CJEU: Data breach ≠ poor measures (but you must prove it) and fear only can constitute non-material damage
How not to get sued by data subjects (se full write-up of case in C-340/21 post)
Dec 14, 2023
—
1 min read
You might also like
CJEU C-65/23 K GmbH (Processing of employees’ personal data)
members
–
2 min read
While Article 88 allows for more specific national rules for processing personal data in the employment context, you still have to comply with Articles 5, 6 and 9 and can't lower the standard for or ignore the 'necessity' requirement.
CJEU C-446/21 Schrems (Communication of data to the general public)
members
–
5 min read
UPDATED: No big surprises, nor new big takeaways, but this ruling sparks questions around 'strictly necessary' and 'purpose'. Ruling: Facebook can't indiscriminately use personal data on or off their platform for personalised ads, without restricting the duration and type of data.
CJEU C-169/23 Masdi
members
–
3 min read
UPDATED: First interpretation of the Art. 14(5)(c) derogation! It applies to *all* data not collected from the data subject, including self-generated data. And a DPA can verify national law under Art. 14(5)(c) - but not include Art. 32 obligations under that. And beware of language differences!