News
Recent legal developments
Court of Justice of the EU
ECJ decisions
-
16 Jul 2026
ECJ, C-209/23 — RRC Sports
FIFA's Football Agent Regulations require agents to publish their contact details, clients, sanctions and earnings online. The Court holds that ensuring agents comply with the regulatory framework is a legitimate interest under Article 6(1)(f), but that disclosure must be limited to persons subject to a verification duty; sanctions relating to criminal offences remain subject to the control of a public authority under Article 10.
Read the decision (PDF) -
14 Jul 2026
ECJ, C-474/24 — NADA Austria e.a.
Four Austrian athletes banned from competition had their name, discipline and sanction published online by the anti-doping agency. The Court holds that such publication is a serious interference that does not always require an individual balancing test where the law itself organises it for deterrence and transparency purposes, but that naming a banned substance or method may, depending on the case, reveal health data.
Read the decision (PDF) -
9 Jul 2026
ECJ, C-199/24 — Legal Newsdesk Sweden
A paid Swedish database (Lexbase) republished criminal convictions online and refused to erase the data of a person convicted in 2011. The Court recalls that the "journalistic purposes" exemption under Article 85 GDPR can never override Chapter VIII (the right to an effective remedy), and adopts a broad — but not unlimited — reading of "journalism", covering any regular or professional editorial or adaptation work aimed at informing the public.
Read the decision (PDF) -
18 Jun 2026
ECJ, C-484/24 — NTH Haustechnik
An employer accessed a former employee's private eBay account, using a login obtained from a work computer, to prove an alleged unlawful resale of goods before a court. The Court holds that the GDPR fully applies to a court's handling of such evidence, that the relevant legal basis is the judge's legal obligation (Article 6(1)(c)) rather than legitimate interest, and that no principle of the GDPR categorically bars taking into account data previously collected unlawfully at the stage of assessing its admissibility.
Read the decision (PDF) -
18 Jun 2026
ECJ, C-414/24 — Datenschutzbehörde (parallel remedies)
A patient asked a doctor-rating platform to erase her personal data, first brought a civil erasure claim, then lodged a complaint with the Austrian supervisory authority. The Court confirms that Articles 77 to 79 GDPR create autonomous, cumulative remedies — with no hierarchy or exclusive jurisdiction between them — and that the supervisory authority remains bound to handle the complaint with due diligence even while a parallel judicial action is pending.
Read the decision (PDF)
European Data Protection Board
EDPB guidelines
-
8 Jul 2026
Guidelines 02/2026 on Anonymisation
Updated EDPB guidance on when personal data can genuinely be considered anonymised — and therefore fall outside the GDPR's scope — covering the re-identification risk criteria and the techniques (aggregation, generalisation, noise addition) that controllers can use to support an anonymisation claim.
EDPB page -
8 Jul 2026
Guidelines 03/2026 on web scraping in the context of generative AI
New EDPB guidelines addressing the collection of personal data from the open web to train or operate generative AI systems — legal basis, transparency towards data subjects, and the safeguards expected from organisations that scrape or reuse scraped datasets.
EDPB page -
7 Jul 2026
Guidelines on processing of personal data through blockchain technologies (v2, final)
Final version of the EDPB's guidance on applying GDPR principles — controllership, data minimisation, the right to erasure — to blockchain-based processing, where the technology's immutability can conflict with core data subject rights.
EDPB page -
16 Apr 2026
Guidelines 1/2026 on processing of personal data for scientific research purposes
Guidance clarifying the GDPR's research-specific rules (further processing compatibility, broad consent, the derogations available to research bodies) and how they interact with sector rules such as the Clinical Trials Regulation.
EDPB page -
19 Jan 2026
Recommendations 1/2026 on Processor Binding Corporate Rules (Art. 47 GDPR)
Recommendations on the application and approval process for Processor Binding Corporate Rules, and the elements and principles supervisory authorities expect to find in a Processor BCR submission.
EDPB page
Belgian Data Protection Authority
APD decisions
-
16 Jul 2026
Settlement decision no. 163/2026
Complaint about unsolicited direct marketing e-mails received after buying a ticket from an entertainment-sector controller. The Litigation Chamber validates, under Article 95, § 1, 2° WOG, the settlement accepted by the respondent on 15 July 2026.
Read the decision (PDF) -
8 May 2026
Decision on the merits no. 99/2026 — transparency & right of access
Complaint about breaches of the transparency principle and the right of access. The Litigation Chamber imposes a €2,520 fine for breaches of Articles 5(1)(a), 12 and 13 GDPR (transparency) and a separate €2,400 fine for breaches of Articles 12(2), 12(4) and 15 GDPR (right of access), and orders the respondent to comply with the complainants' access request within one month.
Read the decision (PDF) -
12 May 2026
Decision on the merits no. 102/2026 — Société Wallonne des Eaux
Complaint about the recording and monitoring of calls for quality assessment and training purposes. The Litigation Chamber publishes the decision with the respondent's identity, noting that some of the unlawful practices had not yet ceased and that publication supports compliance with the orders issued.
Read the decision (PDF) -
2026
Decision on the merits no. 101/2026
Complaint about the closure — allegedly in breach of the GDPR — of an independent consultant's professional mailbox after the end of her assignment, raising grievances under Articles 5, 6, 12, 13, 24 and 25 GDPR. The Litigation Chamber imposes an administrative fine that is proportionate, effective and dissuasive within the meaning of Article 83 GDPR.
Read the decision (PDF) -
11 May 2026
Decision on the merits no. 100/2026 — CCTV in a co-owned residence
Complaint by a co-owner about CCTV surveillance of a residential building. The Litigation Chamber issues a reprimand for breaches of the lawfulness and transparency principles (right of access) and for the absence of a processor agreement covering the footage (Art. 28(3) GDPR), while dismissing the complaint against the second respondent.
Read the decision (PDF)
Belgian Data Protection Authority
APD recommendations
-
2026
Own-initiative recommendation 01/2026 — direct marketing (final version)
Final version of the APD's recommendation on personal data processing carried out in the context of direct marketing activities.
Read the recommendation (PDF) -
2025
Direct marketing checklist
Practical checklist accompanying recommendation 01/2026, allowing an at-a-glance review of the main points to address for a compliant direct marketing processing.
Read the checklist -
11 Dec 2023
Own-initiative recommendation no. 01/2023
Recommendation on providing copies of electoral registers to political parties in the context of election operations.
Read the recommendation (PDF) -
1 Dec 2021
Recommendation 01/2021 — biometric data
APD recommendation on the processing of biometric data, setting out the lawfulness conditions and safeguards expected for this category of sensitive data.
Read the recommendation (PDF) -
11 Dec 2020
Recommendation no. 03/2020 — data sanitisation and media destruction
Recommendation on data sanitisation (secure erasure) techniques and the destruction of media containing personal data.
Read the recommendation (PDF)