Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
The European Data Protection Board (EDPB) can adopt various legal instruments, including Guidelines and Opinions, that are formally non-binding. Yet if supervisory authorities rarely (if ever) depart from them, controllers and processors structure their compliance efforts around them, and data subjects rely upon them in complaints and litigation, perhaps that formal status deserves a second […]
The Digital Omnibus evolutions at the level of the EU Council continue to have a mix of good and bad. Today, a quick focus on ePrivacy rules. First, some good: – There’s an interesting new Recital 46a on standardisation re consent preferences, stressing that technical solutions should allow data subjects to “easily set their consent […]
Stunned to see that Global Privacy Control won’t work as a refusal mechanism under the GDPR / Digital Omnibus, as it doesn’t support active change notifications. Some context: While the GDPR contains a “data subject request forwarding” obligation regarding erasure, rectification & rectification requests, it doesn’t in relation to consent withdrawal (or objections). In the […]
The ICO’s new adtech report to the UK government contains important lessons, also for legislators & regulators from all over Europe. Its suggestion is to foresee a consent exemption under ePrivacy rules (PECR in the UK) for “first-party” use of storage & processing capabilities of a device for the following purposes, if certain safeguards are […]
Global Privacy Control is great, why can’t that solve cookie fatigue in the EU? Could it be part of the Digital Omnibus 88b proposal?” A recent study examines the GPC in context of EU-level discussions on possible changes to the GDPR and ePrivacy rules. It’s an important question, as the idea of browser-level settings needs […]
What does the EU Council’s draft Presidency compromise text on the GDPR & ePrivacy Digital Omnibus tell us? (1) The Council (for now) seems to recognise the need to clarify the concept of “personal data”. As a Recital 27a would provide: The identification of a natural person should be assessed *ex ante and in concreto*, […]
Recently, there have been a few strange comments on the ePrivacy aspects of the Digital Omnibus. I’ll tackle browser-level settings later, but today I want to focus on one issue: what are the ePrivacy Directive consequences of the new Art. 88a proposal? Article 5(3) of the ePrivacy Directive (ePD) is known as the “cookie rule” […]
What is “political advertising” – or not? And when is it permitted? Scope creep beyond legislative intent is a real danger, a risk *everyone* should care about (even if you don’t think political ads concern you). The descriptively named “EU Regulation on Transparency and Targeting of Political Advertising” (“TTPA” for short) has two key aims: […]
[This is a translation of an op-ed in French that was published in the French journal Revue Politique on SRB and the Digital Omnibus, plus the newest EDPB & EDPS Joint Opinion on the topic. The original in French can be found on the Revue Politique website. + The banner image is a jest – […]
What to expect from the EDPB and EDPS on 10 February re the Digital Omnibus on GDPR and ePrivacy? Today I had the privilege of attending an event organised by The Lisbon Council with a very select group of representatives of companies, industry associations, BEUC, the Commission and the EDPB. We discussed the Digital Omnibus […]
