Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
Are Guidelines of the European Data Protection Board “challengeable acts”, and could you attack them before the General Court of the EU? What about Art. 64 GDPR Opinions of the EDPB? The Advocate General’s Opinion in the WhatsApp v EDPB case (re EDPB Binding Decisions) suggests that the answer could be “yes” regarding those Art. […]
A step towards EDPB accountability? Advocate General sides with WhatsApp in CJEU case on whether EDPB binding decisions can be challenged directly. Sure, it’s “just” an AG Opinion, but it’s well researched and argued. What it says: 1. What is a challengeable act? The AG says that some circumstances are *irrelevant* to assessing whether an […]
Readers will know that some of the EDPB’s positions in its pseudonymisation guidelines are unconvincing or absolutist by nature. Now, IAB Europe and other associations in the digital ecosystem have submitted their feedback on these guidelines, and the feedback shows the acute need for a review of those guidelines. This response is well worth the […]
Belgian DPA’s direct marketing recommendation: great first attempt, but questionable positions included. First thoughts: [The BDPA has published a new direct marketing recommendation (replacing one of 5 years ago), and it’s a very good document. A public consultation is open until 10 May, and I hope some comments will deal with its shortcomings.] – Claim […]
IAB Europe’s letter to the EDPB on “Pay or Consent” is out – with considerations relating to the GDPR and broader data protection rules, fundamental rights, personal data as “consideration” for a contract (co-signatories: Alliance Digitale, IAB Italia & IAB Spain) Key points: – �The assessment of �Consent or Pay� models must remain coherent with […]
Time to talk about what can be done to improve the “cookie” rule! In Part I of this series on the opportunities and difficulties of today’s ePrivacy regime, I discussed the underappreciated and seemingly-easy-but-really-complex world of the anti-spam rule, Article 13 of the ePrivacy Directive (or ePD). This Part II is about a provision that […]
EDPB vs administrative law: Reading the EDPB’s Pseudonymisation Guidelines once more (for the public consultation), the question of “why?” keeps repeating in my mind. Why use certain wording, why publish the Guidelines now? The list of CJEU judgments the Guidelines contradict is long already (Breyer, Scania, IAB Europe), and now the Advocate General’s Opinion in […]
Yesterday, I had the pleasure of giving a 5h presentation on the latest case law on the GDPR and other data protection legislation at various levels (Belgium, other EU countries, the Court of Justice and the European Court of Human Rights) to Data Protection Officers from a broad range of organisations and companies. The past […]
After last week’s EU General Court judgment in the Irish DPC vs EDPB case, some claimed that this makes EDPB Guidelines and Opinions unassailable. (Yes, really.) That’s wrong. Let’s look at what the judgment means for the EDPB’s authority – and some issues it raises: 1/ Scope of EDPB binding decisions The judgment of the […]
Contextual ads > targeted ads”? Often this approach refers to one Dutch broadcaster’s (misinterpreted) story and mistaken assumptions that “contextual” means “no data”. Now for the opposite story from Belgium: the news website Tweakers tried an allegedly “tracking-free” contextual ad system since May 2022 but announced yesterday it was not economically viable and would be […]
