CJEU C-604/22 IAB Europe TC String 7 Mar 2024
GDPR definitions are broad; information = personal data if, with third-party data, someone can be identified. Joint controllership doesn’t automatically extend to further processing, but you’re one if you set binding rules on processing and jointly determine purposes and means.
Mar 18, 2024
—
6 min read
You might also like
CJEU C-383/23 ILVA (GDPR fine) 13 Feb 2025
members
–
3 min read
When fining a controller in a corporate group, DPAs must base the maximum fine on the *group’s* total worldwide turnover from the previous business year. A crucial ruling for anyone in a company group – here's also text you can copy for an email to your Management/Board.
CJEU C-413/23 P EDPS v Single Resolution Board 6 Feb 2025 AG Opinion
members
–
1 min read
A much-anticipated case on the concept of personal data, but the AG only advices the CJEU to set aside the General Court’s ruling and send the case back to decide on the second plea (breach of good administration and fair procedure). We're still in the dark on several aspects.
CJEU C-492/23 Russmedia Digital and Inform Media Press 6 Feb 2025 AG Opinion
members
–
1 min read
AG Szpunar: Marketplace operators are processors for ad data (must protect it) and controllers for advertisers' data (must verify identity). Liability applies if you actively manage, modify or promote content.