{"type":"index","name":"GDPR Navigator","publisher":{"name":"DPO School","url":"https://dposchool.com"},"regulation":{"identifier":"Regulation (EU) 2016/679","title":"Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)","eli":"http://data.europa.eu/eli/reg/2016/679/oj"},"url":"https://dposchool.com/gdpr","counts":{"chapters":11,"articles":99,"recitals":173},"anchors":"Paragraph and point ids on article pages and in 'anchors': '1' (paragraph 1), '3-b' (paragraph 3, point (b)), '1-a-i' (nested point), '4-11' (Article 4, definition (11)).","chapters":[{"number":1,"roman":"I","title":"General provisions","url":"https://dposchool.com/gdpr/chapter/1","sections":[],"articles":[{"number":1,"title":"Subject-matter and objectives","url":"https://dposchool.com/gdpr/article/1","json":"https://dposchool.com/gdpr/api/v1/articles/1.json"},{"number":2,"title":"Material scope","url":"https://dposchool.com/gdpr/article/2","json":"https://dposchool.com/gdpr/api/v1/articles/2.json"},{"number":3,"title":"Territorial scope","url":"https://dposchool.com/gdpr/article/3","json":"https://dposchool.com/gdpr/api/v1/articles/3.json"},{"number":4,"title":"Definitions","url":"https://dposchool.com/gdpr/article/4","json":"https://dposchool.com/gdpr/api/v1/articles/4.json"}]},{"number":2,"roman":"II","title":"Principles","url":"https://dposchool.com/gdpr/chapter/2","sections":[],"articles":[{"number":5,"title":"Principles relating to processing of personal data","url":"https://dposchool.com/gdpr/article/5","json":"https://dposchool.com/gdpr/api/v1/articles/5.json"},{"number":6,"title":"Lawfulness of processing","url":"https://dposchool.com/gdpr/article/6","json":"https://dposchool.com/gdpr/api/v1/articles/6.json"},{"number":7,"title":"Conditions for consent","url":"https://dposchool.com/gdpr/article/7","json":"https://dposchool.com/gdpr/api/v1/articles/7.json"},{"number":8,"title":"Conditions applicable to child's consent in relation to information society services","url":"https://dposchool.com/gdpr/article/8","json":"https://dposchool.com/gdpr/api/v1/articles/8.json"},{"number":9,"title":"Processing of special categories of personal data","url":"https://dposchool.com/gdpr/article/9","json":"https://dposchool.com/gdpr/api/v1/articles/9.json"},{"number":10,"title":"Processing of personal data relating to criminal convictions and offences","url":"https://dposchool.com/gdpr/article/10","json":"https://dposchool.com/gdpr/api/v1/articles/10.json"},{"number":11,"title":"Processing which does not require identification","url":"https://dposchool.com/gdpr/article/11","json":"https://dposchool.com/gdpr/api/v1/articles/11.json"}]},{"number":3,"roman":"III","title":"Rights of the data subject","url":"https://dposchool.com/gdpr/chapter/3","sections":[{"number":1,"title":"Transparency and modalities","articles":[12]},{"number":2,"title":"Information and access to personal data","articles":[13,14,15]},{"number":3,"title":"Rectification and erasure","articles":[16,17,18,19,20]},{"number":4,"title":"Right to object and automated individual decision-making","articles":[21,22]},{"number":5,"title":"Restrictions","articles":[23]}],"articles":[{"number":12,"title":"Transparent information, communication and modalities for the exercise of the rights of the data subject","url":"https://dposchool.com/gdpr/article/12","json":"https://dposchool.com/gdpr/api/v1/articles/12.json"},{"number":13,"title":"Information to be provided where personal data are collected from the data subject","url":"https://dposchool.com/gdpr/article/13","json":"https://dposchool.com/gdpr/api/v1/articles/13.json"},{"number":14,"title":"Information to be provided where personal data have not been obtained from the data subject","url":"https://dposchool.com/gdpr/article/14","json":"https://dposchool.com/gdpr/api/v1/articles/14.json"},{"number":15,"title":"Right of access by the data subject","url":"https://dposchool.com/gdpr/article/15","json":"https://dposchool.com/gdpr/api/v1/articles/15.json"},{"number":16,"title":"Right to rectification","url":"https://dposchool.com/gdpr/article/16","json":"https://dposchool.com/gdpr/api/v1/articles/16.json"},{"number":17,"title":"Right to erasure (‘right to be forgotten’)","url":"https://dposchool.com/gdpr/article/17","json":"https://dposchool.com/gdpr/api/v1/articles/17.json"},{"number":18,"title":"Right to restriction of processing","url":"https://dposchool.com/gdpr/article/18","json":"https://dposchool.com/gdpr/api/v1/articles/18.json"},{"number":19,"title":"Notification obligation regarding rectification or erasure of personal data or restriction of processing","url":"https://dposchool.com/gdpr/article/19","json":"https://dposchool.com/gdpr/api/v1/articles/19.json"},{"number":20,"title":"Right to data portability","url":"https://dposchool.com/gdpr/article/20","json":"https://dposchool.com/gdpr/api/v1/articles/20.json"},{"number":21,"title":"Right to object","url":"https://dposchool.com/gdpr/article/21","json":"https://dposchool.com/gdpr/api/v1/articles/21.json"},{"number":22,"title":"Automated individual decision-making, including profiling","url":"https://dposchool.com/gdpr/article/22","json":"https://dposchool.com/gdpr/api/v1/articles/22.json"},{"number":23,"title":"Restrictions","url":"https://dposchool.com/gdpr/article/23","json":"https://dposchool.com/gdpr/api/v1/articles/23.json"}]},{"number":4,"roman":"IV","title":"Controller and processor","url":"https://dposchool.com/gdpr/chapter/4","sections":[{"number":1,"title":"General obligations","articles":[24,25,26,27,28,29,30,31]},{"number":2,"title":"Security of personal data","articles":[32,33,34]},{"number":3,"title":"Data protection impact assessment and prior consultation","articles":[35,36]},{"number":4,"title":"Data protection officer","articles":[37,38,39]},{"number":5,"title":"Codes of conduct and certification","articles":[40,41,42,43]}],"articles":[{"number":24,"title":"Responsibility of the controller","url":"https://dposchool.com/gdpr/article/24","json":"https://dposchool.com/gdpr/api/v1/articles/24.json"},{"number":25,"title":"Data protection by design and by default","url":"https://dposchool.com/gdpr/article/25","json":"https://dposchool.com/gdpr/api/v1/articles/25.json"},{"number":26,"title":"Joint controllers","url":"https://dposchool.com/gdpr/article/26","json":"https://dposchool.com/gdpr/api/v1/articles/26.json"},{"number":27,"title":"Representatives of controllers or processors not established in the Union","url":"https://dposchool.com/gdpr/article/27","json":"https://dposchool.com/gdpr/api/v1/articles/27.json"},{"number":28,"title":"Processor","url":"https://dposchool.com/gdpr/article/28","json":"https://dposchool.com/gdpr/api/v1/articles/28.json"},{"number":29,"title":"Processing under the authority of the controller or processor","url":"https://dposchool.com/gdpr/article/29","json":"https://dposchool.com/gdpr/api/v1/articles/29.json"},{"number":30,"title":"Records of processing activities","url":"https://dposchool.com/gdpr/article/30","json":"https://dposchool.com/gdpr/api/v1/articles/30.json"},{"number":31,"title":"Cooperation with the supervisory authority","url":"https://dposchool.com/gdpr/article/31","json":"https://dposchool.com/gdpr/api/v1/articles/31.json"},{"number":32,"title":"Security of processing","url":"https://dposchool.com/gdpr/article/32","json":"https://dposchool.com/gdpr/api/v1/articles/32.json"},{"number":33,"title":"Notification of a personal data breach to the supervisory authority","url":"https://dposchool.com/gdpr/article/33","json":"https://dposchool.com/gdpr/api/v1/articles/33.json"},{"number":34,"title":"Communication of a personal data breach to the data subject","url":"https://dposchool.com/gdpr/article/34","json":"https://dposchool.com/gdpr/api/v1/articles/34.json"},{"number":35,"title":"Data protection impact assessment","url":"https://dposchool.com/gdpr/article/35","json":"https://dposchool.com/gdpr/api/v1/articles/35.json"},{"number":36,"title":"Prior consultation","url":"https://dposchool.com/gdpr/article/36","json":"https://dposchool.com/gdpr/api/v1/articles/36.json"},{"number":37,"title":"Designation of the data protection officer","url":"https://dposchool.com/gdpr/article/37","json":"https://dposchool.com/gdpr/api/v1/articles/37.json"},{"number":38,"title":"Position of the data protection officer","url":"https://dposchool.com/gdpr/article/38","json":"https://dposchool.com/gdpr/api/v1/articles/38.json"},{"number":39,"title":"Tasks of the data protection officer","url":"https://dposchool.com/gdpr/article/39","json":"https://dposchool.com/gdpr/api/v1/articles/39.json"},{"number":40,"title":"Codes of conduct","url":"https://dposchool.com/gdpr/article/40","json":"https://dposchool.com/gdpr/api/v1/articles/40.json"},{"number":41,"title":"Monitoring of approved codes of conduct","url":"https://dposchool.com/gdpr/article/41","json":"https://dposchool.com/gdpr/api/v1/articles/41.json"},{"number":42,"title":"Certification","url":"https://dposchool.com/gdpr/article/42","json":"https://dposchool.com/gdpr/api/v1/articles/42.json"},{"number":43,"title":"Certification bodies","url":"https://dposchool.com/gdpr/article/43","json":"https://dposchool.com/gdpr/api/v1/articles/43.json"}]},{"number":5,"roman":"V","title":"Transfers of personal data to third countries or international organisations","url":"https://dposchool.com/gdpr/chapter/5","sections":[],"articles":[{"number":44,"title":"General principle for transfers","url":"https://dposchool.com/gdpr/article/44","json":"https://dposchool.com/gdpr/api/v1/articles/44.json"},{"number":45,"title":"Transfers on the basis of an adequacy decision","url":"https://dposchool.com/gdpr/article/45","json":"https://dposchool.com/gdpr/api/v1/articles/45.json"},{"number":46,"title":"Transfers subject to appropriate safeguards","url":"https://dposchool.com/gdpr/article/46","json":"https://dposchool.com/gdpr/api/v1/articles/46.json"},{"number":47,"title":"Binding corporate rules","url":"https://dposchool.com/gdpr/article/47","json":"https://dposchool.com/gdpr/api/v1/articles/47.json"},{"number":48,"title":"Transfers or disclosures not authorised by Union law","url":"https://dposchool.com/gdpr/article/48","json":"https://dposchool.com/gdpr/api/v1/articles/48.json"},{"number":49,"title":"Derogations for specific situations","url":"https://dposchool.com/gdpr/article/49","json":"https://dposchool.com/gdpr/api/v1/articles/49.json"},{"number":50,"title":"International cooperation for the protection of personal data","url":"https://dposchool.com/gdpr/article/50","json":"https://dposchool.com/gdpr/api/v1/articles/50.json"}]},{"number":6,"roman":"VI","title":"Independent supervisory authorities","url":"https://dposchool.com/gdpr/chapter/6","sections":[{"number":1,"title":"Independent status","articles":[51,52,53,54]},{"number":2,"title":"Competence, tasks and powers","articles":[55,56,57,58,59]}],"articles":[{"number":51,"title":"Supervisory authority","url":"https://dposchool.com/gdpr/article/51","json":"https://dposchool.com/gdpr/api/v1/articles/51.json"},{"number":52,"title":"Independence","url":"https://dposchool.com/gdpr/article/52","json":"https://dposchool.com/gdpr/api/v1/articles/52.json"},{"number":53,"title":"General conditions for the members of the supervisory authority","url":"https://dposchool.com/gdpr/article/53","json":"https://dposchool.com/gdpr/api/v1/articles/53.json"},{"number":54,"title":"Rules on the establishment of the supervisory authority","url":"https://dposchool.com/gdpr/article/54","json":"https://dposchool.com/gdpr/api/v1/articles/54.json"},{"number":55,"title":"Competence","url":"https://dposchool.com/gdpr/article/55","json":"https://dposchool.com/gdpr/api/v1/articles/55.json"},{"number":56,"title":"Competence of the lead supervisory authority","url":"https://dposchool.com/gdpr/article/56","json":"https://dposchool.com/gdpr/api/v1/articles/56.json"},{"number":57,"title":"Tasks","url":"https://dposchool.com/gdpr/article/57","json":"https://dposchool.com/gdpr/api/v1/articles/57.json"},{"number":58,"title":"Powers","url":"https://dposchool.com/gdpr/article/58","json":"https://dposchool.com/gdpr/api/v1/articles/58.json"},{"number":59,"title":"Activity reports","url":"https://dposchool.com/gdpr/article/59","json":"https://dposchool.com/gdpr/api/v1/articles/59.json"}]},{"number":7,"roman":"VII","title":"Cooperation and consistency","url":"https://dposchool.com/gdpr/chapter/7","sections":[{"number":1,"title":"Cooperation","articles":[60,61,62]},{"number":2,"title":"Consistency","articles":[63,64,65,66,67]},{"number":3,"title":"European data protection board","articles":[68,69,70,71,72,73,74,75,76]}],"articles":[{"number":60,"title":"Cooperation between the lead supervisory authority and the other supervisory authorities concerned","url":"https://dposchool.com/gdpr/article/60","json":"https://dposchool.com/gdpr/api/v1/articles/60.json"},{"number":61,"title":"Mutual assistance","url":"https://dposchool.com/gdpr/article/61","json":"https://dposchool.com/gdpr/api/v1/articles/61.json"},{"number":62,"title":"Joint operations of supervisory authorities","url":"https://dposchool.com/gdpr/article/62","json":"https://dposchool.com/gdpr/api/v1/articles/62.json"},{"number":63,"title":"Consistency mechanism","url":"https://dposchool.com/gdpr/article/63","json":"https://dposchool.com/gdpr/api/v1/articles/63.json"},{"number":64,"title":"Opinion of the Board","url":"https://dposchool.com/gdpr/article/64","json":"https://dposchool.com/gdpr/api/v1/articles/64.json"},{"number":65,"title":"Dispute resolution by the Board","url":"https://dposchool.com/gdpr/article/65","json":"https://dposchool.com/gdpr/api/v1/articles/65.json"},{"number":66,"title":"Urgency procedure","url":"https://dposchool.com/gdpr/article/66","json":"https://dposchool.com/gdpr/api/v1/articles/66.json"},{"number":67,"title":"Exchange of information","url":"https://dposchool.com/gdpr/article/67","json":"https://dposchool.com/gdpr/api/v1/articles/67.json"},{"number":68,"title":"European Data Protection Board","url":"https://dposchool.com/gdpr/article/68","json":"https://dposchool.com/gdpr/api/v1/articles/68.json"},{"number":69,"title":"Independence","url":"https://dposchool.com/gdpr/article/69","json":"https://dposchool.com/gdpr/api/v1/articles/69.json"},{"number":70,"title":"Tasks of the