CJEU C-394/23 Mousse 9 Jan 2025
Processing customers' titles to personalise communication based on gender isn’t essential for performing a contract; nor is it for a legitimate interest if they weren't informed beforehand, the processing isn't strictly necessary, or the balancing test goes in their favor.
Jan 13, 2025
—
5 min read
You might also like
CJEU C-416/23 Österreichische Datenschutzbehörde (Excessive requests) 9 Jan 2025
members
–
4 min read
Art. 57(4) 'requests' include 'complaints' in 57(1)(f) and 77(1) and aren't 'excessive' due to volume alone; DPAs must show abuse, and can then charge a reasonable fee or refuse to act after considering all circumstances and ensuring their choice is justified.
CJEU C-21/23 Lindenapotheke 4 Oct 2024
members
–
5 min read
NB! Updated re: explicit consent. Competitors can take legal action against your GDPR violations if considered an illegal unfair commercial practice. Special category personal data threshold is lowered: ordering pharmacy-only medicinal products online is considered sharing health data.
CJEU EUDPR General Court T‑354/22 Bindl v Commission 8 Jan 2025
members
–
2 min read
The CJEU's General Court orders the European Commission to pay €400 in non-material damages for US transfers made in March 2022, when no adequacy decision or alternative safeguard was in place. Expect an appeal!