Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
SRB: Do potential cyber attacks matter when assessing whether pseudonymisation is sufficient to make personal data cease to be “personal” from the perspective of a recipient? Short answer: no, they shouldn’t. Why is that? In my extensive analysis of the SRB judgment and its practical implications ( https://lnkd.in/e2eNmGUP ), I did not write much about […]
Several posters seem to agree with the EDPB’s new ePrivacy Guidelines. “Of course every computer interaction is covered”. I disagree, but let’s imagine they are right. Isn’t it still problematic that *almost nothing is exempt from consent* nowadays in the eyes of most EDPB members? First, the basics. Under Art. 5(3) of the ePrivacy Directive […]
So, here’s the comparison between the EDPB’s new ePrivacy Guidelines and the version that was up for public consultation end of 2023. As you can see, not much has changed. The fundamental issues that affected the previous version (competence, overbroad interpretation that doesn’t match the actual meaning of words or the intention of the legislator, […]
Here’s the registration form for the EDPB’s stakeholder event on AI models: https://lnkd.in/enBa5dHq 500-character limit for an explanation of why your organisation should take part More on this in my in-depth article on AI models and GDPR: https://lnkd.in/eYXabSfs data protection privacy
How the GDPR interacts with AI models: my in-depth look at whether AI model training even involves the processing of “personal data”, and which legal grounds might be most appropriate even if we do consider that personal data is involved. With the European Data Protection Board’s “stakeholder” event registration opening tomorrow in relation to its […]
Significant news from the ICO re Meta: lower price than EU, and no “less personalised ads” offering… in the UK. The “Pay or OK” type of approach is alive and well over there (in this case: for Facebook & Instagram). Compared to the EU approach, it looks like the UK regulator has taken a pragmatic stance […]
Simplification and the Draghi report in relation to EU digital laws: what could/should be done? Some thoughts I shared at an event yesterday on the topic: 1. The laws themselves are not always bad. While I have argued for getting rid of the ePrivacy Directive altogether (by taking into account overlaps with the GDPR and […]
Good to read about the EDPB promoting pseudonymisation in Seoul, but let’s be honest: their guidelines on the topic need serious updating further to the CJEU’s SRB judgment. Yes, they do say the opposite of SRB: 22. Pseudonymised data, which could be attributed to a natural person by the use of additional information, is to […]
Fun day! After moderating a RAID panel with as panelists EDPB Chair Anu Talus, Luxembourg CNPD President Tine A. Larsen, Deputy Head of Data Protection Unit at the Commission’s DG Justice Karolina Mojzesowicz, MEP Brando Benifei and Gibson Dunn Partner Ahmed Baladi, I then was a speaker in a debate alongside Max Schrems of noyb.eu, […]
The ruling of the Court of Justice of the European Union (CJEU) of yesterday, 4 September 2025, in the EDPS v SRB case is significant – never mind the naysayers. It is the first time that the CJUE has clearly, explicitly said that if a dataset initially contains personal data but is pseudonymised, and that […]
