GI rannsókna ehf. (Gallup)

What happened

The Icelandic DPA held that a controller did not violate the GDPR by storing the data subject's phone number in its database because their legitimate interest in research outweighed the interests of the data subject. Moreover, the controller could rely on the exception of Article 14(b)(5) GDPR to not inform their data subjects about the processing of personal data as this would have caused excessive costs.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

The source doesn’t list which GDPR articles were involved.