CJEU C-413/23 P EDPS v SRB (Concept of personal data) 4 Sep 2025
CJEU on General Court: 1) ❌ Someone's comment = their personal data, no need to examine further 2) ✅ Pseudonymised data isn’t always personal data for everyone, in every case 3) ❌ Identifiability must be assessed when data is collected and from the controller’s perspective; Deloitte's not relevant.
Sep 7, 2025
—
3 min read
You might also like
CJEU C-655/23 Quirin Privatbank 4 Sep 2025
members
–
3 min read
GDPR offers no judicial remedy outside erasure requests to stop future unlawful processing, but Member States may. Non-material damage covers negative feelings – if proven. A controller’s fault doesn’t affect compensation, and a court order banning repeat GDPR violations can’t reduce or replace it.
CJEU T-553/23 Latombe v Commission 3 Sep 2025
members
–
2 min read
"The General Court dismisses the action for annulment" and the EU-US DPF remains valid! For now – the case will likely be appealed.
CJEU C-383/23 ILVA (GDPR fine) 13 Feb 2025
members
–
4 min read
2 Sep: 💸 ILVA fined €201k | When fining a controller in a corporate group, DPAs must base the maximum fine on the *group’s* total worldwide turnover from the prior business year. A crucial ruling for anyone in a company group – here's also text you can copy for an email to your Management/Board.