EU General Data Protection Regulation

EU General Data Protection Regulation (GDPR)

I. European Union (EU) - General Data Protection Regulation (GDPR)

The EU General Data Protection Regulation (GDPR), adopted in 2016, came into force on 25 May 2018, replacing the EU Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data (EU Directive). The GDPR involves new provisions and enhanced rights. In the wake of technological developments and globalisation and the constitutionalisation of the fundamental right to data protection in the EU, the GDPR aims to harmonise the framework for the digital single market, put individuals in control of their data and formulate a modern data protection governance.

Why is the GDPR relevant to Hong Kong organisations/ businesses?

In Hong Kong, the Personal Data (Privacy) Ordinance, Cap 486 of the Laws of Hong Kong (PDPO) protects the privacy of individuals in relation to personal data. When the PDPO was drafted, reference was made to the relevant requirements under the OECD Privacy Guidelines 1980 and the EU Directive. Given that the GDPR constitutes significant developments of data protection law from the EU Directive, the new regulatory framework includes a number of requirements that are not found under the PDPO.

One of the key developments introduced under the GDPR to the data protection landscape outside the EU is the explicit requirement of compliance by organisations established in non-EU jurisdictions in specified circumstances. Given the diversified business or transaction models (e.g. online transactions), it is all the more important for businesses in Hong Kong to ascertain if the GDPR is applicable to them, and to keep up with the new developments.

II. New Standard Contractual Clauses adopted by the European Commission under the GDPR for International Data Transfers

III. Publications and Articles on the GDPR

IV. Guidance and reference materials issued by the European Union

V. Highlights of Important Decisions and Major Developments under the GDPR

II. New Standard Contractual Clauses adopted by the European Commission under the GDPR for International Data Transfers

The European Commission adopted a new set of Standard Contractual Clauses (which came into effect on 27 June 2021) for the transfer of personal data to non-EU regions (“New SCCs”). From 27 September 2021 onwards, data exporters and data importers can only conclude contracts incorporating the New SCCs for the transfer of personal data out of the European Union. The PCPD publishes, for public reference, a set of frequently asked questions and answers on the implementation framework of the New SCCs and the obligations of parties entering into cross-border data transfer agreements using the New SCCs.

For more information, please refer to the set of frequently asked questions and answers:
https://www.pcpd.org.hk/english/data_privacy_law/eu/files/eu_faq.pdf

Please click here to read the "Introduction to the European Commission’s New Standard Contractual Clauses for International Data Transfers".

Please click here to download the presentation files and watch the video of the Webinar on “the New Standard Contractual Clauses of the EU for Transfer of Personal Data from EU to Non-EU Regions” organised by the PCPD

III. Publications and Articles on the GDPR

To raise the awareness amongst organisations / businesses in Hong Kong of the possible impact of the new regulatory framework for data protection in the GDPR, the PCPD has issued the following publication:

Booklet:
An Update on European Union General Data Protection Regulation 2016
(May 2020 Revised Edition)

Hong Kong Lawyer (June 2018 issue) - EU GDPR and HK PDPO: What's the Difference?
PCPD's Media Statement (3 April 2018) - How Hong Kong Businesses Should Prepare for the EU General Data Protection

IV. Guidance and reference materials issued by the European Union

More Guidelines and Recommendations can be found here: https://edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en?page=0

European Data Protection Board

Subject Matter	Recommendations/Guidelines
Administrative fines	Guidelines 04/2022 on the calculation of administrative fines under the GDPR¹
Consent	Guidelines 05/2020 on consent
Controller and processor	Guidelines 07/2020 on the concepts of controller and processor in the GDPR
Data breach notification	Guidelines 01/2021 on examples regarding personal data breach notification Guidelines 9/2022 on personal data breach notification under GDPR
Data portability	Guidelines on right to data portability
Data protection by design and by default	Guidelines 4/2019 on Article 25 data protection by design and by default
Data protection impact assessments	Guidelines on data protection impact assessments
Data subject rights	Guidelines 01/2022 on data subject rights - Right of access
Derogations	Guidelines 2/2018 on derogations of Article 49 under the GDPR
Information and communications technology	Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) of the GDPR in the context of the provision of online services to data subjects Guidelines 3/2019 on processing of personal data through video device Guidelines 02/2021 on virtual voice assistants
One-Stop-Shop mechanism	Guidelines 02/2022 on the application of Article 60 GDPR Guidelines 8/2022 on identifying a controller or processor’s lead supervisory authority Guidelines 03/2021 on the application of Article 65(1)(a) GDPR
International transfer and tools	Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data Guidelines 04/2021 on codes of conduct as tools for transfers Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR Guidelines 07/2022 on certification as a tool for transfers
Restrictions	Guidelines 10/2020 on restrictions (on the scope of rights of data subject and obligations of controllers/processors) under Article 23 of the GDPR
Social media	Guidelines 8/2020 on the targeting of social media users Guidelines 03/2022 on deceptive design patterns in social media platform interfaces: how to recognise and avoid them
Territorial scope	Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)
Transparency	Guidelines on Transparency under Regulation 2016/679

European Commission

Subject Matter	Reference Materials
Data protection regime	Overview of the data protection regime in the EU
GDPR requirements	Introduction to the requirements of the GDPR

V. Highlights of Important Decisions and Major Developments under the GDPR

A. Highlight of Important Decisions under the GDPR

(I) Decisions involving imposition of fines

¹ The substantive ruling was issued on 2 May 2024 and the announcement on the imposition of fine was made on 16 July 2024.

