Possibly the most useless legal provision ever proposed? Re-reading it doesn’t diminish my surprise at the proposed Article 29a of the GDPR, suggested in the draft EU Council compromise, which would say the following: – “Controllers and processors may apply pseudonymisation to personal data in order to reduce the risks to the data subjects concerned […]
Guilty pleasure: pleading alongside (!) the Belgian Data Protection Authority not just once but three times over the past few months. I’m used to being on the other side, but when a decision isn’t against your client but a third party, you might have the unusual opportunity to support the authority’s position in Court. A […]
What does the EU Council’s draft Presidency compromise text on the GDPR & ePrivacy Digital Omnibus tell us? (1) The Council (for now) seems to recognise the need to clarify the concept of “personal data”. As a Recital 27a would provide: The identification of a natural person should be assessed *ex ante and in concreto*, […]
What is “specific consent”? The EDPB’s acceptance of “broad consent” and “dynamic consent” in its new Guidelines is interesting, but its focus on (a limited view of) “scientific research” is problematic. According to those new Guidelines: In the field of scientific research, it is possible for controllers to rely on the consent of a data […]
EDPB excluding R&D & product development from “scientific research” under the GDPR? “The results of the research are shared with other parties, for example by publication, or will be shared in the future, with due regard to legitimate limitations to access such as protection of intellectual property and trade secrets. (Newly published Guidelines 1/2026 on […]
Ursula von der Leyen just announced that the European age verification app is “technically ready”, touting the lack of data sharing, while the app’s website still describes its zero-knowledge proof implementation as “experimental” and as not having yet been peer-reviewed. Perhaps something needs updating by the European Commission? Many questions remain, because saying “no excuses […]
What is the target audience of the EDPB’s DPIA template? Most who *need* to carry out DPIAs more often have their own templates/tools since 5-10 years. And does it anticipate the Digital Omnibus? Only in part, with the biggest work yet to come. Some comments: 1. On the issue of DPIA requirement screening, its section […]
Australia’s first report on the social media ban has several key lessons for European countries contemplating a similar approach – and for the EU’s special panel on online child safety: – Based on a survey of 898 parents of children from 8 to 15: “Of the parents who reported their child had an account on […]
Recently, there have been a few strange comments on the ePrivacy aspects of the Digital Omnibus. I’ll tackle browser-level settings later, but today I want to focus on one issue: what are the ePrivacy Directive consequences of the new Art. 88a proposal? Article 5(3) of the ePrivacy Directive (ePD) is known as the “cookie rule” […]
EDPB stakeholder event write-up: From “no one wants political ads” to “political parties have to be able to reach their local audience”, today’s topic wasn’t very sexy (the “processing of personal data for the targeting or delivery of political advertisements”) but it still was a colourful event. No bar fight unlike some previous stakeholder events, […]