Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
Here are 15 lessons based on an analysis of various data protection authority decisions across Europe, from a GDPR and cybersecurity article I just submitted after a reputed information security journal reached out. Cybersecurity compliance beyond best practices: key lessons: 1) Document your risk assessments and decisions. => If you deviate from common best practices, […]
Can GDPR administrative fines be imposed for infringements that are not the result of either intent or negligence? (e.g. excusable, non-negligent human error) The CJEU Advocate General Campos S�nchez-Bordona says “No”. Others have already reported on the consequences of the new Opinion in the Deutsche Wohnen case (C?807/21) from the perspective of whether an undertaking […]
7 points after giving another in-depth presentation to global businesses on the path to NIS2 compliance (with a flavour of DORA and GDPR): (i) Having a broad enough team (“multidisciplinary” / “multi-stakeholder” / however you wish to call it) is not easy for many organisations, irrespective of their size (this is nothing new, but it […]
Will data protection authorities be a top target for cybercriminals? Forced sharing of trade secrets is one of the consequences of yesterday’s CJEU judgment, in a way that in my view should prompt a serious question: how will organisations share those trade secrets with those supervisory authorities [SAs], and can the latter be trusted to […]
Yesterday, I had the pleasure of giving a 5h presentation on the latest case law on the GDPR and other data protection legislation at various levels (Belgium, other EU countries, the Court of Justice and the European Court of Human Rights) to Data Protection Officers from a broad range of organisations and companies. The past […]
Looking back + forwards, 4 big topics for me on LinkedIn in 2024 & likely still for 2025 are the following:– ePrivacy– “Consent or Pay”– AI & personal data– Cybersecurity The key ePrivacy topic was the European Data Protection Board’s guidelines on the technical scope of Art. 5(3) of the ePrivacy Directive – basically, “to […]
Newest Belgian DPA decision confirms that “data breach” is not always “GDPR infringement”, in a decision that (i) suggests good practices so that the data breach response does not itself become a GDPR infringement and (ii) echoes (without quoting) the CJEU’s cybersecurity judgment of 14 December 2023 (Natsionalna agentsia za prihodite). � Context: Further to […]
Yes, GenerativeAI is what people are talking about. Yes, it presents specific risks (notably re disinformation). But from an aigovernance and liability perspective, the risks associated with predictive/discriminative AI are just as relevant. In her speech today re the State of the European Union, Ursula von der Leyen said that we should “not underestimate the […]
Some seem to suggest that “unavailability of IT system = security incident = personal data breach”. While data protection *authorities* regularly suggest unavailability is a breach, the main EU *law* on data protection, the GDPR, doesn’t say so. Definition of “personal data breach” in Art. 4(12) GDPR: “breach of security leading to the accidental or […]
Practical checklist: good practices for vendor/supplier risk management inspired by GDPR, NIS2, Data Governance Act and DORA. The underlying question: what good practices do these EU laws highlight and transform into legal obligations in certain cases, and how can we combine them? This checklist is *not* a comprehensive list of best practices, but it should […]