Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
Interesting study on where human dignity and data protection come together, worth the read. I’m not convinced by some parts, though, as there is too much room left for subjectivity in the way certain things are worded. The authors suggest 7 guiding principles, but of particular interest to me were their suggested 6 limits to […]
[This is a translation of an op-ed in French that was published in the French journal Revue Politique on SRB and the Digital Omnibus, plus the newest EDPB & EDPS Joint Opinion on the topic. The original in French can be found on the Revue Politique website. + The banner image is a jest – […]
What to expect from the EDPB and EDPS on 10 February re the Digital Omnibus on GDPR and ePrivacy? Today I had the privilege of attending an event organised by The Lisbon Council with a very select group of representatives of companies, industry associations, BEUC, the Commission and the EDPB. We discussed the Digital Omnibus […]
When do contracts have to be provided in response to a data subject access request? And should a controller maintain a copy thereof to enable data subject requests? A new Belgian DPA decision deals with this issue, applying the EU Court of Justice’s CRIF judgment to the issue of bank account contracts. Article 15 GDPR […]
The Irish DPC’s guide on accessing data on behalf of someone else remains relevant but incomplete. (It dates back to 2021 and has just been republished, in case anyone thought it sounded familiar.) It touches upon a very difficult issue – and one less clear-cut than the Irish DPC suggests. Yes, there are good reasons […]
This does not surprise me – as I was explaining yesterday to two podcast hosts, synthetic data is great on paper but it does not help with accuracy or real-life outliers/divergent situations. It’s easy to claim that synthetic data is the best way to comply with data minimisation and that “you don’t really need all […]
How a simple sentence in your privacy notice can restrict your digital marketing: the Belgian DPA issued an injunction to adapt digital marketing practices for a fitness club that had sent marketing e-mails to a club member, including for non-sporting events. The case highlights a classic misalignment between documentation and marketing practices, as well as […]
With the festive season upon us, I may be posting a little less and instead singing Christmas songs with the family. So let’s look back at 2025 and anticipate 2026, based on interactions with my LinkedIn articles & posts: – Pseudonymisation & the concept of “personal data” were significant in 2025. 4 of my top […]
Appeal against Belgian DPA decision: important findings on legitimate interest, reasonable expectations and (non-)necessity of verifications of prior lawfulness. In a judgment of yesterday, the Market Court (Brussels Court of Appeal) lifted a reprimand for a company that had used personal data for marketing purposes. The legitimate interest considerations will be of great interest to […]
Myth-busting time! This week, the EDPB published its Opinion on AI models & personal data, and then the Italian authority revealed it had fined OpenAI. But unlike what some are suggesting, the Italian decision *predates* the EDPB Opinion by a month. So let’s dispel a few myths surrounding that Opinion: – “Game changer”? The positions […]
