118 éléments avec cette étiquette.
Types d’opérations de traitementCritères issus des lignes directrices du CEPD qu’ils remplissentExemplesTraitements de données de santé mis en œuvre par les établissements de santé ou les établissements médicosociaux pour la prise en charge des personnes.- collecte de données sensibles;- personnes ...
Types d’opérations de traitementExemplesTraitements, mis en œuvre uniquement à des fins de ressources humaines et dans les conditions prévues par les textes applicables, pour la seule gestion du personnel des organismes qui emploient moins de 250 personnes, à l’exception du recours au profilage.Les...
Délibération n° 2024-024 du 29 février 2024 portant adoption d’une recommandation relative à la mise en place de dispositifs de vidéosurveillance au sein des chambres des établissements accueillant des personnes âgées La Commission nationale de l’informatique et des libertés, Vu le 679 du Parlement ...
WP242 rev.01 Adopted on 13 December 2016 - As last Revised and adopted on 5 April 2017 Executive summary Article 20 of the GDPR creates a new right to data portability, which is closely related to the right of access but differs from it in many ways.
WP259 rev.01 Adopted on 28 November 2017 As last Revised and Adopted on 10 April 2018 THE WORKING PARTY ON THE PROTECTION OF INDIVIDUALS WITH REGARD TO THE PROCESSING OF PERSONAL DATA set up by Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995, having regard to Arti...
EDPB Guidelines 2020-07 on the concepts of controller and processor in the GDPR Version 2.1 - Adopted on 07 July 2021 (minor corrections 20 September 2022).
EDPB Guidelines 2021-05 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR Version 2.0 dated 14 February 2023 Go to the official PDF version.
EDPB Guidelines 2021-03 on the application of Article 65(1)(a) GDPR Version 2.1 - Adopted on 24 May 2023 Version history Version 1.013 April 2021Adoption of the Guidelines for public consultationVersion 2.024 May 2023Adoption of the Guidelines after public consultationVersion 2.115 July 2024Editoria...
EDPB Guidelines 2023-02 on Technical Scope of Art.
EDPB Guidelines 2022-06 on the practical implementation of amicable settlements The European Data Protection Board (EDPB) has released guidelines on how supervisory authorities (SAs) should handle amicable settlements under GDPR.
EDPB Guidelines 2022-04 on the calculation of administrative fines under the GDPR Version 2.1 dated 24 May 2023 - Go to the official PDF version.
Other version This is the public consultation draft (v1.0, adopted 2 December 2024). See also the final version (v2.1, adopted 4 June 2025).
Other version This is the final version (v2.1, adopted 4 June 2025, annex resolution improved 20 June 2025).
Official Document Adopted: 13 February 2024 — Adopted Official publication: EDPB website Executive Summary The French Supervisory Authority requested the European Data Protection Board to issue an opinion on the notion of main establishment of a controller under Article 4(16)(a) GDPR, and on the cr...
Executive summary AI technologies create many opportunities and benefits across a wide range of sectors and social activities.
EDPB Guidelines 2024-01 on processing of personal data based on Article 6(1)(f) GDPR Version 1.0 - Adopted on 8 October 2024 - Access official publication on EDPB website.
Version 1.0 Adopted on 03 December 2025 www.edpb.europa.eu/system/files/2025-12/edpb-recommendations-202502-mandatory-user-accounts_en.pdf Executive summary On e-commerce websites, users are frequently required to create an online account before being able to access offers or purchase goods and serv...
[Access official publication on EDPB Website] 💡 Executive Summary Context & Purpose The EDPB issued this statement to provide specific guidance on age assurance in response to increased regulatory focus on protecting children in digital environments Age assurance encompasses methods to determin...
[Access original publication on EDPB website] SUPPORT POOL OF EXPERTS PROGRAMME AI-Complex Algorithms and effective Data Protection Supervision - Effective implementation of data subjects’ rights by Dr.