(II) Interpretation of the GDPR

Date of Decision	Ruling
3 April 2025	Court of Justice of the European Union clarifies lawfulness of processing personal data of representatives of legal persons On 3 April 2025, the Court of Justice of the European Union (CJEU) made a ruling concerning the lawfulness of processing personal data of natural persons representing legal persons in the context of Articles 4, 6 and 86 of the GDPR. The case originated from a request for a preliminary ruling by the Supreme Administrative Court of the Czech Republic in a dispute between L.H. and the Czech Ministry of Health. L.H. lodged a request with the Ministry for information concerning the identification of persons who signed contracts for the purchase of COVID-19 screening tests and certificates related to those tests. The Ministry sent L.H. the certificates but redacted information relating to the natural persons (those representatives) who signed those certificates on behalf of the legal persons concerned, including the names, signatures, positions of those representatives and, in some cases, the contact information of the legal persons. The Ministry justified the redaction with relevant GDPR provisions. While the Czech case law requires a data controller to inform and consult the data subjects concerned before disclosing their data, the Ministry claimed that it was impossible for it to inform and consult those representatives involved because they operate from China and the United Kingdom, where the legal persons issuing the certificates are registered, and that their domiciles are unknown. The referring court sought clarification from CJEU on whether (i) the disclosure of the name, signature and contact information of a natural person acting as the representative of a legal person, made exclusively for the purpose of his/her identification, constitutes processing of “personal data” under Article 4(1) of the GDPR and (ii) whether national law could impose additional obligation to inform or consult data subjects before the disclosure of such data, considering Article 6(1)(c) and (e) of the GDPR. On question (i), the CJEU ruled that disclosing the aforementioned data of a natural person representing a legal person constitutes the processing of personal data under Article 4 of the GDPR. The fact that that disclosure is made for the sole purpose of enabling the identification of the natural person authorised to act on behalf of that legal person is irrelevant. On question (ii), the CJEU ruled that Article 6(1)(c) and (e) of the GDPR (when read with Article 86) do not preclude national case law from requiring a public authority to inform and consult a data subject before disclosing their personal data so long as such obligation is not impossible to implement or require disproportionate effort that results in a disproportionate restriction on public access to documents. For further details, please refer to CJEU’s Judgment in Case C-710/23 dated April 3, 2025.
13 March 2025	Court of Justice of the European Union rules on the right to rectification relating to gender identity On 13 March 2025, the Court of Justice of the European Union (CJEU) published its judgment in Case C-247-23 regarding the conditions made on the right to rectification under the GDPR. This case arose from a request for a preliminary ruling by the Budapest High Court of Hungary with regard to proceedings brought by VP, an Iranian national with refugee status in Hungary, for annulment of a decision made by the National Directorate-General for Immigration Policing of Hungary (the asylum authority). The decision concerned VP’s request for the asylum authority to rectify their gender data in the asylum register under Article 16 of the GDPR, which was rejected by the asylum authority on the ground that VP had not proved that they had undergone gender reassignment surgery. The CJEU ruled that Article 16 of GDPR must be interpreted as requiring a national authority responsible for keeping a public register to rectify the personal data relating to the gender identity of a natural person where those data are inaccurate, within the meaning of Article 5(1)(d) of GDPR. The right to rectification may only be restricted in accordance with the conditions set out in Article 23 of the GDPR, read in the light of recital 73 thereof. A Member State cannot rely on the absence, in its national law, of a procedure for the legal recognition of transgender identity in order to limit the exercise of the right to rectification. Further, the CJEU ruled that for the purposes of exercising the right to rectification of the personal data relating to the gender identity of a natural person that are contained in a public register under Article 16 of GDPR, while that person may be required to provide relevant and sufficient evidence that may reasonably be required of that person in order to establish that those data are inaccurate, a Member State may not, under any circumstances, by way of an administrative practice, make the exercise of that right conditional upon the production of evidence of gender reassignment surgery. Such a requirement undermines the essence of the right to the integrity of the person and the right to respect for private life, and is not necessary nor proportionate in order to ensure the reliability and consistency of a public register such as the asylum register. For further details, please refer to (1) CJEU’s Judgment and (2) Press Release issued by the CJEU dated 13 March 2025.
27 February 2025	Court of Justice of the European Union clarifies the right of access by the data subject in cases of automated decision-making and profiling On 27 February 2025, the Court of Justice of the European Union (CJEU) delivered a judgment concerning the right of access by the data subject in cases of automated decision-making and profiling in the context of Article 15(1)(h) of the GDPR. The case originated from a request for a preliminary ruling by the Administrative Court of Vienna, Austria, which involves a legal dispute between CK (an individual) and the City Council of Vienna regarding the enforcement of a court order. CK was refused a mobile telephone contract based on an automated credit assessment conducted by Dun & Bradstreet Austria GmbH (“D&B”) and hence brought the matter before the Austrian Data Protection Authority. D&B was ordered to provide CK with “meaningful information about the logic involved” in the automated decision-making based on CK’s personal data. However, D&B claimed that the relevant algorithm used was protected by trade secret. The CJEU confirmed that to constitute “meaningful information about the logic involved” in automated decision-making under Article 15(1)(h) of the GDPR, the data controller is required to explain, in a concise, transparent, intelligible and easily accessible form, the procedure and principles actually applied to use the data subject’s personal data in automated processing to reach a specific result, such as a credit profile. It was emphasised that meaningful information must enable data subjects to understand what kind of personal data were used and how the data affected the decision, in allowing them to effectively exercise their rights to express their point of view and contest the decision under Article 22(3) of the GDPR. Although data controllers are not required to disclose complex mathematical formulas or algorithms in their entirety, or the detailed description of all processing steps in automated decision-making, the CJEU noted that information should effectively describe the rationale and criteria relied upon in reaching the automated decision. Further, the CJEU held that where a data controller claims that information to be provided contains trade secret (within the meaning of Article 2(1) of the Trade Secrets Directive (EU) - Directive 2016/943) or personal data of third parties, the data controller must provide the allegedly protected information to the competent supervisory authority or court for the latter to balance the rights and interests at issue to determine the extent of the data subject’s right of access. It was stressed that, as stated in Recital 63 of the GDPR, trade secret should not be a ground of refusal to provide all information to the data subject. For further details, please refer to CJEU’s Judgment in Case C-203/22 dated 27 February 2025.
13 February 2025	Court of Justice of the European Union clarifies the concept of “undertaking” in relation to calculation of fines against subsidiaries on GDPR infringements On 13 February 2025, the Court of Justice of the European Union (CJEU) made a ruling on the interpretation of the concept of “undertaking” when calculating administrative fines for GDPR infringements committed by subsidiaries, in the context of Article 83(4) to (6) of the GDPR. The case arose from a request for a preliminary ruling from the Vestre Landsret (High Court of Western Denmark) in criminal proceedings against ILVA A/S, a furniture store chain (the data controller), for alleged GDPR infringements as regards the retention of the data of at least 350,000 former customers. ILVA is a subsidiary of Lars Larsen Group, which is headquartered in Denmark. The Danish Public Prosecutor’s Office, upon the recommendation of the Danish Data Protection Authority (Datatilsynet), sought a fine of DKK 1.5 million (approximately €201,000) against ILVA with the overall turnover of Lars Larsen Group as the basis of the calculation. Subsequently, the Aarhus District Court found ILVA guilty and imposed a much lower fine of DKK 100,000 (approximately €13,400), taking into account only ILVA’s turnover since it was of the view that ILVA functioned as an independent retail entity and Lars Larsen Group was not established solely for handling the Group’s data. The Public Prosecutor’s Office appealed against the District Court’s decision. The referring court sought clarification from the CJEU on whether the term “undertaking” in Article 83(4) to (6) of the GDPR should be aligned with the concept of “undertaking” under Articles 101 and 102 of the Treaty on the Functioning of the European Union (TFEU), and if so, whether the total worldwide annual turnover of the entire economic entity should be considered when calculating the fine. It was ruled that the term “undertaking” in Article 83(4) to (6) of the GDPR corresponds to the concept of “undertaking” in the TFEU, which is also consistent with Recital 150 of the GDPR. The CJEU found that when a fine regarding GDPR infringement is imposed on a data controller that is part of a larger undertaking, the maximum amount of the fine must be determined based on a percentage of the entire undertaking’s total worldwide annual turnover in the preceding business year. The CJEU further emphasised that a fine must be “effective, proportionate and dissuasive” in consideration of the actual or material economic capacity of the recipient of the fine. For further details, please refer CJEU’s Judgment in Case C‑383/23 dated 13 February 2025.
