Featured posts
Digital Omnibus
20-21 Oct: 🔥 Timeline update from noyb and Council agreed their position on GDPR and ePrivacy changes:
Events 2026
Next up: 21-23 Oct 🇩🇰 Copenhagen: ITechLaw 2026 European Conference I 22-23 Oct 🇳🇴 Sandefjord: Det årlige personvernkurset
Right of access (DSARs)
All things right of access: Article 15 elements table, a handy flowchart, key CJEU rulings and Rie's practical guide.
Data protection impact assessments – DPIAs
Key resources for data protection impact assessment – DPIAs. Latest: EDPB shares new DPIA template (it's excessive)...
DPO role key resources
Key DPO role resources: CJEU rulings, EDPB/WP29 Guidelines, DPA guidance and more.
Lawfulness: Consent
When can you rely on consent as a legal basis? Plus practical tips and key resources (GDPR, DPD, CFR, OECD, CJEU rulings and EDPB guidance).
Lawfulness: Legitimate interest
When can you rely on legitimate interest as a legal basis? Plus practical tips and key resources (GDPR, DPD, CFR, OECD, CJEU rulings and EDPB guidance).
The DPO role: Article 37(1)(b)
Breaking down Article 37(1)(b) key terms: 'core activities', 'regular', 'systematic', 'monitoring' and 'large scale'. And what should you do if you're still unsure whether you need to appoint a DPO? Appoint one voluntarily?
Norway DPA warns site tracking investigations 🧐
paid
–
2 min read
⏰ Datatilsynet will soon start investigating non-compliant tracking technologies. If you use Meta Pixel or similar, it's time for website due diligence!
Lawfulness: Consent - examples
paid
–
34 min read
In need of consent inspiration or determine if your setup is (likely) compliant? Review this page for numerous examples!
CJEU: Data breach ≠ poor measures (but you must prove it) and fear only can constitute non-material damage
paid
–
1 min read
How not to get sued by data subjects (se full write-up of case in C-340/21 post)
AI Act reaches political agreement (post update)
paid
–
1 min read
[post update] The AI Act enters into force 20 days after publication in the Official Journal and becomes (mostly) applicable 2 years after this.
EDPB publishes Urgent Binding Decision regarding Meta
paid
–
1 min read
NB! This post was updated later with two key items: the actual EDPB decision and the DPC's Enforcement notice.
EDPB Plenary meeting 19-20 Sep 2023
paid
–
2 min read
EDPB September meeting minutes with interesting tidsbits!
CJEU (SCHUFA): On credit scoring, automated decision-making and courts' review of DPA decisions
paid
–
2 min read
Two CJEU rulings on SCHUFA Holding: Credit scoring = ADM when decisive for granting credit + national courts can fully review legally binding DPA decisions.
CJEU: Fines can only be imposed where there was intent or negligence
paid
–
1 min read
...and fines MUST be calculated on the *group's* total worldwide annual turnover!
Great resource: Legislative Train Schedule 🚝
paid
–
1 min read
Stop searching for "ePrivacy Regulation latest update", simply bookmark this great resource 🚝
Chief of Updates
