Not a “what ABC taught me about privacy” thing, but a man held on for dear life to the seat in front of him as the plane banked (normally) on my flight back from a great conference in Vilnius. It did bring me back to what I had been telling the hundreds of attendees to […]
That was fast – less than a week after a CJEU judgment stating that it may be necessary for a controller to reveal the identity of the persons (e.g. employees) who processed personal data (C-579/21), the Belgian DPA applies that reasoning (in a separate case from the one handled by the CJEU) and orders a […]
Key takeaways from a great lunch discussion on the Digital Fairness Act with European Commission officials and representatives from consumer rights / industry / SME organisations: – Businesses of all sizes should start gathering data to show to the Commission the impact that personalised advertising has had on their growth, if applicable. – The Commission […]
Amusing settlement decision by the Belgian DPA published yesterday: 500 EUR & 250 EUR respectively, plus adaptations to policies and procedures, so that when people book a table in a given restaurant by phone their data isn’t included automatically in a third-party table booking system and then used to send commercial e-mails. The lesson? If […]
Today’s release of an artificialintelligence fairness toolkit (Veritas Toolkit v2.0) by the Monetary Authority of Singapore is an occasion to recall that there is no plug-and-play tool for everyone – but toolkits can be a useful source of inspiration. Released under an Apache 2.0 open source licence, the diagnosis tool (in Python) and assessment tool […]
Interesting case filed before the EU General Court by a person represented by noyb.eu, now published in the EU Official Journal. The complainants (the applicant + noyb) had sought access to the European Data Protection Board’s file concerning the EDPB’s Facebook-related binding decision of 5 December 2022. The EDPB refused to grant access, “on the […]
Reposting, as I disagree in part and think it’s a debate worth having. If someone acts as a processor under GDPR and processes information that the processor cannot lawfully link (or get linked) to an identifiable natural person but that is personal data from the perspective of the controller, the processing on behalf of the […]
The Irish Data Protection Commission’s statement of 21 May 2025 “on Meta AI” (just like the judgment coming today in a German court case) provides a great excuse to talk briefly about GDPR legal grounds & AI model training, while I continue to work on the next part of my Better Regulation series (that next […]
The European Commission’s announcement that it will consider simplifying regulatory regimes, notably in relation to data and technology, seems to open Pandora’s box. Is it a chance to draw lessons from what works well and what works less well? In this series on “Better Regulation” in relation to the digital economy, I will be exploring […]
Why the “TCF is illegal” claim is incorrect (and why both sides are saying opposite things): 1. The claim for joint controllership of IAB Europe over further processing (and OpenRTB in particular) was denied. This is significant. Some plaintiffs expressed their disappointment with the CJEU’s position on this during a conference at the VUB (Free […]