9 January 2025	Court of Justice of the European Union clarifies the meaning of “excessive requests” under the GDPR On 9 January 2025, the Court of Justice of the European Union (CJEU) issued a preliminary ruling clarifying the criteria on what qualifies as “excessive requests” made to supervisory authorities pursuant to Article 57(4) of the GDPR. F R (an individual) lodged a complaint with the Austrian data protection authority (DSB) on the grounds that a company, as a data controller, did not respond to his data access requests within one month. The DSB, in reliance on Article 57(4), refused to act on that complaint on account of its excessive nature (Decision), noting that 77 similar complaints directed against different data controllers had been filed by F R over a span of approximately 20 months. Dissatisfied with the Decision, F R brought an action against the DSB. The case was subsequently referred to the CJEU to clarify whether (i) the large quantity of requests (including complaints) submitted by data subjects to the supervisory authority alone could render them “excessive”, irrespective of the data subjects’ intentions; and (ii) in cases where excessive requests are submitted, the supervisory authority is free to choose between charging a reasonable fee based on administrative costs and refusing to act on the requests. On question (i), the CJEU ruled that requests could not be deemed “excessive” within the meaning of Article 57(4) solely because a large number of requests (including complaints) have been submitted to a supervisory authority. Instead, the supervisory authority must establish that it is not objectively necessary for the data subjects to submit a large number of requests to protect their rights under the GDPR and that such requests are made for purposes unconnected with the protection of those rights (i.e. there has been an abusive intention on the part of the data subject), such as to interfere with the proper functioning of the supervisory authority by taking up its resources in an abusive manner. On question (ii), it is held that when faced with excessive requests (including complaints), a supervisory authority may choose, by reasoned decision, to charge a reasonable fee based on administrative costs or refuse to act on such requests so long as the chosen option is appropriate, necessary and proportionate. For further details, please refer to CJEU’s judgement dated 9 January 2025.
28 November 2024	Court of Justice of the European Union clarifies data controllers’ information provision obligations when processing data not collected directly from data subjects On 28 November 2024, the Court of Justice of the European Union (CJEU) delivered a preliminary ruling concerning the exception to the obligation to provide information in case of indirect personal data collection under Article 14(5) of the GDPR. The case originated from a request for a preliminary ruling by the Supreme Court of Hungary regarding a proceeding brought by an individual against the Budapest Metropolitan Government Office of Hungary (the authority responsible for issuing certificates of immunity to persons vaccinated against COVID-19 or having contracted that illness) for not drawing up and publishing any statement on the protection of personal data in relation to the issuing of immunity certificates, and not providing information concerning the purpose and legal basis of such data processing or the rights of data subjects. The case was referred to the CJEU to clarify the following issues: (1) Whether the exception to the obligation to provide information to the data subject, laid down in Article 14(5)(c) of the GDPR, applies only to data which the data controller has specifically obtained from another person and not to data generated by the data controller in the context of its own processes; (2) If Article 14(5)(c) of the GDPR is also applicable to data generated by the data controller in the context of its own processes, whether a natural person who alleges an infringement of the obligation to provide information, when exercising his or her right to lodge a complaint with a supervisory authority under Article 77(1) of the GDPR, is entitled to request an examination of whether Member State law provides “appropriate measures” to protect the data subject’s legitimate interests, in accordance with Article 14(5)(c) of the GDPR; and (3) If the answer to the second question is in the affirmative, whether Article 14(5)(c) of the GDPR may be interpreted as meaning that “appropriate measures” require the national legislature to transpose the measures relating to the security of data laid down in Article 32 of the GDPR. On question (1), the CJEU ruled that the Article 14(5)(c) of the GDPR must be interpreted as meaning that the exception to the data controller’s obligation to provide information to the data subject, laid down in that provision, concerns all personal data, without distinction, that have not been collected by the data controller directly from the data subject, including those data that have been obtained by the data controller from a person other than the data subject and data that have been generated by the data controller itself, in the performance of its tasks. In answering questions (2) and (3), the CJEU ruled that Articles 14(5)(c) and 77(1) of the GDPR must be interpreted as meaning that, in a complaint procedure, the supervisory authority is competent to verify whether the Member State law to which the data controller is subject has provided appropriate measures to protect the data subject's legitimate interests, for the purposes of the application of the exception under Article 14(5)(c). That verification does not, however, cover the appropriateness of the measures that the data controller is required to implement under Article 32 to guarantee the security of processing of personal data. For further details, please refer to the CJEU’s judgement dated 28 November 2024.
4 October 2024	Court of Justice of the European Union rules that an online social network cannot use all of the personal data obtained for targeted advertising without restriction as to time and without distinction as to type of data On 4 October 2024, the Court of Justice of the European Union (CJEU) published its judgment in Case C-446/21 regarding the unlawful processing of personal data obtained for the purposes of targeted advertising without restriction as to time and without distinction as to type of data under the GDPR. This case arose from a request for a preliminary ruling by the Supreme Court of Austria, following a complaint from Maximilian Schrems against Meta Platforms Ireland (Meta) regarding the allegedly unlawful processing of his personal data. Mr Schrems alleged that Meta unlawfully processed his personal data, including a statement he made about his sexual orientation during a public panel discussion. The CJEU ruled that the GDPR’s principle of data minimisation under Article 5(1)(c) precludes a controller, such as the operator of an online social network platform from aggregating, analysing and processing all of the personal data, obtained from the data subject or third parties and collected either on or outside that platform, for the purposes of targeted advertising without restriction as to time and without distinction as to type of data. It was held that storing personal data for unlimited periods for targeted advertising purposes constitutes a disproportionate interference with GDPR rights. Regarding sensitive data, while the prohibition on the processing of special categories of personal data (such as sexual orientation) does not apply to personal data that has been manifestly made public by the data subject pursuant to Article 9(2)(e) of the GDPR, the CJEU ruled that the fact that a person has made a statement about his or her sexual orientation on the occasion of a panel discussion open to the public does not authorise the operator of an online social network platform to process other data relating to that person’s sexual orientation obtained outside that platform using partner third-party websites and apps, with a view to aggregating and analysing those data, in order to offer that person personalised advertising. For further details, please refer to (1) CJEU’s Judgment and (2) Press Statement issued by the CJEU dated 4 October 2024.
4 October 2024	Court of Justice of the European Union rules on the disclosure of personal data in commercial registers and the right to erasure On 4 October 2024, the Court of Justice of the European Union (CJEU) delivered a preliminary ruling concerning the disclosure of personal data in commercial registers and the right to erasure under the General Data Protection Regulation (GDPR). The case originated from a request for a preliminary ruling by the Supreme Administrative Court of Bulgaria with regard to proceedings brought by a data subject against the Registration Agency, the Bulgarian authority responsible for maintaining the commercial register. The data subject sought erasure of certain personal data contained in her company’s constitutive instrument, which was published in the commercial register. The CJEU ruled that Article 21(2) of Directive 2017/1132 of the European Parliament and of the Council of 14 June 2017 relating to certain aspects of company law does not impose an obligation on Member States to permit the disclosure, in the commercial register, of a company’s constitutive instrument subject to compulsory disclosure under that directive and containing personal data, other than the minimum personal data required, disclosure of which is not required by the law of that Member State, and the authority responsible for maintaining the commercial register is both a “recipient” and a “controller” under Article 4(7) and (9) of the GDPR. Further, the CJEU found that Article 17 of the GDPR, read in conjunction with Article 16 of Directive 2017/1132, precludes national legislation or practice that leads the authority responsible for maintaining the commercial register to refuse requests for erasure of personal data contained in a company’s constitutive instrument published in the register not required by law. Incidentally, it also ruled that a handwritten signature constitutes personal data within the meaning of Article 4(1) of the GDPR. With regard to damage, the CJEU held that under Article 82(1) of the GDPR, a temporary loss of control over personal data, on account of those data being made available online to the public, in the commercial register may suffice to cause non-material damage. However, the data subject must demonstrate actual harm, even if minimal, without needing to prove additional tangible consequences. Lastly, the CJEU ruled that an opinion issued by a supervisory authority under Article 58(3)(b) of the GDPR is not sufficient to exempt the authority responsible for maintaining the commercial register of that Member State from liability under Article 82(3) of the GDPR. For further details, please refer to CJEU's Judgment in Case C-200/23 dated 4 October 2024.
