Data Protection and Digital Governance

This post summarizes and analyses the key points from the EDPB's Guidelines on Article 48 GDPR, including the EDPB’s interpretation of Article 48, the two-part test the EDPB lays out for Article 48 transfers, and the key obligations for data transferring entities.

This post highlights key insights from Opinion 28/2024 and explores their broader implications for data anonymisation. It underscores the apparent endorsement of a two-pronged test for anonymisation and emphasises the importance of considering all contextually relevant attackers.

This post examines LQDN II judgment on data retention, balancing privacy with copyright enforcement, easing IP data access for minor crimes under strict safeguards.

This post outlines how VAT on data payments from consent-or-pay models challenges social media firms, forcing them to pay tax or rethink data-driven business models.

This post discusses Case C-21/23 and analyses the potential risks that the Court's interpretation poses to consistent enforcement of the GDPR and to potential overexpansion of the concept of sensitive data.

This post argues that despite CJEU rulings, key GDPR data transfer rules for foreign firms remain unclear, and a decisive CJEU ruling is needed to resolve this issue.

This post argues that the new AI Act focuses too much to organizing the AI software, and omits protecting the individual rights of the AI tool users.

This post discusses the ban on predictive policing in the AI Act and seeks to demonstrate the potential limitations of its effectiveness through a critical analysis of this provision.

This article examines how the EU's media protection legislation—specifically the EMFA—does not sufficiently secure media pluralism guarantees in two Member State case studies, Hungarian public media and Italian private media.

This post presents Article 6(11) of the DMA and its underlying rationale and discusses its interpretation in the light of the GDPR.

This post analyses the cases after Österreichische Post to flesh out the Court’s conception of non-material damages under Article 82 GDPR and to analyse whether a coherent approach emerges from the case law.

This post discusses the different forms of control envisaged for data subjects over the secondary use of their health data, describes the respective positions of different institutions, and discusses them in light of the Finnish law.

This post argues that the judgment in Case C-683/21 constitutes an important step in the development of 'GDPR-proofing' artificial intelligence and provides key clarification for entities commissioning and developing AI tools.

This post argues that by using the word “indirectly” in relation to personal data, the Court appears to be introducing a new dimension along which to classify personal data and that in doing so, the Court has departed from its earlier jurisprudence.

This contribution looks into the consequences of the judgment in C-26/22 and C-64/22 on the GDPR procedural rights.

This post argues that to task exclusively national courts with the decision of what TOMs are appropriate to ensure security of processing on a case-by-case basis appears to be particularly problematic and liable to creating fragmentation in the implementation of the GDPR.

This blogpost argues that the new Europol Regulation forms a threat to the protection of the fundamental right to data protection, while the EDPS’ possibilities for monitoring and supervising compliance with the EU’s data protection rules remain limited.

This blog post argues that, if followed by the Court, the interpretation proposed by the AG in the HADOPI case would lead to a severe weakening of the CJEU’s authority and legitimacy, more generally.

This post calls for clearer EU-structured soft law guidance on coordination possibilities in order to envisage coordination initiatives between Member States' different competent authorities.

This post presents the key findings of the Luxembourg Conference on Transatlantic Data Transfers.

This analysis highlights the implications of the ECtHR judgement Glukhin for the legislative process of the Artificial Intelligence Act (AIA).

This post argues that because children are often not mentioned explicitly in the positions taken by the Parliament, the Council and the Commission, it is not clear what effect the AI Act will have for children in AI contexts.

This post is aimed at providing a summary of the ECJ decision in Österreichische Post and outlines the main takeaways in regard to national courts and future judgments.

This post will discuss the regulatory approaches and the importance of foresight and knowledge aspects of the proposed AI regulation.

This post argues that the Court regards the Meta Platforms case as a clear example of a competition authority legitimately intervening after coordinating with the relevant data protection authorities against behaviour that almost without a doubt violates the GDPR.

This contribution highlights selected aspects of the interplay between the AI Act on the one hand, and the EHDS on the other.

This post analyses the complementarity of the voluntary detection regime with the mandatory detection regime in the proposed CSA Regulation and discusses whether such a regime is compatible with particular the General Data Protection Regulation (GDPR) and the e-Privacy Directive.

This post explores the abandonment of dualisim in the Data Act and the problematic points of the proposal that derive from such an abandonment.

This report is a summary of the oral hearings based on the author’s own observations and notes. Notably, it should not be understood as a thorough analysis of Article 22 GDPR.

This post argues that although the legitimacy of cybersecurity legislation is hard to be disputed, the attribution of a specific competence to be conferred to the EU would clarify – and justify – the prominent role that the EU has taken in this area.

This post argues that the proposed threshold for compensation in the AG Campos Sánchez-Bordona's Opinion is not in line with the GDPR and that objective criteria should guide compensation for non-material damages.

This post presents the main emphasis of the executive order by President Biden on enhancing safeguards for US signals intelligence activities, explains implications on transnational data transfers and the GDPR, and analyses the intersection of legal and political arguments.

This post argues that the Case OC v European Commission missed its chance to be a landmark judgment regarding damages under data protection law.

This post summarises how the ECJ assesses the validity of the PNR Directive in light of Articles 7, 8 and 52(1) of the Charter (the fundamental right to respect for private life, to protection of personal data, and the principle of proportionality, respectively).

This blog post narrows down to delimiting the notion of synthetic data generated from personal data and studying its legal qualification within the European data protection framework.

This post argues that although transparency obligations, conceived to fight against corruption, can conflict with the rights of privacy and data protection, the key for solving this conflict lies in a sophisticated and complex proportionality test.

This post explores the interface between the GDPR and journalistic activities and draws on GDPR proceedings from various EU Member States to illustrate the potential of the GDPR to be instrumentalised as a SLAPP strategy.

This post puts forward a novel non-statutory solution that could resolve the “redress” problem in the EU/US adequacy negotiations.

This post focuses on one of the two deficiencies highlighted by the CJEU: the need for the U.S. legal system to provide a redress avenue accessible to all EU data subjects.

This post makes a few observations about the EDPB Guidelines, and draws some conclusions about their implications.

This blog post looks into the possible solutions to enhance access to platform’ data for research on disinformation: Article 31 of the DSA, the strengthen Code of Practice on Disinformation, Art. 40 GDPR Code of Conduct and a Media Data Space.

This contribution focuses on the new data processing powers of Europol.

This post introduces a reflection about regulatory brutality and the – apparent – lack of concern from the EU side about legal coherence in domestic law systems regarding artificial intelligence.

This contribution notes the current role of Eurodac and highlights the proposed changes to the system as they relate to minors and their fundamental rights as enshrined in the Charter of Fundamental Rights of the European Union (Charter).

This post briefly presents the facts of the case and divides the main outcomes of the two judgments in three victories for one or the other camp, without pretensions to be exhaustive on every single point of the judgments.

This post deals with the embedded assessment of a third country’s national security powers under the General Data Protection Regulation and addresses the criticism that a third country is held to stricter standards than a Member State of the Union.