Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
Cookies: EU Commission considering more pragmatism for ePrivacy – perhaps there is hope for useful legislative changes. The Commission is holding discussions next week to gather input from civil society and industry regarding the possibility of clarifying consent exemptions under Article 5(3) of the ePrivacy Directive. As readers may know, I have often written about […]
New Belgian Data Protection Authority decision: – Both the controller *and* the processor can be liable for not having a data processing agreement (DPA) in place – If you sign a DPA with “retroactivity clause” (i.e. foreseeing an earlier effective date than the signature date), that retroactivity clause does not have any effect from a […]
The ruling of the Court of Justice of the European Union (CJEU) of yesterday, 4 September 2025, in the EDPS v SRB case is significant – never mind the naysayers. It is the first time that the CJUE has clearly, explicitly said that if a dataset initially contains personal data but is pseudonymised, and that […]
Interestingly mixed reactions to the CJEU’s SRB ruling. Some: “nothing new!”. Others: “finally, relative nature of personal data confirmed!”. Why? The Court stated in unambiguous terms (paras. 77 + 86) that pseudonymised data can be non-personal data for a recipient if the technical and organisational measures of the pseudonymisation are effective and prevent access by […]
In law, the choice of words matters, and a given interpretation can mean the difference between a behaviour being permitted or prohibited. When some recently claimed that the Cologne Higher Regional Court might have misinterpreted one of the European Union’s newer data-related acts, the Digital Markets Act (DMA for short), the challenge to the judges’ […]
One month into the summer consultation process (thanks EU Commission & others!), a few thoughts on the ICO’s online advertising consultation. There is still one month to respond to the “call for views” from the UK Information Commissioner’s Office (soon “Information Commission”) regarding its approach to regulating online advertising: https://lnkd.in/evScibNJ I cannot stress enough the […]
A recent Amsterdam District Court judgment on whether ID cards can be requested for data subject identification raises interesting points re GDPR and data minimisation – and how controllers can reach a satisfactory level of identification. Context: – A controller (C) had 2 processes for verifying the identity of data subjects making a request: (i) […]
A months-old German court decision on Google Tag Manager has resurfaced here, with many claiming the GDPR applies to every use of GTM or similar tools. A bit of nuance may be useful: – First, that claim that the use of IP addresses and other identifiers = always processing of personal data? Let’s first wait […]
So the Digital Fairness Act consultation process begins, with lofty yet potentially flawed goals. The Commissions wishes to notably: – “[prevent] traders from using dark patterns and other unfair techniques that pressure, deceive and manipulate consumers online – “[address] problematic personalisation practices, including situations where consumer vulnerabilities are targeted for the purposes of personalised advertising […]
Does training of AI systems involve the processing of personal data, and is it permitted under the GDPR? These were the two fundamental questions that I have already looked into in two previous articles: On the date of that second article, the Cologne Higher Regional Court (the Oberlandesgericht Köln – the Cologne HRC) delivered a […]
