In 2019 we’ve been very busy gathering news about data protection and sending monthly newsletters to all you privacy enthusiasts out there. This December we looked back at all the useful guidelines published by the Data Protection Authorities from EU Member States that made it to our newsletters and we gathered them all under the mistletoe.

So sit back, pour yourself a cup of hot chocolate and skim through all this data protection knowledge:

Belgium

📒 Guide for prior consultation following DPIA.
📒 DPIA List (original document in French / article in English).

Denmark

📒 New guidance about posting photos online (article in English).

Finland

📒 Updated cookie guidelines, in the aftermath of the Planet49 decision.

France

📒 DPIA whitelist.
📒 Cookie guidance.
📒 Kit for developers, including guidance on using libraries and third party SDKs.
📒 Draft standards on the processing of personal data for core HR activities.
📒 Binding regulation on the use of biometric data for the purpose of controlling workplace access to premises, devices and computers.
📒 Guide on interface design and choices (French only).

Germany

📒 Bavarian Data Protection Authority answers FAQ on connected vehicles (see here an article in English).
📒 Data Protection Authority of Brandenburg comments on the transfer of group employee data to a third country (article in English).
📒 Bavarian DPA published a new FAQ regarding the requirements for WebFonts, Maps, GoogleAnalytics, Facebook Custom Audience (read here an article in English).
📒 Guidelines on data transfers in asset deals.
📒 Audit checklist for GDPR readiness.
📒 Sample joint controllers agreement.
📒 Conference of Independent Federal and State Data Protection Authorities in Germany (DSK) issued a position paper on data protection requirements regarding the operation of Facebook pages. See here the paper in German and here an article in English.
📒 DSK also published Guidance and FAQ on cookies.
📒 DSK issued guidance on the applicability of the German Telemedia Act, which includes the topic of cookies post-GDPR and a paper on consent for scientific research.
📒 Guidance on data processing in the employment context (available only in German here; see article in English here).

Hungary

📒 Hungarian DPA: Key GDPR cases.

Ireland

📒 General Portable Storage Device Recommendations
📒 Guidance for Organisations on Phishing and Social Engineering Attacks.
📒 Guide to Data Protection Impact Assessments for any processing that is ‘likely to result in a high risk to individuals’, including some specified types of processing.
📒 DSAR FAQ (Data Subject Access Requests).
📒 Guidance for Organisations Engaging Cloud Service Providers.
📒 Guidance on direct marketing and GDPR requirements.
📒 Guide for users about app permission requests.
📒 Guidance on Requesting Personal Data from Prospective Tenants.
📒 Transfers of personal data to third countries or international organisations.
📒  Guidance on CCTV in the home.
📒  Guidance Note on Data Protection Basics.
📒  Quick Guide to GDPR Breach Notifications.
📒 Definition to the ‘right to be forgotten’ or the right to erasure as stated in arts. 17 and art. 19 of the GDPR.
📒 Guidance on the Use of CCTV – For Data Controllers.
📒 Guidance on Data Sharing in the Public Sector.
📒 Elections and canvassing: Data Protection and Electronic Marketing – the data protection rights of individuals.
📒 Guidance for Drivers on use of “Dash Cams”.

Italy

📒 FAQ on the topic of access to banking data.
📒 Approval of the ‘Code of conduct for credit reporting systems operated by private entities regarding consumer credit, creditworthiness and punctuality in payments’.
📒 Rules on processing personal data in the context of political campaigns.

Netherlands

📒 Severely restricts situations when legitimate interest ca be relied on as a legal ground for personal data processing (read here a summary in English).
📒 Further guidance on data breaches.
📒 Indication for the application of pecuniary sanctions under the GDPR (available in Dutch).

Poland

📒 New guide on data breaches.

Slovenia

📒 Cookie guidance.

Spain

📒 Introduction to the hash function as a personal data pseudonymisation technique
📒 Guidance on the use of cookies (English version available here).
📒 Opinion on DNS security, data protection, and privacy.
📒 Guide on the protection of personal data of patients.
📒 Guidelines on privacy by design.
📒 Joint Statement On Data Processing And Artificial Intelligence.
📒 Technical paper on transparency for mobile apps (full document here in Spanish).
📒 Report on the first year of GDPR application.
📒 Technical studies regarding the Android Operating System: User control over the personalization of advertisements and App access to the device screen. The studies are aimed at developers and users alike.
📒 Analysis on the data processing operations conducted via drone.
📒 Survey regarding the use of device fingerprinting.
📒 Guide on personal data breach management and notification.

United Kingdom

📒 Guidance on the processing of special categories of personal data.
📒 Modified guidance on calculating the timescales for responding to data subject access requests.
📒 Cookie guidance.
📒 Update report into adtech and real time bidding.
📒 GDPR – one year on.
📒 Information for medical practitioners with regard to patients’ access to medical data.