CJEU C-604/22 IAB Europe TC String 7 Mar 2024
[9 Jan: DPA must reassess] GDPR definitions are broad: information = personal data if someone can be identified using third-party data. Joint controllership doesn’t automatically cover further processing, but you are one if you set binding rules and jointly decide purposes and means.
Jan 23, 2026
—
6 min read
You might also like
CJEU C-526/24 Brillen Rottler 19 Mar 2026
members
–
2 min read
If a DSAR is made solely to engineer a compensation claim rather than to verify lawful processing, it can be refused as abusive – even if it's the first request.
CJEU C-413/23 P EDPS v SRB (Concept of personal data) 4 Sep 2025 – Case closed!
members
–
6 min read
Pseudonymised data isn’t always personal in every case to everyone – but measures must be effective. Comments are personal by nature – no need to assess content, purpose or effects. Whether a person can be identified must be assessed from the controller’s perspective, when collecting the data.
CJEU C-621/22 KNLTB (legitimate interests) 4 Oct 2024
members
–
3 min read
Under Article 6(1)(f) you can disclose personal data for a commercial interest if the processing is strictly necessary and not outweighed by the data subjects' interests, rights or freedoms. The interest doesn't have to be determined by law, but it must be lawful. And CJEU nudges consent again.