4 October 2024	Court of Justice of the European Union clarifies rules on compensation for GDPR infringements On 4 October 2024, the Court of Justice of the European Union (CJEU) delivered a preliminary ruling concerning the interpretation of Article 82(1) of the GDPR in the context of compensation for non-material damage arising from unlawful processing of personal data. The case originated from a request for a preliminary ruling by the Supreme Court of Latvia regarding proceedings brought by a journalist against the Consumer Rights Protection Centre of Latvia for using and distributing his personal data without authorisation in a consumer awareness video campaign. The CJEU reaffirmed that a mere infringement of the GDPR is not sufficient in itself to constitute “damage” within the meaning of Article 82(1). Three cumulative conditions must be met for the right to compensation: (i) an infringement of the GDPR, (ii) damage suffered, and (iii) a causal link between the infringement and the damage. Even if a provision of the GDPR that has been infringed grants rights to natural persons, such an infringement cannot, in itself, constitute “non-material damage”. Furthermore, the CJEU ruled that making an apology may constitute sufficient compensation for non-material damage under Article 82(1) of the GDPR, including where it is impossible to restore the situation that existed prior to the occurrence of that damage, provided that such a form of redress is capable of fully compensating the damage suffered by the data subject. National courts must take account of the circumstances of each individual case and ensure that such a form of compensation complies with the principles of equivalence and effectiveness. In addition, the CJEU held that Article 82(1) of the GDPR precludes taking into account the attitude and motivation of the controller to award compensation to the data subject that is lower than the damage actually suffered. The CJEU emphasised the exclusively compensatory function of Article 82(1), distinguishing it from the punitive purposes of the imposition of administrative fines and other penalties under Articles 83 and 84 of the GDPR. Consequently, only the damage actually suffered by the data subject should be considered when determining compensation. For further details, please refer to CJEU's Judgment in Case C-507/23 dated 4 October 2024.
26 September 2024	Court of Justice of the European Union clarifies the discretion of supervisory authorities in exercising corrective powers under the GDPR On 26 September 2024, the Court of Justice of the European Union (CJEU) issued a preliminary ruling regarding the discretion of supervisory authorities in exercising corrective powers under Article 58(2) of the GDPR in the context of a data breach incident. TR, a customer of a bank, lodged a complaint with the Hessen Commissioner for Data Protection and Freedom of Information (HBDI) concerning his personal data being unlawfully accessed by an employee of the bank. TR argued that the bank failed to notify him of the breach as required by the GDPR and criticized the bank’s short retention period for access logs and the extensive access rights granted to employees. After investigation, the HBDI concluded that the bank’s assessment on there being unlikely to be a high risk to TR’s rights and freedoms was not manifestly incorrect and hence the bank had not infringed Article 34 of the GDPR. The HBDI requested the bank to extend the retention period for access logs but did not find fault with the access rights granted to employees. Dissatisfied with the HBDI’s decision, particularly that no action was taken against the bank under Article 58(2) of the GDPR, TR initiated a proceeding before the German Administrative Court of Wiesbaden. The case was then referred to the CJEU to clarify whether supervisory authorities (SAs) must exercise the corrective powers under Article 58(2) upon finding an infringement. In its judgment, the CJEU emphasized that SAs have a discretion in deciding whether to exercise one or more of the corrective powers, taking into account the appropriateness, necessity, and proportionality of corrective measures based on the specific circumstances of each case. While SAs must react appropriately to remedy the shortcoming found and ensure that the GDPR is fully enforced, they are not obligated to exercise a corrective power in every instance of a breach. For instance, SAs may, exceptionally and in light of the particular circumstances of the case, refrain from exercising a corrective power where appropriate and necessary measures have been taken to ensure that the breach is brought to an end and does not recur. For further details, please refer to CJEU’s Judgment dated 26 September 2024.
20 June 2024	Court of Justice of the European Union clarifies the rules regarding compensation for non-material damage arising from identity theft On 20 June 2024, the Court of Justice of the European Union (CJEU) delivered a preliminary ruling concerning compensation for non-material damage under Article 82 of the GDPR in the context of identity theft. The case originated from a request for a preliminary ruling by the local court of Munich, Germany with regard to a proceeding brought by two applicants who opened accounts at a German company named Scalable Capital and entered personal data (“Data”) in their respective accounts. The Data was later seized by unknown third parties. There was no indication that the Data had been used fraudulently. The applicants sought compensation for non-material damages which they claimed to have suffered as a result of theft of the Data. The case was referred to the CJEU to clarify these main issues: (1) whether compensation under Article 82 of the GDPR is exclusively compensatory, or both punitive and compensatory; (2) whether, in determining the amount of compensation, it is required to consider the severity and possible intentional nature of the infringement of the GDPR, and whether it is appropriate to consider that non-material damage is by its nature less significant than physical injury; (3) whether minimal compensation can be awarded where the damage is not serious; and (4) whether compensation for non-material damages for “identity theft” requires the actual misuse of the identity of data subject. In answering (1) and (2), the CJEU stressed the difference between the compensatory nature of Article 82 of the GDPR and the punitive nature of Articles 83 and 84 of the GDPR and affirmed that compensation under Article 82 is neither punitive nor deterrent. The CJEU ruled that Article 82(1) is exclusively compensatory to allow the damage actually suffered as a result of an infringement of the GDPR to be compensated fully and effectively. As such, it does not require consideration of the severity and possible intentional nature of the infringement. Also, it is not the case that non-material damage is, by its nature, less significant than physical injury. It is appropriate to consider this when determining the amount of damages due in respect of the right to compensation for non-material damage. On (3), the CJEU took the view that Article 82(1) does not require the damage alleged by the data subject to reach a “de minimis” threshold. Provided that the compensation is such as to compensate the damage suffered in full, minimal compensation can be awarded where the damage is not serious. On (4), the CJEU ruled that to claim compensation for non-material damage caused by identity theft, there must have been actual misuse of the identity of the person affected by a theft of personal data by a third party. However, the CJEU emphasized that compensation for non-material damage caused by the theft of personal data cannot be limited to cases where it is shown that that data theft subsequently gives rise to identify theft or fraud. For further details, please refer to CJEU’s Judgment dated 20 June 2024.
