian Data Protection Authority (Garante)-Innova Camara (4/11/2024)

Principles, Sensitive Data, Storage limitation

Deputy Data Protection Ombudsman-Verkkokauppa.com (3/6/2024)

Data Subjects Rights, Principles, Storage limitation

Hellenic Data Protection Authority (HDPA)-Athens Urban Transport Organization (9/25/2023)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Storage limitation

Lithuanian Data Protection Authority (VDAI)-Company (4/20/2023)

Principles, Sensitive Data, Storage limitation, Technical and Organisational Measures (TOMs)

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Hotel (12/21/2022)

Controllers and Processors, Data Subjects Rights, Principles, Representative, Storage limitation

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Homeowners Association (1/3/2023)

Principles, Storage limitation

French Data Protection Authority (CNIL)-DISCORD INC. (11/10/2022)

Controllers and Processors, Data Subjects Rights, Principles, Storage limitation, Technical and Organisational Measures (TOMs)

Portuguese Data Protection Authority (CNPD)-Setúbal municipality (11/2/2022)

Principles, Sensitive Data, Storage limitation

Hellenic Data Protection Authority (HDPA)-IDIKA SA (8/8/2022)

Data Subjects Rights, Principles, Storage limitation

French Data Protection Authority (CNIL)-GIE INFOGREFFE (9/13/2022)

Data Subjects Rights, Principles, Storage limitation

National Commission for Data Protection (CNPD)-Company (6/30/2022)

Data Subjects Rights, Principles, Storage limitation

Danish Data Protection Authority (Datatilsynet)-Gyldendal A/S (6/22/2022)

Principles, Storage limitation

Belgian Data Protection Authority (APD)-Roularta Media Group (5/25/2022)

Consent, Controllers and Processors, Lawfulness of Processing, Principles, Representative, Storage limitation

Spanish Data Protection Authority (aepd)-CLUB DEPORTIVO SANSUEÑA, S.L. (10/5/2021)

Controllers and Processors, Principles, Representative, Storage limitation, Technical and Organisational Measures (TOMs)

French Data Protection Authority (CNIL)-SGAM AG2R LA MONDIALE (7/20/2021)

Data Subjects Rights, Principles, Storage limitation

National Commission for Data Protection (CNPD)-Unknown (4/8/2021)

Data Subjects Rights, Principles, Storage limitation

French Data Protection Authority (CNIL)-BRICO PRIVÉ (6/14/2021)

Access Requests (DSAR), Controllers and Processors, Data Subjects Rights, Principles, Storage limitation, Technical and Organisational Measures (TOMs)

Cypriot Data Protection Commissioner-Hellenic Bank (3/3/2021)

Controllers and Processors, Principles, Sensitive Data, Storage limitation, Technical and Organisational Measures (TOMs)

Data Protection Authority of Ireland-University College Dublin (12/17/2020)

Controllers and Processors, Data Breaches, Principles, Sensitive Data, Storage limitation, Technical and Organisational Measures (TOMs)

Danish Data Protection Authority (Datatilsynet)-Arp Hansen Hotel Group A/S (7/28/2020)

Principles, Storage limitation

Danish Data Protection Authority (Datatilsynet)-Taxa 4×35 (7/11/1905)

Principles, Storage limitation

Danish Data Protection Authority (Datatilsynet)-IDdesign A / S (2/12/2021)

Controllers and Processors, Principles, Representative, Storage limitation

French Data Protection Authority (CNIL)-SERGIC (Real Estate) (5/28/2019)

Principles, Storage limitation

Opinion 04/2024 on the notion of main establishment of a controller in the Union under Article 4(16)(a) GDPR |EPDB

Definitions, Main Establishment

GUIDELINES CLOCKING AND ATTENDANCE CONTROL PROCESSING USING BIOMETRIC SYSTEMS BY THE AEPD

Employment, Principles, Sensitive Data, Specific processing situations

Case C 683-2021

Data Controller, Data Processors, Joint Controllers

[Draft] Guidelines on the processing of personal data in regard to recruitment by the UK ICO

Automated Decision-making, Controllers and Processors, Data Protection Impact Assessment (DPIA), Employment, Specific processing situations

[Draft] Guidelines on the processing of personal data in regard to employment by the UK ICO

Employment, Specific processing situations

Everything Recruiters Need to Know About GDPR by ZOHO

Employment, Specific processing situations

Opinion on processing of CCTV data in regard to employee performance analytics by the Bulgarian DPA