Board","url":"https://dposchool.com/gdpr/article/70","json":"https://dposchool.com/gdpr/api/v1/articles/70.json"},{"number":71,"title":"Reports","url":"https://dposchool.com/gdpr/article/71","json":"https://dposchool.com/gdpr/api/v1/articles/71.json"},{"number":72,"title":"Procedure","url":"https://dposchool.com/gdpr/article/72","json":"https://dposchool.com/gdpr/api/v1/articles/72.json"},{"number":73,"title":"Chair","url":"https://dposchool.com/gdpr/article/73","json":"https://dposchool.com/gdpr/api/v1/articles/73.json"},{"number":74,"title":"Tasks of the Chair","url":"https://dposchool.com/gdpr/article/74","json":"https://dposchool.com/gdpr/api/v1/articles/74.json"},{"number":75,"title":"Secretariat","url":"https://dposchool.com/gdpr/article/75","json":"https://dposchool.com/gdpr/api/v1/articles/75.json"},{"number":76,"title":"Confidentiality","url":"https://dposchool.com/gdpr/article/76","json":"https://dposchool.com/gdpr/api/v1/articles/76.json"}]},{"number":8,"roman":"VIII","title":"Remedies, liability and penalties","url":"https://dposchool.com/gdpr/chapter/8","sections":[],"articles":[{"number":77,"title":"Right to lodge a complaint with a supervisory authority","url":"https://dposchool.com/gdpr/article/77","json":"https://dposchool.com/gdpr/api/v1/articles/77.json"},{"number":78,"title":"Right to an effective judicial remedy against a supervisory authority","url":"https://dposchool.com/gdpr/article/78","json":"https://dposchool.com/gdpr/api/v1/articles/78.json"},{"number":79,"title":"Right to an effective judicial remedy against a controller or processor","url":"https://dposchool.com/gdpr/article/79","json":"https://dposchool.com/gdpr/api/v1/articles/79.json"},{"number":80,"title":"Representation of data subjects","url":"https://dposchool.com/gdpr/article/80","json":"https://dposchool.com/gdpr/api/v1/articles/80.json"},{"number":81,"title":"Suspension of proceedings","url":"https://dposchool.com/gdpr/article/81","json":"https://dposchool.com/gdpr/api/v1/articles/81.json"},{"number":82,"title":"Right to compensation and liability","url":"https://dposchool.com/gdpr/article/82","json":"https://dposchool.com/gdpr/api/v1/articles/82.json"},{"number":83,"title":"General conditions for imposing administrative fines","url":"https://dposchool.com/gdpr/article/83","json":"https://dposchool.com/gdpr/api/v1/articles/83.json"},{"number":84,"title":"Penalties","url":"https://dposchool.com/gdpr/article/84","json":"https://dposchool.com/gdpr/api/v1/articles/84.json"}]},{"number":9,"roman":"IX","title":"Provisions relating to specific processing situations","url":"https://dposchool.com/gdpr/chapter/9","sections":[],"articles":[{"number":85,"title":"Processing and freedom of expression and information","url":"https://dposchool.com/gdpr/article/85","json":"https://dposchool.com/gdpr/api/v1/articles/85.json"},{"number":86,"title":"Processing and public access to official documents","url":"https://dposchool.com/gdpr/article/86","json":"https://dposchool.com/gdpr/api/v1/articles/86.json"},{"number":87,"title":"Processing of the national identification number","url":"https://dposchool.com/gdpr/article/87","json":"https://dposchool.com/gdpr/api/v1/articles/87.json"},{"number":88,"title":"Processing in the context of employment","url":"https://dposchool.com/gdpr/article/88","json":"https://dposchool.com/gdpr/api/v1/articles/88.json"},{"number":89,"title":"Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes","url":"https://dposchool.com/gdpr/article/89","json":"https://dposchool.com/gdpr/api/v1/articles/89.json"},{"number":90,"title":"Obligations of secrecy","url":"https://dposchool.com/gdpr/article/90","json":"https://dposchool.com/gdpr/api/v1/articles/90.json"},{"number":91,"title":"Existing data protection rules of churches and religious associations","url":"https://dposchool.com/gdpr/article/91","json":"https://dposchool.com/gdpr/api/v1/articles/91.json"}]},{"number":10,"roman":"X","title":"Delegated acts and implementing acts","url":"https://dposchool.com/gdpr/chapter/10","sections":[],"articles":[{"number":92,"title":"Exercise of the delegation","url":"https://dposchool.com/gdpr/article/92","json":"https://dposchool.com/gdpr/api/v1/articles/92.json"},{"number":93,"title":"Committee procedure","url":"https://dposchool.com/gdpr/article/93","json":"https://dposchool.com/gdpr/api/v1/articles/93.json"}]},{"number":11,"roman":"XI","title":"Final provisions","url":"https://dposchool.com/gdpr/chapter/11","sections":[],"articles":[{"number":94,"title":"Repeal of Directive 95/46/EC","url":"https://dposchool.com/gdpr/article/94","json":"https://dposchool.com/gdpr/api/v1/articles/94.json"},{"number":95,"title":"Relationship with Directive 2002/58/EC","url":"https://dposchool.com/gdpr/article/95","json":"https://dposchool.com/gdpr/api/v1/articles/95.json"},{"number":96,"title":"Relationship with previously concluded Agreements","url":"https://dposchool.com/gdpr/article/96","json":"https://dposchool.com/gdpr/api/v1/articles/96.json"},{"number":97,"title":"Commission reports","url":"https://dposchool.com/gdpr/article/97","json":"https://dposchool.com/gdpr/api/v1/articles/97.json"},{"number":98,"title":"Review of other Union legal acts on data protection","url":"https://dposchool.com/gdpr/article/98","json":"https://dposchool.com/gdpr/api/v1/articles/98.json"},{"number":99,"title":"Entry into force and application","url":"https://dposchool.com/gdpr/article/99","json":"https://dposchool.com/gdpr/api/v1/articles/99.json"}]}],"recitals":[{"number":1,"url":"https://dposchool.com/gdpr/recital/1","json":"https://dposchool.com/gdpr/api/v1/recitals/1.json"},{"number":2,"url":"https://dposchool.com/gdpr/recital/2","json":"https://dposchool.com/gdpr/api/v1/recitals/2.json"},{"number":3,"url":"https://dposchool.com/gdpr/recital/3","json":"https://dposchool.com/gdpr/api/v1/recitals/3.json"},{"number":4,"url":"https://dposchool.com/gdpr/recital/4","json":"https://dposchool.com/gdpr/api/v1/recitals/4.json"},{"number":5,"url":"https://dposchool.com/gdpr/recital/5","json":"https://dposchool.com/gdpr/api/v1/recitals/5.json"},{"number":6,"url":"https://dposchool.com/gdpr/recital/6","json":"https://dposchool.com/gdpr/api/v1/recitals/6.json"},{"number":7,"url":"https://dposchool.com/gdpr/recital/7","json":"https://dposchool.com/gdpr/api/v1/recitals/7.json"},{"number":8,"url":"https://dposchool.com/gdpr/recital/8","json":"https://dposchool.com/gdpr/api/v1/recitals/8.json"},{"number":9,"url":"https://dposchool.com/gdpr/recital/9","json":"https://dposchool.com/gdpr/api/v1/recitals/9.json"},{"number":10,"url":"https://dposchool.com/gdpr/recital/10","json":"https://dposchool.com/gdpr/api/v1/recitals/10.json"},{"number":11,"url":"https://dposchool.com/gdpr/recital/11","json":"https://dposchool.com/gdpr/api/v1/recitals/11.json"},{"number":12,"url":"https://dposchool.com/gdpr/recital/12","json":"https://dposchool.com/gdpr/api/v1/recitals/12.json"},{"number":13,"url":"https://dposchool.com/gdpr/recital/13","json":"https://dposchool.com/gdpr/api/v1/recitals/13.json"},{"number":14,"url":"https://dposchool.com/gdpr/recital/14","json":"https://dposchool.com/gdpr/api/v1/recitals/14.json"},{"number":15,"url":"https://dposchool.com/gdpr/recital/15","json":"https://dposchool.com/gdpr/api/v1/recitals/15.json"},{"number":16,"url":"https://dposchool.com/gdpr/recital/16","json":"https://dposchool.com/gdpr/api/v1/recitals/16.json"},{"number":17,"url":"https://dposchool.com/gdpr/recital/17","json":"https://dposchool.com/gdpr/api/v1/recitals/17.json"},{"number":18,"url":"https://dposchool.com/gdpr/recital/18","json":"https://dposchool.com/gdpr/api/v1/recitals/18.json"},{"number":19,"url":"https://dposchool.com/gdpr/recital/19","json":"https://dposchool.com/gdpr/api/v1/recitals/19.json"},{"number":20,"url":"https://dposchool.com/gdpr/recital/20","json":"https://dposchool.com/gdpr/api/v1/recitals/20.json"},{"number":21,"url":"https://dposchool.com/gdpr/recital/21","json":"https://dposchool.com/gdpr/api/v1/recitals/21.json"},{"number":22,"url":"https://dposchool.com/gdpr/recital/22","json":"https://dposchool.com/gdpr/api/v1/recitals/22.json"},{"number":23,"url":"https://dposchool.com/gdpr/recital/23","json":"https://dposchool.com/gdpr/api/v1/recitals/23.json"},{"number":24,"url":"https://dposchool.com/gdpr/recital/24","json":"https://dposchool.com/gdpr/api/v1/recitals/24.json"},{"number":25,"url":"https://dposchool.com/gdpr/recital/25","json":"https://dposchool.com/gdpr/api/v1/recitals/25.json"},{"number":26,"url":"https://dposchool.com/gdpr/recital/26","json":"https://dposchool.com/gdpr/api/v1/recitals/26.json"},{"number":27,"url":"https://dposchool.com/gdpr/recital/27","json":"https://dposchool.com/gdpr/api/v1/recitals/27.json"},{"number":28,"url":"https://dposchool.com/gdpr/recital/28","json":"https://dposchool.com/gdpr/api/v1/recitals/28.json"},{"number":29,"url":"https://dposchool.com/gdpr/recital/29","json":"https://dposchool.com/gdpr/api/v1/recitals/29.json"},{"number":30,"url":"https://dposchool.com/gdpr/recital/30","json":"https://dposchool.com/gdpr/api/v1/recitals/30.json"},{"number":31,"url":"https://dposchool.com/gdpr/recital/31","json":"https://dposchool.com/gdpr/api/v1/recitals/31.json"},{"number":32,"url":"https://dposchool.com/gdpr/recital/32","json":"https://dposchool.com/gdpr/api/v1/recitals/32.json"},{"number":33,"url":"https://dposchool.com/gdpr/recital/33","json":"https://dposchool.com/gdpr/api/v1/recitals/33.json"},{"number":34,"url":"https://dposchool.com/gdpr/recital/34","json":"https://dposchool.com/gdpr/api/v1/recitals/34.json"},{"number":35,"url":"https://dposchool.com/gdpr/recital/35","json":"https://dposchool.com/gdpr/api/v1/recitals/35.json"},{"number":36,"url":"https://dposchool.com/gdpr/recital/36","json":"https://dposchool.com/gdpr/api/v1/recitals/36.json"},{"number":37,"url":"https://dposchool.com/gdpr/recital/37","json":"https://dposchool.com/gdpr/api/v1/recitals/37.json"},{"number":38,"url":"https://dposchool.com/gdpr/recital/38","json":"https://dposchool.com/gdpr/api/v1/recitals/38.json"},{"number":39,"url":"https://dposchool.com/gdpr/recital/39","json":"https://dposchool.com/gdpr/api/v1/recitals/39.json"},{"number":40,"url":"https://dposchool.com/gdpr/recital/40","json":"https://dposchool.com/gdpr/api/v1/recitals/40.json"},{"number":41,"url":"https://dposchool.com/gdpr/recital/41","json":"https://dposchool.com/gdpr/api/v1/recitals/41.json"},{"number":42,"url":"https://dposchool.com/gdpr/recital/42","json":"https://dposchool.com/gdpr/api/v1/recitals/42.json"},{"number":43,"url":"https://dposchool.com/gdpr/recital/43","json":"https://dposchool.com/gdpr/api/v1/recitals/43.json"},{"number":44,"url":"https://dposchool.com/gdpr/recital/44","json":"https://dposchool.com/gdpr/api/v1/recitals/44.json"},{"number":45,"url":"https://dposchool.com/gdpr/recital/45","json":"https://dposchool.com/gdpr/api/v1/recitals/45.json"},{"number":46,"url":"https://dposchool.com/gdpr/recital/46","json":"https://dposchool.com/gdpr/api/v1/recitals/46.json"},{"number":47,"url":"https://dposchool.com/gdpr/recital/47","json":"https://dposchool.com/gdpr/api/v1/recitals/47.json"},{"number":48,"url":"https://dposchool.com/gdpr/recital/48","json":"https://dposchool.com/gdpr/api/v1/recitals/48.json"},{"number":49,"url":"https://dposchool.com/gdpr/recital/49","json":"https://dposchool.com/gdpr/api/v1/recitals/49.json"},{"number":50,"url":"https://dposchool.com/gdpr/recital/50","json":"https://dposchool.com/gdpr/api/v1/recitals/50.json"},{"number":51,"url":"https://dposchool.com/gdpr/recital/51","json":"https://dposchool.com/gdpr/api/v1/recitals/51.json"},{"number":52,"url":"https://dposchool.com/gdpr/recital/52","json":"https://dposchool.com/gdpr/api/v1/recitals/52.json"},{"number":53,"url":"https://dposchool.com/gdpr/recital/53","json":"https://dposchool.com/gdpr/api/v1/recitals/53.json"},{"number":54,"url":"https://dposchool.com/gdpr/recital/54","json":"https://dposchool.com/gdpr/api/v1/recitals/54.json"},{"number":55,"url":"https://dposchool.com/gdpr/recital/55","json":"https://dposchool.com/gdpr/api/v1/recitals/55.json"},{"number":56,"url":"https://dposchool.com/gdpr/recital/56","json":"https://dposchool.com/gdpr/api/v1/recitals/56.json"},{"number":57,"url":"https://dposchool.com/gdpr/recital/57","json":"https://dposchool.com/gdpr/api/v1/recitals/57.json"},{"number":58,"url":"https://dposchool.com/gdpr/recital/58","json":"https://dposchool.com/gdpr/api/v1/recitals/58.json"},{"number":59,"url":"https://dposchool.com/gdpr/recital/59","json":"https://dposchool.com/gdpr/api/v1/recitals/59.json"},{"number":60,"url":"https://dposchool.com/gdpr/recital/60","json":"https://dposchool.com/gdpr/api/v1/recitals/60.json"},{"number":61,"url":"https://dposchool.com/gdpr/recital/61","json":"https://dposchool.com/gdpr/api/v1/recitals/61.json"},{"number":62,"url":"https://dposchool.com/gdpr/recital/62","json":"https://dposchool.com/gdpr/api/v1/recitals/62.json"},{"number":63,"url":"https://dposchool.com/gdpr/recital/63","json":"https://dposchool.com/gdpr/api/v1/recitals/63.json"},{"number":64,"url":"https://dposchool.com/gdpr/recital/64","json":"https://dposchool.com/gdpr/api/v1/recitals/64.json"},{"number":65,"url":"https://dposchool.com/gdpr/recital/65","json":"https://dposchool.com/gdpr/api/v1/recitals/65.json"},{"number":66,"url":"https://dposchool.com/gdpr/recital/66","json":"https://dposchool.com/gdpr/api/v1/recitals/66.json"},{"number":67,"url":"https://dposchool.com/gdpr/recital/67","json":"https://dposchool.com/gdpr/api/v1/recitals/67.json"},{"number":68,"url":"https://dposchool.com/gdpr/recital/68","json":"https://dposchool.com/gdpr/api/v1/recitals/68.json"},{"number":69,"url":"https://dposchool.com/gdpr/recital/69","json":"https://dposchool.com/gdpr/api/v1/recitals/69.json"},{"number":70,"url":"https://dposchool.com/gdpr/recital/70","json":"https://dposchool.com/gdpr/api/v1/recitals/70.json"},{"number":71,"url":"https://dposchool.com/gdpr/recital/71","json":"https://dposchool.com/gdpr/api/v1/recitals/71.json"},{"number":72,"url":"https://dposchool.com/gdpr/recital/72","json":"https://dposchool.com/gdpr/api/v1/recitals/72.json"},{"number":73,"url":"https://dposchool.com/gdpr/recital/73","json":"https://dposchool.com/gdpr/api/v1/recitals/73.json"},{"number":74,"url":"https://dposchool.com/gdpr/recital/74","json":"https://dposchool.com/gdpr/api/v1/recitals/74.json"},{"number":75,"url":"https://