Breyer seemingly confirmed (means of identification are crucial), facts matter re establishment of joint controllership (it depends on whether there is actual influence and an own purpose), and joint controllership doesn’t necessarily extend to further processing (such as advertising) – we will be looking at the CJEU’s newest judgment (C-604/22 – IAB Europe / TCF case) in great detail, but clearly the message is: don’t trust simple soundbites (it’s not the victory privacy campaigners might claim).
EDIT: summary of Q1 (“Is the TC String personal data?”) and some thoughts here: https://lnkd.in/enTPn35W
Edit again: summary of Q2 (“Is IAB Europe a (joint) controller?”), with some thoughts too: https://lnkd.in/emSUFmQh
See also some excerpts from the judgment in my comments
Judgment (in French & Dutch for now):
data protection privacy gdpr
Did this analysis get you thinking? Reach out!
DataLaws.net is entirely open-access, and instead of getting your data in exchange for this content, how about another trade? If this commentary saved you research time or sparked an idea, feel free to invite me over for tea, chai or a hot chocolate next time you are around Brussels or Antwerp - or invite me over to your offices for a chat!
Get in touch ↗ Let's connect on LinkedIn ↗