CCTV, Employment, Specific processing situations

Protection of workers’ personal data: General principles by ILO

Employment, Specific processing situations

Child oriented approach to data processing by DPC Ireland

Children as data subjects, Data Subjects Rights

Bulgarian CPPD Newsletter

Children as data subjects, Controllers and Processors, Data Subjects Rights, Technical and Organisational Measures (TOMs)

Data protection and monitoring workers

Employment, Specific processing situations

C-272/19

Access Requests (DSAR), Data Controller, Data Subjects Rights, Definitions

C-34/21

Employment, Specific processing situations

Recommendation 5: Promote parental controls that respect the child’s privacy and best interests by CNIL

Children as data subjects, Data Subjects Rights

Recommendation 4: Seek parental consent for children under 15 by CNIL

Children as data subjects, Consent, Data Subjects Rights, Lawfulness of Processing

Recommendation 3: Support parents with digital education by CNIL

Children as data subjects, Data Subjects Rights

Recommendation 2: Encourage children to exercise their rights by CNIL

Children as data subjects, Data Subjects Rights

Recommendation 1: Regulate the capacity of children to act online by CNIL

Children as data subjects, Data Subjects Rights

Demonstration of a privacy-preserving age verification process by CNIL

Children as data subjects, Data Subjects Rights

Online age verification: balancing privacy and the protection of minors by CNIL

Children as data subjects, Data Subjects Rights

Online age verification: balancing privacy and the protection of minors by CNIL | French

Children as data subjects, Data Subjects Rights

Recommendation 7: Check the age of the child and parental consent while respecting the child’s privacy by CNIL

Children as data subjects, Data Subjects Rights

Recommendation 6: Strengthen the information and rights of children by design by CNIL

Children as data subjects, Data Subjects Rights

Case C‑461/22 CURIA

Data Controller, Definitions

Principles on Children & Online Gaming Adopted at the Nordic Data Protection Meeting in Oslo 30 May 2024

Children as data subjects, Data Subjects Rights

Opinion 39/2021 on whether Article 58(2)(g) GDPR could serve as a legal basis for a supervisory authority to order ex officio the erasure of personal data, in a situation where such request was not submitted by the data subject |EPDB

Data Controller, Data Subjects Rights, Definitions

EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse

Children as data subjects, Data Subjects Rights

How to deal with SARs as an employer by the UK ICO

Access Requests (DSAR), Employment

GenAI and data protection: how organisations and their employees can use it appropriately and lawfully

AI, Employment

Joint statement on data scraping and the protection of privacy

Personal Data Collection

Guidance Note: Employer Vehicle Tracking | Irish DPC

Employment

Fashion ID, 29 July 2019, C-40/17, ECLI:EU:C:2019:629

Data Controller, Data Processors

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH, in the presence of Facebook Ireland Ltd (Case C-210/16).

Data Controller

Weltimmo s.r.o. v. Nemzeti Adatvédelmi és Információszabadság Hatóság [2015] Case C-230/14, 1 October 2015

Main Establishment

Records of Processing Activities under Article 30 GDPR | Irish DPC

Records of processing Activities (ROPA)

WORKING PARTY 29 POSITION PAPER on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR

Records of processing Activities (ROPA)

Children and the GDPR | UK ICO

Children as data subjects

Records of processing activities template by the CNIL

Records of processing Activities (ROPA)

Guidelines 07/2020 on the concepts of controller and processor in the GDPR

Data Controller, Data Processors, Definitions

Telegram CEO’s Arrest Sparks Debate on Privacy vs. Regulation

Personal Data Collection, Technical and Organisational Measures (TOMs)

A 10-step guide to sharing information to safeguard children by the UK ICO

Children as data subjects

Building a Cybersecurity and Privacy Learning Program | NIST | Initial Public Draft

Data Breaches, Employment, Risk Management, Technical and Organisational Measures (TOMs)

Salvatore Manni Case C 398/15

Data Retention, Legitimate Interest, Storage limitation

A Guide to UK GDPR Principles | UK ICO

Accountability, Accuracy, Data minimisation, Integrity and confidentiality, Lawfulness of Processing, Principles, Purpose limitation, Storage limitation, Transparency

The Employment Practices Code | UK ICO

Data Subjects Rights, Employment