Credits Adobe

EDPB-EDPS Joint Opinion 01/2025 on SME Record-Keeping Simplification

🚨 NEW EDPB-EDPS Joint Opinion on SME Record-Keeping Simplification On 9 July 2025, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) released their Joint Opinion 01/2025 on the proposed regulation to simplify record-keeping obligations for small and medium-sized enterprises (SMEs) and small mid-cap companies (SMCs). 🎯 Key Highlights: Extended threshold: The proposal would raise the employee threshold from 250 to 750 employees for record-keeping exemptions under Art. 30(5) GDPR Broader scope: SMCs (small mid-cap companies) would also benefit from simplified obligations Risk-based approach maintained: High-risk processing activities would still require full compliance regardless of company size Administrative burden reduction: Aims to provide greater flexibility for smaller organizations while maintaining data protection standards 💡 EDPB-EDPS Position: The authorities express preliminary support for this targeted simplification initiative, welcoming the risk-based approach that ensures fundamental rights protection remains intact. However, they’ve requested further clarification on the new 750-employee threshold and recommend better alignment with the newly introduced SME/SMC definitions. ...

10 July 2025 · 1 min · NicFab
Communcation icons created by syafii5758 - Flaticon

Judgment of the Court in Case C-446/21 (Communication of data to the general public)

An online social network such as Facebook cannot use all of the personal data obtained for the purposes of targeted advertising, without restriction as to time and without distinction as to type of data.

4 October 2024 · 1 min · NicFab
Medicine icons created by Good Ware - Flaticon

Judgment of the Court in Case C-21/23 - The online sale of medicines requires the data subject’s consent

The online sale of pharmacy-only medicinal products requires the explicit consent of the customer to the processing of his or her data, even where those medicinal products do not require a prescription.

4 October 2024 · 1 min · NicFab

Judgment of the Court in Case C-768/21 (Obligation of the data protection authority to act)

Personal data protection: the supervisory authority is not obliged to exercise a corrective power in all cases of breach and, in particular, to impose a fine

26 September 2024 · 1 min · NicFab
[Machine-learning icons created by Becris - Flaticon](https://www.flaticon.com/free-icons/machine-learning)

The EDPS published the Model Administrative Arrangement for transfers of personal data

EDPS Model

31 July 2024 · 1 min · NicFab
GDPR icons [created by Smashicons - Flaticon](https://www.flaticon.com/free-icons/gdpr)

The European Commission published the Second Report on the application of the General Data Protection Regulation

The second report on the application of the General Data Protection Regulation (GDPR)

30 July 2024 · 1 min · NicFab
EDPB Documents

Main EDPB Documents (updated on 12/1/2023)

List of the key adopted and published documents by the European Data Protection Board - EDPB

12 January 2023 · 33 min · NicFab
DMA

Data Protection and privacy between European digital sovereignty and Digital Markets Act (DMA)

Some considerations to bear in mind and on which to ponder.

4 July 2022 · 11 min · NicFab
Fine anno 2021

ePrivacy Regulation: the current Perspective

Foto di Pavan Trikutam Previous Next     / [pdf] View the PDF file here. The subject is pretty challenging indeed, considering that the EU proposal on the e-Privacy regulation is under the Institutions’ attention and not defined yet. I created a map consisting of eight sections, where I included all (I hope) the issues related to the proposal on the ePrivacy Regulation, and I will comment on it in each Section. ...

7 December 2021 · 12 min · NicFab
Fine anno 2021

Contact tracing and privacy: an oxymoron. Any technical solution is neutral compared to privacy laws

The content of this post is available in PDF for download here: 1. Chronology of events During the last month, i.e. since the focus has increased on the incidence of the COVID-19 pandemic with respect to personal data protection, we have witnessed the publication of the following main measures issued by some institutional bodies: ...

14 April 2020 · 16 min · NicFab