According to Art. 40 GDPR, associations and other bodies representing categories of controllers or processors are encouraged to prepare codes of conduct, or amend or extend such codes, for the purpose of contributing to the proper application of the GDPR in specific sectors. When such codes of conduct – or amendments to existing ones – […]
sensitive data
CJEU Broadens Definition of Health Data in Pivotal GDPR Ruling
The Court of Justice of the European Union (CJEU) has recently issued a landmark decision (C-21/23 “Lindenapotheke”) that expands the interpretation of what constitutes health data under the General Data Protection Regulation (GDPR). This ruling has significant implications for businesses, especially those involved in the sale of medicinal products online. A Wider Scope of Health […]
Unlawful use of facial recognition technology (FRT) at a school in Essex
The UK’s supervisory authority, the Information Commissioner’s Office (ICO), announced on 23 July 2024 that it had issued a warning to a school in Essex for the unlawful use of facial recognition technology – a violation of Art. 58 para. 2 lit. b UK GDPR. What happened? In March 2023, the school began using facial […]
Privacy matters: the intrinsic value of data protection
Records of processing activities. Data processing agreements. Data processing impact assessments. Privacy notices. Cookie banners. Data subject requests. Data flow mapping…The world of data privacy can be overwhelming, even for those of us who work with it professionally. It is especially frustrating when companies feel that they are losing their competitive edge due to limiting […]
Art. 9 GDPR: What counts as special categories of personal data?
In its judgment of August 1, 2022, the CJEU extended the scope of application of Art. 9 GDPR to “indirectly sensitive data” following a referral from a Lithuanian Administrative Court (Case C 184-20). This ruling is being widely discussed in the data protection world, as it has the potential to have a big impact on […]