Stunned to notice, while re-reading an important Opinion by an Advocate General to advise a client, that when he says “According to the case-law of the Court of Justice [of the European Union]”, he is actually quoting non-binding regulatory opinions (not from the CJEU) and only one CJEU judgment that doesn’t even come close to […]
With the IAB Europe judgment and some others, you may have missed the CJEU’s appellate judgment in the OLAF case on the EUI GDPR – which (also) deals with the concept of “personal data”. Here is my take: First, the EUI GDPR – Regulation 2018/1725 – is extremely similar to the GDPR itself, also as […]
Want to know what is the impact of today’s IAB Europe / TCF judgment for your business? (A couple of adtech / martech players have already reached out for advice, so I figure it may be a question many have) If you can’t find the answer to your specific situation in the IAB Europe FAQ […]
Summary + thoughts on the CJEU’s answer to the 2nd question (“is IAB Europe (joint) controller?”) in the�IAB Europe�& TCF case (C-604/22). [Again, I may be biased] – 55: Broad definition of “controller” in order to ensure an effective and complete protection of data subjects (C-210/16) 57: A natural or legal person who influence “for […]
Summary + thoughts on the CJEU’s answer to the 1st question (“is the TC String personal data?”) in the IAB Europe & TCF case (C-604/22). [I may be biased] – 33: CJEU data protection Directive case law is “in principle” also relevant for the GDPR, “given that this directive was withdrawn by and replaced by […]
Breyer seemingly confirmed (means of identification are crucial), facts matter re establishment of joint controllership (it depends on whether there is actual influence and an own purpose), and joint controllership doesn’t necessarily extend to further processing (such as advertising) – we will be looking at the CJEU’s newest judgment (C-604/22 – IAB Europe / TCF […]
Another adtech discussion showing that not all information gleaned through server connections is personal data under the GDPR (or even the CCPA’s broad “personal information” concept). [Nor is it / should it be automatically covered by ePrivacy rules] In this case, it was about which data points are actually being used, by whom and who […]
What is automated decision-making? This is what the CJEU is asked in case C-634/21. In an Opinion delivered today, Advocate General Pikam�e proposed an answer. Art. 22 GDPR says that a data subject [DS] can only be subject to a decision based solely on automated processing that produces legal effects concerning him/her or �similarly significantly […]
Useful new decision by the Belgian Data Protection Authority on the limits of data subject access requests, in a case where a data subject complained that the response was (i) late and (ii) incomplete. (i) Late response: The response was late due to a long-term absence of the person normally managing data subject requests due […]
Getting some serious “You wouldn’t steal a car”* vibes from NOYB’s “Imagine having to pay for privacy in your own car” consent-or-pay allegory. I have been advising on the idea of “consent or pay” (or “pay or data”, “pay or OK” or however you wish to call it) for a few years now, and the […]