CJEU - DPO Hub

CJEU C-470/21 La Quadrature du Net and Others

members – 1 min read

CJEU holds that Member States may force ISPs to retain IP addresses, in a general and indiscriminate manner, to combate criminal offences in general. 🤨

Apr 30, 2024

CJEU C-670/22 EncroChat & CJEU C-178/22 Bolzano

members – 1 min read

👮 CJEU on access to phone records related to crime + clarifies conditions for transmitting and using evidence in criminal cases with a cross-border dimension.

Apr 30, 2024

AG Szpunar on health data

members – 1 min read

Advocate General Opinion: Customer data from online orders for non-prescription pharmacy medicines isn't considered 'data concerning health'.

Apr 28, 2024

CJEU C-129/21 Proximus (subscribers' consent)

members – 3 min read

Consent is required for listing subscribers' details in publicly available directories. If you obtain it, including on behalf of other controllers, a data subject can withdraw it (which equates to an erasure request) from any of these, and every controller may be required to notify the others.

Apr 28, 2024

CJEU C‑741/21 juris

members – 5 min read

Breaching GDPR rights doesn't automatically result in non-material damage, and controllers can't (ever?) escape liability simply because someone under their authority didn't follow instructions.

Apr 26, 2024

AG Rantos on 'manifestly public'

members – 2 min read

Advocate General Opinion: Making a public statement about your sexual orientation is making it 'manifestly public' but doesn't mean it can be used for personalised ads.

Apr 25, 2024

New CJEU ruling + AG opinion DPAs might dread

members – 1 min read

Breaching GDPR rights doesn't automatically result in non-material damage, and controllers can't (ever?) escape liability simply because someone under their authority didn't follow instructions, and an AG Opinion may disrupt DPAs workload. 😬

Apr 11, 2024

CJEU C-101/01 Bodil Lindqvist

members – 4 min read

A key (Directive 95/46/EC) ruling broadly interpreting key definitions (personal and health data, processing) and narrowly applied exceptions, but found that simply putting a website online doesn't necessarily result in transfers.

Apr 9, 2024

CJEU C-46/23 Ujpesti Polgarmesteri Hivatal

members – 1 min read

DPAs can order controllers to delete unlawfully processed data without a prior request from a data subject, and regardless of where the data came from (the data subject or elsewhere).

Mar 26, 2024

CJEU C-740/22 Endemol Shine Finland

members – 3 min read

The CJEU held that orally disclosing personal data is 'processing' and potentially subject to the GDPR + sharing criminal data orally (or in writing) is not allowed to fulfill a public access request.

Mar 26, 2024

CJEU C-479/22 P OC v Commission

members – 3 min read

The CJEU returned a case to the General Court as they disagreed on the latter's interpretation of the concept of personal data—which is to be interpreted broadly—such as a press release with several data points that could identify someone.

Mar 21, 2024

CJEU C-604/22 IAB Europe TC String

members – 6 min read

IAB Europe is a joint controller and because their 'TC String' contains data about an identifiable user, it's personal data.

Mar 18, 2024