Featured posts
Digital Omnibus
20-21 Oct: 🔥 Timeline update from noyb and Council agreed their position on GDPR and ePrivacy changes:
Events 2026
Next up: 21-23 Oct 🇩🇰 Copenhagen: ITechLaw 2026 European Conference I 22-23 Oct 🇳🇴 Sandefjord: Det årlige personvernkurset
Right of access (DSARs)
All things right of access: Article 15 elements table, a handy flowchart, key CJEU rulings and Rie's practical guide.
Data protection impact assessments – DPIAs
Key resources for data protection impact assessment – DPIAs. Latest: EDPB shares new DPIA template (it's excessive)...
DPO role key resources
Key DPO role resources: CJEU rulings, EDPB/WP29 Guidelines, DPA guidance and more.
Lawfulness: Consent
When can you rely on consent as a legal basis? Plus practical tips and key resources (GDPR, DPD, CFR, OECD, CJEU rulings and EDPB guidance).
Lawfulness: Legitimate interest
When can you rely on legitimate interest as a legal basis? Plus practical tips and key resources (GDPR, DPD, CFR, OECD, CJEU rulings and EDPB guidance).
The DPO role: Article 37(1)(b)
Breaking down Article 37(1)(b) key terms: 'core activities', 'regular', 'systematic', 'monitoring' and 'large scale'. And what should you do if you're still unsure whether you need to appoint a DPO? Appoint one voluntarily?
Denmark DPA says cookie walls are legal - and not
paid
–
2 min read
Update 26 Mar 2024: the DPA rejects reopening the cases, upholding that analytics/statistics aren't a necessary part of the alternative to paid access.
France DPA fines Amazon €32m for invasive employee monitoring
paid
–
3 min read
[22 March update: Amazon has appealed] The 🇫🇷 CNIL fined Amazon for excessively intrusive monitoring, using several illegal indicators and unsecure video surveillance software, without sufficiently informing employees and visitors.
🔥 Swedish Tax Agency greenlights (?) US cloud services
paid
–
2 min read
Following the EU-US DPF, the 🇸🇪 Tax Agency approves using Microsoft Office 365 and Teams. Despite emphasising that everyone must do their own assessments, I'd say this could strengthen your own cloud services assessments.
France: unemployment breach impacts 43m dating back 20 years
paid
–
1 min read
🇫🇷 Massive breach and what we can learn immediately from it: data minimisation, deletion, breach response plans - and communication that people actually understand!
Leaked AI Act (and why I'm not reading it) - update
paid
–
2 min read
12 March: Updated with final text before the final vote scheduled for the 13 March plenary - with all 808 amendments. 🔥
4 new CJEU rulings
paid
–
1 min read
Two rulings on the concept of personal data, one stating that oral data = processing, and last one pertains to the Europol regulation. DPO Hub writeups coming!
EDPB CEF DPO report - a deep dive
public
–
8 min read
🚨 My final writeup of the EDPB's CEF DPO report, which you shouldn't spend time on unless you have time to spare or are simply burning with curiosity! PS: We just released our Grumpy GDPR episode on this.
EDPB launches 2024 CEF action: right of access
paid
–
2 min read
31 DPAs (7 are 🇩🇪 state level) participate with the intention to assess how organisations deal with access requests *in practice*. Final report published!
Sweden MedHelp 1177 case
paid
–
8 min read
This case is not only a goldmine for DPOs in the Swedish healthcare sector (although particularly so), but DPOs in general, for assessing roles, legal bases and processor liability.
Sweden court upholds ~$1m fine: major health data leak and forwarding calls to 🇹🇭
paid
–
2 min read
🇸🇪 MedHelp must pay SEK 11,3 million (~$1m) for leaking 2,7 million health-related conversations (of 170 000 hours) online for several years and no legal basis for forwarding call to Thailand.
UK ICO Gameforge audit report
paid
–
3 min read
The ICO conducted a 'consentual audit' of Gameforge’s processing of 🇬🇧 children’s personal data under the AADC and data protection legislation.
Chief of Updates
