key definitions - DPO Hub (Page 2)

CJEU C-582/14 Breyer (dynamic IP addresses) 19 Oct 2016

members – 2 min read

The CJEU held that not only static IP addresses (ref. Scarlet) are protected personal data under data protection law, but also dynamic ones, and that national laws can't restrict interest which are legitimate under EU law.

Feb 11, 2024

CJEU C-70/10 Scarlet Extended (static IP addresses) 24 Nov 2011

members – 1 min read

In a case on copyright infringement, the CJEU stated that IP addresses are protected personal data because they allow data subjects to be precisely identified.

Feb 8, 2024

CJEU C-231/22 Belgian State (Data processed by an official journal) 11 Jan 2024

members – 3 min read

National law can implicitly determine controllership, including for an official journal that only publishes data it receives, even when it doesn't have a legal personality on its own. (But note my comment on this.)

Jan 16, 2024

CJEU C‑683/21 Nacionalinis visuomenės sveikatos centras 5 Dec 2023

members – 4 min read

The definition of 'controller' is broad and you're liable for all processing, done directly or by others on your behalf, including processors. Joint controllership is determined by facts, not contracts. Know your role(s)!

Jan 6, 2024

CJEU C-807/21 Deutsche Wohnen 5 Dec 2023

members – 3 min read

The definition of 'controller' is broad and includes legal persons, who are liable for any violations committed by any person in their business who act on their behalf. DPAs must demonstrate that you acted with intent or neglect to fine you and must base the max amount on the group's total revenue.

Jan 5, 2024

CJEU C-319/22 Gesamtverband Autoteile-Handel (Access to vehicle information) (VIN, Scania) 9 Nov 2023

members – 3 min read

A vehicle identification number (VIN) is not personal data in nature, but may be(come) so depending on the context, even if you cannot identify someone directly yourself from it.

Nov 16, 2023