11 April 2024	Court of Justice of the European Union publishes preliminary ruling regarding the right to compensation for non-material damage in GDPR infringement On 11 April 2024, the Court of Justice of the European Union (CJEU) delivered a preliminary ruling in relation to the right to compensation for non-material damage under the GDPR. Proceedings were brought by an individual (data subject) against a company (data controller) for using and processing his personal data despite his objections to the company and revocation of his consent to receive marketing information. The data subject relied on Article 82(1) of the GDPR to claim compensation for, inter alia, the loss of control over his personal data. The Regional Court of Saarbrucken Germany referred the case to the CJEU for its preliminary ruling on issues relating to the threshold for claiming non-material damage, data controller’s exemption from liability and determination of the amount of compensation. In its judgment, the CJEU emphasised that to claim compensation under Article 82(1) of the GDPR, three conditions must be satisfied: (i) the data subject suffered material or non-material damage; (ii) there exists an infringement of the GDPR; and (iii) there is a causal link between the infringement and the damage. Thus, the CJEU held that even if the provision of the GDPR which has been infringed confers rights to the data subject, a mere infringement of that provision is, in itself, not sufficient to constitute “non-material damage” within the meaning of Article 82(1) of the GDPR, irrespective of the degree of seriousness of the damage suffered by the data subject. The CJEU also held that in the event of a personal data breach committed by a person acting under a data controller’s authority, the data controller may benefit from the exemption under Article 82(3) of the GDPR only if he proves that there is no causal link between any breach of the data protection obligations imposed on him under Articles 5, 24 and 32 of the GDPR and the damage suffered by the data subject; simply claiming that the damage in question was caused by negligence or failure on the part of a person acting under his authority is not sufficient. Regarding determination of the amount of compensation for non-material damage, in light of the difference between the functions of Articles 82 and 83 of the GDPR, with the former being compensatory while the latter being punitive in nature, the CJEU took the view that (1) the criteria for setting the amount of administrative fines under Article 83 of the GDPR cannot be used to assess the amount of compensation under Article 82 of the GDPR; and (2) it is not necessary to take account of the fact that several infringements of the GDPR concerning the same processing operation affect the person seeking compensation. For further details, please refer to CJEU’s Judgment dated 11 April 2024.
7 March 2024	Court of Justice of the European Union clarifies the meaning of “personal data” and “joint controller” in the context of advertising technology under the GDPR On 7 March 2024, the Court of Justice of the European Union (CJEU) made a ruling concerning the interpretation of “personal data” and “joint controller” under the GDPR in the context of advertising technology. IAB Europe, a non-profit organisation representing the digital advertising and marketing industry, has drawn up the Transparency and Consent Framework (the “Framework”). The Framework establishes a standardised mechanism for requesting, storing and sharing users’ preferences and consents (or objections) concerning the processing of the users’ data for the provision of targeted advertisements. These preferences and consents are stored in a combination of letters and characters, known as the “TC String”. In 2022, the Belgian Data Protection Authority held that the Framework did not conform to the GDPR requirements, and imposed corrective measures and an administrative fine on IAB Europe. IAB Europe contested the decision before the Brussels Court of Appeal, averring that a TC String does not constitute personal data and that IAB Europe does not qualify as a data controller. The Brussels Court of Appeal referred the matter to the CJEU for a preliminary ruling. On the question of personal data, the CJEU referred to recital 26 of the GDPR and took the view that for information to be treated as personal data within the meaning of Article 4(1) of the GDPR, it is not required that all the information enabling the identification of the data subject must be in the hands of one person. Noting also that the user may be identified by combining the TC String with additional data such as the user’s IP address, the CJEU held that the TC String constitutes personal data within the meaning of Article 4(1) of the GDPR. The mere fact that IAB Europe is unable to access the data processed by its members under the Framework and carry out the combination by itself does not preclude a TC String from being classified as personal data. On the question of joint controller, the CJEU held that IAB Europe may be regarded as a “joint controller” under Articles 4(7) and 26(1) of the GDPR since it exerted influence over the processing operation of personal data for its own purposes and determines, jointly with its members, the purposes and means of such processing operation. That said, the CJEU clarified that the joint controllership of IAB Europe does not extend to the subsequent processing of personal data that does not involve the participation of IAB Europe. The CJEU reiterated that joint controllership does not always imply equal responsibility among all joint controllers engaged in the processing of personal data. The level of responsibility of each joint controller must be assessed in light of all relevant circumstances of the particular case. For further details, please refer to (1) CJEU’s Judgment and (2) Press Release issued by the CJEU dated 7 March 2024.
30 January 2024	Court of Justice of the European Union rules police should not indefinitely store biometric data On 30 January 2024, the Court of Justice of the European Union (CJEU) ruled that law enforcement agencies retaining for an indefinite period (i.e. without any time limit other than death of the person) the biometric and genetic data of a person convicted of a criminal offence is contrary to EU law. The case relates to a request by a person, who was convicted and later legally rehabilitated, to remove his personal data from the police records. The Court held that even if the general and indiscriminate storage of the personal data of a convicted person is justified by the prevention, detection, investigation and prosecution of criminal offences or the execution of criminal penalties, national authorities are required to impose on the data controller the obligation to periodically review whether that storage continues to be necessary; and to grant the data subject the right to have the data erased where retention of the data is no longer necessary. The Court also held that where an obligation is imposed on the national authorities to set appropriate time limits on the data storage period, such time limit can be regarded as “appropriate” only if it takes into consideration the relevant circumstances such as the nature and seriousness of the offence committed and the risk presented by the convicted person. For further details of the judgment, please refer to (1) CJEU’s Judgment and (2) Press Statement issued by the CJEU dated 30 January 2024.
14 December 2023	Court of Justice of the European Union clarifies conditions for awarding ‘non-material damage’ On 14 December 2023, the Court of Justice of the European Union (CJEU) ruled that the misuse of personal data following a cyberattack constitutes “non-material damage” under the GDPR. The case stemmed from a 2019 cyberattack of the Bulgarian National Revenue Agency, after which cybercriminals published personal data concerning millions of persons. The Bulgarian Supreme Administrative Court requested the CJEU to determine the conditions for awarding non-material damages, and the extent to which the data controller needed to demonstrate adequate security measures were in place. In the judgment, the CJEU answered the referred questions as follows: In the event of unauthorised disclosure of or unauthorised access to personal data, courts must assess the appropriateness of the protective measures implemented in a concrete manner, and cannot infer from the unauthorised disclosure or unauthorised access alone that the protective measures implemented by the data controller were not appropriate. It is for the data controller to prove that the protective measures implemented were appropriate. In the event that the unauthorised disclosure of personal data or unauthorised access to those data is committed by a ‘third party’ (such as cybercriminals), unless the data controller can prove that it is in no way responsible for the damage suffered by the data subjects, the data controller may be required to compensate the data subjects concerned. The fear experienced by a data subject concerning a possible misuse of his personal data by third parties as a result of an infringement of the GDPR is, in itself, capable of constituting ‘non-material damage’. For further details of the judgment, please refer to (1) CJEU’s Judgment and (2) Press Release issued by the CJEU dated 14 December 2023.
7 December 2023	Court of Justice of the European Union rules on the lawfulness of credit scoring On 7 December 2023, the Court of Justice of the European Union (CJEU) handed down two rulings to oppose two data processing practices by credit information agencies. The rulings against German credit information agency concerned its practice of automated establishment of a probability score regarding an individual’s ability to meet payment commitments in the future based on the personal data of that individual and its retention of customer insolvency data. The CJEU was asked by the German Administrative Court of Wiesbaden to clarify whether credit scoring, a mathematical statistical method used to predict the probability of future behaviour such as the repayment of a loan, constituted “automated decision making” under Article 22 of the GDPR, and whether SCHUFA’s retention period of 3 years for information relating to the granting of a discharge from remaining debts was lawful. The CJEU held that credit scoring must be regarded as an ‘automated individual decision’, which was prohibited in principle under Article 22, in so far as third parties (including SCHUFA’s clients, such as banks) attribute to it a determining role in the granting of credit. It was for the Administrative Court of Wiesbaden to assess whether the German Federal Law on data protection contains any valid exceptions to that prohibition in accordance with the GDPR, and if it does, whether the general conditions for data processing under the GDPR had been met. As regards the retention of information on debt discharge, the CJEU considered that it was contrary to the GDPR for private agencies to keep such data for longer than the 6-month period mandated by German law for the public insolvency register. Since the retention of data beyond six months was held unlawful, the data subject has the right to have the data deleted and the agency is obliged to delete the data as soon as possible. Even where the storage for six months is lawful, the data subject will still have the right to object to the processing of his data and the right to have the data erased, unless the existence of overriding legitimate grounds can be demonstrated. For further details of the judgment, please refer to (1) CJEU’s Judgments of Case C-634/21 and Joined Cases C‑26/22 and C‑64/22 and (2) Press Release issued by the CJEU dated 7 December 2023.
