IAB Europe’s letter to the EDPB on “Pay or Consent” is out – with considerations relating to the GDPR and broader data protection rules, fundamental rights, personal data as “consideration” for a contract (co-signatories: Alliance Digitale, IAB Italia & IAB Spain) Key points: – �The assessment of �Consent or Pay� models must remain coherent with […]
Time to talk about what can be done to improve the “cookie” rule! In Part I of this series on the opportunities and difficulties of today’s ePrivacy regime, I discussed the underappreciated and seemingly-easy-but-really-complex world of the anti-spam rule, Article 13 of the ePrivacy Directive (or ePD). This Part II is about a provision that […]
Three points of interest (also beyond Belgium) taken from the Belgian data protection authority’s new decision regarding bpost (postal services): – Legitimate interests can be a valid legal ground for direct marketing (this is already well known throughout the European Union, but it’s worth repeating, considering the opposite view that the Dutch Autoriteit Persoonsgegevens continues […]
PayOrOkay [I’ll surely get shot for writing this:] 39 members of the European Parliament write to Meta to say that the right to privacy is “no” [I assume “not”] “something you should have to purchase” and that “[s]tudies” [citation needed] “suggest that contextual advertising is nearly as profitable as surveillance-based advertising”. Honestly, I preferred the […]
New BDPA decision on data models + “research” as a compatible purpose. Two key questions: (i) If a data model is *no longer* based on a data subject’s data after an objection, can that data subject still file a complaint before a data protection authority? “Yes as long as that person can demonstrate an interest”, […]
While everyone is shouting “it’s for realz now”*, what will the AIAct actually mean for most organisations? Awareness (“AI literacy”) obligations and obligations to ensure that people know (i) if they are interacting with an AI system or (ii) whether they are subject to an AI system – and safeguards to ensure that no high-risk […]
Will data protection authorities be a top target for cybercriminals? Forced sharing of trade secrets is one of the consequences of yesterday’s CJEU judgment, in a way that in my view should prompt a serious question: how will organisations share those trade secrets with those supervisory authorities [SAs], and can the latter be trusted to […]
Podcast episode on GDPR (“what is personal data?”), ePrivacy (“what requires consent? or not?”), adtech (TCF notably) and “Pay or OK” – a fantastic conversation with Alan Chapell on The Monopoly Report. So much still to talk about, so we’ll see if a follow-up comes! Here are some links (42min): – on the Monopoly Report […]
CJEU confirms in new judgment that if you use automated decision-making, you are not required to reveal your algorithm(s) to data subjects (para. 59), but you might be required to “inform the data subject of the extent to which a variation in the personal data taken into account would have led to a different result” […]
Now that the Commission has withdrawn its proposal for an ePrivacy Regulation, where does that leave the ePrivacy Directive and the issues organisations face? Over the past 7-8 years, a lot has been said about the proposed ePrivacy Regulation. Intended as both a modernisation of the ePrivacy Directive and a manner of getting to (more) […]
