Liability under the GDPR

In the final episode of this series, Aoife Coll and Vivian Spies discuss two recent CJEU decisions in which the ECJ considered liability and fines for breaches of the GDPR. In chronological order, the cases covered in this video are:

– Case C-683/21 Judgment delivered: 05/12/2023 – Nacionalinis visuomenės sveikatos centras

– Case C-807/21 Judgment delivered: 05/12/2023 – Deutsche Wohnen

Role of other supervisory authorities and the notion of main establishment under the GDPR

In this video, Aoife Coll and Rory Curtis discuss the matter of competence of non-data protection authorities in assessing compliance with the GDPR, which came into focus following the 2019 decision of the German Federal Cartel Office in proceedings against Meta Platforms, Meta Platforms Ireland and Facebook Deutschland. They also discuss the notion of main establishment under the GDPR.

They refer to the following CJEU case and EDPB Opinion: 

– Case C252/21: Judgement delivered – 04/07/2023 – Meta Platforms and Others

– EDPB Opinion 04/2024 on the notion of main establishment of a controller in the Union under Article 4(16)(a) GDPR (adopted 13 February 2024)

What constitutes personal data?

The latest video from our series on data protection judgments from the Court of Justice of the European Union (CJEU) features a discussion from senior associates Aoife Coll and Rosemarie Blake, on what constitutes personal data.

Aoife and Rosemarie discuss case C319/22 (Gesamtverband Autoteile-Handel eV v Scania CV AB) in which the CJEU considered whether vehicle identification numbers (also known as the chassis number) are personal data, and the questions raised by the decision for data controllers.

Compensation for non-material damage under the GDPR

Aoife Coll and Laura Dunne discuss the latest European and Irish cases in which the courts considered compensation for non-material damage in relation to a breach of the GDPR. In chronological order, the cases covered in this video are:

– Case C-300/21: Judgement delivered – 04/05/2023 – Österreichische Post (Préjudice moral lié au traitement de données personnelles) ‘Mere Upset’ Not Sufficient for GDPR Compensation Claims – Arthur Cox LLP]

– Kaminski v. Ballymaguire Foods Limited [2023] IECC 5 ‘Modest’ Compensation for GDPR Non-Material Damage Claim: New Guidance from the Irish Courts – Arthur Cox LLP]

– Case C-340/21: Judgment delivered 14/12/2023 – Natsionalna agentsia za prihodite. This case is also included in our Summary of 2023’s Key CJEU Data Protection Judgments – Arthur Cox LLP

– Siobhan Keane v Central Statistics Office [2024] IEHC 20

Independence of the DPO

The case discussed is C453/21. Judgment – 09/02/2023 – X-FAB Dresden

Aoife Coll and Shay Buckley discuss the level of independence that must be afforded to Data Protection Officers (DPOs) under the GDPR in the context of the CJEU judgment in X-FAB Dresden (case C- 453/21) and the results of the EDPB’s 2023 Coordinated Enforcement Action on the Designation and Position of DPOs.

Please also see our Summary of 2023’s Key CJEU Data Protection Judgments for further insights into CJEU jurisprudence in this area, and for more on our Data Protection and Privacy practice click here.

Right of Access

In this first video in our series on data protection judgments from the Court of Justice of the European Union (CJEU), Aoife Coll and David O’Connor, discuss the right of access under Article 15 of the General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR).

The European Data Protection Board’s 2024 Coordinated Enforcement Framework (CEF) is also mentioned in the video, as this year sees it focus its CEF action on the right of access.

In chronological order, the cases covered in this video are:

– Case C-154/21: Judgement delivered 12/01/2023 – Österreichische Post

– Case C-579/21: Judgment delivered 22/06/2023 – Pankki S

– Case C-487/21: Judgment delivered 04/05/2023 – Österreichische Datenschutzbehörde

– Case C-307/22: Judgment delivered 26/10/2023 – FT

Please also see our Summary of 2023’s Key CJEU Data Protection Judgments for further insights into CJEU jurisprudence in this area, and for more on our Data Protection and Privacy practice click here.