DPO Advisor

Find everything you need to stay up-to-date on evolving privacy & security regulations around the world

Birthlink fined £18,000 for deletion of sensitive adoption records

July 28, 2025

The UK ICO fined charity Birthlink £18,000 after losing sensitive adoption records. The case highlights UK GDPR duties to protect and retain personal data, with regulators stressing the severe emotional harm caused by the loss.

Poland fines McDonald’s over employee data breach

July 23, 2025

Poland’s DPA penalized McDonald’s over a breach exposing employee data via misconfigured servers, citing GDPR failures and poor processor oversight.

EDPB finalizes Article 48 guidelines

June 18, 2025

The EDPB adopted final guidelines on Article 48 of the GDPR, clarifying how EU organizations should respond to foreign data requests and when international agreements are required.

Vodafone fined €45M in Germany for data privacy oversight and security failures

June 12, 2025

In June 2025, Vodafone was fined €45 million by Germany’s BfDI for failing to monitor third-party agencies and for weak customer verification practices, highlighting critical gaps in privacy and security compliance.

23andMe fined £2.3M by UK ICO for 2023 credential-stuffing breach

June 5, 2025

The UK ICO fined 23andMe £2.3M after a 2023 cyberattack exposed genetic data of 150K users. The regulator found insufficient safeguards for highly sensitive data, reinforcing strict UK GDPR security obligations.

EU court rejects Meta’s challenge to 'consent or pay' opinion

May 7, 2025

The EU General Court rejected Meta’s attempt to overturn an EDPB opinion, ruling that requiring payment to avoid data tracking violates GDPR principles. The decision reinforces that consent must be freely given and not tied to financial status.