On March 18, 2025, the Norwegian Consumer Council asked the Norwegian Supervisory Authority to investigate a payment app provider for using consumers’ purchase history for targeted advertising.
Continue Reading Watchdog to Investigate Mobile Payment Provider Over Its Use of Purchase History for Targeted AdvertisingGDPR
Belgian High Court Decides on Abuse of Law in relation to the GDPR Right to File a Complaint
By Kristof Van Quathem on
Posted in European Union, GDPR
On January 10, 2025, the Belgian High Court (Hof van Cassatie) upheld the decision of the Market Court in a case that pitched the GDPR right to file a complaint against the general legal principle in Belgian law that prohibits the abuse of law.
Continue Reading Belgian High Court Decides on Abuse of Law in relation to the GDPR Right to File a ComplaintEuropean Commission Confirms Plans to Simplify GDPR
By Kristof Van Quathem on
Posted in European Union, GDPR
On March 13, 2025, the Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection, Michael McGrath, confirmed that the Commission is considering simplifying the GDPR with a view to reducing the burden on smaller businesses. This statement aligns with the Commission’s broader goal of simplifying the EU digital framework.
Continue Reading European Commission Confirms Plans to Simplify GDPREDPB Launches Coordinated Enforcement on the Right to Erasure
Posted in European Union, GDPR Rights
Updated
On March 5, 2025, the European Data Protection Board (“EDPB”) announced that EU Supervisory Authorities (“SAs”) will undertake a coordinated enforcement action in 2025 regarding data subjects’ right to erasure under Art. 17 of the GDPR. For context, the EDPB selects a particular topic each year as its focus for pan-EU coordinated enforcement.
Continue Reading EDPB Launches Coordinated Enforcement on the Right to ErasureCJEU Clarifies GDPR Rights on Automated Decision-Making and Trade Secrets
On February 27, 2025, the Court of Justice of the European Union (“CJEU”) issued a significant decision on the right of data subjects to request access to their personal data under Article 15 GDPR, specifically as it relates to automated decision-making and striking an appropriate balance between informing data subjects and protecting trade secrets (Case C‑203/22).
Continue Reading CJEU Clarifies GDPR Rights on Automated Decision-Making and Trade SecretsCJEU Finds Customers’ Title Is Not Necessary Data For The Purchase Of A Train Ticket
By Kristof Van Quathem & Alix Bertrand on
On January 9, 2025, the Court of Justice of the European Union (“CJEU”) issued a decision on the GDPR’s lawfulness and data minimization principles.
The case arose after a French association (“Mousse”) complained to the French Supervisory Authority (“CNIL”) about the fact that France’s main train company SNCF requires customers to indicate their title and gender identity by ticking either “Sir” or “Madam” when purchasing a train ticket online. Mousse considered that such a mandatory requirement could not be justified under the “contractual performance” or “legitimate interests” legal bases set out in Article 6 GDPR, and infringed the GDPR’s principles of lawfulness, data minimization and transparency.
The CNIL dismissed the complaint, and Mousse appealed the CNIL’s decision before the French Administrative Supreme Court (“Conseil d’Etat”), which stayed the proceedings to refer some questions to the CJEU.
Continue Reading CJEU Finds Customers’ Title Is Not Necessary Data For The Purchase Of A Train TicketEDPB adopts draft guidelines on requirements when responding to requests from non-EU public authorities
By Marty Hansen & Paul Maynard on
On 2 December 2024, the European Data Protection Board (“EDPB”) adopted its draft guidelines on Article 48 GDPR (the “Draft Guidelines”). The Draft Guidelines are intended to provide guidance on the GDPR requirements applicable to private companies in the EU that receive requests or binding demands for personal data from public authorities (e.g., law enforcement or national security agencies, as well as other regulators) located outside the EU.
Continue Reading EDPB adopts draft guidelines on requirements when responding to requests from non-EU public authoritiesFive key takeaways from recent EU developments on the GDPR’s “legitimate interests” legal basis
By Dan Cooper, Mark Young, Paul Maynard & Tomos Griffiths on
- On 4 October 2024, the Court of Justice of the EU (“CJEU”) handed down its judgment in a case relating to the Royal Dutch Lawn
Rounding up Five Recent CJEU Cases on GDPR Compensation
By Kristof Van Quathem on
In recent months, the European Court of Justice (“CJEU”) issued five judgments providing some clarity on the scope of individuals’ rights to claim compensation for “material and non-material damage” under Article 82 of the GDPR. These rulings will inform companies’ exposure to compensation claims, particularly in the context of the EU’s Collective Redress Directive, but open questions remain about the quantum of compensation courts will offer in these cases and we expect both the CJEU and national courts to deliver additional case-law clarifying this topic in the coming year (for more information on recent CJEU cases related to compensation, see our previous blog posts here and here).
- In VB v Natsionalna agentsia za prihodite (C-340/21), the CJEU concluded that individuals may have suffered “non-material damage”—and therefore be able to claim compensation—if they can demonstrate that they feared future misuse of personal data that was compromised in a personal data breach.
- In VX v Gemeinde Ummendorf (C-456/22), the CJEU found that there is no de minimis threshold for damage, below which individuals cannot claim for compensation.
- In BL v MediaMarktSaturn (C-687-21), the CJEU restated its existing case-law, and expanded upon its analysis in VB by clarifying that alleged harms cannot be “purely hypothetical”.
- In Kočner v Europol (C-755/21), the CJEU awarded non-material damages of €2000 for the publication in newspapers of transcripts of “intimate” text messages.
- In GP v Juris GmbH (C-741/21), the CJEU found that where one processing activity infringes multiple provisions of the GDPR, this should not allow claimants to “double-count” the harm they suffered.
We provide further detail on each case below.
Continue Reading Rounding up Five Recent CJEU Cases on GDPR CompensationEDPB’s 2024 Coordinated Enforcement Action on the Access Right: What Can You Expect?
Posted in European Union, GDPR Rights
On February 28, the European Data Protection Board (“EDPB”) announced that EU supervisory authorities (“SAs”) will undertake a coordinated enforcement action in 2024 regarding data subjects’ right of access under the GDPR. For context, the EDPB selects a particular topic each year to serve as the focus for pan-EU coordinated enforcement.
In 2023, regulators focused upon data protection officers’ designation and role. And, on January 17, 2024, the EDPB published its report providing an overview of the actions SAs took in the context of the 2023 action. This blog post provides an overview of what you can expect from the coordinated enforcement action in 2024, based on the lessons learned from 2023.
Continue Reading EDPB’s 2024 Coordinated Enforcement Action on the Access Right: What Can You Expect?