CJEU C-65/23 K GmbH (Processing of employees’ personal data) 19 Dec 2024
While Article 88 allows for more specific national rules for processing personal data in the employment context, you still have to comply with Articles 5, 6 and 9 and can't lower the standard for or ignore the 'necessity' requirement.
Dec 22, 2024
—
2 min read
You might also like
CJEU C-526/24 Brillen Rottler 19 Mar 2026
members
–
2 min read
If a DSAR is made solely to engineer a compensation claim rather than to verify lawful processing, it can be refused as abusive – even if it's the first request.
CJEU C-413/23 P EDPS v SRB (Concept of personal data) 4 Sep 2025 – Case closed!
members
–
6 min read
Pseudonymised data isn’t always personal in every case to everyone – but measures must be effective. Comments are personal by nature – no need to assess content, purpose or effects. Whether a person can be identified must be assessed from the controller’s perspective, when collecting the data.
CJEU C-604/22 IAB Europe TC String 7 Mar 2024
members
–
6 min read
[9 Jan: DPA must reassess] GDPR definitions are broad: information = personal data if someone can be identified using third-party data. Joint controllership doesn’t automatically cover further processing, but you are one if you set binding rules and jointly decide purposes and means.