Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
Yes, the EU Data Act is now largely applicable, but what are the actual concerns and opportunities? In my discussions with various organisations, there has been one common fear: does this mean that I have to make all data concerning connected devices, including business-confidential information, available to everyone? The answer, as often in law, is […]
Fun day! After moderating a RAID panel with as panelists EDPB Chair Anu Talus, Luxembourg CNPD President Tine A. Larsen, Deputy Head of Data Protection Unit at the Commission’s DG Justice Karolina Mojzesowicz, MEP Brando Benifei and Gibson Dunn Partner Ahmed Baladi, I then was a speaker in a debate alongside Max Schrems of noyb.eu, […]
Cookies: EU Commission considering more pragmatism for ePrivacy – perhaps there is hope for useful legislative changes. The Commission is holding discussions next week to gather input from civil society and industry regarding the possibility of clarifying consent exemptions under Article 5(3) of the ePrivacy Directive. As readers may know, I have often written about […]
data protection podcast alert: SRB judgment implications, notably for the adtech / martech world & broader digital ecosystem. Topics: pseudonymisation, processor/controller, “singling out” versus “identification”, “outside GDPR” ≠ “free for all”, data clean rooms, and more. Listen to my discussion with Sergio Maldonado on his Masters of Privacy podcast – available through your favourite podcast […]
New Belgian Data Protection Authority decision: – Both the controller *and* the processor can be liable for not having a data processing agreement (DPA) in place – If you sign a DPA with “retroactivity clause” (i.e. foreseeing an earlier effective date than the signature date), that retroactivity clause does not have any effect from a […]
The ruling of the Court of Justice of the European Union (CJEU) of yesterday, 4 September 2025, in the EDPS v SRB case is significant – never mind the naysayers. It is the first time that the CJUE has clearly, explicitly said that if a dataset initially contains personal data but is pseudonymised, and that […]
Interestingly mixed reactions to the CJEU’s SRB ruling. Some: “nothing new!”. Others: “finally, relative nature of personal data confirmed!”. Why? The Court stated in unambiguous terms (paras. 77 + 86) that pseudonymised data can be non-personal data for a recipient if the technical and organisational measures of the pseudonymisation are effective and prevent access by […]
Amazing turnout for our LinkedIn Live on the SRB ruling – here are the slides, and the replay is available. We tackled issues surrounding the fundamental concepts of the GDPR, the scope of obligations applicable to the use of pseudonymous data, even whether AI models involve the processing of personal data, and of course the […]
First look at SRB, on what is “personal data” and the relative nature of the concept. This part is all about how to determine if information relates to an “identifiable” natural person. The EU Court of Justice stresses the importance, in the case of pseudonymisation, of technical and organisational measures (TOMs) “to ensure that the […]
SRB: relative concept of personal data confirmed. [EDIT: the judgment is out and our webinar replay is linked to below] Here is a key excerpt from the press release: the Court of Justice has confirmed […] that pseudonymised data must not be regarded as constituting, in all cases and for every person, personal data for […]