[Access original publication on EDPB website] SUPPORT POOL OF EXPERTS PROGRAMME AI-Complex Algorithms and effective Data Protection Supervision - Bias evaluation by Dr.
Other version: EDPB Guidelines 2025-02 on processing of personal data through blockchain technologies (v1.1) — the earlier draft version adopted for public consultation.
Other version: EDPB Guidelines 2025-02 on processing of personal data through blockchain technologies (v2.0) — the final version adopted after public consultation.
[Access official publication on EDPB Website] EXECUTIVE SUMMARY The GDPR defines the term ‘pseudonymisation’ for the first time in EU law and refers to it several times as a safeguard that may be appropriate and effective for the fulfilment of certain data protection obligations.
Voir les Questions-Réponses de la CNIL sur le sujet CNIL Délibération 2026-042 concernant les pixels de suivi dans les courriers électroniques Version adoptée le 12 mars 2026 1.
CNIL Délibération 2026-047 concernant l’évaluation de la solvabilité dans le cadre de l’octroi de crédit 1.
CNIL Délibération 2026-045 concernant le vote par correspondance électronique 1.
EDPB-EDPS Joint Opinion 02-2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus) Adopted on 10 February 2026 Executive summary On 19 November 2025, the European Commission (the ‘Commission’) issued a Digital Omnibus proposal^[Propo...
EDPB Guidelines 03-2026 on web scraping in the context of generative AI Version 1.0 Adopted on 07 July 2026 Version history VersionDateAdoption informationVersion 1.007 July 2026adoption of the guidelines for public consultation Executive summary Web scraping is a commonly used technique for extract...
EDPB Guidelines 02-2026 on Anonymisation Version 1.0 Adopted on 07 July 2026 Version history VersionDateAdoption informationversion 1.007 July 2026adoption of the guidelines for public consultation Executive summary These guidelines clarify the notion of anonymous data and provide a practical framew...
Guidelines 01/2026 on processing of personal data for scientific research purposes Adopted on 15 April 2026 Executive Summary Scientific research is an important objective in the EU treaties, which state that the Union has the objective of strengthening its scientific and technological bases by achi...
Executive Summary This is the CNIL’s FAQ (published 22 July 2026) on its recommendation concerning tracking pixels in emails, adopted 14 April 2026.
Description Excellent 3/3 Testimonials N/A Work highlights N/A Badge N/A Source : Magazine Décideurs.
Executive Summary [Note to Claude AI - adapt this section when running the AI Case Law analytics.
Executive Summary Résumé analytique Vue d’ensemble : Question centrale : Le système de géolocalisation continue « Distrio », activé par les distributeurs de Mediaposte pendant leurs tournées et enregistrant leur position toutes les dix secondes, est-il licite au regard de l’article L.
EnglishFrançaisthe categories of personal data referred to in Article 9 of Directive (EU) 2016/680 and Article 10(1) of Regulation (EU) 2018/1725i.e.- personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, - the processing...
EnglishFrançaisany operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission...
EnglishFrançaisan identified or identifiable natural personune personne physique identifiée ou identifiableArt. 4(1) GDPR.
EnglishFrançaisthe natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal datawhere the purposes and means of such processing are determined by Union or Member State law, the controller or ...
the automated recognition of physical, physiological, behavioural, or psychological human features for the purpose of establishing the identity of a natural person by comparing biometric data of that individual to biometric data of individuals stored in a database Art.
EnglishFrançaispersonal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic datales données à car...
Executive Summary [Note to Claude AI - adapt this section when running the AI Case Law analytics.
Important Executive Summary Overview: Issue: Whether EDPB binding decisions adopted under Article 65 GDPR constitute challengeable acts under Article 263 TFEU, and whether a data controller is directly and individually concerned by such decisions to bring an annulment action.
Délibération de la formation restreinte n° SAN-2026-001 du 8 janvier 2026 prononçant une sanction pécuniaire à l’encontre de la société FREE MOBILE Les développements de la délibération comportant des données à caractère personnel ou des secrets protégés par la loi sont remplacés par le signe […] La...