dposchool.com/gdpr/recital/75","json":"https://dposchool.com/gdpr/api/v1/recitals/75.json"},{"number":76,"url":"https://dposchool.com/gdpr/recital/76","json":"https://dposchool.com/gdpr/api/v1/recitals/76.json"},{"number":77,"url":"https://dposchool.com/gdpr/recital/77","json":"https://dposchool.com/gdpr/api/v1/recitals/77.json"},{"number":78,"url":"https://dposchool.com/gdpr/recital/78","json":"https://dposchool.com/gdpr/api/v1/recitals/78.json"},{"number":79,"url":"https://dposchool.com/gdpr/recital/79","json":"https://dposchool.com/gdpr/api/v1/recitals/79.json"},{"number":80,"url":"https://dposchool.com/gdpr/recital/80","json":"https://dposchool.com/gdpr/api/v1/recitals/80.json"},{"number":81,"url":"https://dposchool.com/gdpr/recital/81","json":"https://dposchool.com/gdpr/api/v1/recitals/81.json"},{"number":82,"url":"https://dposchool.com/gdpr/recital/82","json":"https://dposchool.com/gdpr/api/v1/recitals/82.json"},{"number":83,"url":"https://dposchool.com/gdpr/recital/83","json":"https://dposchool.com/gdpr/api/v1/recitals/83.json"},{"number":84,"url":"https://dposchool.com/gdpr/recital/84","json":"https://dposchool.com/gdpr/api/v1/recitals/84.json"},{"number":85,"url":"https://dposchool.com/gdpr/recital/85","json":"https://dposchool.com/gdpr/api/v1/recitals/85.json"},{"number":86,"url":"https://dposchool.com/gdpr/recital/86","json":"https://dposchool.com/gdpr/api/v1/recitals/86.json"},{"number":87,"url":"https://dposchool.com/gdpr/recital/87","json":"https://dposchool.com/gdpr/api/v1/recitals/87.json"},{"number":88,"url":"https://dposchool.com/gdpr/recital/88","json":"https://dposchool.com/gdpr/api/v1/recitals/88.json"},{"number":89,"url":"https://dposchool.com/gdpr/recital/89","json":"https://dposchool.com/gdpr/api/v1/recitals/89.json"},{"number":90,"url":"https://dposchool.com/gdpr/recital/90","json":"https://dposchool.com/gdpr/api/v1/recitals/90.json"},{"number":91,"url":"https://dposchool.com/gdpr/recital/91","json":"https://dposchool.com/gdpr/api/v1/recitals/91.json"},{"number":92,"url":"https://dposchool.com/gdpr/recital/92","json":"https://dposchool.com/gdpr/api/v1/recitals/92.json"},{"number":93,"url":"https://dposchool.com/gdpr/recital/93","json":"https://dposchool.com/gdpr/api/v1/recitals/93.json"},{"number":94,"url":"https://dposchool.com/gdpr/recital/94","json":"https://dposchool.com/gdpr/api/v1/recitals/94.json"},{"number":95,"url":"https://dposchool.com/gdpr/recital/95","json":"https://dposchool.com/gdpr/api/v1/recitals/95.json"},{"number":96,"url":"https://dposchool.com/gdpr/recital/96","json":"https://dposchool.com/gdpr/api/v1/recitals/96.json"},{"number":97,"url":"https://dposchool.com/gdpr/recital/97","json":"https://dposchool.com/gdpr/api/v1/recitals/97.json"},{"number":98,"url":"https://dposchool.com/gdpr/recital/98","json":"https://dposchool.com/gdpr/api/v1/recitals/98.json"},{"number":99,"url":"https://dposchool.com/gdpr/recital/99","json":"https://dposchool.com/gdpr/api/v1/recitals/99.json"},{"number":100,"url":"https://dposchool.com/gdpr/recital/100","json":"https://dposchool.com/gdpr/api/v1/recitals/100.json"},{"number":101,"url":"https://dposchool.com/gdpr/recital/101","json":"https://dposchool.com/gdpr/api/v1/recitals/101.json"},{"number":102,"url":"https://dposchool.com/gdpr/recital/102","json":"https://dposchool.com/gdpr/api/v1/recitals/102.json"},{"number":103,"url":"https://dposchool.com/gdpr/recital/103","json":"https://dposchool.com/gdpr/api/v1/recitals/103.json"},{"number":104,"url":"https://dposchool.com/gdpr/recital/104","json":"https://dposchool.com/gdpr/api/v1/recitals/104.json"},{"number":105,"url":"https://dposchool.com/gdpr/recital/105","json":"https://dposchool.com/gdpr/api/v1/recitals/105.json"},{"number":106,"url":"https://dposchool.com/gdpr/recital/106","json":"https://dposchool.com/gdpr/api/v1/recitals/106.json"},{"number":107,"url":"https://dposchool.com/gdpr/recital/107","json":"https://dposchool.com/gdpr/api/v1/recitals/107.json"},{"number":108,"url":"https://dposchool.com/gdpr/recital/108","json":"https://dposchool.com/gdpr/api/v1/recitals/108.json"},{"number":109,"url":"https://dposchool.com/gdpr/recital/109","json":"https://dposchool.com/gdpr/api/v1/recitals/109.json"},{"number":110,"url":"https://dposchool.com/gdpr/recital/110","json":"https://dposchool.com/gdpr/api/v1/recitals/110.json"},{"number":111,"url":"https://dposchool.com/gdpr/recital/111","json":"https://dposchool.com/gdpr/api/v1/recitals/111.json"},{"number":112,"url":"https://dposchool.com/gdpr/recital/112","json":"https://dposchool.com/gdpr/api/v1/recitals/112.json"},{"number":113,"url":"https://dposchool.com/gdpr/recital/113","json":"https://dposchool.com/gdpr/api/v1/recitals/113.json"},{"number":114,"url":"https://dposchool.com/gdpr/recital/114","json":"https://dposchool.com/gdpr/api/v1/recitals/114.json"},{"number":115,"url":"https://dposchool.com/gdpr/recital/115","json":"https://dposchool.com/gdpr/api/v1/recitals/115.json"},{"number":116,"url":"https://dposchool.com/gdpr/recital/116","json":"https://dposchool.com/gdpr/api/v1/recitals/116.json"},{"number":117,"url":"https://dposchool.com/gdpr/recital/117","json":"https://dposchool.com/gdpr/api/v1/recitals/117.json"},{"number":118,"url":"https://dposchool.com/gdpr/recital/118","json":"https://dposchool.com/gdpr/api/v1/recitals/118.json"},{"number":119,"url":"https://dposchool.com/gdpr/recital/119","json":"https://dposchool.com/gdpr/api/v1/recitals/119.json"},{"number":120,"url":"https://dposchool.com/gdpr/recital/120","json":"https://dposchool.com/gdpr/api/v1/recitals/120.json"},{"number":121,"url":"https://dposchool.com/gdpr/recital/121","json":"https://dposchool.com/gdpr/api/v1/recitals/121.json"},{"number":122,"url":"https://dposchool.com/gdpr/recital/122","json":"https://dposchool.com/gdpr/api/v1/recitals/122.json"},{"number":123,"url":"https://dposchool.com/gdpr/recital/123","json":"https://dposchool.com/gdpr/api/v1/recitals/123.json"},{"number":124,"url":"https://dposchool.com/gdpr/recital/124","json":"https://dposchool.com/gdpr/api/v1/recitals/124.json"},{"number":125,"url":"https://dposchool.com/gdpr/recital/125","json":"https://dposchool.com/gdpr/api/v1/recitals/125.json"},{"number":126,"url":"https://dposchool.com/gdpr/recital/126","json":"https://dposchool.com/gdpr/api/v1/recitals/126.json"},{"number":127,"url":"https://dposchool.com/gdpr/recital/127","json":"https://dposchool.com/gdpr/api/v1/recitals/127.json"},{"number":128,"url":"https://dposchool.com/gdpr/recital/128","json":"https://dposchool.com/gdpr/api/v1/recitals/128.json"},{"number":129,"url":"https://dposchool.com/gdpr/recital/129","json":"https://dposchool.com/gdpr/api/v1/recitals/129.json"},{"number":130,"url":"https://dposchool.com/gdpr/recital/130","json":"https://dposchool.com/gdpr/api/v1/recitals/130.json"},{"number":131,"url":"https://dposchool.com/gdpr/recital/131","json":"https://dposchool.com/gdpr/api/v1/recitals/131.json"},{"number":132,"url":"https://dposchool.com/gdpr/recital/132","json":"https://dposchool.com/gdpr/api/v1/recitals/132.json"},{"number":133,"url":"https://dposchool.com/gdpr/recital/133","json":"https://dposchool.com/gdpr/api/v1/recitals/133.json"},{"number":134,"url":"https://dposchool.com/gdpr/recital/134","json":"https://dposchool.com/gdpr/api/v1/recitals/134.json"},{"number":135,"url":"https://dposchool.com/gdpr/recital/135","json":"https://dposchool.com/gdpr/api/v1/recitals/135.json"},{"number":136,"url":"https://dposchool.com/gdpr/recital/136","json":"https://dposchool.com/gdpr/api/v1/recitals/136.json"},{"number":137,"url":"https://dposchool.com/gdpr/recital/137","json":"https://dposchool.com/gdpr/api/v1/recitals/137.json"},{"number":138,"url":"https://dposchool.com/gdpr/recital/138","json":"https://dposchool.com/gdpr/api/v1/recitals/138.json"},{"number":139,"url":"https://dposchool.com/gdpr/recital/139","json":"https://dposchool.com/gdpr/api/v1/recitals/139.json"},{"number":140,"url":"https://dposchool.com/gdpr/recital/140","json":"https://dposchool.com/gdpr/api/v1/recitals/140.json"},{"number":141,"url":"https://dposchool.com/gdpr/recital/141","json":"https://dposchool.com/gdpr/api/v1/recitals/141.json"},{"number":142,"url":"https://dposchool.com/gdpr/recital/142","json":"https://dposchool.com/gdpr/api/v1/recitals/142.json"},{"number":143,"url":"https://dposchool.com/gdpr/recital/143","json":"https://dposchool.com/gdpr/api/v1/recitals/143.json"},{"number":144,"url":"https://dposchool.com/gdpr/recital/144","json":"https://dposchool.com/gdpr/api/v1/recitals/144.json"},{"number":145,"url":"https://dposchool.com/gdpr/recital/145","json":"https://dposchool.com/gdpr/api/v1/recitals/145.json"},{"number":146,"url":"https://dposchool.com/gdpr/recital/146","json":"https://dposchool.com/gdpr/api/v1/recitals/146.json"},{"number":147,"url":"https://dposchool.com/gdpr/recital/147","json":"https://dposchool.com/gdpr/api/v1/recitals/147.json"},{"number":148,"url":"https://dposchool.com/gdpr/recital/148","json":"https://dposchool.com/gdpr/api/v1/recitals/148.json"},{"number":149,"url":"https://dposchool.com/gdpr/recital/149","json":"https://dposchool.com/gdpr/api/v1/recitals/149.json"},{"number":150,"url":"https://dposchool.com/gdpr/recital/150","json":"https://dposchool.com/gdpr/api/v1/recitals/150.json"},{"number":151,"url":"https://dposchool.com/gdpr/recital/151","json":"https://dposchool.com/gdpr/api/v1/recitals/151.json"},{"number":152,"url":"https://dposchool.com/gdpr/recital/152","json":"https://dposchool.com/gdpr/api/v1/recitals/152.json"},{"number":153,"url":"https://dposchool.com/gdpr/recital/153","json":"https://dposchool.com/gdpr/api/v1/recitals/153.json"},{"number":154,"url":"https://dposchool.com/gdpr/recital/154","json":"https://dposchool.com/gdpr/api/v1/recitals/154.json"},{"number":155,"url":"https://dposchool.com/gdpr/recital/155","json":"https://dposchool.com/gdpr/api/v1/recitals/155.json"},{"number":156,"url":"https://dposchool.com/gdpr/recital/156","json":"https://dposchool.com/gdpr/api/v1/recitals/156.json"},{"number":157,"url":"https://dposchool.com/gdpr/recital/157","json":"https://dposchool.com/gdpr/api/v1/recitals/157.json"},{"number":158,"url":"https://dposchool.com/gdpr/recital/158","json":"https://dposchool.com/gdpr/api/v1/recitals/158.json"},{"number":159,"url":"https://dposchool.com/gdpr/recital/159","json":"https://dposchool.com/gdpr/api/v1/recitals/159.json"},{"number":160,"url":"https://dposchool.com/gdpr/recital/160","json":"https://dposchool.com/gdpr/api/v1/recitals/160.json"},{"number":161,"url":"https://dposchool.com/gdpr/recital/161","json":"https://dposchool.com/gdpr/api/v1/recitals/161.json"},{"number":162,"url":"https://dposchool.com/gdpr/recital/162","json":"https://dposchool.com/gdpr/api/v1/recitals/162.json"},{"number":163,"url":"https://dposchool.com/gdpr/recital/163","json":"https://dposchool.com/gdpr/api/v1/recitals/163.json"},{"number":164,"url":"https://dposchool.com/gdpr/recital/164","json":"https://dposchool.com/gdpr/api/v1/recitals/164.json"},{"number":165,"url":"https://dposchool.com/gdpr/recital/165","json":"https://dposchool.com/gdpr/api/v1/recitals/165.json"},{"number":166,"url":"https://dposchool.com/gdpr/recital/166","json":"https://dposchool.com/gdpr/api/v1/recitals/166.json"},{"number":167,"url":"https://dposchool.com/gdpr/recital/167","json":"https://dposchool.com/gdpr/api/v1/recitals/167.json"},{"number":168,"url":"https://dposchool.com/gdpr/recital/168","json":"https://dposchool.com/gdpr/api/v1/recitals/168.json"},{"number":169,"url":"https://dposchool.com/gdpr/recital/169","json":"https://dposchool.com/gdpr/api/v1/recitals/169.json"},{"number":170,"url":"https://dposchool.com/gdpr/recital/170","json":"https://dposchool.com/gdpr/api/v1/recitals/170.json"},{"number":171,"url":"https://dposchool.com/gdpr/recital/171","json":"https://dposchool.com/gdpr/api/v1/recitals/171.json"},{"number":172,"url":"https://dposchool.com/gdpr/recital/172","json":"https://dposchool.com/gdpr/api/v1/recitals/172.json"},{"number":173,"url":"https://dposchool.com/gdpr/recital/173","json":"https://dposchool.com/gdpr/api/v1/recitals/173.json"}],"references":{"checkedOn":"2026-10-28","counts":{"cases":76,"guidance":70,"fines":60},"cases":[{"kind":"cjeu-case","id":"C-474/24","name":"AR and Others v Österreichische Datenschutzbehörde and Others","ecli":"ECLI:EU:C:2026:579","judgmentDate":"2026-07-14","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-474-24","json":"https://dposchool.com/gdpr/api/v1/cases/c-474-24.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-199/24","name":"ND v Legal Newsdesk Sweden AB, anciennement Garrapatica AB","ecli":"ECLI:EU:C:2026:564","judgmentDate":"2026-07-09","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-199-24","json":"https://dposchool.com/gdpr/api/v1/cases/c-199-24.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-484/24","name":"NTH Haustechnik GmbH v EM","ecli":"ECLI:EU:C:2026:496","judgmentDate":"2026-06-18","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-484-24","json":"https://dposchool.com/gdpr/api/v1/cases/c-484-24.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-414/24","name":"Datenschutzbehörde and Dr. G S v Bundesministerin für Justiz and D GmbH","ecli":"ECLI:EU:C:2026:493","judgmentDate":"2026-06-18","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-414-24","json":"https://dposchool.com/gdpr/api/v1/cases/c-414-24.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-526/24","name":"Brillen Rottler GmbH & Co. KG v TC","ecli":"ECLI:EU:C:2026:216","judgmentDate":"2026-03-19","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-526-24","json":"https://dposchool.com/gdpr/api/v1/cases/c-526-24.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-97/23 P","name":"WhatsApp Ireland Ltd v European Data Protection Board","ecli":"ECLI:EU:C:2026:81","judgmentDate":"2026-02-10","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-97-23-p","json":"https://dposchool.com/gdpr/api/v1/cases/c-97-23-p.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-422/24","name":"Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik","ecli":"ECLI:EU:C:2025:980","judgmentDate":"2025-12-18","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-422-24","json":"https://dposchool.com/gdpr/api/v1/cases/c-422-24.