Resources

Draft Methodology for Human Rights, Democracy and the Rule of Law Impact Assessment for AI Systems by Council of Europe

AI, Data Protection Impact Assessment (DPIA)

Slovenian SA Decision 0603-42/2023/12 against Dodo Pizza

CCTV, Lawfulness of Processing, Legitimate Interest

Records Management Toolkit Tracker

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Records Management Toolkit Tracker – more information about the Toolkit by UK ICO

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Corint Logistic SRL. (5/30/2024)

Access Requests (DSAR), Data Subjects Rights, Lawfulness of Processing, Principles, Right to Object, Sensitive Data

Data Protection Authority of Hessen-Company (7/15/1905)

Data Subjects Rights, Right to Object

Hellenic Data Protection Authority (HDPA)-Greek Ministry of Immigration and Asylum (4/2/2024)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Privacy by Design

Spanish Data Protection Authority (aepd)-CTC EXTERNALIZACIÓN, S.L (2/12/2024)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights

Dutch Supervisory Authority for Data Protection (AP)-International Card Services B.V. (1/15/2024)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

French Data Protection Authority (CNIL)-Candidate for parliamentary elections (12/22/2023)

Data Subjects Rights, Right to Object

Data Protection Authority of Sweden-Östersund Municipality’s Department for Children and Education (11/28/2023)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Hellenic Data Protection Authority (HDPA)-Athens Urban Transport Organization (9/25/2023)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Storage limitation

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-NN Asigurări de Viață S.A. (9/18/2023)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-CONCENTRA CENTRAL DE COMPRAS Y SERVICIOS S.L. (6/7/2023)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-Grizzaffi Management Srl (5/17/2023)

Data Subjects Rights, Lawfulness of Processing, Right to Object

Spanish Data Protection Authority (aepd)-GSMA LTD. (5/3/2023)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Austrian Data Protection Authority (dsb)-Operator of a public toilet (8/23/2022)

Lawfulness of Processing, Legitimate Interest, Sensitive Data

Spanish Data Protection Authority (aepd)-ALBERO FORTE COMPOSITE, S.L. (4/28/2023)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Spanish Data Protection Authority (aepd)-ECOMM MOVADGENCY S.L. (2/28/2023)

Data Subjects Rights, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Tensa Art Design SRL (4/4/2023)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-Azienda Universitaria Friuli Occidentale (12/15/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Principles, Sensitive Data

Italian Data Protection Authority (Garante)-Azienda Universitaria Friuli Centrale (12/15/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Principles, Sensitive Data

Italian Data Protection Authority (Garante)-Azienda Universitaria Giuliano Isontina (12/15/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Principles, Sensitive Data

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Tensa Art Design SA (2/1/2023)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-XASTRE DO PETO, S.L. (11/11/2022)

Consent, Data Subjects Rights, Lawfulness of Processing, Right to Object

French Data Protection Authority (CNIL)-ACCOR SA (8/19/2022)

Access Requests (DSAR), Data Subjects Rights, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Sephora Cosmetics România SA (8/4/2022)

Data Subjects Rights, Right to Object

Data Protection Authority of Niedersachsen-Volkswagen (7/26/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights

French Data Protection Authority (CNIL)-TotalEnergies Electricité et Gaz France (6/23/2022)

Data Subjects Rights, Right to Object

Norwegian Supervisory Authority (Datatilsynet)-Company (3/15/2022)

Consent, Data Subjects Rights, Lawfulness of Processing, Right to Object

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Workshop (3/29/2022)

Legitimate Interest, Principles, Purpose limitation, Sensitive Data

Danish Data Protection Authority (Datatilsynet)-Danish National Genome Center (3/25/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-IAMSAT Muntenia SA (2/22/2022)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-Azienda sanitaria unica regionale Marche (1/13/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Integrity and confidentiality, Principles

Italian Data Protection Authority (Garante)-T.S.M. s.r.l. (1/27/2022)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-Aimon Srl (11/25/2021)

Controllers and Processors, Data Subjects Rights, Lawfulness of Processing, Representative, Right to Object

Norwegian Supervisory Authority (Datatilsynet)-Elektro & Automasjon Systemer AS (12/13/2021)

Lawfulness of Processing, Legitimate Interest

French Data Protection Authority (CNIL)-FREE MOBILE (12/28/2021)

Data Subjects Rights, Principles, Privacy by Design, Right to Object

Hellenic Data Protection Authority (HDPA)-ΚΑΠΑ ΛΑΜΔΑ ΩΜΕΓΑ ΔΙΑΦΗΜΙΣΤΙΚΗ ΕΜΠΟΡΙΚΗ ΜΟΝΟΠΡΟΣΩΠΗ ΕΤΑΙΡΕΙΑ ΠΕΡΙΟΡΙΣΜΕΝΗΣ ΕΥΘΥΝΗΣ (10/14/2021)

