The European Commission has issued its first two penalty decisions for violations of the Digital Markets Act (DMA). Fines of 500 million euros and 200 million euros, respectively, were imposed on the U.S. technology companies Apple and Meta for various violations of DMA regulations.
In 2025, the right to Deletion according to Art. 17 GDPR at the center of a Europe-wide audit by data protection supervisory authorities. As part of the European Data Protection Board's Coordinated Enforcement Framework (CEF), companies and public bodies are being put to the test. What action is required for Responsible persons exists.
Associations are Responsible persons Under Article 4(7) of the GDPR, organizations are required to comply with all data protection requirements and to demonstrate such compliance. Implementing these requirements regularly poses significant practical challenges, particularly for smaller, volunteer-run associations. The following explanation summarizes the key obligations.
A current case before the European Court of Justice focuses on the assessment of email newsletters under data protection law. Among other things, the case addresses the distinction between direct marketing and commercial communications, as well as the applicability of the General Data Protection Regulation in relation to the ePrivacy Directive.
While Compliance-While these topics were often addressed in silos in the past, reality shows that data protection, information security, business continuity, and legal obligations are closely intertwined. This is precisely where the concept of Integrated Risk Management (IRM) comes in—an approach that does not view risks in isolation but systematically links them together.
On March 31, 2025, the French Competition Authority (Autorité de la concurrence) fined Apple 150 million euros. The reason for the fine is the abuse of a dominant market position in the distribution of mobile apps on iOS and iPadOS devices between April 2021 and July 2023.
Anyone introducing biometric access systems should be careful: In Spain, the data protection authority AEPD has imposed a hefty fine on the Spanish soccer association LALIGA. Fine imposed, because before the use of fingerprint scanners no Data Protection Impact Assessment was carried out. Things got really expensive GDPR-Violations involving the Polish Postal Service.
The Federal Court of Justice has clarified that violations of data protection laws Duty to inform the GDPR can also constitute a breach of competition law - and can therefore be prosecuted under civil law by qualified institutions. This means that consumer protection associations can also take legal action against data protection violations.
The inadmissible Processing personal Health data in connection with the online distribution of medicinal products not only establishes a Infringement against the GDPRbut may also constitute an unfair commercial act within the meaning of Section 3a UWG. In these cases, competitors are entitled to injunctive relief under competition law.
Follow us on our social media channels as well:
Contact us
Phone: +1 (954) 852-1633
Mail: info@2b-advice.com
German German 
English
Italian
French