Délibération de la formation restreinte n° SAN-2026-002 du 8 janvier 2026 prononçant une sanction pécuniaire à l’encontre de la société FREE Les développements de la délibération comportant des données à caractère personnel ou des secrets protégés par la loi sont remplacés par le signe […] - La Comm...
Délibération de la formation restreinte n° SAN-2025-017 du 30 décembre 2025 concernant la société X Certains développements de la délibération, permettant d’identifier la société ou comportant notamment des données à caractère personnel ou des secrets protégés par la loi, sont remplacés par le signe...
Délibération de la formation restreinte n° SAN – 2025-015 du 22 décembre 2025 prononçant une sanction pécuniaire à l’encontre de la société NEXPUBLICA FRANCE La Commission nationale de l’informatique et des libertés, réunie en sa formation restreinte composée de M.
Délibération de la formation restreinte n°SAN-2025-011 du 27 novembre 2025 concernant la société AMERICAN EXPRESS CARTE FRANCE La Commission nationale de l’informatique et des libertés, réunie en sa formation restreinte composée de M.
La Commission nationale de l’informatique et des libertés, réunie en sa formation restreinte composée de M.
Abstract Executive Summary: C-654/23 - Inteligo Media SA Case Overview CJEU First Chamber ruling (November 13, 2025) concerning the legality of sending promotional newsletters to users who registered for free accounts on a Romanian news platform (avocatnet.ro).
Délibération de la formation restreinte n°SAN-2025-008 du 18 septembre 2025 prononçant une sanction pécuniaire à l’encontre de la société SAMARITAINE SAS La Commission nationale de l’informatique et des libertés, réunie en sa formation restreinte composée de M.
Important Executive Summary CNIL Sanction SAN-2025-004 Against Google: Key Elements Background and Context Decision date: September 1, 2025 Entities sanctioned: Google LLC and Google Ireland Limited (GIL) Authority: Data Protection Authority, France (CNIL) (French Data Protection Authority) Violati...
Important Executive Summary CNIL Deliberation SAN-2025-006 of September 1, 2025 regarding INFINITE STYLES SERVICES CO.
Important Executive Summary The document outlines a decision made by the French Data Protection Authority (CNIL) on May 15, 2025, concerning SOLOCAL MARKETING SERVICES.
Important Executive Summary This document is a deliberation by the French data protection authority, CNIL, regarding sanctions against the company CALOGA for violations of data protection laws, including GDPR and France’s Privacy and Electronic Communications Code.
Executive Summary — CA Paris, pôle 5, ch.
JUDGMENT OF THE COURT (First Chamber) 13 March 2025 (*) ( Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(d) – Principle of accuracy – Article 16 – Right to rectification – Article 23 – Restri...
Important Executive Summary This document summarizes the judgment of the Court of Justice of the European Union (CJEU) in Case C‑638/23, involving the Amt der Tiroler Landesregierung (Office of the Provincial Government of Tyrol) and the Austrian Data Protection Authority.
🤖 Analyse IA — Case Law Analyst Cliquer sur le bouton ci-dessous pour lancer l’analyse automatique de cette décision avec le prompt AI Agent - Case Law Analyst.
On 11 February 2024, the European Data Protection Board (EDPB) adopted a new statement on age assurance.
In a landmark judgment delivered on 29 January 2025, the General Court of the European Union has affirmed the European Data Protection Board’s (EDPB) authority to require national supervisory authorities to broaden their investigations in cross-border data protection cases.
EDPB Position Paper 2025-01 on Interplay between data protection and competition law [Access official publication on EDPB website] Executive summary Promoting cooperation between personal data protection and competition authorities can be useful to protect individuals and increase their choice.
Important Executive Summary Summary of CNIL Decision SAN-2024-021 (December 19, 2024) The French data protection authority, CNIL, issued Decision SAN-2024-021 against an unnamed real estate company for multiple violations of the GDPR.