5 December 2023	Court of Justice of the European Union rules on the imposition and calculation of administrative fines On 5 December 2023, the Court of Justice of the European Union (CJEU) reaffirmed the conditions under which supervisory authorities could issue fines to data controllers under the GDPR and ruled that a data controller should not receive a fine unless the violation of the GDPR was committed “intentionally or negligently”. The decision stemmed from cases originating from Lithuania and Germany, which respectively dealt with the Lithuania National Public Health Centre processing citizens’ data for its COVID-19 monitoring app and a German real estate company retaining personal data to tenants for longer than necessary. The CJEU was asked by a Lithuanian court and a German court to interpret the GDPR regarding the imposition and calculation of administrative fine on controller for infringements under Article 83. Regarding the imposition of an administrative fine under Article 83, the CJEU ruled that a supervisory authority may not impose a fine on a data controller for an infringement of the GDPR unless that infringement was committed wrongfully, i.e. intentionally or negligently. A data controller may be fined for conduct falling within the scope of the GDPR where that data controller could not have been unaware of the infringing nature of its conduct, regardless of whether or not it was aware of the infringement. In addition, the CJEU held that, where the data controller is a legal person, it is not necessary for the infringement to have been committed by its management body, or for that body to have knowledge of such infringement. On the contrary, a legal person is liable both for infringements committed by its representatives, directors or managers, and for those committed by any other person acting in the course of the business of that legal person and on its behalf. Further, the imposition of fines is not premised upon a finding of an infringement being committed by an identified natural person. A data controller may also be fined for operations performed by a data processor to the extent that the data controller may be held responsible for such operations. As regards the calculation of an administrative fine under Article 83, the CJEU ruled that where the addressee of a fine is, or forms part of, an undertaking, a supervisory authority must take as its basis the concept of an “undertaking” under EU competition law, which defines an economic unit even if in law that economic unit consists of several persons, natural or legal. Accordingly, for the calculation of a fine, a supervisory authority must take into account the total worldwide turnover of the undertaking concerned, taken as a whole, in the preceding business year, as the basis for penalties. For further details of the judgment, please refer to (1) CJEU’s Judgments of Case C-683/21 and Case C-807/21 and (2) Press Release issued by the CJEU dated 5 December 2023.
4 July 2023	Court of Justice of the European Union rules that national competition authorities can determine GDPR violations in competition cases On 4 July 2023, the Court of Justice of the European Union (CJEU) made a ruling that in an abuse of dominance investigation, it may be necessary for the competition authority (of the EU member state concerned) to examine whether a company’s conduct complies with rules other than those relating to competition laws, including the GDPR. However, the CJEU also noted that the competition authority would not replace the data protection authority of a particular EU member state in concern. In fact, when considering whether the GDPR has been complied with, the competition authority is required to consult and cooperate sincerely with the data protection authority, consider whether it has made decisions in similar cases, and must not depart from those decisions. In the present case concerning the German Federal Cartel Office’s prohibition against Meta’s Facebook services from combining user data from different sources for conducting personalised advertising without the user’s consent in 2019, the CJEU commented generally on the data processing practices of Meta. It noted that the performance of a contract as a legal basis for processing under the GDPR can only be relied on if the data processing is objectively indispensable to the main subject matter of that contract. The CJEU doubted, in this regard, whether Meta’s personalised advertising fulfils the criteria and referred the matter back to the German court to decide. For further details of the judgment, please refer to (1) CJEU’s Judgment and (2) Press Statement issued by the CJEU dated 4 July 2023.
22 June 2023	Court of Justice of the European Union rules that data subjects have the right to access the date of and the reasons for the consultations on their personal data On 22 June 2023, the Court of Justice of the European Union (CJEU) makes a ruling, inter alia, in relation to the interpretation of Article 15(1) of the GDPR (rights of access by the data subject). The case concerns a data subject, an ex-employee and customer of Pankki S (“Bank”), requesting the Bank to inform him of the identity of the persons who had consulted his customer data, the exact dates of the consultations and the purposes for which those data had been processed (“Requested Information”). Upon failing to obtain the Requested Information from the Bank and to seek an order to the same effect from the Data Protection Supervisor’s Office, Finland, the data subject brought an action before the Administrative Court of Eastern Finland, which referred the case to CJEU for clarification on the interpretation of Article 15(1) of the GDPR, namely, (i) whether the GDPR applies to the access request as the relevant processing activities occurred before the GDPR came into force (i.e. 25 May 2018); (ii) whether the data subject is entitled to the Requested Information under Article 15(1) of the GDPR; and (iii) whether the controller being a bank and the data subject being a customer and employee of a bank is relevant for defining the scope of right of access. The CJEU decided that Article 15 of the GDPR applies to a request of access made after GDPR comes into force even though the concerned processing was conducted prior to the same, and that information relating to the dates and purposes of the personal data consultation operations constitutes information that the data subject has the right to obtain from the controller. However, the GDPR does not establish such a right in respect of the information relating to the identity of the employees who carried out those operations following the controller’s instructions, unless (i) that information is essential to enable the data subject effectively to exercise the rights conferred on them by the GDPR, and (ii) provided that the rights and freedoms of those employees are dully considered. Lastly, the CJEU ruled that, the fact that a data controller is engaged in the business of banking and acts within the framework of regulated activity, and that the data subject is a customer and employee of the data controller has, in principle, no bearing on the scope of the right conferred on that data subject by Article 15 of the GDPR. For further details of the judgment, please refer to (1) CJEU’s Judgment and (2) Press Statement issued by the CJEU dated 22 June 2023.
4 May 2023	Court of Justice of the European Union rules that mere infringement of the GDPR does not give rise to a right to compensation On 4 May 2023, the Court of Justice of the European Union (CJEU) made a ruling in relation to the compensation available under the GDPR for non-material damage. The case concerned a data subject who filed a complaint against the Austrian Post for collecting personal data relating to the political affinities of Austrian residents in 2017. The data was subsequently sold to various organisations, which enabled them to send targeted advertisements in relation to political elections. The data subject sought €1,000 in non-material damages under Article 82 of GDPR. The case was referred to the CJEU to clarify, among others, (1) whether a data subject would be entitled to compensation under Article 82 from mere infringement of the GDPR, if he/she had not suffered harm as a result of the GDPR infringement; and (2) whether a claim for compensation for non-material damage has to meet a seriousness threshold that requires more than mere upset feelings caused by the GDPR infringement. The CJEU ruled that the right to compensation under Article 82 is subject to three conditions: (1) personal data is processed in a manner that infringes the GDPR; (2) the data subject suffered material or non-material damage; and (3) there is a causal link between the infringement and the damage suffered. Therefore, not every infringement of the GDPR gives rise, by itself, to a right to compensation. The Court also held that the right to compensation is not limited to non-material damage that reaches a certain threshold of seriousness. The GDPR does not contain any such requirement and such a restriction would be contrary to the broad conception of ‘damage’, adopted by the EU legislature. Lastly, the Court noted that the GDPR does not contain any rules governing the assessment of damages. It is therefore for the legal system of each Member State to prescribe the detailed rules for actions intended to safeguard the rights which individuals derive from the GDPR and, in particular, the criteria for determining the extent of compensation payable in that context, provided that the principles of equivalence and effectiveness are complied with. The CJEU stated that this ruling ensures the GDPR provides “full and effective compensation for the damage suffered”. For further details of the judgment, please refer to (1) CJEU’s Judgment and (2) Press Statement issued by the CJEU dated 4 May 2023.
