Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
Is your DPO overworked? Do certain requests from authorities fall through the cracks? You could be in breach of the GDPR, says the Belgian DPA in its newest decision. In this particular case, a DPO was working three days per week, and was the only person to have access to a particular e-mail address to […]
Data protection “case law” suffers from a lack of appeals, which emboldens authorities to reuse a questionable position and make it seem like the law. Case in point? Today the Belgian DPA published yet another decision with a warning about keeping a mailbox active after a person has left a company, this time for just […]
Sending an e-mail to the wrong recipient by mistake is “potentially” an infringement of Articles 5 and 6 of the GDPR, says Belgian DPA, in a “prima facie” decision that may cause a stir. In proceedings before it, the Belgian DPA can decide whether to take a preliminary decision *before* any decision on the merits. […]
No, consent is *not* required for real-time bidding or targeted ads pursuant to the CJEU’s IAB Europe / TCF judgment. Why not? Because the paragraph where the CJEU suggests this is not part of the scope of the responses, so it’s an “obiter dictum” – that’s what it’s called when a court says something that […]
Summary + thoughts on the CJEU’s answer to the 2nd question (“is IAB Europe (joint) controller?”) in the�IAB Europe�& TCF case (C-604/22). [Again, I may be biased] – 55: Broad definition of “controller” in order to ensure an effective and complete protection of data subjects (C-210/16) 57: A natural or legal person who influence “for […]
Summary + thoughts on the CJEU’s answer to the 1st question (“is the TC String personal data?”) in the IAB Europe & TCF case (C-604/22). [I may be biased] – 33: CJEU data protection Directive case law is “in principle” also relevant for the GDPR, “given that this directive was withdrawn by and replaced by […]
Useful new decision by the Belgian Data Protection Authority on the limits of data subject access requests, in a case where a data subject complained that the response was (i) late and (ii) incomplete. (i) Late response: The response was late due to a long-term absence of the person normally managing data subject requests due […]
Which GDPR legal ground does a broadcaster or streaming platform need to publish audiovisual works featuring recognisable natural persons? That was the question examined by the Belgian DPA in its latest decision. The decision related to a kind of documentary, a “human interest” show/programme. The BDPA’s Litigation Chamber summarised the facts as follows (para. 2 […]
In its newest decision, the Belgian DPA takes a stance that will please both consumer rights organisations and anyone who likes to rely on the primacy of EU legislation (versus local national legislation), on an issue that would not have arisen if the Belgian legislator had stuck to the text of the GDPR. This all […]
The linguistics” – that’s what I said was intriguing about the AG Opinion in a GDPR class action case (Meta v BVV, CJEU case C-757/22) when Global Data Review asked me for a quote. This case deals with Art. 80(2) GDPR, which allows EU Member States to adopt (if they wish) laws to permit (consumer […]