Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
This is a big one – the Polish Supreme Administrative Court confirms that cookies & IP addresses aren’t always personal data (even in case of use of Google Analytics), and the burden of proof that they are in specific circumstances rests on the national authority, not the controller. It’s another good application of the EU […]
I received a few questions re the recent Danish & Polish positions on what is “personal data”. Here’s my take: 1. Summary of SRB, building on the CJEU’s Breyer/Scania/OLAF judgments As highlighted in my deep dive on the SRB judgment of the EU Court of Justice (CJEU), information that is pseudonymised (= “Pseu’dData”) by an […]
SRB: Do potential cyber attacks matter when assessing whether pseudonymisation is sufficient to make personal data cease to be “personal” from the perspective of a recipient? Short answer: no, they shouldn’t. Why is that? In my extensive analysis of the SRB judgment and its practical implications ( https://lnkd.in/e2eNmGUP ), I did not write much about […]
Significant news from the ICO re Meta: lower price than EU, and no “less personalised ads” offering… in the UK. The “Pay or OK” type of approach is alive and well over there (in this case: for Facebook & Instagram). Compared to the EU approach, it looks like the UK regulator has taken a pragmatic stance […]
Invoking a new CJEU decision in ongoing proceedings shortly after it has come out? Super! Even better when it confirms what you have been saying for years. I actually had a strong disagreement with an eminent data protection lawyer nearly a decade ago on this particular topic, during a discussion on the nature of cookies […]
Good to read about the EDPB promoting pseudonymisation in Seoul, but let’s be honest: their guidelines on the topic need serious updating further to the CJEU’s SRB judgment. Yes, they do say the opposite of SRB: 22. Pseudonymised data, which could be attributed to a natural person by the use of additional information, is to […]
The ruling of the Court of Justice of the European Union (CJEU) of yesterday, 4 September 2025, in the EDPS v SRB case is significant – never mind the naysayers. It is the first time that the CJUE has clearly, explicitly said that if a dataset initially contains personal data but is pseudonymised, and that […]
Interestingly mixed reactions to the CJEU’s SRB ruling. Some: “nothing new!”. Others: “finally, relative nature of personal data confirmed!”. Why? The Court stated in unambiguous terms (paras. 77 + 86) that pseudonymised data can be non-personal data for a recipient if the technical and organisational measures of the pseudonymisation are effective and prevent access by […]
First look at SRB, on what is “personal data” and the relative nature of the concept. This part is all about how to determine if information relates to an “identifiable” natural person. The EU Court of Justice stresses the importance, in the case of pseudonymisation, of technical and organisational measures (TOMs) “to ensure that the […]
In law, the choice of words matters, and a given interpretation can mean the difference between a behaviour being permitted or prohibited. When some recently claimed that the Cologne Higher Regional Court might have misinterpreted one of the European Union’s newer data-related acts, the Digital Markets Act (DMA for short), the challenge to the judges’ […]
