Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
How the EDPB’s attempt to rewrite key data protection concepts creates more issues than it solves Through its Guidelines 02/2026 on Anonymisation of 7 July 2026, the European Data Protection Board seems at first glance to have done the honourable thing: admitting defeat and moving on. But behind the apparent recognition of the relative nature […]
Around the time I created my data breach risk assessment tool (after really interesting exchanges with ENISA on cybersecurity & data protection), Olivier Sustronck released something similar that he just made available for free. My firm got an award for mine, his went under the radar – but he truly deserves praise for the quality […]
The Digital Omnibus evolutions at the level of the EU Council continue to have a mix of good and bad. Today, a quick focus on ePrivacy rules. First, some good: – There’s an interesting new Recital 46a on standardisation re consent preferences, stressing that technical solutions should allow data subjects to “easily set their consent […]
Not just a good excuse to brush up my limited German! Yesterday’s dual-language event in Zurich was an excellent blend of discussions regarding the concept of “personal data” and the tensions with data sharing frameworks. The juxtaposition of my opening keynote (in English) on case law on the notion of personal data (+ Digital Omnibus […]
As I was in a meeting when the European Data Protection Board opened registration for its pseudonymisation stakeholder event of 12 December 2025, I missed the short (approx. 1h) registration window and they placed me on a waiting list instead – a pity given my frequent interventions on the EU Court of Justice’s SRB judgment […]
NIS2 vs GDPR: fines/injunctions in Belgium to be challenged before different courts? While the Belgian legislator has gradually been entrusting one single, specialised court with highly regulatory cases (essentially regarding telecom rules, financial services rules and data protection rules), it appears for now *not* to have chosen to entrust that same court, the Belgian Market […]
NIS2: Looking forward to giving a 2-day workshop with Chris A. De Vuyst from the Centre for Cybersecurity Belgium (= Belgian cybersecurity authority) next week, further to tremendous preparatory work by Chris and Val�ry Vander Geeten. [Thanks again Val�ry as well as the Data Protection Institute for thinking of me in this respect!] The Network […]
GDPR & Data Act Digital Omnibus: this is *NOT* the final version we expect the Commission to publish in two weeks (already made public by some outlets such as Contexte). But this way anyone keen on reading in more detail the points I summarised and commented in my previous post on the GDPR aspects (see […]
Key points from (& thoughts on) draft GDPR Digital Omnibus: First, Art. 4(1) GDPR would be completed with an SRB-like statement (great news), plus a mitigation of abusive interpretation of the Scania judgment (also great news). Art. 4(15) on “data concerning health” would also finally be more specific, avoiding some of the more awkward and […]
How can you reinforce your cyber resilience? Is a ransomware attack “force majeure” preventing contractual performance? Who is responsible and liable for cybersecurity (failures) in a company? I had the pleasure of taking part in a panel discussion organised by the Belgian Federation of Enterprises (VBO FEB) in which I was asked to speak on […]
