[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuDQUAxiw6Z-f3uB3p3EV8X35qZGJeCsWlIHUyeYu47c":3},{"article":4,"iocs":42,"watch_terms":43,"solutions":44,"lesson":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":24,"category":25,"article_tags":29},"817c87d8-f52a-4303-bb13-172b72bc6884","CJEU - T‑384\u002F20 RENV - OC v Commission","cjeu-t-384-20-renv-oc-v-commission-be1de9","Standardised link ← Older revision Revision as of 13:14, 29 July 2026 Line 47: Line 47: |Initial_Contributor=ap |Initial_Contributor=ap | | |EU_Law_Name_3=Article 6(c) Regulation (EU) 2018\u002F1725|EU_Law_Link_3=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2018\u002F1725\u002Foj\u002Feng|EU_Law_Name_4=Article 6(3) Regulation (EU) 2018\u002F1725|EU_Law_Link_4=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2018\u002F1725\u002Foj\u002Feng|EU_Law_Name_5=Article 41 CFR|EU_Law_Link_5=https:\u002F\u002Fwww.europarl.europa.eu\u002Fcharter\u002Fpdf\u002Ftext_en.pdf}} |EU_Law_Name_3=Article 6(c) Regulation (EU) 2018\u002F1725|EU_Law_Link_3=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2018\u002F1725\u002Foj\u002Feng|EU_Law_Name_4=Article 6(3) Regulation (EU) 2018\u002F1725|EU_Law_Link_4=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2018\u002F1725\u002Foj\u002Feng|EU_Law_Name_5=Article 41 CFR|EU_Law_Link_5=http:\u002F\u002Fdata.europa.eu\u002Feli\u002Ftreaty\u002Fchar_2012\u002Foj}} The General Court ruled that the European Commission must pay a data subject €50,000 in damages following a press release detailing the results of an anti-fraud investigation. The Court held that the Commission processed the data unlawfully by including unnecessary personal data and inaccurate information. The General Court ruled that the European Commission must pay a data subject €50,000 in damages following a press release detailing the results of an anti-fraud investigation. The Court held that the Commission processed the data unlawfully by including unnecessary personal data and inaccurate information.","The General Court of the European Union has ordered the European Commission to pay €50,000 in damages to a data subject. This ruling stems from a press release that detailed the results of an anti-fraud investigation, which the court found contained unnecessary and inaccurate personal data. The Commission's unlawful processing of this information led to the penalty.","EU court orders European Commission to pay €50,000 for unlawful data processing.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_T%E2%80%91384\u002F20_RENV_-_OC_v_Commission&diff=52555&oldid=52266","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-07-29T13:14:27+00:00","2026-07-29T14:00:17.4872+00:00",7,[17,20,22],{"name":18,"type":19},"European Commission","vendor",{"name":21,"type":19},"European Research Council Executive Agency",{"name":23,"type":19},"European Anti-Fraud Office","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":24,"icon":26,"name":27,"slug":28},null,"Policy","policy",[30,35,37],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":36},{"id":24,"icon":26,"name":27,"slug":28},{"category":38},{"id":39,"icon":26,"name":40,"slug":41},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21,23],{"controls":45,"vendors":46},[],[],{"slug":48,"title":49,"body":50,"framework_refs":51,"framework_notes":61},"eu-commission-fined-50k-for-unlawful-personal-data-in-anti-fraud-press-release","EU Commission Fined €50K for Unlawful Personal Data in Anti-Fraud Press Release","The European Commission was ordered to pay €50,000 in damages after publishing a press release containing unnecessary and inaccurate personal data about an individual involved in an anti-fraud investigation. This case highlights that even official institutional communications must adhere strictly to data minimisation and accuracy principles under EU data protection law. Publishing more personal information than is required for a legitimate purpose constitutes unlawful processing, regardless of the public interest nature of the underlying activity. The ruling underscores that data protection obligations apply equally to EU institutions and private organisations, and that reputational and financial harm caused by inaccurate disclosures carries real legal consequences.",[52,53,54,55,56,57,58,59,60],"GDPR Article 5(1)(c) – Data Minimisation","GDPR Article 5(1)(d) – Accuracy","GDPR Article 82 – Right to Compensation and Liability","EU Regulation 2018\u002F1725 – Data Protection for EU Institutions","NIST SP 800-53 IP-1 (Individual Participation Policy)","NIST SP 800-53 SI-12 (Information Management and Retention)","CIS Control 3 – Data Protection","ISO\u002FIEC 29101 – Privacy Architecture Framework","ITIL Service Transition – Communication Management",{}]