{"id":87538,"date":"2026-10-01T11:21:28","date_gmt":"2026-10-01T09:21:28","guid":{"rendered":"https:\/\/www.lexxion.eu\/?post_type=dpi&#038;p=87538"},"modified":"2026-10-01T11:21:37","modified_gmt":"2026-10-01T09:21:37","slug":"data-protection-insider-issue-160","status":"publish","type":"dpi","link":"https:\/\/www.lexxion.eu\/en\/dpi\/data-protection-insider-issue-160\/","title":{"rendered":"Data Protection Insider, Issue 160"},"content":{"rendered":"<p><strong><em>Table of Contents:<\/em><\/strong><\/p>\n<ul>\n<li><a href=\"#AG Spielman Clarifies Requirements on Consent for Direct Marketing Purposes\">AG Spielman Clarifies Requirements on Consent for Direct Marketing Purposes<\/a><\/li>\n<li><a href=\"#EDPB Releases New Opinions\">EDPB Releases New Opinions<\/a><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>In the present edition, we inform our readers of one AG Opinions and two new documents published by the EDPB. In the AG Opinion, AG Spielmann analysed the requirements on consent for direct marketing purposes when a controller indirectly collects the data. The EDPS published new documents on the interplay between the DSA and the GDPR and on administrative fines.<\/p>\n<h2 id=\"AG Spielman Clarifies Requirements on Consent for Direct Marketing Purposes\">AG Spielmann Clarifies Requirements on Consent for Direct Marketing Purposes<\/h2>\n<p>On 17th September, AG Spielmann advised the CJEU to rule that when controllers receive personal data from another controller for direct marketing purposes, they need to obtain a \u201cfresh\u201d consent where the first controller did not mention the identity of the receiving controllers in Groupe Canal + SAS. As to the facts of the case, the applicant in the main proceedings (Groupe Canal +) appealed against a CNIL decision, imposing a fine on it for not having obtained consent, under Article 13 e-Privacy Directive (as transposed in national law) and Article 7(1) GDPR, for direct marketing purposes. In fact, the data subjects had given their consent to two ISPs to which they subscribed to transmit their data to undefined third \u201cpartners\u201d for direct marketing purposes. The CNIL decided that this does not fulfil the requirements on consent. Thus, the preliminary ruling question raised by the referring court seeks guidance on \u201cthe conditions under which an operation involving the subsequent processing of personal data by a different controller may be based on the initial consent given at the time those data were collected\u201d for direct marketing purposes in the framework of the e-Privacy Directive. AG Spielmann started his analysis by examining the requirements on consent in Article 4(11) GDPR, combined with the right to information as anchored in Articles 13 GDPR (when data are directly collected by the controller, <em>in casu<\/em> the ISPs) and Article 14 GDPR (when data are indirectly collected, <em>in casu<\/em> by Groupe Canal +). He concluded that because the concerned individuals did not know the identity of the new controllers, they were not effectively informed about the processing, which also makes the processing unfair and non-transparent under Article 5(1)(a) GDPR. Thus, he concluded that \u201cthe data subject\u2019s consent given to a primary collector for his or her data to be used by a category of recipients who are designated as the primary collector\u2019s \u2018partners\u2019, but whose identity was not known to the data subject at the time consent was given to the primary collector, cannot be regarded as informed consent permitting any person belonging to that category of recipients to carry out commercial marketing activities by electronic means without first obtaining fresh consent from the data subjects before carrying out such commercial marketing activities in relation to them\u201d. AG Spielmann proposed two more approaches in case the Court disagrees with his reasoning and conclusion: (1) \u201cto consider that there is no link between, on the one hand, whether consent is sufficiently informed and, on the other hand, the degree of precision of the concept of a \u2018category\u2019 of recipients\u201d, in which case it should be considered the Groupe Canal + had obtained lawful consent, and (2) the preferred approach by AG Spielmann, according to which \u201ceven in the absence of information regarding the specific identity of the data controller responsible for the direct marketing activity, it would still be necessary to be able to identify that party in order to carry out direct marketing without obtaining fresh consent. The degree of precision of the concept of \u2018category of recipients\u2019 could therefore be significant\u201d. Following that approach, <em>in casu<\/em>, a \u201cfresh\u201d consent would still be needed.<u> <a href=\"#[1]\">[1]<\/a><\/u><\/p>\n<h2 id=\"EDPB Releases New Opinions\">EDPB Releases New Opinions<\/h2>\n<p>Over the past couple of weeks, the EDPB published the following significant documents:<\/p>\n<ul>\n<li>\u201cGuidelines 3\/2025 on the interplay between the DSA and the GDPR\u201d (Version 2.0);<a href=\"#[2]\"> [2]<\/a><\/li>\n<li>\u201cGuidelines 04\/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR\u201d. <a href=\"#[3]\">[3]<\/a><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h4><strong>Notes:<\/strong><\/h4>\n<p><a id=\"[1]\" href=\"https:\/\/infocuria.curia.europa.eu\/tabs\/document\/C\/2025\/C-0317-25-00000000RP-01-P-01\/CONCL\/326756-EN-1-html\" target=\"_blank\" rel=\"noopener\"><u>[1] <\/u>https:\/\/infocuria.curia.europa.eu\/tabs\/document\/C\/2025\/C-0317-25-00000000RP-01-P-01\/CONCL\/326756-EN-1-html<\/a><\/p>\n<p><a id=\"[2]\" href=\"https:\/\/www.edpb.europa.eu\/documents\/guideline\/guidelines-32025-on-the-interplay-between-the-dsa-and-the-gdpr_en\" target=\"_blank\" rel=\"noopener\">[2] https:\/\/www.edpb.europa.eu\/documents\/guideline\/guidelines-32025-on-the-interplay-between-the-dsa-and-the-gdpr_en<\/a><\/p>\n<p><a id=\"[3]\" href=\"https:\/\/www.edpb.europa.eu\/documents\/guideline\/guidelines-042026-on-the-application-of-the-power-to-impose-administrative_en\" target=\"_blank\" rel=\"noopener\">[3] https:\/\/www.edpb.europa.eu\/documents\/guideline\/guidelines-042026-on-the-application-of-the-power-to-impose-administrative_en<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Table of Contents: AG Spielman Clarifies Requirements on Consent for Direct Marketing Purposes EDPB Releases [&hellip;]<\/p>\n","protected":false},"author":144,"featured_media":87545,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","dpi-category":[],"dpi-tag":[],"class_list":["post-87538","dpi","type-dpi","status-publish","has-post-thumbnail","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/87538","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi"}],"about":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/types\/dpi"}],"author":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/users\/144"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/comments?post=87538"}],"version-history":[{"count":2,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/87538\/revisions"}],"predecessor-version":[{"id":87548,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/87538\/revisions\/87548"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media\/87545"}],"wp:attachment":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media?parent=87538"}],"wp:term":[{"taxonomy":"dpi-category","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-category?post=87538"},{"taxonomy":"dpi-tag","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-tag?post=87538"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}