Can't find what you're looking for? Try the search bar!
Pour les francophones: I was given the opportunity to write an op-ed for the French journal Revue Politique on SRB and the Digital Omnibus, plus the newest EDPB & EDPS Joint Opinion on the topic. The result? “Rendre le RGPD réaliste ? Les autorités ne le souhaitent qu’à moitié”. I’m working on a translation into […]
I criticise them a lot for many things, notably their often dogmatic and not-so-pragmatic positions, but kudos to the European Data Protection Board for two things today: (i) they actually sent a reminder to participants for the “Political ads” stakeholder event of 27 March to ask if people wish to speak on particular topics or […]
Under which circumstances does the GDPR consider scientific research compatible with existing purposes of personal data processing? Recent positions by regulators and legislators show it is still a hot topic – one with major implications for R&D globally. Recital 159 of the GDPR states that “the processing of personal data for scientific research purposes should […]
Very glad to see the EU Court of Justice confirm that EDPB binding decisions are challengeable, like the Advocate General had suggested beforehand. I commented the AG Opinion at the time, applauding it for its clear position in the topic. The CJEU’s reasoning is very similar to that of the AG: – “[the EDPB’s binding […]
What to expect from the EDPB and EDPS on 10 February re the Digital Omnibus on GDPR and ePrivacy? Today I had the privilege of attending an event organised by The Lisbon Council with a very select group of representatives of companies, industry associations, BEUC, the Commission and the EDPB. We discussed the Digital Omnibus […]
When do contracts have to be provided in response to a data subject access request? And should a controller maintain a copy thereof to enable data subject requests? A new Belgian DPA decision deals with this issue, applying the EU Court of Justice’s CRIF judgment to the issue of bank account contracts. Article 15 GDPR […]
The Irish DPC’s guide on accessing data on behalf of someone else remains relevant but incomplete. (It dates back to 2021 and has just been republished, in case anyone thought it sounded familiar.) It touches upon a very difficult issue – and one less clear-cut than the Irish DPC suggests. Yes, there are good reasons […]
This does not surprise me – as I was explaining yesterday to two podcast hosts, synthetic data is great on paper but it does not help with accuracy or real-life outliers/divergent situations. It’s easy to claim that synthetic data is the best way to comply with data minimisation and that “you don’t really need all […]
How a simple sentence in your privacy notice can restrict your digital marketing: the Belgian DPA issued an injunction to adapt digital marketing practices for a fitness club that had sent marketing e-mails to a club member, including for non-sporting events. The case highlights a classic misalignment between documentation and marketing practices, as well as […]
IAB Europe & TCF case: Belgian Market Court confirms Belgian DPA went too far in seeking enforcement of full range of measures against IAB Europe. Pleased to see the judgment of the Market Court/MC of Wednesday 7 January 2026, which set aside the BDPA’s decision of January 2023 (through which it had validated IAB Europe’s […]