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-492/23","name":"X v Russmedia Digital SRL and Inform Media Press SRL","ecli":"ECLI:EU:C:2025:935","judgmentDate":"2025-12-02","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-492-23","json":"https://dposchool.com/gdpr/api/v1/cases/c-492-23.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-413/23 P","name":"European Data Protection Supervisor v Single Resolution Board","ecli":"ECLI:EU:C:2025:645","judgmentDate":"2025-09-04","group":"related","url":"https://dposchool.com/gdpr/case/c-413-23-p","json":"https://dposchool.com/gdpr/api/v1/cases/c-413-23-p.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-655/23","name":"IP v Quirin Privatbank AG","ecli":"ECLI:EU:C:2025:655","judgmentDate":"2025-09-04","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-655-23","json":"https://dposchool.com/gdpr/api/v1/cases/c-655-23.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-247/23","name":"VP v Országos Idegenrendészeti Főigazgatóság","ecli":"ECLI:EU:C:2025:172","judgmentDate":"2025-03-13","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-247-23","json":"https://dposchool.com/gdpr/api/v1/cases/c-247-23.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-638/23","name":"Amt der Tiroler Landesregierung v Datenschutzbehörde","ecli":"ECLI:EU:C:2025:127","judgmentDate":"2025-02-27","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-638-23","json":"https://dposchool.com/gdpr/api/v1/cases/c-638-23.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-203/22","name":"CK v Magistrat der Stadt Wien","ecli":"ECLI:EU:C:2025:117","judgmentDate":"2025-02-27","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-203-22","json":"https://dposchool.com/gdpr/api/v1/cases/c-203-22.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-383/23","name":"Criminal proceedings against ILVA A/S","ecli":"ECLI:EU:C:2025:84","judgmentDate":"2025-02-13","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-383-23","json":"https://dposchool.com/gdpr/api/v1/cases/c-383-23.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-394/23","name":"Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect","ecli":"ECLI:EU:C:2025:2","judgmentDate":"2025-01-09","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-394-23","json":"https://dposchool.com/gdpr/api/v1/cases/c-394-23.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-416/23","name":"Österreichische Datenschutzbehörde v F R","ecli":"ECLI:EU:C:2025:3","judgmentDate":"2025-01-09","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-416-23","json":"https://dposchool.com/gdpr/api/v1/cases/c-416-23.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-65/23","name":"MK v K GmbH","ecli":"ECLI:EU:C:2024:1051","judgmentDate":"2024-12-19","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-65-23","json":"https://dposchool.com/gdpr/api/v1/cases/c-65-23.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-169/23","name":"Nemzeti Adatvédelmi és Információszabadság Hatóság v UC","ecli":"ECLI:EU:C:2024:988","judgmentDate":"2024-11-28","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-169-23","json":"https://dposchool.com/gdpr/api/v1/cases/c-169-23.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-621/22","name":"Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens","ecli":"ECLI:EU:C:2024:858","judgmentDate":"2024-10-04","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-621-22","json":"https://dposchool.com/gdpr/api/v1/cases/c-621-22.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-446/21","name":"Maximilian Schrems v Meta Platforms Ireland Limited","ecli":"ECLI:EU:C:2024:834","judgmentDate":"2024-10-04","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-446-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-446-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-21/23","name":"ND v DR","ecli":"ECLI:EU:C:2024:846","judgmentDate":"2024-10-04","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-21-23","json":"https://dposchool.com/gdpr/api/v1/cases/c-21-23.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-200/23","name":"Agentsia po vpisvaniyata v OL","ecli":"ECLI:EU:C:2024:827","judgmentDate":"2024-10-04","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-200-23","json":"https://dposchool.com/gdpr/api/v1/cases/c-200-23.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-507/23","name":"A v Patērētāju tiesību aizsardzības centrs","ecli":"ECLI:EU:C:2024:854","judgmentDate":"2024-10-04","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-507-23","json":"https://dposchool.com/gdpr/api/v1/cases/c-507-23.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-768/21","name":"TR v Land Hessen","ecli":"ECLI:EU:C:2024:785","judgmentDate":"2024-09-26","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-768-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-768-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-17/22","name":"HTB Neunte Immobilien Portfolio and Ökorenta Neue Energien Ökostabil IV","ecli":"ECLI:EU:C:2024:738","judgmentDate":"2024-09-12","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-17-22","json":"https://dposchool.com/gdpr/api/v1/cases/c-17-22.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-757/22","name":"Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V","ecli":"ECLI:EU:C:2024:598","judgmentDate":"2024-07-11","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-757-22","json":"https://dposchool.com/gdpr/api/v1/cases/c-757-22.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-590/22","name":"AT and BT v PS GbR and Others","ecli":"ECLI:EU:C:2024:536","judgmentDate":"2024-06-20","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-590-22","json":"https://dposchool.com/gdpr/api/v1/cases/c-590-22.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-182/22","name":"JU and SO v Scalable Capital GmbH","ecli":"ECLI:EU:C:2024:531","judgmentDate":"2024-06-20","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-182-22","json":"https://dposchool.com/gdpr/api/v1/cases/c-182-22.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-741/21","name":"GP v juris GmbH","ecli":"ECLI:EU:C:2024:288","judgmentDate":"2024-04-11","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-741-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-741-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-604/22","name":"IAB Europe v Gegevensbeschermingsautoriteit","ecli":"ECLI:EU:C:2024:214","judgmentDate":"2024-03-07","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-604-22","json":"https://dposchool.com/gdpr/api/v1/cases/c-604-22.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-687/21","name":"BL v MediaMarktSaturn Hagen-Iserlohn GmbH","ecli":"ECLI:EU:C:2024:72","judgmentDate":"2024-01-25","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-687-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-687-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-33/22","name":"Österreichische Datenschutzbehörde v WK","ecli":"ECLI:EU:C:2024:46","judgmentDate":"2024-01-16","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-33-22","json":"https://dposchool.com/gdpr/api/v1/cases/c-33-22.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-231/22","name":"État belge v Autorité de protection des données","ecli":"ECLI:EU:C:2024:7","judgmentDate":"2024-01-11","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-231-22","json":"https://dposchool.com/gdpr/api/v1/cases/c-231-22.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-667/21","name":"ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts","ecli":"ECLI:EU:C:2023:1022","judgmentDate":"2023-12-21","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-667-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-667-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-340/21","name":"VB v Natsionalna agentsia za prihodite","ecli":"ECLI:EU:C:2023:986","judgmentDate":"2023-12-14","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-340-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-340-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-456/22","name":"VX and AT v Gemeinde Ummendorf","ecli":"ECLI:EU:C:2023:988","judgmentDate":"2023-12-14","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-456-22","json":"https://dposchool.com/gdpr/api/v1/cases/c-456-22.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-26/22","name":"UF and AB v Land Hessen","ecli":"ECLI:EU:C:2023:958","judgmentDate":"2023-12-07","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-26-22","json":"https://dposchool.com/gdpr/api/v1/cases/c-26-22.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-634/21","name":"OQ v Land Hessen","ecli":"ECLI:EU:C:2023:957","judgmentDate":"2023-12-07","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-634-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-634-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-683/21","name":"Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija","ecli":"ECLI:EU:C:2023:949","judgmentDate":"2023-12-05","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-683-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-683-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-807/21","name":"Deutsche Wohnen SE v Staatsanwaltschaft Berlin","ecli":"ECLI:EU:C:2023:950","judgmentDate":"2023-12-05","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-807-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-807-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-319/22","name":"Gesamtverband Autoteile-Handel e.V. v Scania CV AB","ecli":"ECLI:EU:C:2023:837","judgmentDate":"2023-11-09","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-319-22","json":"https://dposchool.com/gdpr/api/v1/cases/c-319-22.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-307/22","name":"FT v DW","ecli":"ECLI:EU:C:2023:811","judgmentDate":"2023-10-26","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-307-22","json":"https://dposchool.com/gdpr/api/v1/cases/c-307-22.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-659/22","name":"RK v Ministerstvo zdravotnictví","ecli":"ECLI:EU:C:2023:745","judgmentDate":"2023-10-05","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-659-22","json":"https://dposchool.com/gdpr/api/v1/cases/c-659-22.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-252/21","name":"Meta Platforms Inc and Others v Bundeskartellamt","ecli":"ECLI:EU:C:2023:537","judgmentDate":"2023-07-04","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-252-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-252-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-579/21","name":"Proceedings brought by J.M","ecli":"ECLI:EU:C:2023:501","judgmentDate":"2023-06-22","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-579-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-579-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-487/21","name":"F.F. v Österreichische Datenschutzbehörde and CRIF GmbH","ecli":"ECLI:EU:C:2023:369","judgmentDate":"2023-05-04","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-487-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-487-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-60/22","name":"UZ v Bundesrepublik Deutschland","ecli":"ECLI:EU:C:2023:373","judgmentDate":"2023-05-04","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-60-22","json":"https://dposchool.com/gdpr/api/v1/cases/c-60-22.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-300/21","name":"UI v Österreichische Post AG","ecli":"ECLI:EU:C:2023:370","judgmentDate":"2023-05-04","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-300-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-300-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-34/21","name":"Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums","ecli":"ECLI:EU:C:2023:270","judgmentDate":"2023-03-30","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-34-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-34-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-268/21","name":"Norra Stockholm Bygg AB v Per Nycander AB","ecli":"ECLI:EU:C:2023:145","judgmentDate":"2023-03-02","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-268-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-268-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-453/21","name":"X-FAB Dresden GmbH & Co. KG v FC","ecli":"ECLI:EU:C:2023:79","judgmentDate":"2023-02-09","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-453-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-453-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-154/21","name":"RW v Österreichische Post AG","ecli":"ECLI:EU:C:2023:3","judgmentDate":"2023-01-12","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-154-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-154-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-132/21","name":"BE v Nemzeti Adatvédelmi és Információszabadság Hatóság","ecli":"ECLI:EU:C:2023:2","judgmentDate":"2023-01-12","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-132-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-132-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-460/20","name":"TU and RE v Google LLC","ecli":"ECLI:EU:C:2022:962","judgmentDate":"2022-12-08","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-460-20","json":"https://dposchool.com/gdpr/api/v1/cases/c-460-20.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-129/21","name":"Proximus NV v Gegevensbeschermingsautoriteit","ecli":"ECLI:EU:C:2022:833","judgmentDate":"2022-10-27","group":"related","url":"https://dposchool.com/gdpr/case/c-129-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-129-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-77/21","name":"Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság","ecli":"ECLI:EU:C:2022:805","judgmentDate":"2022-10-20","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-77-21","json":"https://dposchool.com/gdpr/api/v1/cases/c-77-21.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-184/20","name":"OT v Vyriausioji tarnybinės etikos komisija","ecli":"ECLI:EU:C:2022:601","judgmentDate":"2022-08-01","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-184-20","json":"https://dposchool.com/gdpr/api/v1/cases/c-184-20.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-534/20","name":"Leistritz AG v LH","ecli":"ECLI:EU:C:2022:495","judgmentDate":"2022-06-22","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-534-20","json":"https://dposchool.com/gdpr/api/v1/cases/c-534-20.