Privacy in practice

The download form asks for an email for the guide. The app requests location to function. Is that consent — or payment in...

The boat wasn't just about bad security. It was about no one being responsible for the system.

Mailchimp shows you who opened your newsletter at 9:14 AM on an iPhone. Have you told your subscribers that you see…

Send a request for insights to yourselves — as if you were a customer. Can you respond within 30 days, with…

«Accept terms» is not valid consent — at least not when the alternative is losing access to the service.

The loyalty card collected points. Your email address was forwarded to a social network – without anyone telling you.

750,000 of those exposed were not even active members anymore. The association had never deleted them.

Schibsted wants 39 kroner. Facebook was fined two billion. The question is not the size of the price — but whether...

VG, Aftenposten, and BT give you a choice—share your data with advertisers, or pay an extra 39 kroner per month…

When data from 2.1 million people was published on the Darknet following the SportAdmin breach, it wasn't just the software company that had a problem. Every sports team using the system was also affected.

The online store was hacked through a system no one used anymore. The fine was over ten million kroner.

The prospecting tool stored contact data for five years—and automatically reset the deadline each time the person changed jobs. In practice, the data was never deleted.

Your newsletter knows who opens it, when, and on what device. The CNIL says you need consent for that.

83.5 percent of the transparency requests that noyb has sent to companies over the last eight years did not receive a response in line with...

Merely using the app revealed the user's sexual orientation. The Norwegian Data Protection Authority imposed a fine of 65 million. The Court of Appeal agreed.

The retail chain shared its customer list with a social network. 10.5 million people's emails and phone numbers—used to show them ads…

Two masked men knocked on the door in the middle of the night. They knew his name, his address, and that he had firearms at home.

The bank app required access to the list of all installed apps on your phone. Garante said: that's too much.

The sports app was hacked. Data from 2.1 million children — personal identification numbers, health information, club affiliation — ended up on the Darknet.

160 million contact profiles. Harvested from LinkedIn without asking. Stored for five years. CNIL fined KASPR €240,000.

The vendor had carried out a security audit. The errors were documented. None were fixed. When the breach occurred, data about disabled individuals was leaked. The fine was €1.7 million.

Most businesses know they should consider risks before adopting new systems. Few know what the assessment should entail. Now the EDPB has created the template – for free.

51 municipalities used Google in schools. The Danish Data Inspection Agency found that they didn't know who was actually processing the data — and stated that it was the municipalities' fault, not Google's.

In 2025, 443 data breaches were reported per day in Europe — up 22 percent from the previous year. Most of the businesses affected did not have a plan.

Almost all cloud usage in Norwegian businesses is based on one agreement between the EU and the US. That agreement is under pressure — again.

When the CNIL investigated the France Travail breach, one of the findings was this: access rights were defined too broadly. It's not sabotage. That's how the system was set up.

France Travail was not hacked. The attacker only asked for help. When he was inside, he had access to data on 43 million people.

Most privacy policies are written for lawyers. GDPR says they should be written for people. What should actually be in them?

25 European supervisory authorities are now checking whether your privacy policy gives people what they are entitled to know.

Reddit hadn't done a single risk assessment before they let children in. It cost £14 million.

You deleted the customer from the CRM. But the backup system remembers everything. Are you actually in compliance—or just in the production environment?

32 supervisory authorities checked 764 businesses. Most do not know what they are storing, why, or when they should delete it.