Key takeaways from the EDPB stakeholder session on AI and personal data

My thoughts on today’s EDPB stakeholder event on AI models & personal data: – The EDPB didn’t reveal anything, but the wording of the questions submitted suggests certain assumptions will underlie the upcoming Opinion. – We had interesting exchanges among stakeholders in Group C, and I heard that there were also lively discussions in the […]

Read Analysis →

Why calling the new Article 5(3) guidelines expansive is a massive understatement

They will cover many scenarios” – quite an understatement regarding the EDPB’s new guidelines on Art. 5(3) of the ePrivacy Directive (expanding its scope from cookies and the like to even IP addresses, URLs, pixels and more, through a broad interpretation of what “access” is). Before publishing an analysis of the “content” part of the […]

Read Analysis →

The official launch of the EDPB public consultation on ePrivacy tracking rules

It’s out – new EDPB consultation on guidelines re Art 5(3) ePrivacy Directive. Key section, will post additional thoughts later: “Article 5(3) ePD applies if: a. CRITERION A: the operations carried out relate to �information�. It should be noted that the term used is not �personal data�, but �information�. b. CRITERION B: the operations carried […]

Read Analysis →

Op-ed: AI training data = (non-)personal data? And is consent really relevant?

The European Data Protection Board is at it again: an urgent procedure has been launched to obtain clarification on “some of the core issues that arise in the context of processing for the purpose of developing and training an AI model”. The aim? To bring “some much needed clarity into this complex area”. Yet the […]

Read Analysis →

A counter-perspective on why pay or data frameworks deserve a fair legal review

Probably a very unpopular view here! Companies have recently been getting a lot of flak for implementing or thinking about a “Pay or Data” approach – with only one perspective seemingly presented in data protection discussions on LinkedIn over the past months. So here are some (personal) thoughts aimed at showing there is another side […]

Read Analysis →

An unofficial translation and breakdown of the new Belgian DPA cookie checklist

The Belgian Data Protection Authority just published a “cookie checklist” with its position on a number of issues regarding cookies. I’m attaching an unofficial machine translation (losing lots of its layout too), but here are some first thoughts: – Some of these topics might be subject to litigation, so while they may reflect the newest […]

Read Analysis →

A quick checklist ahead of the EDPB adoption of revised ePrivacy rules

Quick reminder ahead of next week’s adoption by the EDPB of its (revised?) ePrivacy guidelines – here are the links to my in-depth critique of the version that was published for public consultation: Part I (competence): https://lnkd.in/egwqt-mf Part II (content): https://lnkd.in/ehdihkSM Plus some of the feedback on those guidelines: – Submission on behalf of certain […]

Read Analysis →

Missed the discussion? Catch up on the intersection of GDPR, AI, and ePrivacy

For anyone who missed it… Data protection GDPR AI ePrivacy

Read Analysis →

Speaking with Max Schrems on the future of user consent networks

1.000 registered – and counting. The “Future of User Consent” webinar of 24 Sept., where I am speaking alongside Max Schrems of noyb.eu, Romain Gauthier of Didomi and Willy Mikalef of Bird & Bird looks set to have a broad range of attendees. On the agenda are some of the top data protection, GDPR, ePrivacy […]

Read Analysis →

Live observations from the CJEU hearing on complex data processing frameworks

Really interesting hearing this morning at the CJEU, with a few pointed questions from the judges. Always a privilege to present legal and technical explanations to the Court of Justice! gdpr data protection

Read Analysis →