Another important CJEU judgment! Whether GDPR administrative fines are “criminal penalties” or not is a relevant issue for both insurability and indemnification clauses (e.g. “Y agrees to indemnify and hold Z harmless for data protection violations”). Today’s CJEU’s judgment in case C-27/22 strengthens the position of those who raised concerns regarding GDPR fine insurance and […]
Yes, GenerativeAI is what people are talking about. Yes, it presents specific risks (notably re disinformation). But from an aigovernance and liability perspective, the risks associated with predictive/discriminative AI are just as relevant. In her speech today re the State of the European Union, Ursula von der Leyen said that we should “not underestimate the […]
This should be fun! Didomi has invited me to share the floor with Max Schrems during a webinar on 24 Sept. on the Future of User Consent. I don’t always agree with Max or noyb.eu, whether in my personal conviction or through my professional work (in fact, I have/had a few litigation cases where we […]
In today’s Official Journal: Meta’s annulment action against the EDPB’s Consent or Pay Opinion (Opinion 08/2024). Here are the pleas: “In support of the action, the applicant relies on seven pleas in law. 1. First plea in law, alleging that either Article�64(2) GDPR is illegal and inapplicable pursuant to Article�277�TFEU, or it requires a restrictive […]
Clearly the EDPB considers its “Consent or Pay” Opinion to cover “targeted questions requiring a swift answer”, as its minutes from the June plenary reveal that the EDPB members agreed that “Article 64(2) opinions are better suited for targeted questions requiring a swift answer, while guidelines are better suited for matters with a larger scope”. […]
Another Belgian DPA decision on how long to keep the e-mail address of an ex-employee alive. The Belgian DPA repeats its position that is now almost constant (but in cases that do not appear to have been appealed): block access to a mailbox on the day of departure, then kill the e-mail address within 3 […]
This is not an AIAct post. Let’s not forget that before 2 August 2026 (the date that matters to most companies re that Act), there are already many other rules that apply – and have applied for some time – to all kinds of AI systems. For instance, data protection rules (such as the GDPR […]
Some seem to suggest that “unavailability of IT system = security incident = personal data breach”. While data protection *authorities* regularly suggest unavailability is a breach, the main EU *law* on data protection, the GDPR, doesn’t say so. Definition of “personal data breach” in Art. 4(12) GDPR: “breach of security leading to the accidental or […]
Does the GDPR mean gender-neutral language is required? Today’s Opinion by Advocate General Szpunar challenges a common practice in certain languages, namely asking for title (“Madame” & “Monsieur” in French) for contract-related communications. Many organisations want the opening line of an e-mail to be personalised in the name of customer service (“Cher Monsieur XX”, “Ch�re […]
A complaint is just that – a complaint. It is not a decision, it is not authoritative. Yet complaints by well-known campaigners and NGOs are spread widely here and on other platforms, while decisions of lower courts (you know, with judges and their decisions that are actually part of the legal order) are claimed by […]