Executive Summary Résumé exécutif Vue d’ensemble Problème : Une kinésithérapeute condamnée pénalement en 2017 pour abus de faiblesse demandait en référé le déréférencement de 35 URL apparaissant sur Google à la recherche de ses nom et prénom, sur le fondement du droit à l’effacement (art.
Important Executive Summary Summary of CNIL Decision SAN-2024-020 Against KASPR Date of Decision: December 5, 2024 Authority: CNIL (French Data Protection Authority) Case Number: SAN-2024-020 Fine: €240,000 with an additional €10,000 per day for non-compliance after six months Geography: France Key...
Speakers: **Claude-Étienne Armingaud, CIPP/E, **Partner, Data Protection Privacy and Security Practice Group Coordinator, K&L Gates **Shereen Kenyon, **Senior Manager Data Privacy and Data Protection Officer, SharkNinja **Elodie Vandenhende, **Deputy Head of the Digital Economy Unit, French Comp...
In alignment with the ongoing concerns from several European data protection authorities publishing guidelines on data scrapping (i.e., the Dutch DPA, the Italian DPA and the UK Information Commissioner’s Office), the Global Privacy Assembly (GPA)’s International Enforcement Cooperation Working Grou...
The ever-growing digital economy relies extensively on all sorts of data to feed its growth, and personal data oftentimes find itself at the heart of companies’ core or emerging business practices.
La Commission nationale de l’informatique et des libertés, réunie en sa formation restreinte composée de M. Philippe-Pierre CABOURDIN, président, M.
Important Executive Summary Overview: Issue: (insert key issue of the decision) Key Dates: (insert key dates/chronology of the case) Key Findings: (insert key finding no.1): (detail key finding no.1).
Délibération de la formation restreinte n°SAN-2024-014 du 26 septembre 2024 concernant la société COSMOSPACE La Commission nationale de l’informatique et des libertés, réunie en sa formation restreinte composée de M.
La Commission nationale de l’informatique et des libertés, réunie en sa formation restreinte composée de M. Philippe-Pierre CABOURDIN, président, M.
La Commission nationale de l’informatique et des libertés, réunie en sa formation restreinte composée de M. Philippe-Pierre CABOURDIN, président, M.
Executive Summary Overview: Issue: Whether (1) the TC String (Transparency and Consent String), a coded string capturing a user’s consent preferences for online advertising data processing, constitutes personal data under Article 4(1) GDPR, and (2) whether IAB Europe, as the standard-setting organi...
Executive Summary [Note to Claude AI - adapt this section when running the AI Case Law analytics.
Executive Summary [Note to Claude AI - adapt this section when running the AI Case Law analytics.
Important Executive Summary Overview: Issue: (insert key issue of the decision) Key Dates: (insert key dates/chronology of the case) Key Findings: (insert key finding no.1): (detail key finding no.1).
Délibération de la formation restreinte no SAN-2023-018 du 12 décembre 2023 concernant la commune X La Commission nationale de l’informatique et des libertés, réunie en sa formation restreinte composée de M.
JUDGMENT OF THE COURT (First Chamber) 7 December 2023 (*) (Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 22 – Automated individual decision-making – Credit information agencies – Automated establ...
This panel session will focus on the growing concern over the ethical use of Artificial Intelligence (AI) and its impact on privacy.
Important Executive Summary Overview of the Case: The CNIL (French Data Protection Authority) issued a decision on October 12, 2023, regarding GROUPE CANAL+, a French media company.
This panel session will focus on the growing concern over the ethical use of Artificial Intelligence (AI) and its impact on privacy.
This panel session will focus on the growing concern over the ethical use of Artificial Intelligence (AI) and its impact on privacy.
The UK Government has laid adequacy regulations before Parliament that, once in force from 12 October 2023, will permit use of the UK – US “Data Bridge” as a safeguard for personal data transfers from the UK to the US under Article 44 UK GDPR.
