CJEU C-40/17 Fashion ID 29 Jul 2019
You’re a (joint) controller if you use third-party tools on your website that share personal data with the provider – but only for parts where you (jointly) determine purposes and means. If you collect the data, you must inform and get consent, and each controller must pursue a legitimate interest.
Jun 17, 2025
—
4 min read
You might also like
CJEU C-541/24 Naltov 5 Jun 2025 (dismissed)
members
–
The CJEU dismissed the case because the referring court's questions didn't relate to a real legal dispute. Listing it here for completeness.
CJEU C-769/22 Commission v Hungary (Values of the EU) 5 Jun 2025 AG Opinion
members
–
1 min read
AG Ćapeta: Hungary violated EU law by introducing national legislation restricting or prohibiting access to LGBTI content – and the Court should also find a stand-alone breach of Article 2 TEU, which sets out the EU’s fundamental values. A case relevant for policymakers and Member States.
CJEU C-604/22 IAB Europe TC String 7 Mar 2024
members
–
7 min read
[Final 🇧🇪 ruling, articles] GDPR definitions are broad: information = personal data if someone can be identified using third-party data. Joint controllership doesn’t automatically cover further processing, but you are one if you set binding rules and jointly decide purposes and means.