Can't find what you're looking for? Try the search bar!
Appeal against Belgian DPA decision: important findings on legitimate interest, reasonable expectations and (non-)necessity of verifications of prior lawfulness. In a judgment of yesterday, the Market Court (Brussels Court of Appeal) lifted a reprimand for a company that had used personal data for marketing purposes. The legitimate interest considerations will be of great interest to […]
Privacy-friendly analytics: dismissal of complaint for lack of evidence of processing of personal data. Reasoning of the Belgian DPA’s Inspection Service, quoting SRB and Breyer & confirming our arguments: 1. Insufficient evidence of a GDPR infringement The complainant did not provide concrete evidence demonstrating that his personal data had actually been processed by the provider (or […]
NIS2: Looking forward to giving a 2-day workshop with Chris A. De Vuyst from the Centre for Cybersecurity Belgium (= Belgian cybersecurity authority) next week, further to tremendous preparatory work by Chris and Val�ry Vander Geeten. [Thanks again Val�ry as well as the Data Protection Institute for thinking of me in this respect!] The Network […]
Two victories before the Belgian DPA this week: dismissal of a complaint against a privacy-friendly analytics provider (re ads & content) due to lack of evidence of processing of personal data (Breyer + SRB having an impact), and one decision confirming that where data is shared pre-GDPR, the controller using it post-GDPR is the one […]
Digital Omnibus & ePrivacy: good intentions but bad outcome. While I have praised the Commission’s attempt at GDPR-related pragmatism (though a good idea re special categories of data didn’t make it), I have remained silent on the ePrivacy front. There, the proposal is not good in my view. It would create an alternative to Art. […]
Do (re)watch our 53-minute civilised, proper debate on some of the key GDPR parts of the Digital Omnibus proposal! From the notion of “personal data” to special categories of data, AI development & training and even scientific research, a lot of ground covered from two perspectives. [I had a few awkward moments of the “unmute” […]
Really interesting insights from Greet Gysen from the EDPB at the Nordic Privacy and Innovation Summit in Stockholm. Part of the consequences of the “Helsinki statement” adopted by the European Data Protection Board are that the EDPB will be consulting stakeholders more in advance – this much we knew already. She also highlighted that the […]
Key points from (& thoughts on) draft GDPR Digital Omnibus: First, Art. 4(1) GDPR would be completed with an SRB-like statement (great news), plus a mitigation of abusive interpretation of the Scania judgment (also great news). Art. 4(15) on “data concerning health” would also finally be more specific, avoiding some of the more awkward and […]
Some thoughts on today’s EDPB “Pay or Consent” stakeholder event – in practice one about the future of GDPR enforcement, consent, adtech and even the future of the Internet: – At times, things got heated in our breakout room between two camps, typically privacy rights campaigners + contextual ad solution providers on the one hand […]
New Belgian Data Protection Authority decision on video surveillance: don’t do permanent surveillance of employees. Questions remain, but without more background (name of the stores, history of theft within the stores etc.) it’s difficult to assess whether the BDPA was right in its assessment. The decision mentions the fact that cameras were deployed in 6 […]