Can't find what you're looking for? Try the search bar!
What is automated decision-making? This is what the CJEU is asked in case C-634/21. In an Opinion delivered today, Advocate General Pikam�e proposed an answer. Art. 22 GDPR says that a data subject [DS] can only be subject to a decision based solely on automated processing that produces legal effects concerning him/her or �similarly significantly […]
Useful new decision by the Belgian Data Protection Authority on the limits of data subject access requests, in a case where a data subject complained that the response was (i) late and (ii) incomplete. (i) Late response: The response was late due to a long-term absence of the person normally managing data subject requests due […]
Getting some serious “You wouldn’t steal a car”* vibes from NOYB’s “Imagine having to pay for privacy in your own car” consent-or-pay allegory. I have been advising on the idea of “consent or pay” (or “pay or data”, “pay or OK” or however you wish to call it) for a few years now, and the […]
Which GDPR legal ground does a broadcaster or streaming platform need to publish audiovisual works featuring recognisable natural persons? That was the question examined by the Belgian DPA in its latest decision. The decision related to a kind of documentary, a “human interest” show/programme. The BDPA’s Litigation Chamber summarised the facts as follows (para. 2 […]
In its newest decision, the Belgian DPA takes a stance that will please both consumer rights organisations and anyone who likes to rely on the primacy of EU legislation (versus local national legislation), on an issue that would not have arisen if the Belgian legislator had stuck to the text of the GDPR. This all […]
The privacy discourse is often one-sided: regulators and campaigners are vocal (“fundamental rights violated”, “illegal consent”), and few want to push back in public (lawyers because they are not keen on voicing their opinion, businesses because they fear drawing attention to themselves) – even though the GDPR *allows* interferences with privacy and data protection rights […]
Fancy catching up on some of the issues regarding onlineadvertising, ePrivacy, the GDPR, data as a commodity, cookieless and consent? Listen to this podcast episode in which I presented a different angle on these topics (and more). privacy data protection
The linguistics” – that’s what I said was intriguing about the AG Opinion in a GDPR class action case (Meta v BVV, CJEU case C-757/22) when Global Data Review asked me for a quote. This case deals with Art. 80(2) GDPR, which allows EU Member States to adopt (if they wish) laws to permit (consumer […]
It’s finally open: public consultation by the European Commission on the GDPR. Privacy campaigners will be sure to respond – but will controllers & processors? This is your chance to submit comments on what works and what doesn’t. Whether you see weaknesses in the way in which the DPO role is structured (I know this […]
Interesting new CJEU judgment on “controllership” (but only limited considerations re “joint controllership”) and perhaps incidentally broadening the legal ground of “legal obligation” under the GDPR. The CJEU says that legal provisions can determine the purposes and means “at least implicitly”, which is not exactly what some authorities had considered previously. The context: the Moniteur […]