Depuis l’ouverture au grand public de ChatGPT en 2022, l’intelligence artificielle générative (ou « GenAI » pour Generative Artificial Intelligence) ne cesse d’occuper les sommaires des publications, qu’elles soient expertes ou grand public.
Once again included in the Best Lawyers in France ranking for Privacy and Data Security Law Source : Best Lawyers.
Important Executive Summary The document details the CNIL’s (French data protection authority) decision to sanction CRITEO SA, a targeted advertising company, for multiple GDPR violations.
La Commission nationale de l’informatique et des libertés, réunie en sa formation restreinte composée de Monsieur Alexandre LINDEN, président, Monsieur Philippe-Pierre CABOURDIN, vice-président, Monsieur Alain DRU, Monsieur Bertrand du MARAIS et Madame Christine MAUGÜÉ, membres ; Vu le règlement (UE...
Entretiens croisés en compagnie d’Alexandra Iteanu, et Alan Walter du cabinet Walter Billet: Énormément de sociétés se sont emparé du sujet, confirme Claude-Etienne Armingaud, associé et membre de la pratique droit des nouvelles technologies & propriété intellectuelle de K&L Gates.
Important Executive Summary The document details a decision by the French Data Protection Authority (CNIL) regarding HUBSIDE.STORE, a telecommunications retailer, for violating data protection laws during its marketing campaigns.
Joignez vous à nous le jeudi 26 janvier à 19 heures pour le premier HappyHour de l’année avec l’IAPP en l’honneur du DataPrivacyDay ! 🍸 Notre invitée spéciale sera Emmanuelle Bartoli de Capgemini Merci à toute l’équipe IAPP KnowledgeNet – France : Sarah Cadiot, Wajdi Kharrat (CIPP/E-CISA-CDPSE), Ma...
Délibération de la formation restreinte no SAN-2022-026 du 29 décembre 2022 concernant la société Voodoo La Commission nationale de l’informatique et des libertés, réunie en sa formation restreinte composée de Monsieur Alexandre LINDEN, président, Monsieur Philippe-Pierre CABOURDIN, vice-président, ...
Important Executive Summary Link to official publication on Legifrance.
Important Executive Summary Link to official publication on Legifrance.
Alas! I will not be able to attend IAPP - International Association of Privacy Professionals’ 2022 due to schedule conflict… Nevertheless, if you are in Brussels for this fantastic (and already sold-out) event, do not hesitate to meet with our K&L Gates EU Data Protection team - Eleonora Curreri...
EDPB Guidelines 2022-09 on personal data breach notification under GDPR Version 2.0 - Adopted 28 March 2023 Version history Version 1.010 October 2022Adoption of the Guidelines (updated version of the previous guidelines WP250 (rev.01) adopted by the Working Party 29 and endorsed by the EDPB on 25 M...
Délibération de la formation restreinte n° SAN-2022-009 du 15 avril 2022 concernant la société x La Commission nationale de l’informatique et des libertés, réunie en sa formation restreinte composée de Monsieur Alexandre LINDEN, président, Monsieur Philippe-Pierre CABOURDIN, vice-président, Madame A...
Great to be back on the road and exchange with fellow PrivacyPros face to face — after 2022 in Paris and London, it’s time for the pièce de resistance in DC with GPS22 with IAPP - International Association of Privacy Professionals If you are in DC next week, let’s meet up! GDPR data-protection Priva...
Version 2.1 - Adopted on 28 March 2023 Version 1.018 January 2022Adoption of the Guidelines for public consultationVersion 2.028 March 2023Adoption of the Guidelines after public consultationVersion 2.130 May 2024Minor corrections EXECUTIVE SUMMARY The right of access of data subjects is enshrined i...
Claude-Etienne Armingaud from K&L Gates ranked among the Best Lawyers France 2021 for Privacy and Data Security Law Source : Best Lawyers.
GDPR fines have been increasing over the last 18 months, and it is proving to be a complex environment for the regulators and the regulated.
