CJEU C-200/23 Agentsia po vpisvaniyata 4 Oct 2024
Tag, you're it! Got personal data --> you're a controller and can't shift accountability to the data subject. Temporary loss of control (e.g. public disclosure) can lead to damage, but harm must be proven. Handwritten signatures = personal data.
Dec 28, 2024
—
6 min read
You might also like
CJEU C-526/24 Brillen Rottler 19 Mar 2026
members
–
2 min read
If a DSAR is made solely to engineer a compensation claim rather than to verify lawful processing, it can be refused as abusive – even if it's the first request.
CJEU C-413/23 P EDPS v SRB (Concept of personal data) 4 Sep 2025 – Case closed!
members
–
6 min read
Pseudonymised data isn’t always personal in every case to everyone – but measures must be effective. Comments are personal by nature – no need to assess content, purpose or effects. Whether a person can be identified must be assessed from the controller’s perspective, when collecting the data.
CJEU C-604/22 IAB Europe TC String 7 Mar 2024
members
–
6 min read
[9 Jan: DPA must reassess] GDPR definitions are broad: information = personal data if someone can be identified using third-party data. Joint controllership doesn’t automatically cover further processing, but you are one if you set binding rules and jointly decide purposes and means.