Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
In 2026, agentic AI has moved from being a trendy tinkerer’s experiment to a tool of mass appeal, with corporate AI agents being deployed increasingly often and most high-profile AI labs launching personal AI agent offerings one after another, over the course of just a few months. The period in which I wrote my previous […]
Smart glasses are attracting much attention these days. Already significant sales seem to pale in comparison to the explosion of social commentary on them, just as the segment of camera-enabled wearables is growing also in terms of form factors and devices, with AI-powered pins, portable speakers and even headphones around the corner. A few months […]
The European Data Protection Board (EDPB) can adopt various legal instruments, including Guidelines and Opinions, that are formally non-binding. Yet if supervisory authorities rarely (if ever) depart from them, controllers and processors structure their compliance efforts around them, and data subjects rely upon them in complaints and litigation, perhaps that formal status deserves a second […]
How the EDPB’s attempt to rewrite key data protection concepts creates more issues than it solves Through its Guidelines 02/2026 on Anonymisation of 7 July 2026, the European Data Protection Board seems at first glance to have done the honourable thing: admitting defeat and moving on. But behind the apparent recognition of the relative nature […]
How solid is your anonymisation? Is “good enough + contractual prohibition to re-identify” really sufficient? The Commission’s DMA team seems to think so, though its own idea of “good enough” relies on magic personal data scrubbers. Perhaps the Commission’s DMA team should read up again on GDPR case law on “personal data” (Breyer, Scania, SRB […]
Double standards: On the Digital Omnibus re GDPR, the EDPB & EDPS claim the Commission shouldn’t have the power to adopt implementing acts to “specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities”. Yet under the Digital Markets Act, no problem at all. The situations […]
The clear repudiation of an “absolute” concept of personal data has thrown a sharp focus on the process of pseudonymisation in the world of data protection. Through its SRB judgment of 4 September 2025, the Court of Justice of the European Union (CJEU) made it clear that personal data that has undergone pseudonymisation can be […]
When I pointed out issues with the DMA-GDPR Guidelines & resulting risks for *all* controllers (not just gatekeepers), the EDPB’s Gwendal Le Grand said something to the effect of “Don’t just post about it, submit a response”. So here we go, a copy of the response submitted yesterday to the public consultation by the Commission […]
Not a gatekeeper? No matter – the DMA-GDPR Guidelines of the EDPB & European Commission are important: the EDPB’s input aims to ensure consistency in the interpretation of the GDPR. I’ll go through all 55 pages before next week’s great CEDPO panel with the EDPB’s own Gwendal Le Grand, Borja Martínez Corral and our moderator […]
In law, the choice of words matters, and a given interpretation can mean the difference between a behaviour being permitted or prohibited. When some recently claimed that the Cologne Higher Regional Court might have misinterpreted one of the European Union’s newer data-related acts, the Digital Markets Act (DMA for short), the challenge to the judges’ […]
