Can't find what you're looking for? Try the search bar!
Stunned to see that Global Privacy Control won’t work as a refusal mechanism under the GDPR / Digital Omnibus, as it doesn’t support active change notifications. Some context: While the GDPR contains a “data subject request forwarding” obligation regarding erasure, rectification & rectification requests, it doesn’t in relation to consent withdrawal (or objections). In the […]
Out with a bang, but with controversial positions? The latest fines of the Belgian DPA represent the last from Hielke Hijmans, the departing Director of the Litigation Chamber. The amounts are modest by international standards (86k, 120k & 176k EUR) but are still relatively high for the Litigation Chamber in its approach to GDPR enforcement. […]
Ask them where they got their legal degree”, someone recently exhorted people to do whenever someone made a link between Recital 4 of the GDPR and Article 16 of the EU Charter of Fundamental Rights, on the freedom to conduct business. Yet now the EU Court of Justice has confirmed for the second time that […]
Today’s CJEU judgment on press & fair compensation indirectly impacts the “Consent or Pay” & broader discussions on online advertising, through its teachings on the freedom to conduct business: any measure liable to have a sufficiently direct and significant effect on the freedom of the operators concerned to exercise a trade or profession constitutes a […]
I’ve always said we need a proper debate about key issues. Pity then to see how many one-sided panels there are at the upcoming CPDP conference in Brussels (often with panellists who criticise social media bubbles or deplore lack of diversity of opinion in other contexts). Diversity on panels is important, and perhaps we need […]
DMA & data: real risk of over-sharing of identifiable, personal search query data. The European Commission has launched a public consultation on the measures it intends to impose on Google for compliance with Article 6(11) of the Digital Markets Act (DMA) – a specific obligation to anonymise search query data and share it with other […]
Guilty pleasure: pleading alongside (!) the Belgian Data Protection Authority not just once but three times over the past few months. I’m used to being on the other side, but when a decision isn’t against your client but a third party, you might have the unusual opportunity to support the authority’s position in Court. A […]
What is “specific consent”? The EDPB’s acceptance of “broad consent” and “dynamic consent” in its new Guidelines is interesting, but its focus on (a limited view of) “scientific research” is problematic. According to those new Guidelines: In the field of scientific research, it is possible for controllers to rely on the consent of a data […]
Ursula von der Leyen just announced that the European age verification app is “technically ready”, touting the lack of data sharing, while the app’s website still describes its zero-knowledge proof implementation as “experimental” and as not having yet been peer-reviewed. Perhaps something needs updating by the European Commission? Many questions remain, because saying “no excuses […]
What is the target audience of the EDPB’s DPIA template? Most who *need* to carry out DPIAs more often have their own templates/tools since 5-10 years. And does it anticipate the Digital Omnibus? Only in part, with the biggest work yet to come. Some comments: 1. On the issue of DPIA requirement screening, its section […]