nederlands

Marketing and data together constitute one of the most dynamic and risk-sensitive domains of the digital economy. Data-driven marketing is no longer confined to the distribution of generic commercial messages, but encompasses a broad range of activities in which personal data, behavioural data, interaction data, preferences, location indicators, click behaviour,…

Cookies and ePrivacy constitute a particularly concrete, visible and testable domain within digital regulation, because they do not affect the user at a distance, but directly at the first point of contact with a website, platform, app or digital service. Whereas many obligations in the fields of data protection, cybersecurity,…

Engagement with data protection authorities is one of the most decisive tests of digital governance, because contact with a privacy regulator reveals whether an organisation merely regulates personal data formally or whether it actually controls, explains and operationally accounts for its processing activities. A data protection authority does not look…

The data controller occupies the normative, governance and operational centre of gravity within the GDPR for every processing of personal data. This is not a merely formal classification, but concerns the party that directs the processing, determines the purposes, selects the essential means, and bears responsibility for the lawfulness, proportionality,…

The data processor occupies a position under the GDPR that extends far beyond the traditional image of an external service provider performing merely technical acts. In a digital economy in which cloud infrastructures, SaaS platforms, managed service providers, data centres, cybersecurity suppliers, HR systems, payment processors, marketing technology and specialised…

The core principles of the GDPR constitute the foundational normative framework for any processing of personal data that must be legally sustainable, administratively explainable and operationally defensible. They determine not only the conditions under which data may be collected, used, shared, retained or erased, but also the degree of care…

The General Data Protection Regulation has not only tightened the legal framework for data protection, but has also made clear that digital legal protection only has real substance where the rights of data subjects are practically accessible, intelligible and enforceable. An organisation may have policies, registers, procedures and contractual clauses…