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-319/20","name":"Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband eV","ecli":"ECLI:EU:C:2022:322","judgmentDate":"2022-04-28","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-319-20","json":"https://dposchool.com/gdpr/api/v1/cases/c-319-20.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-245/20","name":"X and Z v Autoriteit Persoonsgegevens","ecli":"ECLI:EU:C:2022:216","judgmentDate":"2022-03-24","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-245-20","json":"https://dposchool.com/gdpr/api/v1/cases/c-245-20.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-175/20","name":"SIA 'SS' v Valsts ieņēmumu dienests","ecli":"ECLI:EU:C:2022:124","judgmentDate":"2022-02-24","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-175-20","json":"https://dposchool.com/gdpr/api/v1/cases/c-175-20.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-439/19","name":"Proceedings brought by B","ecli":"ECLI:EU:C:2021:504","judgmentDate":"2021-06-22","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-439-19","json":"https://dposchool.com/gdpr/api/v1/cases/c-439-19.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-597/19","name":"Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA","ecli":"ECLI:EU:C:2021:492","judgmentDate":"2021-06-17","group":"related","url":"https://dposchool.com/gdpr/case/c-597-19","json":"https://dposchool.com/gdpr/api/v1/cases/c-597-19.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-645/19","name":"Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit","ecli":"ECLI:EU:C:2021:483","judgmentDate":"2021-06-15","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-645-19","json":"https://dposchool.com/gdpr/api/v1/cases/c-645-19.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-61/19","name":"Orange Romania SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)","ecli":"ECLI:EU:C:2020:901","judgmentDate":"2020-11-11","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-61-19","json":"https://dposchool.com/gdpr/api/v1/cases/c-61-19.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-511/18","name":"La Quadrature du Net and Others v Premier ministre and Others (joined cases C-511/18, C-512/18 and C-520/18)","ecli":"ECLI:EU:C:2020:791","judgmentDate":"2020-10-06","group":"related","url":"https://dposchool.com/gdpr/case/c-511-18","json":"https://dposchool.com/gdpr/api/v1/cases/c-511-18.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-311/18","name":"Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems","ecli":"ECLI:EU:C:2020:559","judgmentDate":"2020-07-16","group":"gdpr","url":"https://dposchool.com/gdpr/case/c-311-18","json":"https://dposchool.com/gdpr/api/v1/cases/c-311-18.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-673/17","name":"Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. v Planet49 GmbH","ecli":"ECLI:EU:C:2019:801","judgmentDate":"2019-10-01","group":"related","url":"https://dposchool.com/gdpr/case/c-673-17","json":"https://dposchool.com/gdpr/api/v1/cases/c-673-17.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-136/17","name":"GC and Others v Commission nationale de l'informatique et des libertés (CNIL)","ecli":"ECLI:EU:C:2019:773","judgmentDate":"2019-09-24","group":"related","url":"https://dposchool.com/gdpr/case/c-136-17","json":"https://dposchool.com/gdpr/api/v1/cases/c-136-17.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-507/17","name":"Google LLC, successor in law to Google Inc. v Commission nationale de l'informatique et des libertés (CNIL)","ecli":"ECLI:EU:C:2019:772","judgmentDate":"2019-09-24","group":"related","url":"https://dposchool.com/gdpr/case/c-507-17","json":"https://dposchool.com/gdpr/api/v1/cases/c-507-17.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-40/17","name":"Fashion ID GmbH & Co.KG v Verbraucherzentrale NRW eV","ecli":"ECLI:EU:C:2019:629","judgmentDate":"2019-07-29","group":"related","url":"https://dposchool.com/gdpr/case/c-40-17","json":"https://dposchool.com/gdpr/api/v1/cases/c-40-17.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-25/17","name":"Proceedings brought by Tietosuojavaltuutettu","ecli":"ECLI:EU:C:2018:551","judgmentDate":"2018-07-10","group":"related","url":"https://dposchool.com/gdpr/case/c-25-17","json":"https://dposchool.com/gdpr/api/v1/cases/c-25-17.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-210/16","name":"Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH","ecli":"ECLI:EU:C:2018:388","judgmentDate":"2018-06-05","group":"related","url":"https://dposchool.com/gdpr/case/c-210-16","json":"https://dposchool.com/gdpr/api/v1/cases/c-210-16.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-582/14","name":"Patrick Breyer v Bundesrepublik Deutschland","ecli":"ECLI:EU:C:2016:779","judgmentDate":"2016-10-19","group":"related","url":"https://dposchool.com/gdpr/case/c-582-14","json":"https://dposchool.com/gdpr/api/v1/cases/c-582-14.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-362/14","name":"Maximillian Schrems v Data Protection Commissioner","ecli":"ECLI:EU:C:2015:650","judgmentDate":"2015-10-06","group":"related","url":"https://dposchool.com/gdpr/case/c-362-14","json":"https://dposchool.com/gdpr/api/v1/cases/c-362-14.json","review":"reviewed"},{"kind":"cjeu-case","id":"C-131/12","name":"Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González","ecli":"ECLI:EU:C:2014:317","judgmentDate":"2014-05-13","group":"related","url":"https://dposchool.com/gdpr/case/c-131-12","json":"https://dposchool.com/gdpr/api/v1/cases/c-131-12.json","review":"reviewed"}],"guidance":[{"kind":"edpb-guideline","id":"EDPB 04/2026","title":"Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR","status":"draft for consultation","adoptedDate":"2026-09-21","finalDate":null,"url":"https://dposchool.com/gdpr/guidance/edpb-04-2026","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-04-2026.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 03/2025","title":"Guidelines 3/2025 on the interplay between the DSA and the GDPR","status":"final","adoptedDate":"2025-09-12","finalDate":"2026-09-17","url":"https://dposchool.com/gdpr/guidance/edpb-03-2025","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-03-2025.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 03/2026","title":"Guidelines 03/2026 on web scraping in the context of generative AI","status":"draft for consultation","adoptedDate":"2026-07-08","finalDate":null,"url":"https://dposchool.com/gdpr/guidance/edpb-03-2026","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-03-2026.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 02/2026","title":"Guidelines 02/2026 on anonymisation","status":"draft for consultation","adoptedDate":"2026-07-08","finalDate":null,"url":"https://dposchool.com/gdpr/guidance/edpb-02-2026","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-02-2026.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 02/2025","title":"Guidelines 02/2025 on processing of personal data through blockchain technologies","status":"final","adoptedDate":"2025-04-14","finalDate":"2026-07-07","url":"https://dposchool.com/gdpr/guidance/edpb-02-2025","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-02-2025.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 01/2026","title":"Guidelines 1/2026 on processing of personal data for scientific research purposes","status":"draft for consultation","adoptedDate":"2026-04-16","finalDate":null,"url":"https://dposchool.com/gdpr/guidance/edpb-01-2026","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-01-2026.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB Rec 01/2026","title":"Recommendations 1/2026 on the application for approval and on the elements and principles to be found in Processor Binding Corporate Rules","status":"draft for consultation","adoptedDate":"2026-01-19","finalDate":null,"url":"https://dposchool.com/gdpr/guidance/edpb-rec-01-2026","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-rec-01-2026.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB Rec 02/2025","title":"Recommendations 2/2025 on the legal basis for requiring the creation of user accounts on e-commerce websites","status":"draft for consultation","adoptedDate":"2025-12-04","finalDate":null,"url":"https://dposchool.com/gdpr/guidance/edpb-rec-02-2025","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-rec-02-2025.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB-COM DMA/GDPR","title":"Joint Guidelines (European Commission and EDPB) on the interplay between the Digital Markets Act and the GDPR","status":"draft for consultation","adoptedDate":"2025-10-09","finalDate":null,"url":"https://dposchool.com/gdpr/guidance/edpb-com-dma-gdpr","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-com-dma-gdpr.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 02/2024","title":"Guidelines 02/2024 on Article 48 GDPR","status":"final","adoptedDate":"2024-12-03","finalDate":"2025-06-05","url":"https://dposchool.com/gdpr/guidance/edpb-02-2024","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-02-2024.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 01/2025","title":"Guidelines 01/2025 on pseudonymisation","status":"draft for consultation","adoptedDate":"2025-01-17","finalDate":null,"url":"https://dposchool.com/gdpr/guidance/edpb-01-2025","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-01-2025.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB Opinion 28/2024","title":"Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models","status":"final","adoptedDate":"2024-12-18","finalDate":"2024-12-18","url":"https://dposchool.com/gdpr/guidance/edpb-opinion-28-2024","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-opinion-28-2024.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 02/2023","title":"Guidelines 2/2023 on technical scope of Art. 5(3) of the ePrivacy Directive","status":"final","adoptedDate":"2023-11-16","finalDate":"2024-10-16","url":"https://dposchool.com/gdpr/guidance/edpb-02-2023","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-02-2023.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 01/2024","title":"Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR","status":"draft for consultation","adoptedDate":"2024-10-09","finalDate":null,"url":"https://dposchool.com/gdpr/guidance/edpb-01-2024","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-01-2024.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB Opinion 22/2024","title":"Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s)","status":"final","adoptedDate":"2024-10-09","finalDate":"2024-10-09","url":"https://dposchool.com/gdpr/guidance/edpb-opinion-22-2024","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-opinion-22-2024.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 01/2023 (LED)","title":"Guidelines 01/2023 on Article 37 Law Enforcement Directive","status":"final","adoptedDate":"2023-09-27","finalDate":"2024-06-19","url":"https://dposchool.com/gdpr/guidance/edpb-01-2023-led","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-01-2023-led.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB Opinion 08/2024","title":"Opinion 08/2024 on valid consent in the context of consent or pay models implemented by large online platforms","status":"final","adoptedDate":"2024-04-17","finalDate":"2024-04-17","url":"https://dposchool.com/gdpr/guidance/edpb-opinion-08-2024","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-opinion-08-2024.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB Rec 01/2022","title":"Recommendations 1/2022 on the application for approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR)","status":"final","adoptedDate":null,"finalDate":"2023-06-20","url":"https://dposchool.com/gdpr/guidance/edpb-rec-01-2022","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-rec-01-2022.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 04/2022","title":"Guidelines 04/2022 on the calculation of administrative fines under the GDPR","status":"final","adoptedDate":"2022-05-16","finalDate":"2023-05-24","url":"https://dposchool.com/gdpr/guidance/edpb-04-2022","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-04-2022.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 03/2021","title":"Guidelines 03/2021 on the application of Article 65(1)(a) GDPR","status":"final","adoptedDate":"2021-04-16","finalDate":"2023-05-24","url":"https://dposchool.com/gdpr/guidance/edpb-03-2021","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-03-2021.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 05/2022","title":"Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement","status":"final","adoptedDate":"2022-05-16","finalDate":"2023-05-17","url":"https://dposchool.com/gdpr/guidance/edpb-05-2022","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-05-2022.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 01/2022","title":"Guidelines 01/2022 on data subject rights - Right of access","status":"final","adoptedDate":"2022-01-28","finalDate":"2023-04-17","url":"https://dposchool.com/gdpr/guidance/edpb-01-2022","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-01-2022.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 08/2022","title":"Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority","status":"final","adoptedDate":"2022-10-21","finalDate":"2023-04-17","url":"https://dposchool.com/gdpr/guidance/edpb-08-2022","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-08-2022.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 09/2022","title":"Guidelines 9/2022 on personal data breach notification under GDPR","status":"final","adoptedDate":"2022-10-18","finalDate":"2023-04-04","url":"https://dposchool.com/gdpr/guidance/edpb-09-2022","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-09-2022.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 03/2022","title":"Guidelines 03/2022 on deceptive design patterns in social media platform interfaces","status":"final","adoptedDate":"2022-03-21","finalDate":"2023-02-24","url":"https://dposchool.com/gdpr/guidance/edpb-03-2022","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-03-2022.