CJEU C-621/22 KNLTB (legitimate interests)
UPDATED: Article 6(1)(f) allows personal data to be disclosed for a commercial interest if the processing is strictly necessary and not outweighed by the interests, rights or freedoms of the data subjects. The interest doesn't have to be determined by law, but it must be lawful.
Oct 29, 2024
—
3 min read
You might also like
CJEU C-446/21 Schrems (Communication of data to the general public)
members
–
5 min read
UPDATED: No big surprises, nor new big takeaways, but this ruling sparks questions around 'strictly necessary' and 'purpose'. Ruling: Facebook can't indiscriminately use personal data on or off their platform for personalised ads, without restricting the duration and type of data.
CJEU C-169/23 Masdi
members
–
3 min read
UPDATED: First interpretation of the Art. 14(5)(c) derogation! It applies to *all* data not collected from the data subject, including self-generated data. And a DPA can verify national law under Art. 14(5)(c) - but not include Art. 32 obligations under that. And beware of language differences!
CJEU C-17/22 HTB Neunte Immobilien Portfolio
members
–
5 min read
UPDATED: National case-law could be relevant under Article 6(1)(c) legal obligation. And while we get some further guidance on legitimate interest assessments, the CJEU creates some confusion around 'strictly necessary' again.