Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
Under which circumstances does the GDPR consider scientific research compatible with existing purposes of personal data processing? Recent positions by regulators and legislators show it is still a hot topic – one with major implications for R&D globally. Recital 159 of the GDPR states that “the processing of personal data for scientific research purposes should […]
Some thoughts (+ & -) on the EDPB & EDPS’s joint opinion on the GDPR & ePrivacy Digital Omnibus, part 1: + The overall tone seems constructive – On the definition of personal data (PD), I don’t think quoting the Scania/SRB situation of information being “indirectly” PD for a disclosing party (§16) helps the EDPB/EDPS’s […]
Not just a good excuse to brush up my limited German! Yesterday’s dual-language event in Zurich was an excellent blend of discussions regarding the concept of “personal data” and the tensions with data sharing frameworks. The juxtaposition of my opening keynote (in English) on case law on the notion of personal data (+ Digital Omnibus […]
With the festive season upon us, I may be posting a little less and instead singing Christmas songs with the family. So let’s look back at 2025 and anticipate 2026, based on interactions with my LinkedIn articles & posts: – Pseudonymisation & the concept of “personal data” were significant in 2025. 4 of my top […]
As I was in a meeting when the European Data Protection Board opened registration for its pseudonymisation stakeholder event of 12 December 2025, I missed the short (approx. 1h) registration window and they placed me on a waiting list instead – a pity given my frequent interventions on the EU Court of Justice’s SRB judgment […]
Myth-busting time! This week, the EDPB published its Opinion on AI models & personal data, and then the Italian authority revealed it had fined OpenAI. But unlike what some are suggesting, the Italian decision *predates* the EDPB Opinion by a month. So let’s dispel a few myths surrounding that Opinion: – “Game changer”? The positions […]
Full analysis likely to come in the coming days, but some first thoughts on the EDPB’s “AI models & personal data” Opinion. In essence, the EDPB doesn’t exclude anything entirely but leaves it up to national supervisory authorities to make a call in cases they are handling – and while it doesn’t prohibit relying on […]
Digital Omnibus & GDPR: I like some things & dislike others about the proposal, but want to push back against claims that the “personal data” definition change will weaken protection. Of course some data protection supervisory authorities will say this (non-personal data generally falls outside of their remit), but is there truly weakening of protection […]
Privacy-friendly analytics: dismissal of complaint for lack of evidence of processing of personal data. Reasoning of the Belgian DPA’s Inspection Service, quoting SRB and Breyer & confirming our arguments: 1. Insufficient evidence of a GDPR infringement The complainant did not provide concrete evidence demonstrating that his personal data had actually been processed by the provider (or […]
Two victories before the Belgian DPA this week: dismissal of a complaint against a privacy-friendly analytics provider (re ads & content) due to lack of evidence of processing of personal data (Breyer + SRB having an impact), and one decision confirming that where data is shared pre-GDPR, the controller using it post-GDPR is the one […]
