Can't find what you're looking for? Try the search bar!
EDPB vs administrative law: Reading the EDPB’s Pseudonymisation Guidelines once more (for the public consultation), the question of “why?” keeps repeating in my mind. Why use certain wording, why publish the Guidelines now? The list of CJEU judgments the Guidelines contradict is long already (Breyer, Scania, IAB Europe), and now the Advocate General’s Opinion in […]
Belgian DPA drops a bomb on a complaint filed by noyb.eu: in Belgium at least, says the BDPA, in order for noyb to have a legal interest in filing a complaint on behalf of data subjects, those data subjects cannot have been working for noyb at the time. The case in question concerned cookies and […]
For anyone with an interest in ePrivacy, onlineadvertising, digital businesses or even computing in general, I highly recommend reading the comments that we had the privilege of working on with IAB Europe and national associations in relation to the EDPB’s proposed ePrivacy guidelines. Link to the IAB Europe press release: https://lnkd.in/ediZ4Cxq And here are comments […]
Lots to digest in the Belgian Data Protection Authority’s latest decision, regarding a large data broker. One of the most important parts is its paragraph 100, which inadvertently raises the question of whether non-compliance with a data source’s terms of use or licence agreement can render a processing unlawful. The context: the data broker included […]
Here is an English version of the questions referred yesterday to the CJEU on the right to erasure or “right to be forgotten” in a case about a request for removal from a baptism register – an interesting balance of fundamental rights. The case, an appeal against a decision by the Belgian Data Protection Authority […]
In case of a complaint before a supervisory authority, will a settlement to withdraw the complaint stop an investigation? The Belgian Data Protection Authority examined the issue in its newest decision: 1. Context and procedure: A data subject complaints before the BDPA because a (large) search engine provider (as controller) has rejected a delisting/erasure request […]
Now for a different “Consent or Pay” anecdote (not mine though!): a night club tells those trying to get in that they need to download an app and scan a code after registering. It later turns out the alternative was to pay 10�. Is this “Pay or OK” in relation to non-digital services? The context […]
Newest Belgian DPA decision confirms that “data breach” is not always “GDPR infringement”, in a decision that (i) suggests good practices so that the data breach response does not itself become a GDPR infringement and (ii) echoes (without quoting) the CJEU’s cybersecurity judgment of 14 December 2023 (Natsionalna agentsia za prihodite). � Context: Further to […]
What should you urgently do during the first two weeks of 2024? Respond to the European Data Protection Board’s public consultation on ePrivacy. Why? Every single interaction with information on a computer or information sent over the Internet will require a justification or consent, following the EDPB’s proposed guidelines on the technical scope of Art. […]
The Belgian Data Protection Authority has adopted a new decision that applies the principles on automated decision-making set out by the CJEU in its SCHUFA I decision of 7 December 2023. Some specific considerations: – This decision is a “prima facie” one, i.e. not yet a full decision on the merits, to order the controller […]