Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
Biometrics & Digital Omnibus: EU Council’s draft compromise could cripple biometrics in *all* industries if unchanged. The use of biometrics for identity verification is often based on consent (Art. 9(2)(a) GDPR), and the Commission’s proposal added a consent exemption if “the biometric data or the means needed for the [identity] verification is under the sole […]
Possibly the most useless legal provision ever proposed? Re-reading it doesn’t diminish my surprise at the proposed Article 29a of the GDPR, suggested in the draft EU Council compromise, which would say the following: – “Controllers and processors may apply pseudonymisation to personal data in order to reduce the risks to the data subjects concerned […]
What does the EU Council’s draft Presidency compromise text on the GDPR & ePrivacy Digital Omnibus tell us? (1) The Council (for now) seems to recognise the need to clarify the concept of “personal data”. As a Recital 27a would provide: The identification of a natural person should be assessed *ex ante and in concreto*, […]
What is “specific consent”? The EDPB’s acceptance of “broad consent” and “dynamic consent” in its new Guidelines is interesting, but its focus on (a limited view of) “scientific research” is problematic. According to those new Guidelines: In the field of scientific research, it is possible for controllers to rely on the consent of a data […]
EDPB excluding R&D & product development from “scientific research” under the GDPR? “The results of the research are shared with other parties, for example by publication, or will be shared in the future, with due regard to legitimate limitations to access such as protection of intellectual property and trade secrets. (Newly published Guidelines 1/2026 on […]
What is the target audience of the EDPB’s DPIA template? Most who *need* to carry out DPIAs more often have their own templates/tools since 5-10 years. And does it anticipate the Digital Omnibus? Only in part, with the biggest work yet to come. Some comments: 1. On the issue of DPIA requirement screening, its section […]
EDPB stakeholder event write-up: From “no one wants political ads” to “political parties have to be able to reach their local audience”, today’s topic wasn’t very sexy (the “processing of personal data for the targeting or delivery of political advertisements”) but it still was a colourful event. No bar fight unlike some previous stakeholder events, […]
What is “political advertising” – or not? And when is it permitted? Scope creep beyond legislative intent is a real danger, a risk *everyone* should care about (even if you don’t think political ads concern you). The descriptively named “EU Regulation on Transparency and Targeting of Political Advertising” (“TTPA” for short) has two key aims: […]
Some key findings from the responses to the DMA-GDPR Interplay consultation, now made public by the Commission & EDPB: – Quite a few civil society responses are copies of one another. Going through the submissions, you’ll see many with identical titles (“uncompromised privacy”, “ensuring data portability is practical and secure”, …) and content. Fortunately there […]
The clear repudiation of an “absolute” concept of personal data has thrown a sharp focus on the process of pseudonymisation in the world of data protection. Through its SRB judgment of 4 September 2025, the Court of Justice of the European Union (CJEU) made it clear that personal data that has undergone pseudonymisation can be […]
