[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fchrszvyLnRIJ-nF9XoxFy7wjehsaF0rR2s4hFWtioXY":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":49},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"a547c642-177f-4c5e-b825-e5ea47c9eb24","RVS - 202401622\u002F1\u002FA3","rvs-202401622-1-a3-bb2813","Fixed link and references ← Older revision Revision as of 07:59, 8 October 2026 Line 44: Line 44: |GDPR_Article_4= |GDPR_Article_4=Recital 26 GDPR |GDPR_Article_Link_4= |GDPR_Article_Link_4=Recitals GDPR |GDPR_Article_5= |GDPR_Article_Link_5= |EU_Law_Name_1= |EU_Law_Name_1= Line 61: Line 55: |National_Law_Name_1=Recital 26 GDPR |National_Law_Name_1= |National_Law_Link_1=https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2016\u002F679\u002Foj\u002Feng |National_Law_Link_1=","The Council of State in the Netherlands overturned a €600,000 fine imposed by the Dutch DPA on the Municipal Executive Board of Enschede. The fine was for processing personal data without a legal basis. The court ruled that the DPA failed to sufficiently prove that pseudonymised MAC addresses and location data constituted personal data, a key requirement under GDPR.","Dutch court overturns €600K GDPR fine due to insufficient proof of personal data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=RVS_-_202401622\u002F1\u002FA3&diff=53331&oldid=53075","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-10-08T07:59:07+00:00","2026-10-08T08:00:10.766037+00:00",7,[17,20],{"name":18,"type":19},"Autoriteit Persoonsgegevens","vendor",{"name":21,"type":22},"MAC addresses","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":47,"vendors":48},[],[],{"slug":50,"title":51,"body":52,"framework_refs":53,"framework_notes":64},"dutch-dpa-fine-overturned-due-to-insufficient-proof-that-mac-addresses-constitute-personal-data","Dutch DPA Fine Overturned Due to Insufficient Proof That MAC Addresses Constitute Personal Data","The Council of State overturned a €600,000 GDPR fine against the Municipality of Enschede because the Dutch DPA could not sufficiently prove that pseudonymised MAC addresses and location data qualified as personal data under GDPR. This case highlights a critical gap in regulatory enforcement: the legal definition of 'personal data' is context-dependent, and pseudonymisation can shift the burden of proof significantly. Organisations and regulators alike must rigorously assess whether data elements can reasonably identify individuals before classifying and enforcing them as personal data. This ruling matters because it sets a precedent that challenges assumptions about pseudonymised data, potentially affecting how organisations design privacy programmes and how DPAs build their enforcement cases.",[54,55,56,57,58,59,60,61,62,63],"GDPR Article 4(1) — Definition of Personal Data","GDPR Article 5 — Principles Relating to Processing of Personal Data","GDPR Article 6 — Lawfulness of Processing","GDPR Article 25 — Data Protection by Design and by Default","GDPR Article 35 — Data Protection Impact Assessment","NIST Privacy Framework PR.DS-P1 — Data Processing Policies","NIST SP 800-188 — De-Identification of Government Datasets","CIS Control 3 — Data Protection","ISO\u002FIEC 29101 — Privacy Architecture Framework","ITIL Service Design — Information Security Management",{}]