2 March 2023	Court of Justice of European Union clarifies rules on the production of evidence containing personal data in civil proceedings On 2 March 2023, the Court of Justice of the European Union (CJEU) made a ruling on the applicability of the GDPR in the context of discovery in civil proceedings. An issue arose in a payment dispute between a construction company and its customer as to whether personal data that was originally collected for tax purposes can be produced in civil proceedings. The issue was referred to the CJEU for a preliminary ruling by the Swedish Supreme Court. The CJEU decided that any processing of personal data, including processing carried out by public authorities such as courts, must be based on a legal ground under Article 6 of the GDPR. The CJEU examined Articles 6(1)(e) (processing in the public interest) and Article 6(3) (European Union member states may adopt more specific provisions regarding personal data processing activities in the public interest, provided that such more specific law meets an objective of public interest and is proportionate to the public interest pursued) of the GDPR, and considered that the requirements of Article 6(3) of the GDPR were fulfilled due to the obligation under Swedish law to submit evidence to the courts if it may be deemed to have probative value. The CJEU also decided that disclosure of the documents was a further processing for the purposes of Article 6(4) of the GDPR which will be permitted where the processing is based on national law and constitutes a necessary and proportionate measure in a democratic society to safeguard one of the objectives referred to in Article 23(1) of the GDPR. In its decision, the CJEU indicates that, those objectives include Articles 23(1)(f) (the protection of judicial independence and judicial proceedings) and 23(1)(j) (the enforcement of civil claims) of the GDPR. However, the CJEU emphasised that it is up to the referring court to examine whether the requirements of Article 6(4) of the GDPR in conjunction with Article 23(1) of the GDPR are met. For further details of the judgment, please refer to CJEU’s Judgment dated 2 March 2023.
9 February 2023	Court of Justice of European Union rules on data protection officer dismissal and conflict of interests On 9 February 2023, the Court of Justice of the European Union (CJEU) made a ruling in relation to conditions for dismissing Data Protection Officers (DPOs) under Article 38(3) and definition of conflict of interests under Article 38(6) of the GDPR. The case relates to the dismissal of a DPO of a Germany company group, who was also the “chair of the works council” of the same group, in May 2018 when the GDPR came into effect. The DPO sought a declaration that the dismissal was ineffective by bringing proceedings before the Germany courts, while the company cited conflict of interest as the just cause for dismissal. The Germany Federal Labour Court referred the case to the CJEU clarifying, among others, (i) whether Article 38(3) precludes member states from setting out further conditions for dismissing DPOs, and (ii) the extent to which conflicts of interest in the context of Article 38(6) can justify the dismissal of DPOs. In relation to Article 38(3), the CJEU ruled that member states are free to “to lay down more protective specific provisions on the dismissal of the DPO” as long as these do not “undermine the achievement of the objectives of the GDPR”. In relation to Article 38(6), the CJEU ruled that DPOs should “be in a position to perform their duties and tasks in an independent manner”, and conflicts of interest within the meaning of Article 38(6) arise where DPOs are “assigned any tasks or duties which would lead [them] to determine the purposes and means of the processing of personal data”. For further details of the judgment, please refer to CJEU’s Judgment dated 9 February 2023.
12 January 2023	Court of Justice of European Union rules administrative and civil remedies provided for by the GDPR may be exercised concurrently and independently of each other On 12 January 2023, the Court of Justice of the European Union (CJEU) made a ruling in relation to the relationship between administrative and civil remedies provided under the GDPR. The case relates to a shareholder’s request for audio recording of the company’s general meeting. The shareholder was only provided extracts which reproduced his contributions, and subsequently requested the Hungarian data protection authority to order the company to send him the recording in question. After his request was refused by the Hungarian data protection authority, he brought an administrative appeal against that decision, and at the same time, brought proceedings before the Hungarian civil courts against the decision of the company. While the administrative appeal proceedings are still ongoing, the civil courts have found that the company had infringed the shareholder’s right of access to his personal data. The Budapest High Court therefore referred the case to the CJEU clarifying whether, in the context of reviewing the lawfulness of the decision of the national supervisory authority, it is bound by the final judgment of the civil courts concerning the same facts and same alleged infringement of the GDPR; and whether one of those remedies might take priority over the other. In the said Judgment, the CJEU found that the GDPR does not provide for any priority or exclusive competence or jurisdiction or for any rule of precedence in respect of the assessment carried out by the supervisory authority or by a court as to whether there is an infringement of the rights concerned. Consequently, the administrative and civil remedies provided for by the GDPR may be exercised concurrently with and independently of each other. It is for each member state to ensure that the concurrent and independent remedies do not call into question the effectiveness of the GDPR and effective protection of the rights thereunder, the consistent and homogeneous application of its provisions and the right to an effective remedy before a court or tribunal. For further details of the judgment, please refer to (1) CJEU’s Judgment and (2) Press Statement issued by the CJEU dated 12 January 2023.
12 January 2023	Court of Justice of European Union confirms data subjects’ right of access to information about specific recipients to whom the personal data have been or will be disclosed On 12 January 2023, the Court of Justice of the European Union (CJEU) made a ruling in relation data subjects’ right to access information about the recipients or categories of recipients to whom the personal data have been or will be disclosed under Article 15(1)(c) of the EU GDPR. In this case, Österreichische Post AG (responsible for the Austrian postal service), in responding to a data subject’s data access request for the information as to the identity of the recipients of his personal data, merely provided a description of the categories of recipients, without disclosing the identity of the specific recipients of the personal data. The Supreme Court of Austria referred the case to the CJEU for its interpretation of Article 15(1)(c) of the EU GDPR. In the Judgment, CJEU ruled that in order to ensure the effectiveness of other rights conferred on data subjects under the EU GDPR (including the right to rectification, right to erasure, right to restriction of processing and right to object under Articles 16, 17, 18 and 21 of the EU GDPR respectively), the data subject must have the right to be informed of information about the specific recipients to whom his/her personal data have been or will be disclosed. That said, CJEU acknowledged that in specific circumstances such right of access may be subject to limits, for example, where it is impossible to disclose the identity of specific recipients, in particular where they are not yet known, or where the controller demonstrates that the data subjects’ requests are manifestly unfounded or excessive (within the meaning of Article 12(5) of the EU GPDR). For further details of the judgment, please refer to (1) CJEU’s Judgment and (2) Press Statement issued by the CJEU dated 12 January 2023.
8 December 2022	Court of Justice of European Union extends right to erasure (right to be forgotten) to remove manifestly inaccurate information On 8 December 2022, the Court of Justice of the European Union (CJEU) made a ruling on right to erasure (right to be forgotten). This case concerned two investment managers who had requested Google to de-reference search results linking their names to certain articles criticizing their business investment model. They alleged that those articles contain inaccurate claims. They also required Google to remove thumbnail photos of them from search results based on their names. Google declined their request and contended that it was unaware of the alleged inaccuracy of the information contained therein. The German Federal Court of Justice referred the case to the CJEU for its interpretation of Article 17(3)(a) of the EU GDPR which concerns the exercise of right to erasure and right of freedom of expression and information. In the said Judgment, CJEU pointed out that the right to protection of personal data is not an absolute right but must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. While the EU GDPR expressly provides that the right to erasure is excluded where processing is necessary for the exercise of the right to freedom of expression and information, the right to freedom of expression and information cannot be taken into account where, at the very least, a part – which is not of minor importance – of the information found in the referenced content proves to be inaccurate. CJEU ruled that the search engine operator must remove information found in referenced content where the person requesting de-referencing submits relevant and sufficient evidence to prove that such information is manifestly inaccurate. To avoid an excessive burden on the requestor, CJEU stated that such proof does not have to come from a judicial decision against the website publishers in question and the requestor only has to provide evidence that can reasonably be required of him or her to try to find. Regarding the display of the thumbnail photos following a search by name, CJEU stated that such display constitutes a particularly significant interference with the data subjects’ rights to private life and their personal data. A separate weighing-up of competing rights and interests is required depending on whether the said photos are displayed in the original context illustrating the information provided in those articles and the opinions expressed in them, or outside such context. For further details of the judgment, please refer to (1) CJEU’s Judgment and (2) Press Statement issued by the CJEU dated 8 December 2022.

