The decision comes at the end of a proceeding initiated by a complaint filed by NOYB, the Austrian NGO co-founded by Maximillian Schrems. According to the Austrian DPA, data collected via Google Analytics and stored and further processed by Google violate EU law since US authorities might access it. Schrems, the honorary chairman of NOYB,...

In the judgment Ekimdzhiev and Others v. Bulgaria, the European Court of Human Rights held that Article 8 of the European Convention of Human Rights (ECHR) is violated by the Bulgarian law Special Surveillance Means Act 1997. The reasons outlined by the Court are lack of appropriate judicial oversight in issuing warrants, lack of clear...

While the European Union Agency for Law Enforcement Cooperation (Europol) has dealt with many data protection risks pointed by European Data Protection Supervisor in the past, the primary concern regarding storing of personal data pursuant to Europol regulations remains somewhat amiss. In light of this, the EDPS has ordered a six-month retention period within which...

Another public office sanctioned for lack of adequate cybersecurity measures. Pursuant to a cyberattack, personal information in the municipality’s database was leaked and published on dark web. The data was about residents and municipality’s employees. The DPA found shortcomings in the municipality’s cybersecurity posture including weak firewall protection and lack of secure backups. Find the...

John Edwards, the new UK Privacy Commissioner ,began his term on 4 January 2022. The term is for five years. Edwards previously served as privacy commissioner in New Zealand. Find the related press release here

The new guidance complements the earlier guidance released in 2017, which was produced by the Working Party Article 29. While the earlier version had a general character, the new guidance is released with the objective of helping controllers to manage collected data and established parameters to be considered in the conduction of risk management. Find...