A legal obligation to process personal data arising under the laws of a non-EU jurisdiction (e.g., an obligation arising under US law) does not provide a lawful basis for processing personal data.

DeepMind's inaugural data-sharing deal with the UK's National Health Service looks to be coming firmly unstuck.

A Dutch court has found Facebook did not have a lawful basis to process local users' data for ad targeting.