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 05/2021","title":"Guidelines 05/2021 on the interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR","status":"final","adoptedDate":"2021-11-19","finalDate":"2023-02-24","url":"https://dposchool.com/gdpr/guidance/edpb-05-2021","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-05-2021.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 07/2022","title":"Guidelines 07/2022 on certification as a tool for transfers","status":"final","adoptedDate":"2022-06-30","finalDate":"2023-02-24","url":"https://dposchool.com/gdpr/guidance/edpb-07-2022","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-07-2022.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 06/2022","title":"Guidelines 06/2022 on the practical implementation of amicable settlements","status":"final","adoptedDate":"2022-05-12","finalDate":"2022-05-12","url":"https://dposchool.com/gdpr/guidance/edpb-06-2022","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-06-2022.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 02/2022","title":"Guidelines 02/2022 on the application of Article 60 GDPR","status":"final","adoptedDate":"2022-03-14","finalDate":"2022-03-14","url":"https://dposchool.com/gdpr/guidance/edpb-02-2022","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-02-2022.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 04/2021","title":"Guidelines 04/2021 on codes of conduct as tools for transfers","status":"final","adoptedDate":"2021-07-14","finalDate":"2022-02-22","url":"https://dposchool.com/gdpr/guidance/edpb-04-2021","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-04-2021.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 01/2021","title":"Guidelines 01/2021 on examples regarding personal data breach notification","status":"final","adoptedDate":"2021-01-19","finalDate":"2022-01-03","url":"https://dposchool.com/gdpr/guidance/edpb-01-2021","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-01-2021.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 10/2020","title":"Guidelines 10/2020 on restrictions under Article 23 GDPR","status":"final","adoptedDate":"2020-12-18","finalDate":"2021-10-13","url":"https://dposchool.com/gdpr/guidance/edpb-10-2020","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-10-2020.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 07/2020","title":"Guidelines 07/2020 on the concepts of controller and processor in the GDPR","status":"final","adoptedDate":"2020-09-07","finalDate":"2021-07-07","url":"https://dposchool.com/gdpr/guidance/edpb-07-2020","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-07-2020.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 02/2021","title":"Guidelines 02/2021 on virtual voice assistants","status":"final","adoptedDate":"2021-03-12","finalDate":"2021-07-07","url":"https://dposchool.com/gdpr/guidance/edpb-02-2021","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-02-2021.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB Rec 01/2020","title":"Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data","status":"final","adoptedDate":null,"finalDate":"2021-06-18","url":"https://dposchool.com/gdpr/guidance/edpb-rec-01-2020","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-rec-01-2020.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB Rec 02/2021","title":"Recommendations 02/2021 on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions","status":"final","adoptedDate":"2021-05-19","finalDate":"2021-05-19","url":"https://dposchool.com/gdpr/guidance/edpb-rec-02-2021","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-rec-02-2021.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 08/2020","title":"Guidelines 8/2020 on the targeting of social media users","status":"final","adoptedDate":"2020-09-07","finalDate":"2021-04-13","url":"https://dposchool.com/gdpr/guidance/edpb-08-2020","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-08-2020.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 09/2020","title":"Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679","status":"final","adoptedDate":"2020-10-13","finalDate":"2021-03-09","url":"https://dposchool.com/gdpr/guidance/edpb-09-2020","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-09-2020.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 01/2020","title":"Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications","status":"final","adoptedDate":"2020-02-07","finalDate":"2021-03-09","url":"https://dposchool.com/gdpr/guidance/edpb-01-2020","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-01-2020.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 06/2020","title":"Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR","status":"final","adoptedDate":"2020-07-22","finalDate":"2020-12-15","url":"https://dposchool.com/gdpr/guidance/edpb-06-2020","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-06-2020.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 02/2020","title":"Guidelines 2/2020 on articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies","status":"final","adoptedDate":"2020-02-24","finalDate":"2020-12-15","url":"https://dposchool.com/gdpr/guidance/edpb-02-2020","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-02-2020.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB Rec 02/2020","title":"Recommendations 02/2020 on the European Essential Guarantees for surveillance measures","status":"final","adoptedDate":"2020-11-10","finalDate":"2020-11-10","url":"https://dposchool.com/gdpr/guidance/edpb-rec-02-2020","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-rec-02-2020.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 04/2019","title":"Guidelines 4/2019 on Article 25 Data Protection by Design and by Default","status":"final","adoptedDate":"2019-11-20","finalDate":"2020-10-20","url":"https://dposchool.com/gdpr/guidance/edpb-04-2019","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-04-2019.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 05/2019","title":"Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1)","status":"final","adoptedDate":"2019-12-11","finalDate":"2020-07-07","url":"https://dposchool.com/gdpr/guidance/edpb-05-2019","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-05-2019.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 05/2020","title":"Guidelines 05/2020 on consent under Regulation 2016/679","status":"final","adoptedDate":"2020-05-04","finalDate":"2020-05-04","url":"https://dposchool.com/gdpr/guidance/edpb-05-2020","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-05-2020.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 03/2020","title":"Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak","status":"final","adoptedDate":"2020-04-21","finalDate":"2020-04-21","url":"https://dposchool.com/gdpr/guidance/edpb-03-2020","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-03-2020.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 04/2020","title":"Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak","status":"final","adoptedDate":"2020-04-21","finalDate":"2020-04-21","url":"https://dposchool.com/gdpr/guidance/edpb-04-2020","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-04-2020.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 03/2019","title":"Guidelines 3/2019 on processing of personal data through video devices","status":"final","adoptedDate":"2019-07-12","finalDate":"2020-01-30","url":"https://dposchool.com/gdpr/guidance/edpb-03-2019","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-03-2019.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 03/2018","title":"Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)","status":"final","adoptedDate":"2018-11-23","finalDate":"2019-11-12","url":"https://dposchool.com/gdpr/guidance/edpb-03-2018","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-03-2018.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 02/2019","title":"Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects","status":"final","adoptedDate":"2019-04-12","finalDate":"2019-10-16","url":"https://dposchool.com/gdpr/guidance/edpb-02-2019","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-02-2019.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 01/2018","title":"Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43","status":"final","adoptedDate":"2018-05-30","finalDate":"2019-06-04","url":"https://dposchool.com/gdpr/guidance/edpb-01-2018","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-01-2018.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 01/2019","title":"Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679","status":"final","adoptedDate":"2019-02-19","finalDate":"2019-06-04","url":"https://dposchool.com/gdpr/guidance/edpb-01-2019","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-01-2019.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 04/2018","title":"Guidelines 4/2018 on the accreditation of certification bodies under Article 43","status":"final","adoptedDate":"2018-12-14","finalDate":"2018-12-14","url":"https://dposchool.com/gdpr/guidance/edpb-04-2018","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-04-2018.json","review":"reviewed"},{"kind":"edpb-guideline","id":"EDPB 02/2018","title":"Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679","status":"final","adoptedDate":"2018-05-25","finalDate":"2018-05-25","url":"https://dposchool.com/gdpr/guidance/edpb-02-2018","json":"https://dposchool.com/gdpr/api/v1/guidance/edpb-02-2018.json","review":"reviewed"},{"kind":"edpb-guideline","id":"WP251 rev.01","title":"Guidelines on automated individual decision-making and profiling for the purposes of Regulation 2016/679","status":"final","adoptedDate":null,"finalDate":"2018-05-25","url":"https://dposchool.com/gdpr/guidance/wp251-rev-01","json":"https://dposchool.com/gdpr/api/v1/guidance/wp251-rev-01.json","review":"reviewed"},{"kind":"edpb-guideline","id":"WP242 rev.01","title":"Guidelines on the right to data portability","status":"final","adoptedDate":null,"finalDate":"2018-05-25","url":"https://dposchool.com/gdpr/guidance/wp242-rev-01","json":"https://dposchool.com/gdpr/api/v1/guidance/wp242-rev-01.json","review":"reviewed"},{"kind":"edpb-guideline","id":"WP248 rev.01","title":"Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is 'likely to result in a high risk'","status":"final","adoptedDate":null,"finalDate":"2018-05-25","url":"https://dposchool.com/gdpr/guidance/wp248-rev-01","json":"https://dposchool.com/gdpr/api/v1/guidance/wp248-rev-01.json","review":"reviewed"},{"kind":"edpb-guideline","id":"WP243 rev.01","title":"Guidelines on Data Protection Officers ('DPO')","status":"final","adoptedDate":null,"finalDate":"2018-05-25","url":"https://dposchool.com/gdpr/guidance/wp243-rev-01","json":"https://dposchool.com/gdpr/api/v1/guidance/wp243-rev-01.json","review":"reviewed"},{"kind":"edpb-guideline","id":"WP253","title":"Guidelines on the application and setting of administrative fines for the purposes of Regulation 2016/679","status":"final","adoptedDate":null,"finalDate":"2018-05-25","url":"https://dposchool.com/gdpr/guidance/wp253","json":"https://dposchool.com/gdpr/api/v1/guidance/wp253.json","review":"reviewed"},{"kind":"edpb-guideline","id":"WP254 rev.01","title":"Adequacy Referential","status":"final","adoptedDate":null,"finalDate":"2018-05-25","url":"https://dposchool.com/gdpr/guidance/wp254-rev-01","json":"https://dposchool.com/gdpr/api/v1/guidance/wp254-rev-01.json","review":"reviewed"},{"kind":"edpb-guideline","id":"WP257 rev.01","title":"Working document setting up a table with the elements and principles to be found in Processor Binding Corporate Rules","status":"final","adoptedDate":null,"finalDate":"2018-05-25","url":"https://dposchool.com/gdpr/guidance/wp257-rev-01","json":"https://dposchool.com/gdpr/api/v1/guidance/wp257-rev-01.json","review":"reviewed"},{"kind":"edpb-guideline","id":"WP265","title":"Recommendation on the standard application form for approval of Processor Binding Corporate Rules","status":"final","adoptedDate":null,"finalDate":"2018-05-25","url":"https://dposchool.com/gdpr/guidance/wp265","json":"https://dposchool.com/gdpr/api/v1/guidance/wp265.json","review":"reviewed"},{"kind":"edpb-guideline","id":"WP29 Art. 30(5) position paper","title":"Position paper on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR","status":"final","adoptedDate":null,"finalDate":"2018-05-25","url":"https://dposchool.com/gdpr/guidance/wp29-art-30-5-position-paper","json":"https://dposchool.com/gdpr/api/v1/guidance/wp29-art-30-5-position-paper.json","review":"reviewed"},{"kind":"edpb-guideline","id":"WP259 rev.01","title":"Guidelines on consent under Regulation 2016/679","status":"superseded by EDPB 05/2020","adoptedDate":null,"finalDate":"2018-05-25","url":"https://dposchool.com/gdpr/guidance/wp259-rev-01","json":"https://dposchool.com/gdpr/api/v1/guidance/wp259-rev-01.json","review":"reviewed"},{"kind":"edpb-guideline","id":"WP250 rev.01","title":"Guidelines on personal data breach notification under Regulation 2016/679","status":"superseded by EDPB 09/2022","adoptedDate":null,"finalDate":"2018-05-25","url":"https://dposchool.com/gdpr/guidance/wp250-rev-01","json":"https://dposchool.com/gdpr/api/v1/guidance/wp250-rev-01.json","review":"reviewed"},{"kind":"edpb-guideline","id":"WP244 rev.01","title":"Guidelines for identifying a controller or processor's lead supervisory authority","status":"superseded by EDPB 08/2022","adoptedDate":null,"finalDate":"2018-05-25","url":"https://dposchool.com/gdpr/guidance/wp244-rev-01","json":"https://dposchool.com/gdpr/api/v1/guidance/wp244-rev-01.json","review":"reviewed"},{"kind":"edpb-guideline","id":"WP256 rev.01","title":"Working document setting up a table with the elements and principles to be found in Binding Corporate Rules","status":"superseded by EDPB Rec 01/2022","adoptedDate":null,"finalDate":"2018-05-25","url":"https://dposchool.com/gdpr/guidance/wp256-rev-01","json":"https://dposchool.com/gdpr/api/v1/guidance/wp256-rev-01.json","review":"reviewed"},{"kind":"edpb-guideline","id":"WP264","title":"Recommendation on the standard application for approval of Controller Binding Corporate Rules","status":"superseded by EDPB Rec 01/2022","adoptedDate":null,"finalDate":"2018-05-25","url":"https://dposchool.com/gdpr/guidance/wp264","json":"https://dposchool.com/gdpr/api/v1/guidance/wp264.json","review":"reviewed"},{"kind":"edpb-guideline","id":"WP263 