Brazil was the partner country at this year’s HANNOVER MESSE. The trade fair was opened three weeks ago by Chancellor Merz and President Lula in person. Brazil was represented more strongly than any partner country before it. Ahead of the fair, the Brazilian Embassy invited selected guests from business, politics and academia to a formal […]
GDPR
AEPD’s Asesora Brecha: A Practical Tool for Article 33 GDPR Breach Notification Decisions
One of the most time-sensitive obligations under the GDPR is the requirement for data controllers to notify their supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons (Art. 33 para. 1 […]
The CNIL on AI and Data Subject Information: A Practical Guide for Organizations
The information obligation on the processing of personal data is a requirement that persists whenever a processing is performed. This does not exclude the processing of personal data for the purposes of AI models or system development. Those are the cases, for example, where personal data can be used to train the AI model. Last […]
When Access Requests Become Abusive: Key Takeaways from C-526/24 Brillen Rottler
The Court of Justice of the European Union (CJEU) has clarified in Brillen Rottler (C-526/24) that, in exceptional circumstances, even a first data subject access request (DSAR) may be refused as “manifestly unfounded or excessive” under Article 12 para. 5 GDPR. This is an important development. However, the judgment should not be misunderstood. The Court […]
Unlawful Profiling and Poor Transparency: Key Takeaways from the Garante’s Fine Against Intesa Sanpaolo
The Italian Data Protection Authority (Garante) has imposed a €17.6 million fine on Intesa Sanpaolo, one of the largest banking groups in Italy, for unlawful processing of personal data affecting approximately 2.4 million customers in the context of their transfer to the digital bank Isybank. What makes this case particularly relevant is not only its […]
Spanish AEDP v FC Barcelona: DPIA Required for Processing Biometric Data
The Spanish Data Protection Authority (AEPD) recently imposed a €500,000 fine on Fútbol Club Barcelona for failing to properly conduct a Data Protection Impact Assessment (DPIA) when implementing biometric systems used during the club’s membership census process. This complex decision ultimately focuses on Article 35 GDPR, with the AEPD concluding that the club failed to […]
Biometric Data: Key GDPR Lessons from an AEPD Decision
The Spanish Data Protection Authority (AEPD) recently imposed a €950,000 fine on a company offering digital identity and age verification services that rely on facial analysis technology. The decision is particularly relevant for organisations deploying facial analysis technologies, including AI-based age estimation and identity verification systems that generate biometric templates, as it illustrates how regulators […]
Italian DPA Orders Amazon Entity to Stop Unlawful Employee Data Processing
The Italian Data Protection Authority (Garante per la protezione dei dati personali) has issued an urgent order with immediate effect requiring Amazon Italia Logistica S.r.l. to stop processing personal data relating to more than 1,800 employees at one of its logistics facilities. The investigation revealed multiple violations from a data protection perspective. In particular, the […]
AI Logging Under the EU AI Act: The Compliance Infrastructure Behind High-Risk Systems
When organizations prepare for the EU ArtificiaI Intelligence Regulation (or AI Act), the conversation usually gravitates toward high-level themes: ethical frameworks, bias mitigation, and human oversight. However, one of the most compelling obligations is remarkably easy to overlook: the requirement for systematic record-keeping through logs. While logs are usually treated as a technical byproduct of […]
EU-Brazil Adequacy Decisions: What Changes in Practice
On 26 January 2026, Brazil and Europe adopted mutual adequacy decisions regarding international transfers of personal data. The European Commission adopted an adequacy decision for Brazil under Article 45 GDPR, enabling transfers from the EU to Brazil. The Brazilian data protection authority (ANPD) adopted Resolution No. 32/2026 recognizing the EU as providing an adequate level […]
Digital Omnibus Part 2: What Organisations Need to Know About the Joint Opinion of EDBP and EDPS
The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have published their Joint Opinion (the Joint Opinion) on the European Commission’s Digital Omnibus Proposal (the Proposal). Following our earlier analysis (Part 1) of the Proposal itself, this article examines how key elements of the reform are viewed by these supervisory bodies. […]
Reading Between the Lines of the Italian DPA’s 2026 Inspection Plan
With its Resolution of 30 December 2025, the Italian Data Protection Authority (Garante per la protezione dei dati personali) published its inspection plan for the period January to July 2026. The plan sets out the Authority’s inspection focus for the first semester of the year and provides for at least 40 targeted inspections across the […]
EU Data Act: Practical Guidance from the Dutch AP’s Newsletter
The Data Act entered into force on 12 September 2025, and in the Netherlands its national Implementation Act (Dataverordening, Dv) followed on 21 November 2025. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) published a newsletter this week explaining what the Data Act means in practice, particularly for organisations that work with data from connected […]
Finally Here: The Digital Omnibus Proposal and Practical Implications for Organisations Through the Lens of GDPR
The European Commission’s Digital Omnibus Package Proposal (the Proposal) represents one of the most comprehensive realignments of the EU’s digital regulatory landscape since the introduction of the GDPR. This comes in addition to the changes the European Commission proposed in May 2025 under Omnibus IV. The long-awaited text, leaked during the previous weekend and now […]
CNIL Fines Samaritaine €100,000 for Hidden Cameras: A Legal Analysis
On 18 September 2025, the French Data Protection Authority (CNIL) issued Deliberation SAN-2025-008, imposing a €100,000 fine on Samaritaine SAS for clandestinely installing surveillance cameras in employee areas. In August 2023, in response to a rise in stockroom thefts, the company installed five hidden cameras disguised as smoke detectors. The devices also recorded audio. Within […]