CJEU C-65/23 K GmbH (Processing of employees’ personal data)
While Article 88 allows for more specific national rules for processing personal data in the employment context, you still have to comply with Articles 5, 6 and 9 and can't lower the standard for or ignore the 'necessity' requirement.
Dec 22, 2024
—
2 min read
You might also like
CJEU C-446/21 Schrems (Communication of data to the general public)
members
–
5 min read
UPDATED: No big surprises, nor new big takeaways, but this ruling sparks questions around 'strictly necessary' and 'purpose'. Ruling: Facebook can't indiscriminately use personal data on or off their platform for personalised ads, without restricting the duration and type of data.
CJEU C-169/23 Masdi
members
–
3 min read
UPDATED: First interpretation of the Art. 14(5)(c) derogation! It applies to *all* data not collected from the data subject, including self-generated data. And a DPA can verify national law under Art. 14(5)(c) - but not include Art. 32 obligations under that. And beware of language differences!
CJEU C-17/22 HTB Neunte Immobilien Portfolio
members
–
5 min read
UPDATED: National case-law could be relevant under Article 6(1)(c) legal obligation. And while we get some further guidance on legitimate interest assessments, the CJEU creates some confusion around 'strictly necessary' again.