The judgment of the German Constitutional Court of 15 December 1983 on the German Census Act of 1983 (the so-called "census judgment") had a long-lasting effect on the development of data protection law. Below I briefly review the background of the 40-year-old census judgment and its impact on the…
AI and data protection: Data protection enforcement procedures in connection with the use of AI
Legislative and enforcement developments concerning artificial intelligence (AI) have received considerable attention recently: first, the data protection authority procedure initiated in Italy concerning ChatGPT (which also resulted in the temporary suspension of the service in Italy) received a…
The German DPAs' new concept on calculating GDPR fines
The Conference of the independent Data Protection Authorities of Germany (Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder; DSK) published its generally applicable principles on imposing GDPR fines on companies. By publishing its concept, the DSK follows the Dutsch…
E-mail encryption - How to meet GDPR requirements?
One of the biggest challenges in meeting data protection requirements is to translate the general principles and rules into concrete actions and daily routines. How much and what data is needed to achieve a particular purpose? How can we obtain the necessary consent? How can we provide proper…
Lists of mandatory DPIAs
GDPR requires supervisory authories to establish and make public their lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment (DPIA).
22 supervisory authorities submitted their draft lists to the European Data Protection Board (EDPB)…
Collection of national laws implementing the GDPR
Below, you can find a collection of national laws that are necessary for the enforcement of the GDPR. (Last updated on 28.09.2018.) If you need information regarding the status of the implementation in the EU Member States or look for some background information in connection with the implemenation…
The Swiss Army Knife of Data Protection – The consent
Many data controllers consider consent as the primary or preferred legal basis for data processing. Although in many cases it would be justified to use another legal basis instead of the consent, data controllers often obtain consents from the data subjects.
Not only data controllers have this…