CJEU confirms in new judgment that if you use automated decision-making, you are not required to reveal your algorithm(s) to data subjects (para. 59), but you might be required to “inform the data subject of the extent to which a variation in the personal data taken into account would have led to a different result” […]
Now that the Commission has withdrawn its proposal for an ePrivacy Regulation, where does that leave the ePrivacy Directive and the issues organisations face? Over the past 7-8 years, a lot has been said about the proposed ePrivacy Regulation. Intended as both a modernisation of the ePrivacy Directive and a manner of getting to (more) […]
Want to learn about mobile app reflexes re GDPR + ePrivacy compliance, and fancy hearing about both the legal and technical aspects and how they interact? Watch the recording of the webinar that Thomas Ghys and I gave today (1h). We talk in it about the CNIL recommendations re mobile apps, what regulators are likely […]
EDPB vs administrative law: Reading the EDPB’s Pseudonymisation Guidelines once more (for the public consultation), the question of “why?” keeps repeating in my mind. Why use certain wording, why publish the Guidelines now? The list of CJEU judgments the Guidelines contradict is long already (Breyer, Scania, IAB Europe), and now the Advocate General’s Opinion in […]
Yesterday, I had the pleasure of giving a 5h presentation on the latest case law on the GDPR and other data protection legislation at various levels (Belgium, other EU countries, the Court of Justice and the European Court of Human Rights) to Data Protection Officers from a broad range of organisations and companies. The past […]
AI-powered adtech = prohibited AI? Interesting perspective, though I have my doubts as to whether the typical adtech-related AI systems we encounter in Europe would be classified as “manipulative” (let alone harmful) under the EU AI Act – once we look at how things work in practice. After all, manipulation and influence are not the […]
Wasn’t FOMO manipulation / “trick wording” a darkpattern? Why then do some critics thereof use them? Genuinely curious. Not all do so, far from it (and some of the most prominent ones are very good at *avoiding* such techniques), but it seems that some enjoy labelling everything as “Breaking” (even information that is more than […]
Understanding what is and is not personal data is fundamental to the proper interpretation and enforcement of the most famous data protection law, the GDPR. If no personal data are being processed, the GDPR simply does not apply. Some have considered that “personal data” is an absolute concept, i.e. information can be “in and of […]
Personalisation of digital audiovisual service + use of social media logins: Belgian DPA follows our arguments that contract can be a valid legal ground for personalised services and that terms of use of an online service can be a valid contract to that end, and it recognises that provided there is transparency & data minimisation, […]
After last week’s EU General Court judgment in the Irish DPC vs EDPB case, some claimed that this makes EDPB Guidelines and Opinions unassailable. (Yes, really.) That’s wrong. Let’s look at what the judgment means for the EDPB’s authority – and some issues it raises: 1/ Scope of EDPB binding decisions The judgment of the […]