🤖 Analyse IA — Case Law Analyst Cliquer sur le bouton ci-dessous pour lancer l’analyse automatique de cette décision avec le prompt AI Agent - Case Law Analyst.
Depending on whether you are an optimist or a pessimist, it will have taken the European Commission either three years and two weeks (since the entry into force of the General Data Protection Regulation (GDPR) or eleven months (since the Schrems II decision — see our Alert here) to publish its final...
L’équipe parisienne de K&L Gates LLP dispose d’une forte expertise en matière de conformité RGPD et de protection des données.
This article names K&L Gates among Global Data Review ’s inaugural GDR 100, a ranking of the world’s best data law firms.
Délibération de la formation restreinte n°SAN-2020-018 du 8 décembre 2020 concernant la société X La Commission nationale de l’informatique et des libertés, réunie en sa formation restreinte composée de Monsieur Philippe-Pierre CABOURDIN, vice-président, Mme Dominique CASTERA, Mme Anne DEBET et Mme ...
EDPB Guidelines 2020-08 on the targeting of social media users Version 2.0 - Adopted on 13 April 2021, following public consultation on the v1.0 draft of 02 September 2020.
In a highly anticipated Schrems II decision, the Court of Justice of the European Union (CJEU) invalidated the Privacy Shield, the legal framework allowing transatlantic exchanges of personal data for commercial purposes between the European Union and the United States, mainly citing US surveillance...
With the recent decision from the Court of Justice of the European Union (CJEU) invalidating the Privacy Shield framework (Court of Justice of the European Union - Grand Chamber - 16 July 2020 - C-311/18 - Schrems II - see our alert GDPR - Data Transfers 20 Navigating Through Post-Schrems II Waters)...
Le feuilleton de l’été de la Revue Lamy Droit de l’Immatériel s’apprête à tirer sa révérence après les contributions de ce numéro aoûtien.
Délibération de la formation restreinte n° SAN – 2019-007 du 18 juillet 2019 prononçant une sanction pécuniaire à l’encontre de la société X La Commission nationale de l’informatique et des libertés, réunie en sa formation restreinte composée de M.
Le 25 mai 2018 - il y a un an déjà, mais pourtant, il n’y a qu’un an seulement.
While Capitol Hill is inundated with proposed privacy legislations from the Data Breach Prevention and Compensation Act (DBPCA), the CLOUD Act and the ENCRYPT Act, organizations the world over are trying to understand how to get their own regulations deemed adequate enough to ensure the flow of busi...
On 2 July 2018, the French Data Protection Authority (“Commission Nationale de l’Informatique et des Libertés” or “CNIL ”) published its yearly thematic guidance for the priority axes of its control activities, notably further to the entry into force of the recent General Data Protection Regulation ...
Adopted on 25 May 2018 - Access official version on EDPB website The European Data Protection Board Having regard to Article 70 (1j) and (1e) of the EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data a...
WP260 rev.01 - Adopted on 29 November 2017 - As last Revised and Adopted on 11 April 2018 Introduction These guidelines provide practical guidance and interpretative assistance from the Article 29 Working Party (WP29) on the new obligation of transparency concerning the processing of personal data u...
On 17 October 2017, after about 18 months of waiting, a consultation involving more than 20 players, and two intermediate versions, the French Data Protection Authority (“Commission Nationale de l’Informatique et des Libertés” or “CNIL ”) has released the final version of its “compliance package” on...
JUDGMENT OF THE COURT (Second Chamber) 4 May 2017 (*) (Reference for a preliminary ruling — Directive 95/46/EC — Article 7(f) — Personal data — Conditions for the lawful processing of personal data — Concept of ‘necessity for the realisation of the legitimate interests of a third party’ — Request fo...
🤖 Analyse IA — Case Law Analyst Cliquer sur le bouton ci-dessous pour lancer l’analyse automatique de cette décision avec le prompt AI Agent - Case Law Analyst.