Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
Appeal against Belgian DPA decision: important findings on legitimate interest, reasonable expectations and (non-)necessity of verifications of prior lawfulness. In a judgment of yesterday, the Market Court (Brussels Court of Appeal) lifted a reprimand for a company that had used personal data for marketing purposes. The legitimate interest considerations will be of great interest to […]
Myth-busting time! This week, the EDPB published its Opinion on AI models & personal data, and then the Italian authority revealed it had fined OpenAI. But unlike what some are suggesting, the Italian decision *predates* the EDPB Opinion by a month. So let’s dispel a few myths surrounding that Opinion: – “Game changer”? The positions […]
Full analysis likely to come in the coming days, but some first thoughts on the EDPB’s “AI models & personal data” Opinion. In essence, the EDPB doesn’t exclude anything entirely but leaves it up to national supervisory authorities to make a call in cases they are handling – and while it doesn’t prohibit relying on […]
When I pointed out issues with the DMA-GDPR Guidelines & resulting risks for *all* controllers (not just gatekeepers), the EDPB’s Gwendal Le Grand said something to the effect of “Don’t just post about it, submit a response”. So here we go, a copy of the response submitted yesterday to the public consultation by the Commission […]
Two victories before the Belgian DPA this week: dismissal of a complaint against a privacy-friendly analytics provider (re ads & content) due to lack of evidence of processing of personal data (Breyer + SRB having an impact), and one decision confirming that where data is shared pre-GDPR, the controller using it post-GDPR is the one […]
Digital Omnibus & ePrivacy: good intentions but bad outcome. While I have praised the Commission’s attempt at GDPR-related pragmatism (though a good idea re special categories of data didn’t make it), I have remained silent on the ePrivacy front. There, the proposal is not good in my view. It would create an alternative to Art. […]
Do (re)watch our 53-minute civilised, proper debate on some of the key GDPR parts of the Digital Omnibus proposal! From the notion of “personal data” to special categories of data, AI development & training and even scientific research, a lot of ground covered from two perspectives. [I had a few awkward moments of the “unmute” […]
From fishing (instead of the GDPR) to a random “v” having appeared instead of a few words (a typo upon deletion?), the Commission’s GDPR & Data Act Omnibus feels like a rushed document. But what does it cover really? I’m focussing here on GDPR & ePrivacy: – Personal data definition: I like the idea of […]
On some topics our views may differ, but on the future of data protection rules, I find that Mark and I are pretty aligned. Dr M.R. (Mark) Leiser’s comments come from the observation that the law needs to *make sense* to be effective, and where the law isn’t the problem to start with but its […]
Privacy-enhancing technologies: “death by ePrivacy”? PETs were on the agenda of the IAPP DPC24 in Brussels this week, but few talked about the dangers to PETs caused by evolving positions of regulators. PETs (for ads with less data, content-focussed analytics, etc.) are being worked on by companies of all backgrounds and sizes and touted as […]