Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
First look at SRB, on what is “personal data” and the relative nature of the concept. This part is all about how to determine if information relates to an “identifiable” natural person. The EU Court of Justice stresses the importance, in the case of pseudonymisation, of technical and organisational measures (TOMs) “to ensure that the […]
In law, the choice of words matters, and a given interpretation can mean the difference between a behaviour being permitted or prohibited. When some recently claimed that the Cologne Higher Regional Court might have misinterpreted one of the European Union’s newer data-related acts, the Digital Markets Act (DMA for short), the challenge to the judges’ […]
While I disagree with his conclusions, do read the post of Damien Desfontaines re the BfDI’s public consultation on personal data in AI models. Pity that it ends on 31 August, with the EU Court of Justice’s SRB judgment coming out on 4 September. I hope the BfDI takes a relativistic approach to the notion […]
A months-old German court decision on Google Tag Manager has resurfaced here, with many claiming the GDPR applies to every use of GTM or similar tools. A bit of nuance may be useful: – First, that claim that the use of IP addresses and other identifiers = always processing of personal data? Let’s first wait […]
My takeaways from the 100+ comment discussion following my post on whether the Crowdstrike incident is a “personal data breach” under the GDPR: 1. There are clearly two camps on this. I didn’t expect this level of opposition between two visions of what is a personal data breach. 2. One camp adheres to the views […]
Does training of AI systems involve the processing of personal data, and is it permitted under the GDPR? These were the two fundamental questions that I have already looked into in two previous articles: On the date of that second article, the Cologne Higher Regional Court (the Oberlandesgericht Köln – the Cologne HRC) delivered a […]
One to watch. Based on the summary of the hearing, this looks like a continuation of the CNIL’s Orange decision and of the CJEU’s SwTL v eprimo case – if so, I fear we are going down a path of bad legal precedent after bad legal precedent. As I have previously commented, the eprimo judgment […]
Not impressed. PayorOK, Meta & DMA: EU Commission says paid service is not “equivalent” to ad-funded service. The reason? You need “access to an online payment service” [§91] + the user experience (UX) is different due to other access conditions. Basically, per the decision of the Commission (EC), a choice between “pay with your wallet, […]
Many myths and exaggerations in reactions to WhatsApp’s announcement re ads. From “everything I mention in chats is used for ads” (that’s not how digital advertising works, and Meta had even made it clear message content is never used) to “all your Instagram and Facebook data is used” (while the WhatsApp announcement suggests this only […]
That was fast – less than a week after a CJEU judgment stating that it may be necessary for a controller to reveal the identity of the persons (e.g. employees) who processed personal data (C-579/21), the Belgian DPA applies that reasoning (in a separate case from the one handled by the CJEU) and orders a […]
