CASES, SANCTIONS AND CLAIMS
- (2019, Mar) Drivers in the UK sue Uber for allegations of refusing Data Subject Access Requests for GPS and other app usage data.
- (2019, Apr) Danish DPA decides that public transportation travel cards system must respect the right to rectification; a system which only permits adding information instead of correcting it does not comply with the GDPR.
- (2019, Apr) UK High Court of Justice: data subjects are entitled to information about the sources from which an organisation received their personal data (Case of Rudd v Bridle [2019] EWHC 893 (QB)).
- (2019, Apr) German high court decides that the scope of the right to a copy of the personal data includes copies of performance and behavioral data. See here a comment on this case in English.
- (2019, Apr) There is a new request for a preliminary ruling originating from Verwaltungsgericht Wiesbaden (Germany) on the issue of the right to access and public bodies.
- (2019, May) The Cologne Regional Court, in a recent decision, has answered questions on the extent of “personal data” covered by the right of access, as well as what it means to provide a copy of the personal data.
- (2019, Jul) Italian DPA issues Decision on the right to be forgotten in a case concerning de-listing from Google search results.
- (2020, Jul) As shown by the EDPS newsletter, EDPS issued a decision on a complaint submitted against the European Parliament, concerning the access by a complainant’s to their evaluation results in an intelligible form.
- (2019, Nov) Poland: Company fined for obstructing withdrawal of consent by data subjects.
- (2019, Nov) France: Futura Internationale has been fined with 500,000 EUR by the France DPA (CNIL) for lack of compliance with the minimization principle and certain data subject rights (to be informed, to object) and, also, for not signing agreements for international data transfer.
- (2019) Regional Court of Frankfurt: refraining to process personal data in the future is also part of right to erasure (read this article for further reference).
- (2019) A Romanian court of first instance fines a state-owned company for publishing personal data on its website – judgement not final, subject to appeal.
- (2019) The Austrian DPA considered that a controller could identify the data subject using his/her e-mail address and the information already stored by the controller (read here a summary in English).
- (2020, Mar) According to the Regional Court of Heidelberg’s decision, the right of access is not observed if access can only be provided by the data controller with “unreasonable effort”.
- (2020, Mar) France’s highest court struck out a decision by CNIL to fine Google for limiting the right to be forgotten to Europe.
- (2020, Mar) The Swedish DPA imposes a fine of EUR 7 million on Google for failure to fulfill its obligations in respect of the right to request delisting.
- (2020, May) The Belgian DPA’s Litigation Chamber imposed a fine of 50.000 EUR based on the findings of lack of transparency and inappropriately documented and justified legal grounds.
- (2020, Aug) The local court of Seligenstadt (Hesse) decided that right of access according to the GDPR does not include information on data storage devices, cloud storage or already deleted data.
- (2020, Aug) The Belgian DPA has issued an administrative fine of €20,000 against the telecoms company Proximus after the company refused a client request to delete her personal details from the phone book.
REPORTS AND ARTICLES FROM OTHER ORGANISATIONS
- (2020, Jan) Read this post by Greet Gysen: Getting data subject rights right.
- (2020, Apr) MIT Technology Review: Why an internet that never forgets is especially bad for young people.
CNIL: The right to de-listing in questions. - (2020, Aug) Eduardo Ustaran: A forgotten right gets into action in UK A-Level controversy (see the article here).
OFFICIAL GUIDELINES, REPORTS AND STATEMENTS
- Irish DPC: complex definition to the ‘right to be forgotten’ or the right to erasure as stated in arts. 17 and art. 19 of the GDPR.
- (2019, Aug) ICO(UK): modifies its guidance on calculating the timescales for responding to data subject access requests.
- (2019, Oct) Irish DPC has updated its DSAR FAQ (Data Subject Access Requests).
- (2020, Feb) Bavarian DPA for the Private Sector: list of don’ts when handling data subject requests (see here an article in English).
- (2020, Jul) Centre for Information Policy Leadership: white paper on Data Subject Rights under the GDPR in a Global Data Driven and Connected World.
- (2020, Mar) The Gibraltar Regulatory Authority (‘GRA’) issued guidance on privacy notices under the GDPR and the Data Protection Act 2004 (as amended in 2018).
- (2020, Jul) EDPB: Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1).
- (2020, Aug) NautaDutilh: New Belgian DPA decision: broader “controller” concept & extensive access rights?
- (2020, Mar) The Gibraltar Regulatory Authority (‘GRA’) issued guidance on privacy notices under the GDPR and the Data Protection Act 2004 (as amended in 2018).
