European Union

 EDPS reprimands Frontex for moving to the cloud without proper data protection assessment

The EDPS announced on 1 April 2022, that it had reprimanded Frontex for a breach of the Data Protection Regulation (EU) 2018/1725.

For the EDPS,

• Frontex moved to the cloud without assessing the data protection risks and without identifying appropriate mitigating measures or relevant safeguards for processing.
• Frontex failed to demonstrate the necessity of the planned cloud services, as it has not shown that the chosen solution (Microsoft 365) was the outcome of a thorough process whereby the existence of data protection compliant, alternative products and services meeting Frontex’s specific needs were assessed.
• Frontex failed to demonstrate that it limited Microsoft’s collection of personal data to what is necessary, based on an identified legal basis and established purposes.

In addition to the reprimand, the EDPS ordered Frontex to review its DPIA.

You can read the decision, here.

EDPB publishes rules of procedure

The EDPB published and adopted on 6 April 2022, a new version of its rules of procedure. These rules enter into force on the date of their adoption (Article 41).

You can read the press release here and the rules here.

IAB Europe submits action to the Belgian DPA following its decision regarding the TCF

IAB Europe announced, on 1 April 2022, that it had submitted the action plan required by the Belgian DPA’s decision on the IAB TCF.

You can read the press release here.

Fines

Belgium:  The Belgian DPA fines Brussels Airport Company €200,000 and Ambuce Rescue Team €20,000 for unlawful temperature screening during the Covid-19 pandemic

The Belgian DPA published, on 4 April 2022, its decision in which it imposed a fine of €200,000 to Brussels Airport Company NV/SA for violations of Articles 5, 6, 9, 12, 13 and 35 of the GDPR, and a fine of €20,000 to Ambuce Rescue Team NV for violations of Articles 5, 6, 9, 35 of the GDPR, following the use of thermal cameras to screen temperatures of passengers.

The Belgian DPA investigation was initiated following media reports on the use of thermal cameras