New Belgian Data Protection Authority decision: – Both the controller *and* the processor can be liable for not having a data processing agreement (DPA) in place – If you sign a DPA with “retroactivity clause” (i.e. foreseeing an earlier effective date than the signature date), that retroactivity clause does not have any effect from a […]
The ruling of the Court of Justice of the European Union (CJEU) of yesterday, 4 September 2025, in the EDPS v SRB case is significant – never mind the naysayers. It is the first time that the CJUE has clearly, explicitly said that if a dataset initially contains personal data but is pseudonymised, and that […]
Interestingly mixed reactions to the CJEU’s SRB ruling. Some: “nothing new!”. Others: “finally, relative nature of personal data confirmed!”. Why? The Court stated in unambiguous terms (paras. 77 + 86) that pseudonymised data can be non-personal data for a recipient if the technical and organisational measures of the pseudonymisation are effective and prevent access by […]
Amazing turnout for our LinkedIn Live on the SRB ruling – here are the slides, and the replay is available. We tackled issues surrounding the fundamental concepts of the GDPR, the scope of obligations applicable to the use of pseudonymous data, even whether AI models involve the processing of personal data, and of course the […]
First look at SRB, on what is “personal data” and the relative nature of the concept. This part is all about how to determine if information relates to an “identifiable” natural person. The EU Court of Justice stresses the importance, in the case of pseudonymisation, of technical and organisational measures (TOMs) “to ensure that the […]
SRB: relative concept of personal data confirmed. [EDIT: the judgment is out and our webinar replay is linked to below] Here is a key excerpt from the press release: the Court of Justice has confirmed […] that pseudonymised data must not be regarded as constituting, in all cases and for every person, personal data for […]
Beyond the press release, what does the judgment actually say? Very interesting points raised by Theodore Christakis regarding the Latombe judgment on GDPR and the EU-U.S. Data Privacy Framework. Data protection
Why do I keep talking about the concept of “personal data”? From cases regarding privacy-friendly analytics to cases on equipment, from user preferences to pseudonymisation, many clients come to me with practical scenarios in which the recognition of an individual is irrelevant – sometimes even the very opposite of what an organisation is trying to […]
In law, the choice of words matters, and a given interpretation can mean the difference between a behaviour being permitted or prohibited. When some recently claimed that the Cologne Higher Regional Court might have misinterpreted one of the European Union’s newer data-related acts, the Digital Markets Act (DMA for short), the challenge to the judges’ […]
Belgian DPA: 100k EUR fine for a controller for not responding during 14 months to a data subject access request. [Decision of 23 August 2024; fine:
