Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
I received a few questions re the recent Danish & Polish positions on what is “personal data”. Here’s my take: 1. Summary of SRB, building on the CJEU’s Breyer/Scania/OLAF judgments As highlighted in my deep dive on the SRB judgment of the EU Court of Justice (CJEU), information that is pseudonymised (= “Pseu’dData”) by an […]
Nothing like a last minute extra – just stepped in to moderate a great discussion with the excellent Herke Kranenborg and Yann Padova after their two co-speakers were unfortunately prevented from attending the CEDPO Conference (no, it wasn’t meant to be a “manel”). Great exchanges on the pragmatism and complications of the SRB judgment of […]
SRB: Do potential cyber attacks matter when assessing whether pseudonymisation is sufficient to make personal data cease to be “personal” from the perspective of a recipient? Short answer: no, they shouldn’t. Why is that? In my extensive analysis of the SRB judgment and its practical implications ( https://lnkd.in/e2eNmGUP ), I did not write much about […]
AI Act compliance is complex, so it’s good when tools can help you along the way. It was a privilege to develop such a tool for one client. There are plenty of amazing resources available to help organisations, such as (to name just a couple) a great tool by David Rosenthal of Visscher, fantastic infographics […]
Significant news from the ICO re Meta: lower price than EU, and no “less personalised ads” offering… in the UK. The “Pay or OK” type of approach is alive and well over there (in this case: for Facebook & Instagram). Compared to the EU approach, it looks like the UK regulator has taken a pragmatic stance […]
Invoking a new CJEU decision in ongoing proceedings shortly after it has come out? Super! Even better when it confirms what you have been saying for years. I actually had a strong disagreement with an eminent data protection lawyer nearly a decade ago on this particular topic, during a discussion on the nature of cookies […]
Good to read about the EDPB promoting pseudonymisation in Seoul, but let’s be honest: their guidelines on the topic need serious updating further to the CJEU’s SRB judgment. Yes, they do say the opposite of SRB: 22. Pseudonymised data, which could be attributed to a natural person by the use of additional information, is to […]
data protection podcast alert: SRB judgment implications, notably for the adtech / martech world & broader digital ecosystem. Topics: pseudonymisation, processor/controller, “singling out” versus “identification”, “outside GDPR” ≠ “free for all”, data clean rooms, and more. Listen to my discussion with Sergio Maldonado on his Masters of Privacy podcast – available through your favourite podcast […]
The ruling of the Court of Justice of the European Union (CJEU) of yesterday, 4 September 2025, in the EDPS v SRB case is significant – never mind the naysayers. It is the first time that the CJUE has clearly, explicitly said that if a dataset initially contains personal data but is pseudonymised, and that […]
Interestingly mixed reactions to the CJEU’s SRB ruling. Some: “nothing new!”. Others: “finally, relative nature of personal data confirmed!”. Why? The Court stated in unambiguous terms (paras. 77 + 86) that pseudonymised data can be non-personal data for a recipient if the technical and organisational measures of the pseudonymisation are effective and prevent access by […]
