Will Schufa's long retention periods soon be history? The Cologne Higher Regional Court sees a Infringement against the GDPRif a credit agency does not promptly delete negative entries after debts have been settled. The Hessian data protection authority had approved Schufa's actions.
The European Commission has taken its first two sanction decisions for violations of the Digital Markets Act (DMA). The US technology companies Apple and Meta were fined €500 million and €200 million respectively for various breaches of the DMA regulations.
In 2025, the right to Deletion according to Art. 17 GDPR at the center of a Europe-wide audit by data protection supervisory authorities. As part of the European Data Protection Board's Coordinated Enforcement Framework (CEF), companies and public bodies are being put to the test. What action is required for Responsible persons exists.
Associations are Responsible persons within the meaning of Art. 4 No. 7 GDPR to fulfill all data protection requirements and to demonstrate compliance with them. Implementation regularly poses considerable practical challenges, especially for smaller, voluntarily organized associations. The following explanations summarize the main obligations.
A current case before the European Court of Justice focuses on the data protection assessment of email newsletters. Among other things, it concerns the distinction between direct advertising and commercial communication as well as the applicability of the General Data Protection Regulation in relation to the ePrivacy Directive.
While compliance issues have often been dealt with in silos in the past, the reality shows that data protection, information security, business continuity and legal obligations are closely interlinked. This is precisely where the idea of Integrated Risk Management (IRM) comes in - an approach that does not look at risks in isolation, but systematically links them together.
The French competition authority (Autorité de la concurrence) fined Apple 150 million euros on March 31, 2025. The reason is the abuse of a dominant market position in the distribution of mobile apps on iOS and iPadOS devices between April 2021 and July 2023.
Anyone introducing biometric access systems should be careful: In Spain, the data protection authority AEPD has imposed a hefty fine on the Spanish soccer association LALIGA. Fine imposed, because before the use of fingerprint scanners no Data protection impact assessment was carried out. GDPR violations became really expensive for the Polish postal service.
The Federal Court of Justice has made it clear that breaches of data protection law Duty to inform the GDPR can also constitute a breach of competition law - and can therefore be prosecuted under civil law by qualified institutions. This means that consumer protection associations can also take legal action against data protection violations.
You can also follow us on our social media channels:
Contact us
Phone: +1 (954) 852-1633
E-Mail:info@2b-advice.com
German German 
English
Italian
French