special category

CJEU C-252/21 Meta Platforms and Others (General terms of use of a social network) 4 July 2023

members – 6 min read

Legal bases are interpreted stricter and while you might rely on legitimate interest for direct marketing, network security or product improvement, processing personal data must be *strictly* necessary (but is it correctly applied? 🤔)

Nov 13, 2024

CJEU C-446/21 Schrems (communication of data to the general public)

members – 3 min read

Facebook (and similar platforms) can't use all personal data obtained for targeted ads, without restriction as to time and distinction as to type of data.

Oct 4, 2024

CJEU C-21/23 Lindenapotheke

members – 2 min read

The CJEU rules against the Advocate General's Opinion, concluding that any medicinal product you order, prescription or not, is health data and requires your explicit consent. 🤯

Oct 4, 2024

CJEU C-115/22 NADA and Others

members – 2 min read

Controversial AG Opinion concluding that sports are outside GDPR's scope, with odd logic on Art. 9, stays unclear as the CJEU finds the referring body lacks the needed independence to be a 'court or tribunal', making their preliminary ruling request inadmissible. 🙄

May 10, 2024

CJEU C-101/01 Bodil Lindqvist

members – 4 min read

A key (Directive 95/46/EC) ruling broadly interpreting key definitions (personal and health data, processing) and narrowly applied exceptions, but found that simply putting a website online doesn't necessarily result in transfers.

Apr 9, 2024

Sweden MedHelp 1177 case

members – 8 min read

This case is not only a goldmine for DPOs in the Swedish healthcare sector (although particularly so), but DPOs in general, for assessing roles, legal bases and processor liability.

Feb 22, 2024