Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
Invoking a new CJEU decision in ongoing proceedings shortly after it has come out? Super! Even better when it confirms what you have been saying for years. I actually had a strong disagreement with an eminent data protection lawyer nearly a decade ago on this particular topic, during a discussion on the nature of cookies […]
Good to read about the EDPB promoting pseudonymisation in Seoul, but let’s be honest: their guidelines on the topic need serious updating further to the CJEU’s SRB judgment. Yes, they do say the opposite of SRB: 22. Pseudonymised data, which could be attributed to a natural person by the use of additional information, is to […]
data protection podcast alert: SRB judgment implications, notably for the adtech / martech world & broader digital ecosystem. Topics: pseudonymisation, processor/controller, “singling out” versus “identification”, “outside GDPR” ≠ “free for all”, data clean rooms, and more. Listen to my discussion with Sergio Maldonado on his Masters of Privacy podcast – available through your favourite podcast […]
The ruling of the Court of Justice of the European Union (CJEU) of yesterday, 4 September 2025, in the EDPS v SRB case is significant – never mind the naysayers. It is the first time that the CJUE has clearly, explicitly said that if a dataset initially contains personal data but is pseudonymised, and that […]
Interestingly mixed reactions to the CJEU’s SRB ruling. Some: “nothing new!”. Others: “finally, relative nature of personal data confirmed!”. Why? The Court stated in unambiguous terms (paras. 77 + 86) that pseudonymised data can be non-personal data for a recipient if the technical and organisational measures of the pseudonymisation are effective and prevent access by […]
Amazing turnout for our LinkedIn Live on the SRB ruling – here are the slides, and the replay is available. We tackled issues surrounding the fundamental concepts of the GDPR, the scope of obligations applicable to the use of pseudonymous data, even whether AI models involve the processing of personal data, and of course the […]
First look at SRB, on what is “personal data” and the relative nature of the concept. This part is all about how to determine if information relates to an “identifiable” natural person. The EU Court of Justice stresses the importance, in the case of pseudonymisation, of technical and organisational measures (TOMs) “to ensure that the […]
SRB: relative concept of personal data confirmed. [EDIT: the judgment is out and our webinar replay is linked to below] Here is a key excerpt from the press release: the Court of Justice has confirmed […] that pseudonymised data must not be regarded as constituting, in all cases and for every person, personal data for […]
Beyond the press release, what does the judgment actually say? Very interesting points raised by Theodore Christakis regarding the Latombe judgment on GDPR and the EU-U.S. Data Privacy Framework. Data protection
Why do I keep talking about the concept of “personal data”? From cases regarding privacy-friendly analytics to cases on equipment, from user preferences to pseudonymisation, many clients come to me with practical scenarios in which the recognition of an individual is irrelevant – sometimes even the very opposite of what an organisation is trying to […]
