The de la Torre Review (Page 7)

Home
GDPR
EU AI Act
About

Sign in Subscribe

More issues

What is the "Right to Rectification" under the GDPR?

The GDPR's right to rectification allows individuals to have inaccurate personal data corrected and incomplete data completed. This article explains Article 16, how to handle rectification requests, response deadlines, verification requirements, and when controllers may refuse a request.

22 Feb 2019 6 min read

What is the "Right to Restrict Processing" under the GDPR?

The GDPR's right to restrict processing allows individuals to require organizations to temporarily limit the use of their personal data. This article explains Article 18 GDPR, when the right applies, controller obligations, exceptions, deadlines, and practical compliance tips.

22 Feb 2019 10 min read

What Is the “Right to Be Informed” Under the GDPR?

The GDPR's right to be informed requires organizations to be transparent about how they collect, use, and share personal data. This article explains Articles 13 and 14, outlines key disclosure requirements, highlights best practices, and examines the main exceptions to this obligation.

21 Feb 2019 6 min read

What is the "Right to Erasure" (or "Right to be Forgotten") under the GDPR?

The GDPR's right to erasure, also known as the right to be forgotten, allows individuals to request the deletion of their personal data in specific circumstances. This guide explains when the right applies, its exceptions, controllers' obligations, response deadlines, and practical compliance tips.

21 Feb 2019 9 min read

What are "Legitimate Interests" under the GDPR?

Legitimate interests is the GDPR's most flexible lawful basis, but it requires careful analysis. This practical checklist walks through the Legitimate Interests Assessment (LIA), balancing test, documentation requirements, and safeguards organizations should consider before relying on this basis.

05 Feb 2019 8 min read

What is "Public Task" under the GDPR?

The GDPR's public task lawful basis permits processing when it is necessary to perform a task in the public interest or exercise official authority established by law. Learn who can rely on this basis, its legal requirements, the necessity test, and the documentation controllers should maintain.

05 Feb 2019 2 min read

What is "Vital Interest" under the GDPR?

The GDPR's vital interests lawful basis is reserved for exceptional situations where processing is necessary to protect someone's life. Learn when this narrow legal basis applies, why necessity is essential, its limits for special category data, and the documentation controllers should maintain.

05 Feb 2019 2 min read

What is "Legal Obligation" under the GDPR?

The GDPR's legal obligation lawful basis allows organizations to process personal data when doing so is necessary to comply with an obligation imposed by EU or Member State law. Learn when it applies, why contracts alone are insufficient, and the documentation organizations should maintain.

05 Feb 2019 2 min read

What is "Contractual Necessity" under the GDPR?

When can organizations rely on contractual necessity as a lawful basis under the GDPR? This article explains when Article 6(1)(b) applies, what qualifies as a contract, why necessity must be interpreted narrowly, and the common mistakes organizations make when relying on this lawful basis.

05 Feb 2019 4 min read

What are "Special Categories of Data" under the GDPR?

Special category data receives enhanced protection under the GDPR due to its sensitive nature. This article explains what qualifies as special category data, the relationship between Articles 6 and 9, the Article 9 processing conditions, and the safeguards controllers should apply.

05 Feb 2019 3 min read

About

The de la Torre Review

Privacy, tech & AI insights from Lydia de la Torre, Santa Clara Law Professor and Director of Privacy Initiatives, covering U.S., EU & global privacy law.

Sign up now to get access to the library of members-only issues.

jamie@example.com

Featured

Alabama Subpoenas OpenAI After Autonomous AI Agent Escapes Testing Environment and Hacks Hugging Face

Alabama subpoenas OpenAI after an autonomous AI agent escaped a testing environment and hacked Hugging Face. The investigation offers an early look at how existing consumer protection law may regulate AI safety, agentic behavior, and governance.

25 Aug 2026 6 min read

New Jersey’s Bot Disclosure Law Explained: When Automated Accounts Must Identify Themselves

New Jersey’s bot disclosure law requires certain automated accounts to identify themselves when communicating with people in the state about commercial transactions, real estate, or elections. Learn who and what the law covers, when disclosure is required, and how to comply.

24 Aug 2026 7 min read

Nebraska’s Conversational AI Safety Act: New Rules for Chatbots, Minors, and AI Safety

Nebraska’s Conversational AI Safety Act regulates certain public-facing AI services, imposing transparency requirements, heightened protections for minors, self-harm response protocols, and other safeguards. The Act’s key provisions become operative July 1, 2027.

21 Aug 2026 8 min read

In the Matter of LocateSmarter, LLC

A practical analysis of CalPrivacy’s LocateSmarter decision, addressing data broker registration, the CCPA’s data minimization principle, and why businesses cannot require consumers to provide sensitive personal information to exercise the right to opt out of sale or sharing.

10 Aug 2026 9 min read

California’s AI Training Data Transparency Law: What Generative AI Developers Must Disclose

California’s AI Training Data Transparency Law requires generative AI developers to disclose key information about training datasets, including their sources, contents, use of personal information, licensing, modifications, collection periods, and synthetic data.

01 Jan 2026 11 min read

Topics

Access Controls

Accountability

Accuracy

Adequacy Decisions

Advertising

Aggregated Data

AI Agents

AI Deployers

AI Developer

AI Distributors

AI Governance

AI Importers

AI model

AI Operators

AI Providers

AI system

AI Systems

AI Training

Alabama

Algorithmic Accountability

Anonymization

Application Programming Interface (API)

Archiving

Arkansas

Article 29 Working Party (WP29)

Artificial Intelligence (AI)

Attorneys General (AGs)

Audits

Authorized representatives

Automated Calls

Automated Decision-Making Technology (ADMT)

Balancing Test

Binding Corporate Rules (BCRs)

Biometric Data

Blockchain

California

California Consumer Privacy Act (CCPA)

California Delete Act

California Financial Information Privacy Act (CalFIPA)

California Online Privacy Protection Act (CalOPPA)

California Privacy Rights Act (CPRA)

CalPrivacy

Caselaw

Certifications

ChatBots

Children

CIA triad

Codes of Conduct

Colorado

Colorado Privacy Act (CPA)

Commercial Speech

Compatible Purposes

Consent

Constitutional Privacy

Contractual Necessity

Contractual Requirements

Controller

Convention 108

Council of Europe (CoE)

Court of Justice of the European Union (CJEU)

Cross-Border Data Transfers

Cybersecurity

Dark Patterns

Data Breach

Data Brokers

Data Mapping

Data Minimization

Data Processing Agreement (DPA)

Data Protection Directive, Directive 95/46/EC

Data Protection Impact Assessment (DPIA) / Privacy Impact Assessment (PIA)

Data Protection Law

Data Protection Officer (DPO)

Data Provenance

Data Retention

Data Subject

Deceptive Practice

Delete Request and Opt-out Platform (DROP)

Discrimination

Do-not-track

Education and Training

Encryption

ePrivacy Directive

Establishment

EU

EU AI Act

EU Representative

European Convention on Human Rights (ECHR)

European Court of Human Rights (ECtHR)

European Data Protection Board (EDPB)

European Data Protection Board (EDPB)

European Data Protection Seal

Extraterritoriality

Facial Recognition

Fairness

Filing System

Financial Privacy

First Amendment

FTC

GDPR

Generative AI

Subscribe to The de la Torre Review

Don’t miss out on the latest issues. Sign up now to get access to the library of members-only issues.

jamie@example.com

The de la Torre Review © 2026

Sign up

Powered by Ghost