Can't find what you're looking for? Try the search bar!
Can GDPR administrative fines be imposed for infringements that are not the result of either intent or negligence? (e.g. excusable, non-negligent human error) The CJEU Advocate General Campos S�nchez-Bordona says “No”. Others have already reported on the consequences of the new Opinion in the Deutsche Wohnen case (C?807/21) from the perspective of whether an undertaking […]
Will data protection authorities be a top target for cybercriminals? Forced sharing of trade secrets is one of the consequences of yesterday’s CJEU judgment, in a way that in my view should prompt a serious question: how will organisations share those trade secrets with those supervisory authorities [SAs], and can the latter be trusted to […]
Newest Belgian DPA decision confirms that “data breach” is not always “GDPR infringement”, in a decision that (i) suggests good practices so that the data breach response does not itself become a GDPR infringement and (ii) echoes (without quoting) the CJEU’s cybersecurity judgment of 14 December 2023 (Natsionalna agentsia za prihodite). � Context: Further to […]
Yes, GenerativeAI is what people are talking about. Yes, it presents specific risks (notably re disinformation). But from an aigovernance and liability perspective, the risks associated with predictive/discriminative AI are just as relevant. In her speech today re the State of the European Union, Ursula von der Leyen said that we should “not underestimate the […]
Some seem to suggest that “unavailability of IT system = security incident = personal data breach”. While data protection *authorities* regularly suggest unavailability is a breach, the main EU *law* on data protection, the GDPR, doesn’t say so. Definition of “personal data breach” in Art. 4(12) GDPR: “breach of security leading to the accidental or […]
Practical checklist: good practices for vendor/supplier risk management inspired by GDPR, NIS2, Data Governance Act and DORA. The underlying question: what good practices do these EU laws highlight and transform into legal obligations in certain cases, and how can we combine them? This checklist is *not* a comprehensive list of best practices, but it should […]
Laws with cybersecurity requirements: time for the lawyer to wear a hoodie and for the CISO to put on a lawyer’s gown. [because we all know that’s how the other profession dresses 100% of the time] For years I have been stressing the need for cybersecurity and legal teams to work as one – and […]
Looking for good practices re AI security? The new ENISA report can help. It shows the need for a broad strategy that takes into account various risks (including legal ones) regarding not just your machine-learning algorithm or other tool but also the data sources themselves and the expected output. Bias, for instance, is not a […]
On the importance of knowing your data well: a recruiter just cold-contacted me about a position that would be perfect for “a data scientist such as yourself”. Hint: data scientist and data lawyer do not often mean the same thing* **. The GDPR and other data protection rules are there to ensure that if you […]
Chances are you’ve seen this and your first thought was positive. But these innovations also come with risks, and you should be mindful of the opportunities such innovations present for bad actors (in this case, car thieves) and the legal implications thereof. Does that mean you should stop innovating? No! But it means that a […]