AG Szpunar (C-394/23 Mousse)
Advocate General Opinion: On the principles of data minimisation and lawfulness of processing—where the 🇫🇷 CNIL made a somewhat startling decision on what's 'necessary for the performance of a contract'! + remember to spell out your legitimate interest when you collect the data!
Aug 9, 2024
—
2 min read
You might also like
CJEU C-446/21 Schrems (Communication of data to the general public)
members
–
5 min read
UPDATED: No big surprises, nor new big takeaways, but this ruling sparks questions around 'strictly necessary' and 'purpose'. Ruling: Facebook can't indiscriminately use personal data on or off their platform for personalised ads, without restricting the duration and type of data.
CJEU C-169/23 Masdi
members
–
3 min read
UPDATED: First interpretation of the Art. 14(5)(c) derogation! It applies to *all* data not collected from the data subject, including self-generated data. And a DPA can verify national law under Art. 14(5)(c) - but not include Art. 32 obligations under that. And beware of language differences!
CJEU C-17/22 HTB Neunte Immobilien Portfolio
members
–
5 min read
UPDATED: National case-law could be relevant under Article 6(1)(c) legal obligation. And while we get some further guidance on legitimate interest assessments, the CJEU creates some confusion around 'strictly necessary' again.