GDPR

Germany: New government plans to centralize data protection supervision and reduce regulation for small and medium-sized companies

By Verena Grentzenberg, Lucas Blum & Luca Sawatzki on April 14, 2025

Posted in General Data Protection Regulation, Supervisory authority relations

On April 9, 2025, the coalition agreement of the future German Federal Government, consisting of the three German parties CDU, CSU and SPD, was published. The document entitled “Responsibility for Germany” contains several plans, including some that may fundamentally change the German data protection supervisory authority structure and that aim to ease the regulatory burden…

EU: DLA Piper GDPR Fines and Data Breach Survey: January 2025

By Rachel de Souza on January 21, 2025

Posted in Data security and breaches, Enforcement, EU privacy, General Data Protection Regulation, Privacy Law

The seventh annual edition of DLA Piper’s GDPR Fines and Data Breach Survey has revealed another significant year in data privacy enforcement, with an aggregate total of EUR1.2 billion (USD1.26 billion/GBP996 million) in fines issued across Europe in 2024.

Ireland once again remains the preeminent enforcer issuing EUR3.5 billion (USD3.7 billion/GBP2.91 billion) in fines since…

EU: EDPB Opinion on AI Provides Important Guidance though Many Questions Remain

By James Clark, Heidi Waem, John Magee & Rachel de Souza on January 14, 2025

Posted in Artificial Intelligence, EDBP (European Data Protection Board), Privacy Law

A much-anticipated Opinion from the European Data Protection Board (EDPB) on AI models and data protection has not resulted in the clear or definitive guidance that businesses operating in the EU had hoped for. The Opinion emphasises the need for case-by-case assessments to determine GDPR applicability, highlighting the importance of accountability and record-keeping…

Germany: Judgment on Non-Material Damages for Loss of Control over Personal Data

By Verena Grentzenberg, Jan Pohle, Philipp Adelberg & Lucas Blum on November 19, 2024

Posted in EU privacy, General Data Protection Regulation

On November 18, 2024, the German Federal Court of Justice (Bundesgerichtshof – “BGH”) made a (to date unpublished) judgment under the case number VI ZR 10/24 regarding claims for non-material damages pursuant to Art. 82 GDPR, due to the loss of control over personal data.

The judgment is based on a personal…

EU: CJEU Insight

By Rachel de Souza, Philipp Schmechel, Radha Pull ter Gunne & Lorcan Moylan Burke on October 15, 2024

Posted in CJEU, EU privacy, General Data Protection Regulation

October has already been a busy month for the Court of Justice of the European Union (“CJEU”), which has published a number of judgments on the interpretation and application of the GDPR, including five important decisions, all issued by the CJEU on one day – 4 October 2024.

This article provides an overview…

Europe/Germany: Right to bring collective action for violations of information obligations under GDPR

By Andreas Ruediger on August 29, 2024

Posted in Class actions, ECJ; Article 29 Working Party;, EU privacy, General Data Protection Regulation, Privacy Law, Transparency

Summary

In its judgement of 11 July 2024 (C-757/22), the European Court of Justice (‘ECJ’) ruled that the violation of a controller’s information obligations under Art. 12 and 13 GDPR, can be subject to a representative action under Article 80(2) GDPR.

Facts of the case

Meta Platforms Ireland Limited (“…

Europe: EDPB issues Opinion on ‘consent or pay’ models deployed by large online platforms

By Rachel de Souza on April 24, 2024

Posted in EDBP (European Data Protection Board), General Data Protection Regulation

The European Data Protection Board (“EDPB”) has adopted an Opinion (“EDPB Opinion”) on the validity of consent to process personal data for the purposes of behavioural advertising in the context of ‘consent or pay’ models deployed by large online platforms. The EDPB concludes that “in most cases”, the requirements of…

CJEU Insight

By Lorcan Moylan Burke & Sarah Leeman on January 24, 2024

Posted in Cyber security, EU privacy, General Data Protection Regulation

2023 was a busy year for the Court of Justice of the European Union (CJEU), with the issuance of a number of far-reaching judgments on the interpretation and application of the GDPR.

In December 2023, the CJEU delivered two important decisions which supplement a growing body of jurisprudence on the issuance of administrative fines and…