EU GDPR Art 24

In addition to corrective powers, the EDPB suggests that Data Protection Authorities (DPAs) follow a five-step approach when deciding fines.

The company was fined after VDAI identified GDPR compliance weaknesses related to incident reporting and data security.

Datatilsynet in Norway found that Telenor contravened EU GDPR with multiple failures.

More than 2,300 customers were contacted, with some ‘relationships on paper’ endorsed with false signatures.

Around 16,000 registered users connected to the university were affected, included Ukrainian refugees.

The DPC reports a busy year with increasing cases and GDPR breaches, and a record fine on Meta.

When do regulators choose to go after data processors instead of data controllers?