CJEU publishes judgment on supervisory authorities ordering erasure of unlawfully processed personal data

Article 58(2) of the GDPR should be interpreted as allowing a data protection authority (DPA) to order a controller or processor to erase unlawfully processed personal data in the absence of a prior request to that effect from a data subject exercising the right to be forgotten according to Article 17(1) of the GDPR. Read more.