Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
Two victories before the Belgian DPA this week: dismissal of a complaint against a privacy-friendly analytics provider (re ads & content) due to lack of evidence of processing of personal data (Breyer + SRB having an impact), and one decision confirming that where data is shared pre-GDPR, the controller using it post-GDPR is the one […]
From fishing (instead of the GDPR) to a random “v” having appeared instead of a few words (a typo upon deletion?), the Commission’s GDPR & Data Act Omnibus feels like a rushed document. But what does it cover really? I’m focussing here on GDPR & ePrivacy: – Personal data definition: I like the idea of […]
Hopefully thought-provoking? My keynote on “Personal Data in a Digital World: What Are We Protecting?” kicked off the Nordic Privacy & Innovation Summit 2025 today in Stockholm. Among my topics: SRB, OT, ePrivacy, AI and AI model training, plus how to make the GDPR more workable (see slides, which show that data protection involves a […]
GDPR & Data Act Digital Omnibus: this is *NOT* the final version we expect the Commission to publish in two weeks (already made public by some outlets such as Contexte). But this way anyone keen on reading in more detail the points I summarised and commented in my previous post on the GDPR aspects (see […]
Key points from (& thoughts on) draft GDPR Digital Omnibus: First, Art. 4(1) GDPR would be completed with an SRB-like statement (great news), plus a mitigation of abusive interpretation of the Scania judgment (also great news). Art. 4(15) on “data concerning health” would also finally be more specific, avoiding some of the more awkward and […]
Some thoughts on today’s EDPB “Pay or Consent” stakeholder event – in practice one about the future of GDPR enforcement, consent, adtech and even the future of the Internet: – At times, things got heated in our breakout room between two camps, typically privacy rights campaigners + contextual ad solution providers on the one hand […]
That draft GDPR Digital Omnibus is quite worth the read. Once the story gets out, I’ll be posting a summary of all the changes and some preliminary thoughts – but it’s a promising blend of data protection case law (+ mitigations of excessive interpretations that might be made of certain judgments), ePrivacy improvements and AI […]
These excerpts from the Getty v Stability judgment will be interesting for data protection professionals to look at, not just copyright professionals: – Judge: “Stable Diffusion does not itself store the data on which it was trained” [para. 552 of the judgment] – Expert report: “Rather than storing their training data, diffusion models learn the […]
New Belgian Data Protection Authority decision on video surveillance: don’t do permanent surveillance of employees. Questions remain, but without more background (name of the stores, history of theft within the stores etc.) it’s difficult to assess whether the BDPA was right in its assessment. The decision mentions the fact that cameras were deployed in 6 […]
This is a big one – the Polish Supreme Administrative Court confirms that cookies & IP addresses aren’t always personal data (even in case of use of Google Analytics), and the burden of proof that they are in specific circumstances rests on the national authority, not the controller. It’s another good application of the EU […]