Stunned to see that Global Privacy Control won’t work as a refusal mechanism under the GDPR / Digital Omnibus, as it doesn’t support active change notifications. Some context: While the GDPR contains a “data subject request forwarding” obligation regarding erasure, rectification & rectification requests, it doesn’t in relation to consent withdrawal (or objections). In the […]
The ICO’s new adtech report to the UK government contains important lessons, also for legislators & regulators from all over Europe. Its suggestion is to foresee a consent exemption under ePrivacy rules (PECR in the UK) for “first-party” use of storage & processing capabilities of a device for the following purposes, if certain safeguards are […]
Out with a bang, but with controversial positions? The latest fines of the Belgian DPA represent the last from Hielke Hijmans, the departing Director of the Litigation Chamber. The amounts are modest by international standards (86k, 120k & 176k EUR) but are still relatively high for the Litigation Chamber in its approach to GDPR enforcement. […]
Ask them where they got their legal degree”, someone recently exhorted people to do whenever someone made a link between Recital 4 of the GDPR and Article 16 of the EU Charter of Fundamental Rights, on the freedom to conduct business. Yet now the EU Court of Justice has confirmed for the second time that […]
Today’s CJEU judgment on press & fair compensation indirectly impacts the “Consent or Pay” & broader discussions on online advertising, through its teachings on the freedom to conduct business: any measure liable to have a sufficiently direct and significant effect on the freedom of the operators concerned to exercise a trade or profession constitutes a […]
Global Privacy Control is great, why can’t that solve cookie fatigue in the EU? Could it be part of the Digital Omnibus 88b proposal?” A recent study examines the GPC in context of EU-level discussions on possible changes to the GDPR and ePrivacy rules. It’s an important question, as the idea of browser-level settings needs […]
I’ve always said we need a proper debate about key issues. Pity then to see how many one-sided panels there are at the upcoming CPDP conference in Brussels (often with panellists who criticise social media bubbles or deplore lack of diversity of opinion in other contexts). Diversity on panels is important, and perhaps we need […]
Why is the “personal data” definition aspect of the Digital Omnibus deemed controversial by some? And why are the alleged issues with the definition in fact absent? The Commission’s proposal is to codify recent case law of the EU Court of Justice, notably the SRB judgment (4 Sept 2025), by putting it into the law […]
How solid is your anonymisation? Is “good enough + contractual prohibition to re-identify” really sufficient? The Commission’s DMA team seems to think so, though its own idea of “good enough” relies on magic personal data scrubbers. Perhaps the Commission’s DMA team should read up again on GDPR case law on “personal data” (Breyer, Scania, SRB […]
Double standards: On the Digital Omnibus re GDPR, the EDPB & EDPS claim the Commission shouldn’t have the power to adopt implementing acts to “specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities”. Yet under the Digital Markets Act, no problem at all. The situations […]