In Schrems v Meta (C-446/21), the CJEU emphasized data minimisation , ruling that personal data cannot be processed indefinitely for targeted advertising without strict temporal limits. Article 6: Lawfulness of Processing
Processing is only legal if it meets one of six bases, such as consent or "legitimate interests".
Confirmed fines require intent or negligence and can be based on total group turnover.
Anyone who has suffered damage due to a GDPR infringement has the right to receive compensation from the controller or processor.