In C-645/19 Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit, the Court confirmed that only the lead Data Protection Authority can act against a controller, another supervisory authority can only initiate proceedings against a controller, provided that this power is exercised in one of the limited situations where the Regulation (EU) 2016/679 confers a competence to adopt a final decision, and provided that the cooperation and...

The processing of biometric data resulting from the illegal surveillance of employees at work is certainly one of the most common practices of operators, and the violation of the provisions established by art. 5 para. (1) lit. a) reported to art. 6 para. (1) of the General Data Protection Regulation must be strongly sanctioned. A last paradigmatic case is that of the operator Glove Technology SRL, a company specialized in consulting services, s...