May 24, 2023
The Irish Data Protection Commission (DPC) has evaluated the legality of Facebook’s (now Meta Platforms) data transfer for over 10 years.
In those 10 years, we have seen the Irish DPC trying to avoid ruling on the matter multiple times and the European Data Protection Board (EDPB) forcing them to do it.
We now have a final ruling on the matter, which is unfavorable to Meta.
In fact, in addition to having to stop the data transfer within 5 months and having to move back all data within 6 months, Meta has to pay a € 1.2 billion fine.
Read More 
September 26, 2022
In the last few months, we have witnessed multiple European Data Protection offices weigh on the legitimacy of Google Analytics.
Back in January, I’ve published a post that touched on the topic but was not really about Google Analytics.
So, let’s start looking at what happened, why Google Analytics seems to be so interesting for the European Privacy authorities, and finish with some guessing on what could happen in the next few months.
Read More 
May 31, 2021
Three years passed from the moment the GDPR become binding law in the European Union.
On the one hand, I’m happy that it has already been three years, but on the other hand, I’m impatient to see GDPR fully applied.
Cookies
Cookies are always a hot theme when we talk about GDPR.
I still see websites handing out cookies (first and third parties ones) without a cookie banner or to users who have not pressed the “accept” button on the cookie banner.
Also, speaking about cookie banners, the majority are not compliant since they often make it hard to refuse cookies or pre-select cookie acceptance.
This situation is unfortunate, but we see some movement on this (like the noyb initiative).
If those initiatives continue, as I hope, next year, the cookie situation will be much better!
Read More 
May 25, 2020
As it is becoming a sort of tradition, here we are, after two years from the enactment of GDPR to see how it performs in the real world.
In our previous yearly check, we analyzed the situation from two points of view: the banners and the fines.
Let’s see how those two topics have evolved in the last year.
The Cookie Banners
On the 1st of October 2019, with the judgment in case C-673/17, the European Union Court of Justice clarified that pre-ticketed consent checkboxes are not sufficient since the consent has to be expressed actively by the user.
This requirement was clear to me since my initial approaches to the GDPR, since it was clear that this was the only way to respect the Regulation’s spirit.
Still, it is very nice to see it stated explicitly by the European Union Court of Justice.
Read More 
July 14, 2019
In the last few days, multiple fines related to privacy have been announced.
More specifically:
Even if I talk about them “collectively”, I would like to point out that the third one is very different in nature, in nature and in the jurisdiction, and therefore in the amount of the fine from the first two, which are fairly similar among them.
Read More 
May 25, 2019
One year has passed by the 25/05/2018, the day that the GDPR started to be enforced.
Today I’d like to see how this first year of GDPR went and what we could be expecting for the future given what we have seen so far.
The first consideration that I think is obvious but interesting is that the Internet did not close down on the 25/05/2018 as many were worried.
In fact, not much changed on that day.
A thing that did change a lot is the number of banners asking the authorization to give some cookies to your browser.
This increase of cookie banners is an interesting phenomenon since the differences between the EU cookie law and the GDPR on cookies are minor.
I think this phenomenon can be explained by the fact that now companies are more worried about violating those regulations than before, thanks to the massive fines that they can incur into with the GDPR.
Read More 
(Fabio Alessandro Locati|Fale)'s blog