Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
Stunned to see that Global Privacy Control won’t work as a refusal mechanism under the GDPR / Digital Omnibus, as it doesn’t support active change notifications. Some context: While the GDPR contains a “data subject request forwarding” obligation regarding erasure, rectification & rectification requests, it doesn’t in relation to consent withdrawal (or objections). In the […]
When do contracts have to be provided in response to a data subject access request? And should a controller maintain a copy thereof to enable data subject requests? A new Belgian DPA decision deals with this issue, applying the EU Court of Justice’s CRIF judgment to the issue of bank account contracts. Article 15 GDPR […]
Belgian DPA: 100k EUR fine for a controller for not responding during 14 months to a data subject access request. [Decision of 23 August 2024; fine:
The European Commission’s announcement that it will consider simplifying regulatory regimes, notably in relation to data and technology, seems to open Pandora’s box. Is it a chance to draw lessons from what works well and what works less well? In this series on “Better Regulation” in relation to the digital economy, I will be exploring […]
Yesterday, I had the pleasure of giving a 5h presentation on the latest case law on the GDPR and other data protection legislation at various levels (Belgium, other EU countries, the Court of Justice and the European Court of Human Rights) to Data Protection Officers from a broad range of organisations and companies. The past […]
Here is an English version of the questions referred yesterday to the CJEU on the right to erasure or “right to be forgotten” in a case about a request for removal from a baptism register – an interesting balance of fundamental rights. The case, an appeal against a decision by the Belgian Data Protection Authority […]
The Belgian Data Protection Authority has adopted a new decision that applies the principles on automated decision-making set out by the CJEU in its SCHUFA I decision of 7 December 2023. Some specific considerations: – This decision is a “prima facie” one, i.e. not yet a full decision on the merits, to order the controller […]
Ex-employee request for 8 years of e-mails, labelled excessive by Belgian data protection authority in new decision. What is an “excessive” data subject request under the GDPR has not often been discussed by authorities, so this case may be of interest – but careful generalising it too hastily, due to the facts. Facts: – X, […]
