[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frhRfhEnNxWAhqP6CEcfz_JPIUlsLtARPWLdfmrOpFmg":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"8039168a-a722-478d-a298-be7a65d67c00","RVS - 202401622\u002F1\u002FA3","rvs-202401622-1-a3-78b741","Fixed link ← Older revision Revision as of 07:40, 16 September 2026 Line 15: Line 15: |Original_Source_Name_1=Rechtspraak.nl |Original_Source_Name_1=Rechtspraak.nl |Original_Source_Link_1=https:\u002F\u002Fuitspraken.rechtspraak.nl\u002Fdetails?id=ECLI:NL:RVS:2026:4403 |Original_Source_Link_1=https:\u002F\u002Fuitspraken.rechtspraak.nl\u002Fdetails?id=ECLI:NL:RVS:2026:4403 |Original_Source_Language_1=Dutch; Flemish |Original_Source_Language_1=Dutch |Original_Source_Language__Code_1=NL |Original_Source_Language__Code_1=NL","The Council of State in the Netherlands has overturned a €600,000 fine imposed by the Dutch DPA. The fine was issued for processing personal data without a legal basis, specifically pseudonymized MAC addresses and location data collected for pedestrian counting. The court found that the DPA failed to adequately prove that this data constituted personal data under GDPR, particularly regarding the feasibility of re-identification.","Dutch court overturns €600K GDPR fine over pseudonymized MAC addresses and location data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=RVS_-_202401622\u002F1\u002FA3&diff=53075&oldid=52603","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-09-16T07:40:47+00:00","2026-09-16T08:00:14.726099+00:00",7,[17,20,23],{"name":18,"type":19},"MAC addresses","product",{"name":21,"type":22},"Autoriteit Persoonsgegevens","vendor",{"name":24,"type":19},"pedestrian-counting system","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":25,"icon":27,"name":28,"slug":29},null,"Privacy Fines","privacy-fines",[31,36,41],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":43,"icon":27,"name":44,"slug":45},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[21,18,24],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":68},"dutch-court-overturns-600k-gdpr-fine-over-inadequate-personal-data-proof","Dutch Court Overturns €600K GDPR Fine Over Inadequate Personal Data Proof","The Dutch Data Protection Authority (DPA) failed to sufficiently demonstrate that pseudonymized MAC addresses and location data collected for pedestrian counting constituted 'personal data' under GDPR, specifically regarding the realistic feasibility of re-identification. This case highlights that regulators bear the burden of proving re-identification is reasonably possible, not merely theoretical. It also underscores that pseudonymization, when implemented effectively, can serve as a meaningful legal and technical defense. Organizations must nonetheless carefully assess their data classification processes and legal bases before processing any potentially identifiable data, as outcomes can vary significantly based on context and jurisdiction.",[56,57,58,59,60,61,62,63,64,65,66,67],"GDPR Article 4(1) – Definition of Personal Data","GDPR Article 5(1)(b) – Purpose Limitation","GDPR Article 5(1)(e) – Storage Limitation","GDPR Article 6 – Lawfulness of Processing","GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Recital 26 – Pseudonymization and Re-identification Risk","NIST SP 800-188 – De-Identification of Government Datasets","NIST Privacy Framework PR.DS-P1 – Data Classification","CIS Control 3 – Data Protection","ISO\u002FIEC 29101 – Privacy Architecture Framework","ENISA Guidelines on Pseudonymisation",{}]