EDPBI:FR:OSS:D:2022:351: GDPR decision metadata and cohort analysis

What this register entry establishes

The EDPB register records EDPBI:FR:OSS:D:2022:351 with a decision date of 18 March 2022, lead supervisory authority FR, main legal reference “Article 5 (Principles relating to processing of personal data)” and outcome “Reprimand”. The EDPB classifies it under Basic principles, Data subject rights.

Decision-register record

The identifier is the safest citation key for cross-checking this record. Country code, year and serial components can help organise research, but they are not substitutes for the decision text.

How to review the main legal reference

Article 5 contains the GDPR’s core processing principles, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability.

Identify the specific principle at issue, the processing stage where it applies, and the evidence the authority used to test accountability.

A “main legal reference” is a register classification, not necessarily an exhaustive list of every GDPR provision discussed. When extracting precedent or compliance actions, read the full PDF for the factual test, procedural posture, other provisions, remedies and any limits on the authority’s reasoning.

Legal-reference and outcome cohort

Across the captured register, 146 unique decisions share this exact main legal-reference label. The comparison answers a narrow research question—how the EDPB register classifies similar records—without claiming that identical labels mean identical facts or holdings.

The most frequent recorded outcome in this exact-label cohort is “Reprimand” (27.4%). That distribution describes register classification only; it is not a forecast for a new case.

Authority, year and cross-border context

The captured register assigns 119 decisions to FR and 288 decisions to 2022. These counts describe register coverage, not enforcement intensity adjusted for population, complaint volume, case complexity or publication practice.

The captured card does not list a concerned supervisory authority. Do not infer from that blank alone that the underlying processing had no cross-border dimension.

The decision belongs to the 2022 register cohort. Year counts can reflect decision timing and publication practice; they should not be treated as a normalised enforcement-rate series.

Topic classification and related decisions

Basic principles

The captured register contains 117 unique decisions tagged “Basic principles”. Topic tags are useful discovery facets, but the full decision controls the scope of the case.

Data subject rights

The captured register contains 1,030 unique decisions tagged “Data subject rights”. Topic tags are useful discovery facets, but the full decision controls the scope of the case.

Closest certified decision profiles

Technical decision-review checklist

1. Verify the record. Match the EDPBI identifier, date and PDF on the official register before relying on a secondary description.
2. Extract facts separately from holdings. Record the processing operation, roles, data categories, data subjects, geography and timeline before summarising the legal test.
3. Map every cited provision. Treat this card’s main legal reference as a starting point; capture all GDPR articles and national-law provisions actually used in the decision.
4. Identify the procedural route. Note the lead and concerned authorities, cooperation steps, objections, appeals and whether the published text is final for the point being researched.
5. Separate infringement from remedy. Record findings, corrective powers, fine methodology, deadlines and compliance orders as distinct elements.
6. Test comparability. Compare business model, scale, intent, duration, mitigation and authority—not merely the article number or outcome label.
7. Check later developments. Verify appeals, replacement decisions, updated guidance and later case law before using the decision operationally.

Article 27 and non-EU organisations

This decision card is not, by itself, an Article 27 territorial-scope determination. A non-EU controller or processor should separately assess Article 3: establishment, offering goods or services to people in the Union, and monitoring behaviour in the Union. Where Article 3(2) applies and no exception covers the processing, Article 27 may require a representative in the Union.

The EDPB’s territorial-scope guidance explains that the representative is an additional contact point and does not replace the controller’s or processor’s own responsibility. The designation, mandate, location and accessibility should be documented against the actual processing and data-subject geography.

Research questions this page can and cannot answer

Does the outcome label describe the whole remedy?

No. A register label is a discovery field. The PDF may include multiple findings, corrective measures, deadlines or procedural qualifications.

Can another organisation treat this decision as a direct precedent?

Not without a comparability analysis. Supervisory-authority decisions are highly fact dependent, and later appeals, national procedure or subsequent EDPB and court materials can affect how they should be used.

Why compare exact legal-reference labels?

Exact-label cohorts make the method reproducible and reduce subjective grouping. Their limitation is equally clear: differently worded labels may concern overlapping provisions, while identical labels may cover different conduct.

Does this profile provide legal advice?

No. It is a source index and analytical research aid. Qualified counsel or a specialist should review the primary decision and current law for a specific compliance position.

Sources, provenance and limitations

Build certificate: policy 2026-08-14.1; 1,203 non-navigation words; 8 source facts; EDPB snapshot 212f041b5aa0fd09… . All classifications and counts were computed offline. The live page performs no source API, PDF extraction, database or AI call.

Limitations: Register metadata can be corrected or expanded after capture. Cohort counts reflect this snapshot and do not measure underlying incidence, enforcement probability or legal merit. The decision PDF and current official law remain controlling sources.