Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
Understanding what is and is not personal data is fundamental to the proper interpretation and enforcement of the most famous data protection law, the GDPR. If no personal data are being processed, the GDPR simply does not apply. Some have considered that “personal data” is an absolute concept, i.e. information can be “in and of […]
Personalisation of digital audiovisual service + use of social media logins: Belgian DPA follows our arguments that contract can be a valid legal ground for personalised services and that terms of use of an online service can be a valid contract to that end, and it recognises that provided there is transparency & data minimisation, […]
After last week’s EU General Court judgment in the Irish DPC vs EDPB case, some claimed that this makes EDPB Guidelines and Opinions unassailable. (Yes, really.) That’s wrong. Let’s look at what the judgment means for the EDPB’s authority – and some issues it raises: 1/ Scope of EDPB binding decisions The judgment of the […]
If A pseudonymises personal data of person Z and sends it to B, is it personal data from B’s perspective, even if B is never allowed to get additional information [=AddInfo] allowing the identification of Z? The EDPB suggests “yes” in its latest guidance on pseudonymisation. Based on the definition of pseudonymisation under the GDPR, […]
The Bindl judgment is significant. Some positives for controllers/processors: (i) hypothetical, unproven data transfers are not transfers (“the mere risk of access to personal data by a third country cannot amount to a transfer of data” – para. 135);(ii) repeating the principle (for EU Institutions’ non-contractual liability, but similar ones exist in most countries) that […]
First thoughts on the CJEU’s Mousse judgment (“is Mr/Mrs necessary?”): (i) alternative apparently required to each personalisation; (ii) data minimisation is inherent to the assessment of (strict) necessity; (iii) the risk of discrimination has an impact on a legitimate interest assessment. I’ll focus for now on (i). The CJEU appears to require the offering of […]
Looking back + forwards, 4 big topics for me on LinkedIn in 2024 & likely still for 2025 are the following:– ePrivacy– “Consent or Pay”– AI & personal data– Cybersecurity The key ePrivacy topic was the European Data Protection Board’s guidelines on the technical scope of Art. 5(3) of the ePrivacy Directive – basically, “to […]
Here is an English version of the questions referred yesterday to the CJEU on the right to erasure or “right to be forgotten” in a case about a request for removal from a baptism register – an interesting balance of fundamental rights. The case, an appeal against a decision by the Belgian Data Protection Authority […]
The new French fine against Orange for notably displaying ads among a list of e-mails is a misstep, in my view. It builds upon a rare legal misstep of the CJEU, a case in which the highest EU judges introduced subjectivity in an ePrivacy provision that was built around objective criteria. I am speaking about […]
Newest Belgian DPA decision confirms that “data breach” is not always “GDPR infringement”, in a decision that (i) suggests good practices so that the data breach response does not itself become a GDPR infringement and (ii) echoes (without quoting) the CJEU’s cybersecurity judgment of 14 December 2023 (Natsionalna agentsia za prihodite). � Context: Further to […]
