Rie Aleksandra - DPO Hub (Page 13)

CJEU C-740/22 Endemol Shine Finland 7 Mar 2024

members – 3 min read

Orally disclosing personal data = 'processing' and potentially subject to the GDPR, and sharing criminal data orally (or in writing) isn't allowed to fulfill a public access request.

Mar 26, 2024

Denmark DPA says cookie walls are legal - and not

members – 2 min read

Update 26 Mar 2024: the DPA rejects reopening the cases, upholding that analytics/statistics aren't a necessary part of the alternative to paid access.

Mar 26, 2024

France DPA fines Amazon €32m for invasive employee monitoring

members – 3 min read

[22 March update: Amazon has appealed] The 🇫🇷 CNIL fined Amazon for excessively intrusive monitoring, using several illegal indicators and unsecure video surveillance software, without sufficiently informing employees and visitors.

Mar 22, 2024

🔥 Swedish Tax Agency greenlights (?) US cloud services

members – 2 min read

Following the EU-US DPF, the 🇸🇪 Tax Agency approves using Microsoft Office 365 and Teams. Despite emphasising that everyone must do their own assessments, I'd say this could strengthen your own cloud services assessments.

Mar 22, 2024

CJEU C-479/22 P OC v Commission 7 Mar 2024

members – 3 min read

The CJEU returned a case to the General Court as they disagreed on the latter's interpretation of the concept of personal data, which is to be interpreted broadly, such as a press release with several data points that could identify someone.

Mar 21, 2024

France: unemployment breach impacts 43m dating back 20 years

members – 1 min read

🇫🇷 Massive breach and what we can learn immediately from it: data minimisation, deletion, breach response plans - and communication that people actually understand!

Mar 20, 2024

CJEU C-604/22 IAB Europe TC String 7 Mar 2024

members – 6 min read

GDPR definitions are broad; information = personal data if, with third-party data, someone can be identified. Joint controllership doesn’t automatically extend to further processing, but you’re one if you set binding rules on processing and jointly determine purposes and means.

Mar 18, 2024

Leaked AI Act (and why I'm not reading it) - update

members – 2 min read

12 March: Updated with final text before the final vote scheduled for the 13 March plenary - with all 808 amendments. 🔥

Mar 12, 2024

4 new CJEU rulings

members – 1 min read

Two rulings on the concept of personal data, one stating that oral data = processing, and last one pertains to the Europol regulation. DPO Hub writeups coming!

Mar 11, 2024

🚨 CJEU confirms TC String as personal data and IAB Europe as joint controller

members – 1 min read

DPO Hub writeup coming soon!

Mar 7, 2024

EDPB CEF DPO report - a deep dive

members – 8 min read

🚨 My final writeup of the EDPB's CEF DPO report, which you shouldn't spend time on unless you have time to spare or are simply burning with curiosity! PS: We just released our Grumpy GDPR episode on this.

Feb 29, 2024

EDPB launches 2024 CEF action: right of access

members – 2 min read

31 DPAs (7 are 🇩🇪 state level) participate with the intention to assess how organisations deal with access requests *in practice*. Final report published!

Feb 28, 2024