Skip to content
  • «
  • 1
  • »

The search returned 3 results.

Between Legitimacy and Lawfulness: In Search of Rationality and Consistency in EU Data Protection journal article

Magdalena Brewczyńska

European Data Protection Law Review, Volume 9 (2023), Issue 2, Page 112 - 122

The principle of ‘lawfulness’ of data processing with this explicit label assigned to it in Article 5(1)(a) of the General Data Protection Regulation (‘GDPR’)1 seems to be one of the least disputed principles in the EU data protection framework.2 It sounds almost like a truism to say that once the processing relies on at least one of six grounds for data processing exhaustively enumerated in Article 6(1) GDPR – titled ‘Lawfulness of Processing’ – such processing shall be regarded lawful. According to Article 8(1) of the Law Enforcement Directive (‘LED’),3 in turn, ‘Member States shall provide for processing to be lawful only if and to the extent that processing is necessary for the performance of a task carried out by a competent authority for the [law enforcement] purposes (…) and that it is based on Union or Member State law.’4 Key Words: Legitimacy | lawfulness | Grounds for Data Processing | Charter of Fundamental Rights (CFR) | Secondary Law


European Commission v Spain: Heavy Financial Sanctions and Missed Opportunity to Clarify the Importance of Data Protection Rules in the Law Enforcement Context journal article

Magdalena Brewczyńska

European Data Protection Law Review, Volume 7 (2021), Issue 2, Page 336 - 342

Case C-658/19 European Commission v Kingdom of Spain, Judgement of the Court of Justice of the European Union (Eighth Chamber) of 25 February 2021 (ECLI:EU:C:2021:138) Spain has failed to fulfil its obligations under Article 63 of the Law Enforcement Directive (LED) by failing to adopt, by the expiry of the period prescribed in the reasoned opinion of the European Commission, measures, i.e. the laws, regulations and administrative provisions necessary to comply with the LED and, therefore, by failing to notify those measures to the European Commission. By failing to adopt, by the time the Court examined the facts, the measures necessary to transpose the provisions of the LED into its national law and, therefore, failing to notify those measures to the Commission, Spain persisted in its failure to fulfil its obligations. Spain was ordered to pay the Commission a lump sum in the amount of EUR 15.000.000 and, as from the date of the delivery of the judgement and until an end is put to the infringement, a daily penalty payment of EUR 89.000.


  • «
  • 1
  • »