CJEU C-340/21 Natsionalna agentsia za prihodite (cybercrime)
Unauthorised disclosure or access doesn't equate to inadequate measures, but must be proven to prevent damages claims. National courts must assess your case concretely and cannot systematically rely on expert reports. Mere fear 😱 = non-material damages (but must be proven by the data subject).
Jan 8, 2024
—
7 min read
You might also like
CJEU C-252/21 Meta Platforms and Others (General terms of use of a social network) 4 July 2023
members
–
6 min read
Legal bases are interpreted stricter and while you might rely on legitimate interest for direct marketing, network security or product improvement, processing personal data must be *strictly* necessary (but is it correctly applied? 🤔)
CJEU C-621/22 KNLTB (legitimate interests)
members
–
3 min read
UPDATED: Article 6(1)(f) allows personal data to be disclosed for a commercial interest if the processing is strictly necessary and not outweighed by the interests, rights or freedoms of the data subjects. The interest doesn't have to be determined by law, but it must be lawful.
CJEU C-634/21 SCHUFA Holding (scoring)
members
–
4 min read
Credit scoring = Art. 22(1) 'automated individual decision-making' when a third party heavily relies on a probability value to form or end a contract with a data subject. 🚨 A ruling of "ground-breaking importance for AI-based decisions" according to the Hamburg DPA!