Defining personal data: Danish and Polish authority insights

I received a few questions re the recent Danish & Polish positions on what is “personal data”. Here’s my take: 1. Summary of SRB, building on the CJEU’s Breyer/Scania/OLAF judgments As highlighted in my deep dive on the SRB judgment of the EU Court of Justice (CJEU), information that is pseudonymised (= “Pseu’dData”) by an […]

Read Analysis →

CNIL study: user perceptions of paid services and ads

Good & bad of the new CNIL study on perception of digital services and readiness to pay vs targeted advertising: 1. “Paid offers that allow them to better protect their personal data”: This line in the CNIL write-up shows part of the issue. Campaigners and some regulators view “pay or OK” approaches – i.e. “subscription […]

Read Analysis →

German Labour Court: balancing access rights and third-party interests

Interesting judgment from Germany regarding the scope of the right of access – and in particular the extent to which the rights of others (here: a person making a statement) are taken into account to exclude (or not) certain information from the scope of a response. In this particular case, the Labour Court found that […]

Read Analysis →

Political advertising and Digital Services Act critique

You won’t often find in-depth and reasoned articles on the Political Ads Regulation and Digital Services Act – this is a good one. I don’t agree with everything that is said, but it definitely deserves a wide audience for pointing out some of the issues caused by legislative ambitions detached from practical challenges of compliance.

Read Analysis →

Cookie audit strategies: expert insights

Great insights from Brian Clifton on the scope of cookie audits.

Read Analysis →

European Parliament approves GDPR procedural regulation

European Parliament votes in favour of GDPR additional procedural rules. I wrote a few months ago about the concerns I have with the GDPR Procedural Regulation (GPR), highlighting its potential for abuse regarding the scope of complaints – see input here: https://lnkd.in/ef527U3N Today, the European Parliament just voted in favour of this unfortunately flawed piece […]

Read Analysis →

Ad blockers, liability, and the future of web content

Ad blocker on? Aside from meaning “I want all content for free, no matter the cost for the provider”, did you check who decides which ads/scripts/cookies to allow or block, and if this is even legal? Several browser extensions (even some browsers) now prevent certain scripts/cookies/… from loading. This creates “dark traffic”, web traffic that […]

Read Analysis →

CEDPO Conference: DMA-GDPR Guidelines and consistency

GDPR & DMA at CEDPO: Another great discussion (and a mini bit of sparring too) with Gwendal Le Grand, together with Borja Martínez Corral and our moderator Natascha Gerlach. Readers know how often I get to write critically about the European Data Protection Board, and my first thoughts on their DMA-GDPR Guidelines drafted together with […]

Read Analysis →

SRB judgment and EU-U.S. transfers: CEDPO reflections

Nothing like a last minute extra – just stepped in to moderate a great discussion with the excellent Herke Kranenborg and Yann Padova after their two co-speakers were unfortunately prevented from attending the CEDPO Conference (no, it wasn’t meant to be a “manel”). Great exchanges on the pragmatism and complications of the SRB judgment of […]

Read Analysis →

Analyzing the critical agenda items for the EDPB forum on AI models

Going through the European Data Protection Board’s list of key topics for its stakeholder event on 5 November on AI models (thanks EDPB for confirming my participation!), I hope all attendees will have had the chance to carefully read the following materials (in their entirety): – My in-depth article on the two key topics, i.e. […]

Read Analysis →