Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
The European Data Protection Board (EDPB) can adopt various legal instruments, including Guidelines and Opinions, that are formally non-binding. Yet if supervisory authorities rarely (if ever) depart from them, controllers and processors structure their compliance efforts around them, and data subjects rely upon them in complaints and litigation, perhaps that formal status deserves a second […]
How the EDPB’s attempt to rewrite key data protection concepts creates more issues than it solves Through its Guidelines 02/2026 on Anonymisation of 7 July 2026, the European Data Protection Board seems at first glance to have done the honourable thing: admitting defeat and moving on. But behind the apparent recognition of the relative nature […]
Confused about these GDPR 10-year anniversary posts in May 2026? While I have been working on it for a decade, I’m not keen on May 2016 (entry into force) but rather May 2018, when the GDPR became *applicable*, even more than April 2016, when it was *adopted*. Why? Before May 2018: – Enforcement of data […]
Ask them where they got their legal degree”, someone recently exhorted people to do whenever someone made a link between Recital 4 of the GDPR and Article 16 of the EU Charter of Fundamental Rights, on the freedom to conduct business. Yet now the EU Court of Justice has confirmed for the second time that […]
Today’s CJEU judgment on press & fair compensation indirectly impacts the “Consent or Pay” & broader discussions on online advertising, through its teachings on the freedom to conduct business: any measure liable to have a sufficiently direct and significant effect on the freedom of the operators concerned to exercise a trade or profession constitutes a […]
What does the EU Council’s draft Presidency compromise text on the GDPR & ePrivacy Digital Omnibus tell us? (1) The Council (for now) seems to recognise the need to clarify the concept of “personal data”. As a Recital 27a would provide: The identification of a natural person should be assessed *ex ante and in concreto*, […]
The clear repudiation of an “absolute” concept of personal data has thrown a sharp focus on the process of pseudonymisation in the world of data protection. Through its SRB judgment of 4 September 2025, the Court of Justice of the European Union (CJEU) made it clear that personal data that has undergone pseudonymisation can be […]
Is “personal data” an asset? A study on human dignity & data protection has been released that on paper sounds like it should cover all the key topics. Its authors argue that individuals are “the primary right-holders in relation to the processing of their personal data” and that these “are dignity-relevant manifestations of the person […]
Interesting study on where human dignity and data protection come together, worth the read. I’m not convinced by some parts, though, as there is too much room left for subjectivity in the way certain things are worded. The authors suggest 7 guiding principles, but of particular interest to me were their suggested 6 limits to […]
Some thoughts on the leaked EU Council draft compromise re the GDPR parts of the Digital Omnibus: – This draft reads as a major lobbying win by data protection authorities and civil society. The EDPB would be given more power, the Commission no supervision, and a lot of the more business-friendly proposals would be removed […]