B.Major Developments under the GDPR

Date	Major Developments
15 January 2024	The European Commission Retains all its Existing Adequacy Decisions On 15 January 2024, the European Commission concluded its review and evaluation of its 11 existing adequacy decisions under the 1995 Data Protection Directive and the GDPR. In its published report, the European Commission finds that personal data transferred from the European Union to Andorra, Argentina, Canada, Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay, continues to benefit from adequate data protection safeguards. As such, the adequacy decisions adopted for these 11 countries and territories would remain in place and data can continue to flow freely to these jurisdictions. The review has demonstrated that the data protection frameworks in these countries and territories have further converged with the EU’s framework and strengthened protection of personal data in their jurisdictions. The review also showed that public authorities in the 11 jurisdictions are subject to appropriate safeguards in the area of access to data by public authorities, notably for law enforcement or national security purposes. For further details of the review, please refer to the European Commission’s full report dated 15 January 2024.
10 July 2023	The Adequacy Decision for the EU-US Data Privacy Framework (DPF) On 10 July 2023, the European Commission Union adopted an adequacy decision on the EU-US Data Privacy Framework (DPF), concluding that the US provides a level of protection essentially equivalent to that of the EU for personal data transferred under the DPF from a data controller or a processor in the EU to certified organisations in the US. Specifically, the adequacy decision has the effect that such transfers may take place without the need to obtain any further authorisation. Some new binding safeguards introduced by the DPF include: limiting access to EU data subject's personal data by US intelligence services to what is necessary and proportionate to protect national security (under the US's Executive Order on ‘Enhancing Safeguards for United States Signals Intelligence Activities'); providing EU data subjects whose data would be transferred to the US under the DPF with several new rights (i.e., to access their data, or to correct or delete inaccurate or unlawfully handled data); and establishing a two-tier redress mechanism for EU data subjects (i.e., EU data subjects' complaints would first be investigated by the Civil Liberties Protection Officer (CLPO) of the US intelligence community, and the data subjects may appeal the CLPO's decision before the independent and newly established Data Protection Review Court). US organisations will be able to self-certify under the DPF by committing to comply with a detailed set of privacy obligations (e.g., purpose limitation, data minimisation, data deletion as soon as no longer necessary, specific obligations concerning data security and sharing of data with third parties, etc). Certifications must be renewed on an annual basis. Organisations that are found to persistently fail to comply with the principles will be removed from the DPF list and must return or delete the personal data received under the DPF. The adequacy decision takes effect immediately, and the DPF will start to apply upon certification of US organisations. Meanwhile, the European Commission will periodically review the adequacy decision, with the first review to take place within one year after the entry into force. For further details of the DPF, please refer to the full Adequacy Decision for the EU-US Data Privacy dated 10 July 2023.
25 March 2022	The new Trans-Atlantic Data Privacy Framework between the EU and the United States (“US”) On 16 July 2020, the Court of Justice of the European Union struck down the framework of the EU-US Privacy Shield in the case of Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems and intervening parties (commonly known as “Schrems II Judgment”). Since 2016, the EU-US Privacy Shield had been implemented as a major mechanism for effecting transfers of personal data from EU companies to US companies. Following continuous discussions between the European Commission and the US, the parties announced on 25 March 2022 that an agreement had been reached in principle on a new Trans-Atlantic Data Privacy Framework (“New Framework”), with a view to re-establishing a legal mechanism for the transfer of personal data from the EU to the US. In particular, the New Framework ensures that (i) signals intelligence activities undertaken by the US should be necessary and proportionate in advancing legitimate national security objectives; (ii) a new redress mechanism with independent and binding authority will be established to direct remedial measures for affected EU individuals; and (iii) US intelligence agencies will adopt procedures to ensure effective oversight of new privacy and civil liberties standards. As the next step forward, the European Commission and the US will continue to work on the legal documents required to be adopted by both sides for putting the New Framework into practice. For further details of the New Framework, please refer to (1) the European Commission and United States Joint Statement on Trans-Atlantic Data Privacy Framework and (2) the Press Statement issued by the White House of the US, both dated 25 March 2022.
21 March 2022	New Transfer Instruments for transferring personal data from the United Kingdom The GDPR is retained in the domestic law in the United Kingdom (“the UK”) as the “UK GDPR”. Article 46(1) of the UK GDPR allows international transfers of personal data, inter alia, where the data exporter has provided appropriate safeguards (including through standard data protection clauses issued by the Information Commissioner, etc). On 21 March 2022, two new transfer instruments, namely (i) the International Data Transfer Agreement (“IDTA”) and (ii) the international data transfer addendum to the European Commission’s standard contractual clauses for international data transfers adopted in June 2021 (“Addendum”) issued by the Information Commissioner came into force. In particular, the new instruments are intended to replace the existing Standard Contractual Clauses recognised in the UK, i.e. the Standard Contractual Clauses adopted in the EU in the pre-GDPR era (“the Old SCCs”). The practical implications of the introduction of the IDTA and the Addendum for data transferors and data transferees are that: Contracts concluded on or before 21 September 2022 on the basis of the Old SCCs shall continue to provide appropriate safeguards for the purpose of the UK GDPR (provided that the processing operations that are the subject matter of the contract remain unchanged) until 21 March 2024. From 22 September 2022, either the IDTA or the Addendum will have to be incorporated for new contracts concerning international transfers of personal data under the UK GDPR. From 22 March 2024, the old SCCs will no longer be deemed to provide “appropriate safeguards” for the purpose of the UK GDPR. All contracts that have incorporated the old SCCs will have to be substituted by either the IDTA or the Addendum by 21 March 2024. For further details of the IDTA and the Addendum, please refer to the introduction provided by the Information Commissioner’s Office of the UK.
17 December 2021	The adequacy decision for South Korea On 17 December 2021, the European Commission adopted the decision that the Republic of Korea ensures an adequate level of protection for personal data transferred from the EU to entities in the Republic of Korea subject to the Personal Information Protection Act as contemplated by the additional safeguards stipulated therein, together with the relevant official representations, assurances and commitments. For details of the adequacy decision for South Korea, please refer to the Joint Press Statement by Didier Reynders, Commissioner for Justice of the European Commission, and Yoon Jong In, Chairperson of the Personal Information Protection Commission of the Republic of Korea.
28 June 2021	The adequacy decision for the United Kingdom On 28 June 2021, the European Commission adopted two adequacy decisions for the United Kingdom, one under the GDPR and the other for the Law Enforcement Directive. Free flow of personal data from the EU to the United Kingdom is allowed where the United Kingdom ensures essentially an equivalent level of personal data protection to that guaranteed under the EU law. For details of the adequacy decision for the United Kingdom, please refer to the press release issued by the European Commission

¹ A five-step methodology was listed by the European Data Protection Board in the Guidelines, which composed of the following steps:
(1) Identify relevant processing operations and evaluating the application of Article 83(3) of the GDPR;
(2) Identify the starting point for further calculation of the fine amount by, inter alia, consider the categorisation of infringements under Articles 83(4)–(6) of the GDPR and the nature of gravity of the infringement, and the turnover of the undertaking;
(3) Evaluating aggravating or mitigating factors listed in Article 83(2) of the GDPR ;
(4) Identify the legal maximums (static and dynamic maximums) of fines (whichever is higher); and
(5) Consider the effectiveness, proportionality and dissuasiveness of the fine.
Please refer to the Guidelines for details.