EU/UK Privacy & Cybersecurity News Roundup ' Week Of October 30, 2023

• Published date: 06 November 2023
• Subject Matter: Privacy, Technology, Data Protection, New Technology
• Law Firm: Goodwin Procter LLP
• Author: Lore Leitner, Gretchen Scott, Boris Segalis, Oliver Benson and Mickey Lee

Case Law Updates and Fines

• On May 29, 2023, the Hellenic Data Protection Authority (HDPA) published Decision No. 20/2023, in which it fined WIND Hellas Telecommunications S.A. (now NOVA Telecommunications & Media Monoprosopi SA) '150,000, for violations of the General Data Protection Regulation (GDPR), following a complaint. You can read the press release here and the decision here, both only available in Greek.
• On September 20, 2023, the Polish data protection authority (UODO) announced that the Supreme Administrative Court (the Supreme Court) upheld the UODO's decision to impose an administrative fine of PLN 943,000 (approx. $217,880) on Bisnode Polska (now Dun &amp Bradstreet), for processing data without informing the persons whose data it processed. You can read the press release, only available in Polish, here.
• The Hellenic Data Protection Authority (HDPA) published, on September 25, 2023, its decision No. 30/2023, as issued on September 25, 2023, in which it imposed a fine of '50,000, as well as a reprimand, to Athens Urban Transport Organization S.A (OASA), for violations of the General Data Protection Regulation (GDPR), following an ex officio inspection. You can read the press release here and the decision here, both only available in Greek.
• On October 10, 2023, the Italian data protection authority (Garante) announced in its newsletter its Decision No. 393, as issued on July 18, 2023, in which it imposed a fine of '75,000 and a corrective order on Università e-Campus, for violations of the General Data Protection Regulation (GDPR) and the Personal Data Protection Code, Containing Provisions to Adapt the National Legislation to the GDPR (the Code), following the submission of complaints by multiple individuals. You can read the newsletter here and the decision here, both only available in Italian.
• The French data protection authority (CNIL) issued, on October 12, 2023, its decision No. SAN-2023-015, in which it imposed a fine of '600,000 on Groupe Canal + SA, for violations of the General Data Protection Regulation (GDPR) and the Post and Electronic Communications Code (Communications Code), following numerous complaints. You can read the decision, only available in French, here.
• On October 19, 2023, the Austrian data protection authority (DSB) issued a decision, in which it found Google LLC in violation of the General Data Protection Regulation (GDPR), following its investigation of Google's product, Google Fonts. You can read the press release, only available in German, here.
• On October 19, 2023, the Swedish Authority for Privacy Protection (IMY) published its Decision No. DI-2020-10545, as issued on October 17, 2023, in which it imposed a fine of SEK 350,000 (approx. $31,850) on Hennes & Mauritz GBC AB (H&M) for violation of the General Data Protection Regulation (GDPR). You can read the press release here and the decision here, both only available in Swedish.
• On October 20, 2023, the Polish data protection authority (UODO) announced that the Provincial Administrative Court in Warsaw upheld the UODO's decision to impose an administrative fine of PLN 1.6 million (approx. $380,260) on P4 Sp. z o.o. (formerly Virgin Mobile Poland Spz o.o) for violations of the General Data Protection Regulation (GDPR). You can read the press release, only available in Polish, here.
• On October 20, 2023, the Court of Amsterdam published its judgment...