CJEU: Data breach ≠ poor measures (but you must prove it) and fear only can constitute non-material damage
How not to get sued by data subjects (se full write-up of case in C-340/21 post)
Dec 14, 2023
—
1 min read
You might also like
CJEU C-383/23 ILVA (GDPR fine) 13 Feb 2025
members
–
3 min read
When fining a controller in a corporate group, DPAs must base the maximum fine on the *group’s* total worldwide turnover from the previous business year. A crucial ruling for anyone in a company group – here's also text you can copy for an email to your Management/Board.
CJEU C-413/23 P EDPS v Single Resolution Board 6 Feb 2025 AG Opinion
members
–
1 min read
A much-anticipated case on the concept of personal data, but the AG only advices the CJEU to set aside the General Court’s ruling and send the case back to decide on the second plea (breach of good administration and fair procedure). We're still in the dark on several aspects.
CJEU C-492/23 Russmedia Digital and Inform Media Press 6 Feb 2025 AG Opinion
members
–
1 min read
AG Szpunar: Marketplace operators are processors for ad data (must protect it) and controllers for advertisers' data (must verify identity). Liability applies if you actively manage, modify or promote content.