Can't find what you're looking for? Try the search bar or refine your parameters using the Frameworks & Concepts button above.
With the IAB Europe judgment and some others, you may have missed the CJEU’s appellate judgment in the OLAF case on the EUI GDPR – which (also) deals with the concept of “personal data”. Here is my take: First, the EUI GDPR – Regulation 2018/1725 – is extremely similar to the GDPR itself, also as […]
Want to know what is the impact of today’s IAB Europe / TCF judgment for your business? (A couple of adtech / martech players have already reached out for advice, so I figure it may be a question many have) If you can’t find the answer to your specific situation in the IAB Europe FAQ […]
Summary + thoughts on the CJEU’s answer to the 2nd question (“is IAB Europe (joint) controller?”) in the�IAB Europe�& TCF case (C-604/22). [Again, I may be biased] – 55: Broad definition of “controller” in order to ensure an effective and complete protection of data subjects (C-210/16) 57: A natural or legal person who influence “for […]
Summary + thoughts on the CJEU’s answer to the 1st question (“is the TC String personal data?”) in the IAB Europe & TCF case (C-604/22). [I may be biased] – 33: CJEU data protection Directive case law is “in principle” also relevant for the GDPR, “given that this directive was withdrawn by and replaced by […]
Breyer seemingly confirmed (means of identification are crucial), facts matter re establishment of joint controllership (it depends on whether there is actual influence and an own purpose), and joint controllership doesn’t necessarily extend to further processing (such as advertising) – we will be looking at the CJEU’s newest judgment (C-604/22 – IAB Europe / TCF […]
What is automated decision-making? This is what the CJEU is asked in case C-634/21. In an Opinion delivered today, Advocate General Pikam�e proposed an answer. Art. 22 GDPR says that a data subject [DS] can only be subject to a decision based solely on automated processing that produces legal effects concerning him/her or �similarly significantly […]
The linguistics” – that’s what I said was intriguing about the AG Opinion in a GDPR class action case (Meta v BVV, CJEU case C-757/22) when Global Data Review asked me for a quote. This case deals with Art. 80(2) GDPR, which allows EU Member States to adopt (if they wish) laws to permit (consumer […]
Reading through the CNIL’s new decision against Yahoo on cookies brings back to mind a question that has stuck with me for well over a decade: what is the exact reasoning that has led many EU-based authorities to say that advertising cookies/etc. are not strictly necessary for the provision of a service, and why does […]
Interesting new CJEU judgment on “controllership” (but only limited considerations re “joint controllership”) and perhaps incidentally broadening the legal ground of “legal obligation” under the GDPR. The CJEU says that legal provisions can determine the purposes and means “at least implicitly”, which is not exactly what some authorities had considered previously. The context: the Moniteur […]
The relative nature of “personal data” strikes again (or does it?). In today’s judgment in C-319/22 (Scania), the CJEU has seemingly confirmed that whether information is “personal data” or not depends on the entity/person processing it, like the General Court had done in other cases. This case asks whether a vehicle identification number (VIN) is […]