rev.01","title":"Working document setting forth a co-operation procedure for the approval of BCRs","status":"superseded by the EDPB document on the BCR co-operation procedure","adoptedDate":null,"finalDate":"2018-05-25","url":"https://dposchool.com/gdpr/guidance/wp263-rev-01","json":"https://dposchool.com/gdpr/api/v1/guidance/wp263-rev-01.json","review":"reviewed"},{"kind":"edpb-guideline","id":"WP260 rev.01","title":"Guidelines on transparency under Regulation 2016/679","status":"final","adoptedDate":"2018-04-11","finalDate":"2018-04-11","url":"https://dposchool.com/gdpr/guidance/wp260-rev-01","json":"https://dposchool.com/gdpr/api/v1/guidance/wp260-rev-01.json","review":"reviewed"}],"fines":[{"kind":"fine","id":"dt-xandr-2026-10","organisation":"Xandr Inc.","authority":"Datatilsynet (Norwegian Data Protection Authority)","country":"Norway","date":"2026-10-02","dateBasis":"decision","amount":{"currency":"NOK","amount":"92,000,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/dt-xandr-2026-10","json":"https://dposchool.com/gdpr/api/v1/fines/dt-xandr-2026-10.json","review":"reviewed"},{"kind":"fine","id":"garante-iqvia-2026-09","organisation":"IQVIA Solutions Italy S.r.l","authority":"Garante per la protezione dei dati personali","country":"Italy","date":"2026-09-23","dateBasis":"decision","amount":{"currency":"EUR","amount":"7,000,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/garante-iqvia-2026-09","json":"https://dposchool.com/gdpr/api/v1/fines/garante-iqvia-2026-09.json","review":"reviewed"},{"kind":"fine","id":"dpc-google-2026-09","organisation":"Google Ireland Limited","authority":"Data Protection Commission (Ireland)","country":"Ireland","date":"2026-09-21","dateBasis":"announcement","amount":{"currency":"EUR","amount":"403,000,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/dpc-google-2026-09","json":"https://dposchool.com/gdpr/api/v1/fines/dpc-google-2026-09.json","review":"reviewed"},{"kind":"fine","id":"ap-uber-2026-08","organisation":"Uber","authority":"Autoriteit Persoonsgegevens (Dutch Data Protection Authority)","country":"Netherlands","date":"2026-08-21","dateBasis":"announcement","amount":{"currency":"EUR","amount":"824,990,000"},"appealStatus":"under appeal","url":"https://dposchool.com/gdpr/fine/ap-uber-2026-08","json":"https://dposchool.com/gdpr/api/v1/fines/ap-uber-2026-08.json","review":"reviewed"},{"kind":"fine","id":"cnil-france-travail-2026-01","organisation":"FRANCE TRAVAIL","authority":"Commission nationale de l'informatique et des libertés (CNIL)","country":"France","date":"2026-01-22","dateBasis":"decision","amount":{"currency":"EUR","amount":"5,000,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/cnil-france-travail-2026-01","json":"https://dposchool.com/gdpr/api/v1/fines/cnil-france-travail-2026-01.json","review":"reviewed"},{"kind":"fine","id":"cnil-free-mobile-2026-01","organisation":"FREE MOBILE","authority":"Commission nationale de l'informatique et des libertés (CNIL)","country":"France","date":"2026-01-08","dateBasis":"decision","amount":{"currency":"EUR","amount":"27,000,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/cnil-free-mobile-2026-01","json":"https://dposchool.com/gdpr/api/v1/fines/cnil-free-mobile-2026-01.json","review":"reviewed"},{"kind":"fine","id":"ap-experian-2025-10","organisation":"Experian Nederland B.V.","authority":"Autoriteit Persoonsgegevens (Dutch Data Protection Authority)","country":"Netherlands","date":"2025-10-16","dateBasis":"decision","amount":{"currency":"EUR","amount":"2,700,000"},"appealStatus":"not appealed","url":"https://dposchool.com/gdpr/fine/ap-experian-2025-10","json":"https://dposchool.com/gdpr/api/v1/fines/ap-experian-2025-10.json","review":"reviewed"},{"kind":"fine","id":"uodo-mcdonalds-2025-07","organisation":"McDonald’s Polska Sp. z o.o.","authority":"Prezes Urzędu Ochrony Danych Osobowych (Polish Data Protection Authority)","country":"Poland","date":"2025-07-21","dateBasis":"announcement","amount":{"currency":"PLN","amount":"16,932,657"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/uodo-mcdonalds-2025-07","json":"https://dposchool.com/gdpr/api/v1/fines/uodo-mcdonalds-2025-07.json","review":"reviewed"},{"kind":"fine","id":"dpc-tiktok-2025-04","organisation":"TikTok Technology Limited","authority":"Data Protection Commission (Ireland)","country":"Ireland","date":"2025-04-30","dateBasis":"decision","amount":{"currency":"EUR","amount":"530,000,000"},"appealStatus":"under appeal","url":"https://dposchool.com/gdpr/fine/dpc-tiktok-2025-04","json":"https://dposchool.com/gdpr/api/v1/fines/dpc-tiktok-2025-04.json","review":"reviewed"},{"kind":"fine","id":"garante-luka-replika-2025-04","organisation":"Luka Inc.","authority":"Garante per la protezione dei dati personali","country":"Italy","date":"2025-04-10","dateBasis":"decision","amount":{"currency":"EUR","amount":"5,000,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/garante-luka-replika-2025-04","json":"https://dposchool.com/gdpr/api/v1/fines/garante-luka-replika-2025-04.json","review":"reviewed"},{"kind":"fine","id":"bfdi-vodafone-2025-03","organisation":"Vodafone GmbH","authority":"Federal Commissioner for Data Protection and Freedom of Information (BfDI)","country":"Germany","date":"2025-03-10","dateBasis":"decision","amount":{"currency":"EUR","amount":"45,000,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/bfdi-vodafone-2025-03","json":"https://dposchool.com/gdpr/api/v1/fines/bfdi-vodafone-2025-03.json","review":"reviewed"},{"kind":"fine","id":"dpc-meta-2024-12","organisation":"Meta Platforms Ireland Limited","authority":"Data Protection Commission (Ireland)","country":"Ireland","date":"2024-12-12","dateBasis":"decision","amount":{"currency":"EUR","amount":"251,000,000"},"appealStatus":"under appeal","url":"https://dposchool.com/gdpr/fine/dpc-meta-2024-12","json":"https://dposchool.com/gdpr/api/v1/fines/dpc-meta-2024-12.json","review":"reviewed"},{"kind":"fine","id":"ap-netflix-2024-11","organisation":"Netflix International B.V.","authority":"Autoriteit Persoonsgegevens (Dutch Data Protection Authority)","country":"Netherlands","date":"2024-11-26","dateBasis":"decision","amount":{"currency":"EUR","amount":"4,750,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/ap-netflix-2024-11","json":"https://dposchool.com/gdpr/api/v1/fines/ap-netflix-2024-11.json","review":"reviewed"},{"kind":"fine","id":"fi-posti-2024-11","organisation":"Posti","authority":"Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman, Finland)","country":"Finland","date":"2024-11-13","dateBasis":"decision","amount":{"currency":"EUR","amount":"2,400,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/fi-posti-2024-11","json":"https://dposchool.com/gdpr/api/v1/fines/fi-posti-2024-11.json","review":"reviewed"},{"kind":"fine","id":"garante-foodinho-2024-11","organisation":"Foodinho s.r.l.","authority":"Garante per la protezione dei dati personali","country":"Italy","date":"2024-11-13","dateBasis":"decision","amount":{"currency":"EUR","amount":"5,000,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/garante-foodinho-2024-11","json":"https://dposchool.com/gdpr/api/v1/fines/garante-foodinho-2024-11.json","review":"reviewed"},{"kind":"fine","id":"garante-openai-2024-11","organisation":"OpenAI","authority":"Garante per la protezione dei dati personali","country":"Italy","date":"2024-11-02","dateBasis":"decision","amount":{"currency":"EUR","amount":"15,000,000"},"appealStatus":"annulled","url":"https://dposchool.com/gdpr/fine/garante-openai-2024-11","json":"https://dposchool.com/gdpr/api/v1/fines/garante-openai-2024-11.json","review":"reviewed"},{"kind":"fine","id":"dpc-linkedin-2024-10","organisation":"LinkedIn Ireland Unlimited Company","authority":"Data Protection Commission (Ireland)","country":"Ireland","date":"2024-10-22","dateBasis":"decision","amount":{"currency":"EUR","amount":"310,000,000"},"appealStatus":"under appeal","url":"https://dposchool.com/gdpr/fine/dpc-linkedin-2024-10","json":"https://dposchool.com/gdpr/api/v1/fines/dpc-linkedin-2024-10.json","review":"reviewed"},{"kind":"fine","id":"dpc-meta-2024-09","organisation":"Meta Platforms Ireland Limited","authority":"Data Protection Commission (Ireland)","country":"Ireland","date":"2024-09-26","dateBasis":"decision","amount":{"currency":"EUR","amount":"91,000,000"},"appealStatus":"under appeal","url":"https://dposchool.com/gdpr/fine/dpc-meta-2024-09","json":"https://dposchool.com/gdpr/api/v1/fines/dpc-meta-2024-09.json","review":"reviewed"},{"kind":"fine","id":"imy-apoteket-2024-08","organisation":"Apoteket AB","authority":"Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection)","country":"Sweden","date":"2024-08-29","dateBasis":"decision","amount":{"currency":"SEK","amount":"37,000,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/imy-apoteket-2024-08","json":"https://dposchool.com/gdpr/api/v1/fines/imy-apoteket-2024-08.json","review":"reviewed"},{"kind":"fine","id":"ap-uber-2024-07","organisation":"Uber Technologies Inc. en Uber B.V.","authority":"Autoriteit Persoonsgegevens (Dutch Data Protection Authority)","country":"Netherlands","date":"2024-07-22","dateBasis":"decision","amount":{"currency":"EUR","amount":"290,000,000"},"appealStatus":"under appeal","url":"https://dposchool.com/gdpr/fine/ap-uber-2024-07","json":"https://dposchool.com/gdpr/api/v1/fines/ap-uber-2024-07.json","review":"reviewed"},{"kind":"fine","id":"ap-clearview-2024-05","organisation":"Clearview AI Inc.","authority":"Autoriteit Persoonsgegevens (Dutch Data Protection Authority)","country":"Netherlands","date":"2024-05-16","dateBasis":"decision","amount":{"currency":"EUR","amount":"30,500,000"},"appealStatus":"not appealed","url":"https://dposchool.com/gdpr/fine/ap-clearview-2024-05","json":"https://dposchool.com/gdpr/api/v1/fines/ap-clearview-2024-05.json","review":"reviewed"},{"kind":"fine","id":"uoou-avast-2024-04","organisation":"Avast Software s.r.o.","authority":"Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ)","country":"Czech Republic","date":"2024-04-10","dateBasis":"decision","amount":{"currency":"CZK","amount":"351,000,000"},"appealStatus":"upheld","url":"https://dposchool.com/gdpr/fine/uoou-avast-2024-04","json":"https://dposchool.com/gdpr/api/v1/fines/uoou-avast-2024-04.json","review":"reviewed"},{"kind":"fine","id":"garante-enel-energia-2024-02","organisation":"Enel Energia S.p.A.","authority":"Garante per la protezione dei dati personali","country":"Italy","date":"2024-02-08","dateBasis":"decision","amount":{"currency":"EUR","amount":"79,107,101"},"appealStatus":"upheld","url":"https://dposchool.com/gdpr/fine/garante-enel-energia-2024-02","json":"https://dposchool.com/gdpr/api/v1/fines/garante-enel-energia-2024-02.json","review":"reviewed"},{"kind":"fine","id":"cnil-amazon-france-logistique-2023-12","organisation":"Amazon France Logistique","authority":"Commission nationale de l'informatique et des libertés (CNIL)","country":"France","date":"2023-12-27","dateBasis":"decision","amount":{"currency":"EUR","amount":"32,000,000"},"appealStatus":"reduced","url":"https://dposchool.com/gdpr/fine/cnil-amazon-france-logistique-2023-12","json":"https://dposchool.com/gdpr/api/v1/fines/cnil-amazon-france-logistique-2023-12.json","review":"reviewed"},{"kind":"fine","id":"ap-uber-2023-12","organisation":"Uber Technologies Inc. en Uber B.V.","authority":"Autoriteit Persoonsgegevens (Dutch Data Protection Authority)","country":"Netherlands","date":"2023-12-11","dateBasis":"decision","amount":{"currency":"EUR","amount":"10,000,000"},"appealStatus":"under appeal","url":"https://dposchool.com/gdpr/fine/ap-uber-2023-12","json":"https://dposchool.com/gdpr/api/v1/fines/ap-uber-2023-12.json","review":"reviewed"},{"kind":"fine","id":"azop-eos-matrix-2023-10","organisation":"EOS Matrix d.o.o.","authority":"Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP)","country":"Croatia","date":"2023-10-05","dateBasis":"announcement","amount":{"currency":"EUR","amount":"5,470,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/azop-eos-matrix-2023-10","json":"https://dposchool.com/gdpr/api/v1/fines/azop-eos-matrix-2023-10.json","review":"reviewed"},{"kind":"fine","id":"dpc-tiktok-2023-09","organisation":"TikTok Technology Limited","authority":"Data Protection Commission (Ireland)","country":"Ireland","date":"2023-09-01","dateBasis":"decision","amount":{"currency":"EUR","amount":"345,000,000"},"appealStatus":"under appeal","url":"https://dposchool.com/gdpr/fine/dpc-tiktok-2023-09","json":"https://dposchool.com/gdpr/api/v1/fines/dpc-tiktok-2023-09.json","review":"reviewed"},{"kind":"fine","id":"cnil-criteo-2023-06","organisation":"CRITEO","authority":"Commission nationale de l'informatique et des libertés (CNIL)","country":"France","date":"2023-06-15","dateBasis":"decision","amount":{"currency":"EUR","amount":"40,000,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/cnil-criteo-2023-06","json":"https://dposchool.com/gdpr/api/v1/fines/cnil-criteo-2023-06.json","review":"reviewed"},{"kind":"fine","id":"imy-spotify-2023-06","organisation":"Spotify AB","authority":"Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection)","country":"Sweden","date":"2023-06-12","dateBasis":"decision","amount":{"currency":"SEK","amount":"58,000,000"},"appealStatus":"upheld","url":"https://dposchool.com/gdpr/fine/imy-spotify-2023-06","json":"https://dposchool.com/gdpr/api/v1/fines/imy-spotify-2023-06.json","review":"reviewed"},{"kind":"fine","id":"dpc-meta-2023-05","organisation":"Meta Platforms Ireland Limited","authority":"Data Protection Commission (Ireland)","country":"Ireland","date":"2023-05-12","dateBasis":"decision","amount":{"currency":"EUR","amount":"1,200,000,000"},"appealStatus":"under appeal","url":"https://dposchool.com/gdpr/fine/dpc-meta-2023-05","json":"https://dposchool.com/gdpr/api/v1/fines/dpc-meta-2023-05.json","review":"reviewed"},{"kind":"fine","id":"dpc-meta-facebook-2022-12","organisation":"Meta Platforms Ireland Limited","authority":"Data Protection Commission (Ireland)","country":"Ireland","date":"2022-12-31","dateBasis":"decision","amount":{"currency":"EUR","amount":"210,000,000"},"appealStatus":"under appeal","url":"https://dposchool.com/gdpr/fine/dpc-meta-facebook-2022-12","json":"https://dposchool.com/gdpr/api/v1/fines/dpc-meta-facebook-2022-12.json","review":"reviewed"},{"kind":"fine","id":"dpc-meta-instagram-2022-12","organisation":"Meta