Data Subjects Rights, Lawfulness of Processing, Right to Object

Spanish Data Protection Authority (aepd)-SERVICIOS LOGÍSTICOS MARTORELL SIGLO XXI, S.L. (10/26/2021)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Hellenic Data Protection Authority (HDPA)-PREMIUMMEDIA ΠΑΡΑΓΩΓΗ ΟΠΤΙΚΟ-ΑΚΟΥΣΤΙΚΩΝ ΕΡΓΩΝ ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΙΑ (10/4/2021)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (10/19/2021)

Data Subjects Rights, Right to Object

Data Protection Authority of Ireland-Vodafone Ireland Limited (9/7/2021)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-Caixabank S.A. (7/8/2021)

Lawfulness of Processing, Legitimate Interest

Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)-Storstockholms Lokaltrafik (6/21/2021)

Data Subjects Rights, Lawfulness of Processing, Legitimate Interest, Principles, Sensitive Data

Lithuanian Data Protection Authority (VDAI)-Unknown (7/12/1905)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Technical and Organisational Measures (TOMs)

Spanish Data Protection Authority (aepd)-Promotech Digital S.L. (4/6/2021)

Data Subjects Rights, Right to Object

Norwegian Supervisory Authority (Datatilsynet)-Ålesund Municipality (3/15/2021)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Spanish Data Protection Authority (aepd)-Equifax Iberica S.L. (3/10/2021)

Lawfulness of Processing, Legitimate Interest

French Data Protection Authority (CNIL)-Perfomeclic (12/7/2020)

Data minimisation, Data Subjects Rights, Principles, Right to Object, Sensitive Data

Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)-Gnosjö Municipality (11/25/2020)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Representative

Spanish Data Protection Authority (aepd)-Tour & People Max S.L. (7/31/2020)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-De Vere Spain S.L. (7/2/2020)

Data Subjects Rights, Right to Object

Deputy Data Protection Ombudsman-Taksi Helsinki (5/29/2020)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Representative

Deputy Data Protection Ombudsman-Kymen Vesi Oy (5/22/2020)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Financial Enterprise (6/26/2019)

Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Data Protection Authority of Hamburg-Hamburger Volksbank eG (7/11/1905)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-Eni Gas e Luce (12/11/2019)

Access Requests (DSAR), Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Italian Data Protection Authority (Garante)-TIM (telecommunications operator) (1/15/2020)

Access Requests (DSAR), Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Spanish Data Protection Authority (aepd)-Iberia Lineas Aereas de Espana, S.A. Operadora Unipersonal (2/3/2020)

Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Spanish Data Protection Authority (aepd)-Banco Bilbao Vizcaya Argentaria S.L. (2/3/2020)

Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-SC Enel Energie S.A. (Electricity Distributor) (12/16/2019)

Consent, Controllers and Processors, Data Subjects Rights, Lawfulness of Processing, Principles, Representative, Right to Object

Hellenic Data Protection Authority (HDPA)-Wind Hellas Telecommunications (10/18/2019)

Data Subjects Rights, Right to Object

Hellenic Data Protection Authority (HDPA)-Telecommunication Service Provider (10/7/2019)

Data Subjects Rights, Right to Object

Data Protection Authority of Sweden-School in Skellefteå (8/20/2019)

Controllers and Processors, Data minimisation, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data

Data Protection Authority of Berlin-Delivery Hero (9/19/2019)

Access Requests (DSAR), Data Subjects Rights, Right to Object

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg discussion paper on “Legal Foundations in Data Protection for the Use of AI”

AI, Lawfulness of Processing, Legitimate Interest, Specific processing situations

Case C‑621/22 CJEU

Lawfulness of Processing, Legitimate Interest, Marketing and Advertising, Specific processing situations

Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR by EDPB

Lawfulness of Processing, Legitimate Interest

Privacy Impact Assessment (PIA) Templates by CNIL

Data Protection Impact Assessment (DPIA)

Recommendation 01/2019 on the draft list of the European Data Protection Supervisor regarding the processing operations subject to the requirement of a data protection impact assessment (Article 39.4 of Regulation (EU) 2018/1725) |EPDB

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Opinion 04/2024 on the notion of main establishment of a controller in the Union under Article 4(16)(a) GDPR |EPDB

Definitions, Main Establishment

Comparison of U.S. State Privacy Laws. Data Protection Assessments by CIPL

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Recommendations 02/2020 on the European Essential Guarantees for surveillance measures

CCTV, Lawfulness of Processing, Legitimate Interest, Specific processing situations

Draft Impact Assessment Framework by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Processing Personal Data on the Basis of Legitimate Interests under the GDPR by FPF

Lawfulness of Processing, Legitimate Interest

Case C 683-2021

Data Controller, Data Processors, Joint Controllers

GUIDELINES ON LEGITIMATE INTEREST by the NPC of the Republic of Philippines

Lawfulness of Processing, Legitimate Interest

Annex: A summary of the Transparency in Health and Social Care guidance impact assessment by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

Transparency in health and social care by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

[Draft] Guidelines on the processing of personal data in regard to recruitment by the UK ICO

Automated Decision-making, Controllers and Processors, Data Protection Impact Assessment (DPIA), Employment, Specific processing situations

