In a recent ruling, the Court of Justice of the European Union ("CJEU") has spoken for the first time on the interpretation of 32 of the GDPR and the obligation to take adequate privacy security measures in the context of a data breach.
The decision of the CJEU on potential damages deriving from a data breach might potentially increase the risk of a class action connected to privacy related violations.ย
The Court of Justice of the European Union ("CJEU") has ruled on the conditions under which national data protection supervisory authorities may impose administrative fines on one or more data controllers for a violation of EU Regulation 679/2016 ("GDPR").
According to the CJEU, the GDPR poses an obligation on a controller to provide the data subject, free of charge, with a first copy of its personal data.
The European Court of Justice (CJEU) delivered a ruling leading to major discussions, mandating controllers to inform data subjects of recipients' names upon exercising their privacy right of access under GDPR unless specific exceptions apply.
The position of the European Court of Justice in the Planet 49 case on consent required for the acceptance of cookies might impact the approach previously validated by the Italian data protection authority on the matter.