Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
Hopefully thought-provoking? My keynote on “Personal Data in a Digital World: What Are We Protecting?” kicked off the Nordic Privacy & Innovation Summit 2025 today in Stockholm. Among my topics: SRB, OT, ePrivacy, AI and AI model training, plus how to make the GDPR more workable (see slides, which show that data protection involves a […]
Key points from (& thoughts on) draft GDPR Digital Omnibus: First, Art. 4(1) GDPR would be completed with an SRB-like statement (great news), plus a mitigation of abusive interpretation of the Scania judgment (also great news). Art. 4(15) on “data concerning health” would also finally be more specific, avoiding some of the more awkward and […]
These excerpts from the Getty v Stability judgment will be interesting for data protection professionals to look at, not just copyright professionals: – Judge: “Stable Diffusion does not itself store the data on which it was trained” [para. 552 of the judgment] – Expert report: “Rather than storing their training data, diffusion models learn the […]
In law, the choice of words matters, and a given interpretation can mean the difference between a behaviour being permitted or prohibited. When some recently claimed that the Cologne Higher Regional Court might have misinterpreted one of the European Union’s newer data-related acts, the Digital Markets Act (DMA for short), the challenge to the judges’ […]
Does training of AI systems involve the processing of personal data, and is it permitted under the GDPR? These were the two fundamental questions that I have already looked into in two previous articles: On the date of that second article, the Cologne Higher Regional Court (the Oberlandesgericht Köln – the Cologne HRC) delivered a […]
The European Commission’s announcement that it will consider simplifying regulatory regimes, notably in relation to data and technology, seems to open Pandora’s box. Is it a chance to draw lessons from what works well and what works less well? In this series on “Better Regulation” in relation to the digital economy, I will be exploring […]
Here is an English version of the questions referred yesterday to the CJEU on the right to erasure or “right to be forgotten” in a case about a request for removal from a baptism register – an interesting balance of fundamental rights. The case, an appeal against a decision by the Belgian Data Protection Authority […]
The European Data Protection Board is at it again: an urgent procedure has been launched to obtain clarification on “some of the core issues that arise in the context of processing for the purpose of developing and training an AI model”. The aim? To bring “some much needed clarity into this complex area”. Yet the […]
Expect a lot of misinformation regarding AG Rantos’s Opinion of today in the CJEU case regarding Schrems v Meta. Why? (i) Some campaigners are claiming that this is a victory on question 2*, because the advertising industry would allegedly keep years and years of data for advertising purposes. Yet old information is less valuable for […]
Illustration: Dall-E rendering of just how potentially evil the European Data Protection Board (EDPB) and certain privacy rights campaigners view the “Pay or Consent” approach + large companies. I didn’t try to get any drug cartel references in there, though as a lawyer acting for adtech companies I have been likened to a drug cartel […]
