The GDPR is a challenging framework. It is also in constant development

The GDPR is subject to ongoing interpretation and guidance by various actors, such as the EDPB, the Court of Justice of the European Union (CJEU) and national regulators. Accordingly, it is imperative for organisations to stay informed and up-to-date on such a dynamic data protection landscape.

In the case of ND v DR (Case C-21/23) for instance, the CJEU was asked to determine inter alia whether personal data (such as name, delivery address and product details) entered online by customers for ordering pharmacy-only medicines amounted to health data under Article 9(1) of the GDPR. The CJEU in this regard ruled that such data would indeed qualify as ‘data concerning health’ under the GDPR on the basis that:

1. First, a broad interpretation is required to ensure a high level of protection of the fundamental rights and freedoms of natural persons (especially for sensitive information) and 

2. Second, “even if such medicinal products are intended for persons other than the customers, it may be possible to identify those persons and draw conclusions about their health status”.

Moreover, in the case of Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens (Case C-621/22), the CJEU was asked to interpret what constitutes legitimate interests in terms of the GDPR. Specifically, the KNLTB - which is the Royal Dutch Lawn Tennis Association - had shared personal data of its members to two sponsors in exchange for payment, arguing that such sharing was carried out on the basis of its legitimate interest. In this regard, the CJEU argued that a legitimate interest ‘is not limited to interests enshrined in and determined by law’ but rather must be a lawful interest. It then ruled that a commercial interest ‘which consists in the promotion and sale of advertising space for marketing purposes’ can be considered as a legitimate interest provided that necessary safeguards are in place.

Data and digital regulations are evolving. A coherent compliance strategy should be favoured over siloed practices.

Technology is fast-moving, and while it is creating many opportunities for innovation, this constant evolution has also brought a multifaceted regulatory environment that European organisations must get right.

Besides the GDPR, organisations for instance need to also understand the interplay between applicable data protection rules (such as those governing consent) and the provisions of the ePrivacy Directive when deploying tracking technologies such as cookies and beacons on the terminal equipment of end users. In October 2024, the EDPB revisited its Guidelines 2/2023 related to the ePrivacy Directive due to the emergence of new tracking methods and tools such as ‘intermittent and mediated Internet-of-Things (IoT) reporting’. 

The cyber regulatory landscape has also gone through a major shift after Directives such as the NIS2 and the CER entered into force, key rules which aim to enhance the cyber risk management requirements and strengthen critical infrastructures against physical threats respectively. On 17 January 2025, the Digital Operational Resilience Act (DORA) started to apply to in-scope European financial entities, requiring them inter alia to maintain a robust third-party risk management framework through appropriate contractual clauses and registers of information.  

The Digital Services Act (DSA) and the Digital Markets Act (DMA) are legislative initiatives that seek to create a safer and more equitable digital space. While the DSA focuses on increasing transparency and accountability of intermediary service providers such as online platforms, the DMA aims to prevent anti-competitive practices by large digital gatekeepers. Together, these acts form part of the EU’s Digital Services Act Package.