Platforms Ireland Limited","authority":"Data Protection Commission (Ireland)","country":"Ireland","date":"2022-12-31","dateBasis":"decision","amount":{"currency":"EUR","amount":"180,000,000"},"appealStatus":"under appeal","url":"https://dposchool.com/gdpr/fine/dpc-meta-instagram-2022-12","json":"https://dposchool.com/gdpr/api/v1/fines/dpc-meta-instagram-2022-12.json","review":"reviewed"},{"kind":"fine","id":"dpc-meta-2022-11","organisation":"Meta Platforms Ireland Limited","authority":"Data Protection Commission (Ireland)","country":"Ireland","date":"2022-11-25","dateBasis":"decision","amount":{"currency":"EUR","amount":"265,000,000"},"appealStatus":"under appeal","url":"https://dposchool.com/gdpr/fine/dpc-meta-2022-11","json":"https://dposchool.com/gdpr/api/v1/fines/dpc-meta-2022-11.json","review":"reviewed"},{"kind":"fine","id":"cnil-clearview-2022-10","organisation":"Clearview AI","authority":"Commission nationale de l'informatique et des libertés (CNIL)","country":"France","date":"2022-10-17","dateBasis":"decision","amount":{"currency":"EUR","amount":"20,000,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/cnil-clearview-2022-10","json":"https://dposchool.com/gdpr/api/v1/fines/cnil-clearview-2022-10.json","review":"reviewed"},{"kind":"fine","id":"dpc-instagram-2022-09","organisation":"Meta Platforms Ireland Limited","authority":"Data Protection Commission (Ireland)","country":"Ireland","date":"2022-09-02","dateBasis":"decision","amount":{"currency":"EUR","amount":"405,000,000"},"appealStatus":"under appeal","url":"https://dposchool.com/gdpr/fine/dpc-instagram-2022-09","json":"https://dposchool.com/gdpr/api/v1/fines/dpc-instagram-2022-09.json","review":"reviewed"},{"kind":"fine","id":"hdpa-clearview-2022-07","organisation":"Clearview AI, Inc","authority":"Hellenic Data Protection Authority","country":"Greece","date":"2022-07-13","dateBasis":"decision","amount":{"currency":"EUR","amount":"20,000,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/hdpa-clearview-2022-07","json":"https://dposchool.com/gdpr/api/v1/fines/hdpa-clearview-2022-07.json","review":"reviewed"},{"kind":"fine","id":"aepd-google-2022-05","organisation":"Google LLC","authority":"Agencia Española de Protección de Datos (AEPD)","country":"Spain","date":"2022-05-18","dateBasis":"announcement","amount":{"currency":"EUR","amount":"10,000,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/aepd-google-2022-05","json":"https://dposchool.com/gdpr/api/v1/fines/aepd-google-2022-05.json","review":"reviewed"},{"kind":"fine","id":"ap-belastingdienst-2022-04","organisation":"Minister van Financiën (controller for the Belastingdienst, Dutch Tax Administration)","authority":"Autoriteit Persoonsgegevens (Dutch Data Protection Authority)","country":"Netherlands","date":"2022-04-07","dateBasis":"decision","amount":{"currency":"EUR","amount":"3,700,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/ap-belastingdienst-2022-04","json":"https://dposchool.com/gdpr/api/v1/fines/ap-belastingdienst-2022-04.json","review":"reviewed"},{"kind":"fine","id":"garante-clearview-2022-02","organisation":"Clearview AI","authority":"Garante per la protezione dei dati personali","country":"Italy","date":"2022-02-10","dateBasis":"decision","amount":{"currency":"EUR","amount":"20,000,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/garante-clearview-2022-02","json":"https://dposchool.com/gdpr/api/v1/fines/garante-clearview-2022-02.json","review":"reviewed"},{"kind":"fine","id":"apd-iab-europe-2022-02","organisation":"IAB Europe","authority":"Autorité de protection des données / Gegevensbeschermingsautoriteit (Belgium)","country":"Belgium","date":"2022-02-02","dateBasis":"decision","amount":{"currency":"EUR","amount":"250,000"},"appealStatus":"upheld","url":"https://dposchool.com/gdpr/fine/apd-iab-europe-2022-02","json":"https://dposchool.com/gdpr/api/v1/fines/apd-iab-europe-2022-02.json","review":"reviewed"},{"kind":"fine","id":"dt-grindr-2021-12","organisation":"Grindr LLC","authority":"Datatilsynet (Norwegian Data Protection Authority)","country":"Norway","date":"2021-12-13","dateBasis":"decision","amount":{"currency":"NOK","amount":"65,000,000"},"appealStatus":"upheld","url":"https://dposchool.com/gdpr/fine/dt-grindr-2021-12","json":"https://dposchool.com/gdpr/api/v1/fines/dt-grindr-2021-12.json","review":"reviewed"},{"kind":"fine","id":"dpc-whatsapp-2021-08","organisation":"WhatsApp Ireland Ltd","authority":"Data Protection Commission (Ireland)","country":"Ireland","date":"2021-08-20","dateBasis":"decision","amount":{"currency":"EUR","amount":"225,000,000"},"appealStatus":"under appeal","url":"https://dposchool.com/gdpr/fine/dpc-whatsapp-2021-08","json":"https://dposchool.com/gdpr/api/v1/fines/dpc-whatsapp-2021-08.json","review":"reviewed"},{"kind":"fine","id":"garante-deliveroo-2021-07","organisation":"Deliveroo Italy s.r.l.","authority":"Garante per la protezione dei dati personali","country":"Italy","date":"2021-07-22","dateBasis":"decision","amount":{"currency":"EUR","amount":"2,500,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/garante-deliveroo-2021-07","json":"https://dposchool.com/gdpr/api/v1/fines/garante-deliveroo-2021-07.json","review":"reviewed"},{"kind":"fine","id":"cnpd-amazon-2021-07","organisation":"Amazon Europe Core S.à r.l.","authority":"Commission nationale pour la protection des données (Luxembourg)","country":"Luxembourg","date":"2021-07-15","dateBasis":"decision","amount":{"currency":"EUR","amount":"746,000,000"},"appealStatus":"annulled","url":"https://dposchool.com/gdpr/fine/cnpd-amazon-2021-07","json":"https://dposchool.com/gdpr/api/v1/fines/cnpd-amazon-2021-07.json","review":"reviewed"},{"kind":"fine","id":"aepd-vodafone-espana-2021-02","organisation":"VODAFONE ESPAÑA, S.A.U.","authority":"Agencia Española de Protección de Datos (AEPD)","country":"Spain","date":"2021-02-11","dateBasis":"decision","amount":{"currency":"EUR","amount":"6,000,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/aepd-vodafone-espana-2021-02","json":"https://dposchool.com/gdpr/api/v1/fines/aepd-vodafone-espana-2021-02.json","review":"reviewed"},{"kind":"fine","id":"lfd-ni-notebooksbilliger-2021-01","organisation":"notebooksbilliger.de AG","authority":"State Commissioner for Data Protection of Lower Saxony (LfD Niedersachsen)","country":"Germany","date":"2021-01-08","dateBasis":"announcement","amount":{"currency":"EUR","amount":"10,400,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/lfd-ni-notebooksbilliger-2021-01","json":"https://dposchool.com/gdpr/api/v1/fines/lfd-ni-notebooksbilliger-2021-01.json","review":"reviewed"},{"kind":"fine","id":"aepd-caixabank-2021-01","organisation":"CAIXABANK, S.A.","authority":"Agencia Española de Protección de Datos (AEPD)","country":"Spain","date":"2021-01-07","dateBasis":"decision","amount":{"currency":"EUR","amount":"6,000,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/aepd-caixabank-2021-01","json":"https://dposchool.com/gdpr/api/v1/fines/aepd-caixabank-2021-01.json","review":"reviewed"},{"kind":"fine","id":"ap-booking-2020-12","organisation":"Booking.com B.V.","authority":"Autoriteit Persoonsgegevens (Dutch Data Protection Authority)","country":"Netherlands","date":"2020-12-10","dateBasis":"decision","amount":{"currency":"EUR","amount":"475,000"},"appealStatus":"not appealed","url":"https://dposchool.com/gdpr/fine/ap-booking-2020-12","json":"https://dposchool.com/gdpr/api/v1/fines/ap-booking-2020-12.json","review":"reviewed"},{"kind":"fine","id":"dpc-twitter-2020-12","organisation":"Twitter International Company","authority":"Data Protection Commission (Ireland)","country":"Ireland","date":"2020-12-09","dateBasis":"decision","amount":{"currency":"USD","amount":"500,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/dpc-twitter-2020-12","json":"https://dposchool.com/gdpr/api/v1/fines/dpc-twitter-2020-12.json","review":"reviewed"},{"kind":"fine","id":"cnil-carrefour-france-2020-11","organisation":"Carrefour France","authority":"Commission nationale de l'informatique et des libertés (CNIL)","country":"France","date":"2020-11-18","dateBasis":"decision","amount":{"currency":"EUR","amount":"2,250,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/cnil-carrefour-france-2020-11","json":"https://dposchool.com/gdpr/api/v1/fines/cnil-carrefour-france-2020-11.json","review":"reviewed"},{"kind":"fine","id":"ico-marriott-2020-10","organisation":"Marriott International Inc","authority":"Information Commissioner's Office (United Kingdom)","country":"United Kingdom","date":"2020-10-30","dateBasis":"decision","amount":{"currency":"GBP","amount":"18,400,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/ico-marriott-2020-10","json":"https://dposchool.com/gdpr/api/v1/fines/ico-marriott-2020-10.json","review":"reviewed"},{"kind":"fine","id":"ico-ba-2020-10","organisation":"British Airways plc","authority":"Information Commissioner's Office (United Kingdom)","country":"United Kingdom","date":"2020-10-16","dateBasis":"decision","amount":{"currency":"GBP","amount":"20,000,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/ico-ba-2020-10","json":"https://dposchool.com/gdpr/api/v1/fines/ico-ba-2020-10.json","review":"reviewed"},{"kind":"fine","id":"hmbbfdi-hm-2020-10","organisation":"H&M Hennes & Mauritz Online Shop A.B. & Co. KG","authority":"Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI)","country":"Germany","date":"2020-10-01","dateBasis":"announcement","amount":{"currency":"EUR","amount":"35,258,707.95"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/hmbbfdi-hm-2020-10","json":"https://dposchool.com/gdpr/api/v1/fines/hmbbfdi-hm-2020-10.json","review":"reviewed"},{"kind":"fine","id":"imy-google-2020-03","organisation":"Google LLC","authority":"Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection)","country":"Sweden","date":"2020-03-10","dateBasis":"decision","amount":{"currency":"SEK","amount":"75,000,000"},"appealStatus":"reduced","url":"https://dposchool.com/gdpr/fine/imy-google-2020-03","json":"https://dposchool.com/gdpr/api/v1/fines/imy-google-2020-03.json","review":"reviewed"},{"kind":"fine","id":"garante-tim-2020-01","organisation":"TIM S.p.A.","authority":"Garante per la protezione dei dati personali","country":"Italy","date":"2020-01-15","dateBasis":"decision","amount":{"currency":"EUR","amount":"27,802,946"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/garante-tim-2020-01","json":"https://dposchool.com/gdpr/api/v1/fines/garante-tim-2020-01.json","review":"reviewed"},{"kind":"fine","id":"bfdi-1und1-2019-12","organisation":"1&1 Telecom GmbH","authority":"Federal Commissioner for Data Protection and Freedom of Information (BfDI)","country":"Germany","date":"2019-12-09","dateBasis":"announcement","amount":{"currency":"EUR","amount":"9,550,000"},"appealStatus":"reduced","url":"https://dposchool.com/gdpr/fine/bfdi-1und1-2019-12","json":"https://dposchool.com/gdpr/api/v1/fines/bfdi-1und1-2019-12.json","review":"reviewed"},{"kind":"fine","id":"blnbdi-deutsche-wohnen-2019-10","organisation":"Deutsche Wohnen SE","authority":"Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI)","country":"Germany","date":"2019-10-30","dateBasis":"decision","amount":{"currency":"EUR","amount":"14,500,000"},"appealStatus":"reduced","url":"https://dposchool.com/gdpr/fine/blnbdi-deutsche-wohnen-2019-10","json":"https://dposchool.com/gdpr/api/v1/fines/blnbdi-deutsche-wohnen-2019-10.json","review":"reviewed"},{"kind":"fine","id":"dsb-post-2019-10","organisation":"Post AG","authority":"Datenschutzbehörde (Austrian Data Protection Authority)","country":"Austria","date":"2019-10-23","dateBasis":"decision","amount":{"currency":"EUR","amount":"18,000,000"},"appealStatus":"reduced","url":"https://dposchool.com/gdpr/fine/dsb-post-2019-10","json":"https://dposchool.com/gdpr/api/v1/fines/dsb-post-2019-10.json","review":"reviewed"},{"kind":"fine","id":"cnil-google-2019-01","organisation":"Google LLC","authority":"Commission nationale de l'informatique et des libertés (CNIL)","country":"France","date":"2019-01-21","dateBasis":"decision","amount":{"currency":"EUR","amount":"50,000,000"},"appealStatus":"upheld","url":"https://dposchool.com/gdpr/fine/cnil-google-2019-01","json":"https://dposchool.com/gdpr/api/v1/fines/cnil-google-2019-01.json","review":"reviewed"},{"kind":"fine","id":"lfdi-bw-knuddels-2018-11","organisation":"Knuddels","authority":"State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW)","country":"Germany","date":"2018-11-21","dateBasis":"decision","amount":{"currency":"EUR","amount":"20,000"},"appealStatus":"unknown","url":"https://dposchool.com/gdpr/fine/lfdi-bw-knuddels-2018-11","json":"https://dposchool.com/gdpr/api/v1/fines/lfdi-bw-knuddels-2018-11.json","review":"reviewed"}],"disclaimer":"Summaries are written by DPO School and are not the official text. Only the documents published by the court or the authority are authoritative. Reference material, not legal advice."},"source":{"statement":"Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu","regulation":"Regulation (EU) 2016/679","eli":"http://data.europa.eu/eli/reg/2016/679/oj","celex":"32016R0679","officialJournal":"OJ L 119, 4.5.2016, p. 1","corrigenda":[{"reference":"OJ L 127, 23.5.2018, p. 2","celex":"32016R0679R(02)","date":"2018-05-23"}],"files":{"articles":{"description":"Consolidated text 02016R0679-20160504, version 000.002 (incorporates the 2018 corrigendum)","url":"http://publications.europa.eu/resource/celex/02016R0679-20160504"},"recitals":{"description":"Official Journal text, OJ L 119, 4.5.2016; recital 71 as corrected by OJ L 127, 23.5.2018","url":"http://publications.europa.eu/resource/celex/32016R0679"},"corrigendum":{"description":"Corrigendum, OJ L 127, 23.5.2018, p. 2","url":"http://publications.europa.eu/resource/celex/32016R0679R%2802%29"}},"licence":"© European Union, https://eur-lex.europa.eu. Reuse is authorised under Commission Decision 2011/833/EU, provided the source is acknowledged.","authentic":"Only the text published in the Official Journal of the European Union is authentic."},"dates":{"adopted":"2016-04-27","published":"2016-05-04","appliesFrom":"2018-05-25","textRetrievedOn":"2026-10-28"},"disclaimer":"Unofficial reproduction for reference. Not legal advice. Verify against the official text on EUR-Lex."}