Key points for companies on data inventories, privacy notices and explicit consent in light of recent Board decisions.
Recent decisions of the Personal Data Protection Board emphasise that controllers must meet the duty to inform in a layered, clear way, and that explicit consent must not be made a condition of service. Up-to-date data inventories and documented retention periods are among the first items checked in audits.