The episode is an audio version of the GDPR Hub newsletter, read by Ria Alexandra Valle, with show notes available at notais.consulting.com. It begins with a ruling from Austria's federal administrative court permitting credit reference agencies to collect and process data from the National Public Insolvency Registry for at least five years after debts are cleared. In Belgium, the Data Protection Authority decided that controllers do not need to report breaches resulting from listing email recipients in CC instead of BCC if the email reaches only a small group, specifically 16 people. This contrasts with Norway's stance, where the DPA requires reporting for any personal data breach, highlighting regulatory differences across Europe. The Belgian DPA also fined the Belgian National Railway 10,000 euros for sending an unsolicited advertisement email without an opt-out option, noting that the breach occurred because promotional content was added to what was supposed to be communication of terms and conditions. In Denmark, the DPA issued a reprimand against the Trade Union and Unemployment Fund for violating GDPR articles 5.1d and 32 by accidentally disclosing a data subject's new name to her violent former partner. The episode presents these cases in a neutral, educational tone, focusing on specific legal decisions and their implications. It does not include interviews or debates but rather summarizes key rulings. The format is straightforward, with each case introduced by country and authority. Recurring themes include breach reporting obligations, fines for non-compliance, and the real-world impact of data mishandling. The episode ends abruptly after the Danish case, suggesting it may be part of a longer series. Overall, it provides a concise overview of recent GDPR enforcement actions, aimed at professionals seeking updates on European data protection law.
