CJEU C-604/22 IAB Europe TC String 7 Mar 2024
[9 Jan: DPA must reassess] GDPR definitions are broad: information = personal data if someone can be identified using third-party data. Joint controllership doesn’t automatically cover further processing, but you are one if you set binding rules and jointly decide purposes and means.
Jan 13, 2026
—
7 min read
You might also like
CJEU C-422/24 Storstockholms Lokaltrafik 18 Dec 2025
members
–
3 min read
If public transport ticket inspectors process personal data using body cams, they must inform data subjects under Article 13 – not Article 14 – because the data's collected directly from the data subject.
CJEU C-492/23 Russmedia Digital and Inform Media Press 2 Dec 2025
members
–
5 min read
🧨 CJEU rules contrary to the AG: marketplace operators are *controllers* for ads data instead. This has major implications for marketplaces. (And what about DSA?) Also check out CJEU's recorded debrief with President Lenaerts.
CJEU C-654/23 Inteligo Media 13 Nov 2025
members
–
7 min read
If a user creates a free account and gets access to articles, newsletters and the option to pay for further content, this falls under Art. 13(1) and (2) ePD as 'sale of a service' and 'direct marketing', and you don't need a legal basis under Art. 6 GDPR, in line with Art. 95 GDPR.