Privacy

Anyone who violates the GDPR risks heavy fines. Until now, each national privacy supervisory authority determined the amount of these fines quite independently. With European guidelines for the calculation of GDPR fines, that is changing...

News services process a great deal of personal data, but enjoy an exception: the full GDPR does not apply to journalistic publications, in order to protect freedom of expression. However, that journalistic exception is not...

If you process personal data only incidentally and to a limited extent in the course of an assignment, a comprehensive data processing agreement is not always necessary. Often, a privacy clause in your general terms and conditions suffices. In the case of a true processor relationship...

The GDPR protects personal data of living persons; after death, GDPR rules in principle no longer apply to the data of the deceased themselves. However, you are not allowed to simply do anything: data...

Health data are “special categories of personal data” under the GDPR and enjoy additional protection: you may only process them if strict requirements are met, usually with explicit consent. Furthermore, medical professionals have...

An unclear or incomplete privacy statement can result in a massive fine: WhatsApp (Meta) received one of approximately 225 million euros for it, purely because it failed to properly comply with the duty to provide information. You...

The right to be forgotten is not absolute: if you have a legal obligation to retain data, you do not have to delete it in response to a deletion request. For example, a primary school was allowed to...

If you transfer personal data to a country outside the EEA (a “third country”), you must properly substantiate that transfer. This is often done using the standard contractual clauses (model contract) of the European...

TikTok received a fine of over 750,000 euros from the Dutch Data Protection Authority because its privacy policy was only available in English and not understandable to (often young) Dutch users....

Anyone who collects personal data via a website must secure it properly — especially in healthcare and when dealing with children's data. An orthodontic practice that asks patients to register via an unsecured (unencrypted) form...