Processing of Personal Data That May Indirectly Reveal Sensitive Information on the Basis of a Legal Obligation: The CJEU Draws the Contours | Data Law Insights
Briefly

The Court of Justice of the European Union (CJEU) confirmed that for a national law to provide a legal basis for data processing under GDPR, it must pursue a public interest purpose and be proportionate to that legitimate aim.
In its ruling, the CJEU emphasized that even non-sensitive data that may reveal sensitive information deserve strong protections, underscoring the broader scope of the GDPR's protective measures.
Read at Data Law Insights
[
|
]