On March 7, 2024, the Court of Justice of the European Union issued its judgment in the case of Endemol Shine (Case C‑604/22). In this case, the CJEU was called upon to assess whether oral disclosure of information could be considered as processing of personal data under the GDPR and to clarify the relationship between personal data protection and public access to documents.
Continue Reading CJEU Rules That Oral Disclosure May Be Considered as Processing of Personal Data Under the GDPR
Court of Justice of the European Union
CJEU Rules on IAB Europe’s Transparency and Consent Framework
On March 7, 2024, the Court of Justice of the European Union issued its judgment in the case of IAB Europe (Case C‑604/22). In this judgment, the CJEU assessed the role of IAB Europe in the processing operations associated with its Transparency and Consent Framework and further developed CJEU case law on the concept of personal data under the GDPR.
Continue Reading CJEU Rules on IAB Europe’s Transparency and Consent Framework
CNIL Opens Consultation on Transfer Impact Assessment Guide
On January 8, 2024, the French Data Protection Authority opened a consultation on its draft guidance for the use of transfer impact assessments. …
Continue Reading CNIL Opens Consultation on Transfer Impact Assessment Guide
CJEU Rules on Processing of Sensitive Data and Compensation Under the GDPR
On December 21, 2023, the Court of Justice of the European Union (“CJEU”) issued its judgment in the case of Krankenversicherung Nordrhein (C-667/21) in which it clarified, among other things, the rules for processing special categories of personal data (hereafter “sensitive personal data”) under Article 9 of the EU General Data Protection Regulation (“GDPR”) and the nature of the compensation owed for damages under Article 82 of the GDPR.Continue Reading CJEU Rules on Processing of Sensitive Data and Compensation Under the GDPR
CJEU Rules That Fear May Constitute Damage Under the GDPR
On December 14, 2023, the Court of Justice of the European Union issued its judgment in the case of VB v. Natsionalna agentsia za prihodite (C‑340/21), in which it clarified the concept of non-material damage under Article 82 of the GDPR and the rules governing burden of proof in the GDPR.
Continue Reading CJEU Rules That Fear May Constitute Damage Under the GDPR
CJEU Rules that GDPR Prohibition on Automated Decision-Making Applies to Credit Scoring
On December 7, 2023, the Court of Justice of the European Union ruled that credit scoring constitutes automated decision-making, which is prohibited under Article 22 of the EU General Data Protection Regulation unless certain conditions are met. …
Continue Reading CJEU Rules that GDPR Prohibition on Automated Decision-Making Applies to Credit Scoring
BREAKING: EU Commission Adopts EU-U.S. Data Privacy Framework Adequacy Decision
On July, 10 2023, the European Commission formally adopted a new adequacy decision on the EU-U.S. Data Privacy Framework, which follows years of intense negotiations between the EU and the U.S. after the invalidation of the EU-U.S. Privacy Shield by the CJEU in the Schrems II case.
Continue Reading BREAKING: EU Commission Adopts EU-U.S. Data Privacy Framework Adequacy Decision
European Parliament Adopts EU-U.S. Data Privacy Framework Resolution
On May 11, 2023, at a plenary session, the European Parliament voted to adopt a resolution on the adequacy of the protection afforded by the EU-U.S. Data Privacy Framework which calls on the European Commission to continue negotiations with its U.S. counterparts with the aim of creating a mechanism that would ensure equivalence and provide the adequate level of protection required by EU data protection law. …
Continue Reading European Parliament Adopts EU-U.S. Data Privacy Framework Resolution
CJEU Determines that a Mere Infringement of the GDPR is not Sufficient to Require Compensation
On May 4, 2023, the Court of Justice of the European Union issued a judgment in the Österreichische Post case. …
Continue Reading CJEU Determines that a Mere Infringement of the GDPR is not Sufficient to Require Compensation
CJEU Clarifies Rules on Conflict of Interest in Relation to DPO Role
On February 9, 2023, the Court of Justice of the European Union issued a judgment in the X-FAB Dresden case. …
Continue Reading CJEU Clarifies Rules on Conflict of Interest in Relation to DPO Role