by Annika Gierich / Johannes Zhou// On September 4, 2025, the European Court of Justice (CJEU) issued an important decision (Case C-413/23 P) concerning the concept of “personal data”. The decision provides further clarity on how to distinguish between personal, pseudonymized,…
France CNIL Breaks New Ground: First Standalone Sanctions Against Data Processors
by Aurélie Banck// In December 2025, CNIL issued two significant penalties against data processors for GDPR violations, marking a watershed moment in European enforcement. For the first time, the French supervisory authority sanctioned processors independently, without simultaneously pursuing the data…
Digital Omnibus: cui bono?
by Ulrich Kelber// The European Commission has, unexpectedly and deviating from long-communicated timelines, presented far-reaching proposals to amend the GDPR (and other regulations) as part of the “Digital Omnibus”. Many are now attempting to interpret the proposed rules, with assessments…
Austrian DPA: YouTube is ordered to honor users’ Right of Access
by Dr. Gerald Trieb and Viktoria Kovacs// The Austrian Data Protection Authority (“Datenschutzbehörde”, hereinafter “DSB”) recently issued a significant decision in a long-running case brought by an individual against Google LLC, represented by NOYB – the European Center for Digital Rights. The dispute concerned the right of access under…
District Court of Amsterdam Prohibits Meta from Using Personal Data for AI Training – Private Enforcement of DMA?
by Sebastian Louven// An interim injunction by the District Court of Amsterdam against Meta prohibits Meta from using the applicant’s personal data for training its AI models.1 The decision is available in the Dutch judicial database.2 Context: Private Enforcement of…
Neurotechnologies and Data Protection – Challenges to Consent
Thorsten Kranz// The emergence of neurotechnologies represent a ground breaking intersection between science, engineering and medicine. Whilst their recent proliferation has been largely contained to the health and research sector, use may enter – and in some cases, already has…
Introduction to Thailand’s Personal Data Protection Act (PDPA)
by Norravich Limpanukorn*// A rapid development of information technology has raised concerns in society across the globe, especially regarding data, as things in the current era are data-driven. The European regional interaction to this issue resulted in a landmark regulation…
CJEU: a “Controller” does not need to have legal personality and legal capacity
by Dr. Gerald Trieb and Viktoria Kovacs// The European Court of Justice (CJEU) recently ruled on a case relating to Austria: The CJEU had to decide on the question referred by the Austrian Supreme Administrative Court (“VwGH”) as to whether or not a Tyrolian State Law designating the…
CJEU lost in translation: the Right to Information on Automated Decision-Making (Dun & Bradstreet Case)
by Dr. Gerald Trieb and Theodor Paul Mach-Walter// In the proceedings submitted from Austria, the CJEU had to decide how the right to obtain information by a data subject whose data has been processed using automated decision-making must be fulfilled…
New EDPB guidelines on legitimate interest
by Jan Horstmann// On 8 October 2024, the European Data Protection Board (EDPB) issued guidelines on the processing of personal data on the basis of a legitimate interest in accordance with Art. GDPR Article 6(1)(f) GDPR for public consultation (the…