Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
The relative nature of “personal data” strikes again (or does it?). In today’s judgment in C-319/22 (Scania), the CJEU has seemingly confirmed that whether information is “personal data” or not depends on the entity/person processing it, like the General Court had done in other cases. This case asks whether a vehicle identification number (VIN) is […]
Pro tip: next time you want to let an AI bot join a group call on your behalf, make sure that all participants are OK with it. (In recent calls within the digitalecosystem and adtech industry, it’s like every week we have to boot a new transcription bot that was invited by a different person […]
Looking forward to seeing many contacts next week at the IAPP Congress in Brussels – let me know if you would like to meet up on the Wednesday or Thursday. On Tuesday 14 November we are giving an invite-only workshop to select companies on Tomorrow’s Data Challenges, with discussions on topics such as dark patterns, […]
“Pay or data” and cookie walls are clearly controversial topics, but I feel something needs to be said regarding their justification – else LinkedIn and the broader web may seem to be a very anti-business environment from a data protection perspective, based on various posts and articles I have seen in recent months. Running a […]
I’m seeing significant misinterpretations of the CJEU’s newest GDPR judgment. The CJEU *did not say* today that simply seeing information on a mobile app is processing of personal data. Instead, it said that *the process by which a COVID certificate is scanned by a device and then interpreted to reveal a green checkmark or a […]
Fines aren’t the only possible sanction in case of an infringement of data protection rules – prison is also a possibility in certain countries. That’s exactly the outcome of a case in France, where a former head of HR received a six-month (suspended) prison sentence yesterday. In that case, the person in question had created […]
100% GDPR compliant” claims seem to have made a big comeback with the flurry of GenerativeAI tools being released*. As a reminder, claiming that a software solution is GDPR compliant is a marketing trick at best and misleading at worst. First, if you’re not sure what the sources are on which a particular AI system […]
I’m not sure X/Y’s data protection practices are compliant” is not a justification for filing a complaint, says the Belgian DPA in a new decision, reminding data subjects that they should exercise their rights before a complaint or at least be able to show that an alleged non-compliance by a controller or processor somehow affects […]
Important comment by the Belgian Market Court in a new judgment, here on confidentiality of controller/processor documents vis-�-vis a complainant: “the general principle regarding the prohibition of the abuse of rights prevents a complainant [�] from using the complaint to obtain information that it would not be able to obtain lawfully by other means”. The […]
Great news about the EU-U.S. adequacy decision! But let’s remember that many organisations want a solution for global transfers, not just for the United States. While the EU-U.S. adequacy decision helps a lot, it is only part of the solution that organisations need. Let’s look at some of the other components. Another part of the […]