Privacy Impact Assessment Tool by the Australian Government

Controllers and Processors, Data Protection Impact Assessment (DPIA)

GDPR guidance: Legitimate Inerersts Assessments (LIA) for Digital Advertising

Lawfulness of Processing, Legitimate Interest, Marketing and Advertising, Specific processing situations

DPIA for AI template

Controllers and Processors, Data Protection Impact Assessment (DPIA)

AI and Data Protection Risk Toolkit by UK ICO

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

Audit Requirements for Personal Data Processing Activities involving AI by AEPD

Controllers and Processors, Data Protection Impact Assessment (DPIA), Technical and Organisational Measures (TOMs)

Human rights Impact Assessments for AI

Controllers and Processors, Data Protection Impact Assessment (DPIA)

One-Stop-Shop thematic case digest: RIGHT TO OBJECTAND RIGHT TO ERASURE

Data Subjects Rights, Right to Erasure, Right to Object

C-460/20

Data Subjects Rights, Right to Erasure, Search Engines, Specific processing situations

C-597/19

Lawfulness of Processing, Legitimate Interest

C-708/18

CCTV, Lawfulness of Processing, Legitimate Interest, Specific processing situations

C-272/19

Access Requests (DSAR), Data Controller, Data Subjects Rights, Definitions

C-136/17

Data Subjects Rights, Principles, Right to Erasure, Search Engines, Sensitive Data, Specific processing situations

Relying on the legal basis of legitimate interests to develop an AI system by CNIL

Lawfulness of Processing, Legitimate Interest

CNIL open source PIA software – data protection impact assessment

Data Protection Impact Assessment (DPIA)

Case C‑461/22 CURIA

Data Controller, Definitions

Data protection impact assessment for AI Solutions by Danish DPA

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

Data protection impact assessment on the processing of personal data on government Facebook Pages

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Opinion 39/2021 on whether Article 58(2)(g) GDPR could serve as a legal basis for a supervisory authority to order ex officio the erasure of personal data, in a situation where such request was not submitted by the data subject |EPDB

Data Controller, Data Subjects Rights, Definitions

Human rights Impact Assessments for AI by Access Now

AI, Data Protection Impact Assessment (DPIA)

Opinion on legitimate interests of the data controller (Opinion 06/2014)

Legitimate Interest

Joint statement on data scraping and the protection of privacy

Personal Data Collection

Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González [2014] Case C-131/12

Search Engines

Fashion ID, 29 July 2019, C-40/17, ECLI:EU:C:2019:629

Data Controller, Data Processors

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH, in the presence of Facebook Ireland Ltd (Case C-210/16).

Data Controller

CNIL and others v Google Case C 136/17

Search Engines, Specific processing situations

Google v CNIL Case C 507/17

Search Engines

Weltimmo s.r.o. v. Nemzeti Adatvédelmi és Információszabadság Hatóság [2015] Case C-230/14, 1 October 2015

Main Establishment

Guide to Data Protection Impact Assessments by PDPC Singapore

Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessments (DPIA) Template by UK ICO

Data Protection Impact Assessment (DPIA)

How to manage DPIAs by Data Protection Network (DPN)

Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessment (DPIAs) by APDCAT

Data Protection Impact Assessment (DPIA)

Guide to Data Protection Impact Assessments (DPIAs) by the Irish DPC

Data Protection Impact Assessment (DPIA)

GDPR Risk Assessment by the AEPD

Data Protection Impact Assessment (DPIA)

Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Knowledge Bases by CNIL

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Methodology by CNIL

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Methodology Mindmap by CNIL

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment – Internet of Things Devices (CNIL)

Data Protection Impact Assessment (DPIA)

Guidelines 07/2020 on the concepts of controller and processor in the GDPR

Data Controller, Data Processors, Definitions

Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679

Data Subjects Rights, Right to Object

CIPL Examples of Legitimate Interest Grounds for Processing of Personal Data [PDF] [Official Guidelines]

Lawfulness of Processing, Legitimate Interest

Telegram CEO’s Arrest Sparks Debate on Privacy vs. Regulation

Personal Data Collection, Technical and Organisational Measures (TOMs)

The NSW AI Assessment Framework

Controllers and Processors, Data Protection Impact Assessment (DPIA)

AI Possible Risks & Mitigations Optical Character Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

AI Possible Risks & Mitigations Named Entity Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

5310-C Privacy Threshold Assessments and Privacy Impact Assessments by Office of Information Security

Controllers and Processors, Data Protection Impact Assessment (DPIA)

AI and Data Protection risk toolkit by the UK ICO

AI, Data Protection Impact Assessment (DPIA)

Salvatore Manni Case C 398/15

Data Retention, Legitimate Interest, Storage limitation

A Guide to Lawful Basis | UK ICO

Consent, Lawfulness of Processing, Legal Obligation, Legitimate Interest, Performance of Contract, Public Interests, Vital Interests

Risk Management and Impact Assessment (DPIA) by AEPD

Data Protection Impact Assessment (DPIA)