What is “political advertising” – or not? And when is it permitted? Scope creep beyond legislative intent is a real danger, a risk *everyone* should care about (even if you don’t think political ads concern you). The descriptively named “EU Regulation on Transparency and Targeting of Political Advertising” (“TTPA” for short) has two key aims: […]
Is Brillen-Rottler truly nothing new, as some appear to be suggesting? This new judgment of the EU Court of Justice confirms that data subject access requests made with a demonstrable aim of obtaining an advantage other than the gaining of awareness about the processing of personal data can be rejected as abusive. Given the number […]
Judgment analysis: when is a data subject request abusive? Today’s judgment of the EU Court of Justice is significant, though its scope cannot be misused either. These excerpts are essential reading for data protection practitioners: (EDIT: English version now available, quotes updated) Para 27: “It cannot therefore be ruled out […] that a […]
Moving past soundbites, what matters in today’s child online safety debate? A great event last week examined the EU Commission’s plans for protecting children online – and whether a social media “delay” or ban might make sense (or not). The Commission’s approach involves work by a Special Panel on child safety online. It features 21 […]
What evolutions await data protection litigation & GDPR fines/sanctions in Belgium? Since Hielke Hijmans announced he is stepping down from his role as Director of the Litigation Chamber of the Belgian Data Protection Authority, hearings in ongoing cases have been pushed back until an as of yet unspecified date. It’s unclear whether it is feasible […]
Some key findings from the responses to the DMA-GDPR Interplay consultation, now made public by the Commission & EDPB: – Quite a few civil society responses are copies of one another. Going through the submissions, you’ll see many with identical titles (“uncompromised privacy”, “ensuring data portability is practical and secure”, …) and content. Fortunately there […]
The clear repudiation of an “absolute” concept of personal data has thrown a sharp focus on the process of pseudonymisation in the world of data protection. Through its SRB judgment of 4 September 2025, the Court of Justice of the European Union (CJEU) made it clear that personal data that has undergone pseudonymisation can be […]
On the Criteo decision of the French Conseil d’État: beyond the question of whether online identifiers are sufficient for identification (see below), this is a typical case of a court keeping fines 100% intact after questioning the scope of processing. It’s not the first time I have seen this: a court says “this isn’t all […]
Why banning minors from accessing social media etc is a bad idea: (i) While I think it is unjustified fear-mongering, several consumer rights organisations and privacy researchers say it will lead to mandated surveillance of Internet usage, and that it will concentrate power among the platforms that are able to deploy age verification effectively. I […]
Scientific push against blocking of minors: since December, journalists from across Europe & Australia have asked me to comment on age-gating initiatives internationally to restrict minors’ access to online content, and at the CEDPO conference in 2025 I pushed back against a 5-person panel that was fully in favour of prohibiting minors’ access to social […]
