stefan – Page 71 – Privacy Design®

State Data Protection Commissioner of Lower Saxony has now submitted its final report for the result of a cross-industry GDPR-audit of 50 companies.

Find below the press release with

questionnaire
*criteria for evaluating the responses*
final report

*Only in German”.. As expected quite a few didn’t get their legitimate interest assessments right, etc..

https://lfd.niedersachsen.de/startseite/allgemein/presseinformationen/abschluss-der-querschnittsprufung-182253.html

November 18, 2019November 19, 2019

Italy – Garante: Report

https://www.garanteprivacy.it/regolamentoue/bilancio

November 18, 2019November 19, 2019

EDPB Opinions

https://edpb.europa.eu/our-work-tools/consistency-findings/opinions_de

November 18, 2019

EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects

includes
“[..]
49. The EDPB does not consider that Article 6(1)(b) would generally be an appropriate lawful basis for processing for the purposes of improving a service or developing new functions within an existing service. In most cases, a user enters into a contract to avail of an existing service. While the possibility of improvements and modifications to a service may routinely be included in contractual terms, such processing usually cannot be regarded as being objectively necessary for the performance of the contract with the user. ”

Also the EDPB again gives special attention to personalisation, saying that where personalisation is not really necessary for the performance of a contract, eg where content personalisation is just used to increase user engagement, data controllers should consider another legal basis

https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines-art_6-1-b-adopted_after_public_consultation_en.pdf

November 18, 2019November 19, 2019