CLAIM-2026-10-09-12
GDPR Article 25 is titled "Data protection by design and by default"; 25(2) requires measures ensuring that by default only personal data necessary for each specific purpose are processed, and that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.
Why it matters
Carries the 2026-10-09-the-hook-that-let-it-through edition's argument about a control plane that defaults to permissive.
Sources
- gdprinfoeu2026data
- eurlex2016regulatio