The full corpus — beyond today's front page.
65 results · page 2 of 3
France's data protection authority, the CNIL, fined IT and engineering firm EXTIA €300,000 for violating individuals' rights under GDPR, including failures around transparency and the right to erasure. The case originated from complaints filed by former employees in 2024.
Who should care: Lawyers · Privacy officers · Compliance · AI governance · General readers · Policy
France's data protection authority, the CNIL, fined IT and engineering firm EXTIA €300,000 following complaints from former employees about violations of transparency requirements and the right to erasure under GDPR. The July 2026 decision found the company failed to respect individuals' rights over their personal data.
Who should care: Lawyers · Privacy officers · Compliance · AI governance · General readers · Policy
A coalition of 19 civil society groups, businesses, and academics has published an open letter urging EU institutions to support legally binding automated privacy signals as part of the Digital Omnibus package — a mechanism that would let people set privacy preferences once instead of clicking through cookie banners repeatedly. The tracking industry is opposing the proposal.
Who should care: Lawyers · Privacy officers · AI governance · Cybersecurity · General readers · Policy
France's data protection authority, the CNIL, fined Hôpital Privé de la Loire €500,000 after an attacker gained unauthorized access to its centralized patient records system in the summer of 2025. The hospital was found to have violated GDPR rules on both security of processing and notifying affected patients of the breach.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · Healthcare professionals · General readers · Policy
France's data protection authority, the CNIL, fined Hôpital Privé de la Loire €500,000 after an attacker gained unauthorized access to its centralized patient records system in summer 2025. The hospital was found in violation of GDPR rules on security of processing and breach notification to affected individuals.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · Healthcare professionals · General readers · Policy
A study found that 86% of licensed UK gambling websites appear to be violating GDPR by nudging users toward accepting tracking, and in many cases harvesting data before any consent is given. The research accuses the industry of widespread non-compliance and what it describes as systematic data surveillance of customers.
Who should care: Lawyers · Privacy officers · AI governance · Compliance · Cybersecurity · General readers · Policy
A new analysis examines how the GDPR and the EU AI Act interact when it comes to AI-powered medical chatbots, focusing on what rights patients hold under both frameworks.
Who should care: Lawyers · Privacy officers · AI governance · Administrators · General readers · Policy
Austria's Supreme Court has ruled that credit reference agency CRIF violated GDPR's purpose limitation principle by collecting personal data from address publishers without a lawful basis. The decision, secured before a full hearing, strengthens a parallel class action brought by privacy group noyb on behalf of millions of affected Austrians.
Who should care: Lawyers · Privacy officers · AI governance
German privacy group noyb has sent a cease-and-desist letter to credit agency SCHUFA after investigations revealed it retained millions of records that should have been deleted, and used them for customer testing. Noyb has opened an interest list for a class action, with up to 69 million people potentially affected.
Who should care: Lawyers · Privacy officers · AI governance
The UK Information Commissioner's Office has formally reprimanded ACRO Criminal Records Office for violating UK GDPR security requirements following a data breach. ACRO is a national police unit that handles sensitive records including criminal history, Police Certificates, and International Child Protection Certificates.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · AI governance
The European Data Protection Board has released draft guidelines on anonymization, offering new technical and legal benchmarks for when data can be considered truly anonymous and therefore outside the scope of GDPR obligations. The guidelines are aimed at clarifying a standard that organizations have long applied inconsistently.
Who should care: Lawyers · Privacy officers · AI governance
The EU AI Act is shaping how companies outside Europe build and deploy AI systems, as firms seeking access to the EU market must comply with its requirements regardless of where they are headquartered. This regulatory reach mirrors the pattern seen with GDPR, where European rules effectively became a global baseline.
Who should care: AI governance · Lawyers · Administrators · General readers · Policy
Privacy advocacy group noyb has filed a GDPR complaint against the online dictionary dict.cc, alleging that the site uses a single-click consent button to grant data access to 1,741 advertising and tracking partners. The complaint argues that bundling that many recipients into one click makes it impossible for users to give the informed, specific consent the GDPR requires.
Who should care: Lawyers · Privacy officers · Compliance · AI governance · Cybersecurity · General readers · Policy
At a July 2026 meeting in Dublin, the European Data Protection Board called for an explicit legal foundation governing how data protection authorities share information with regulators outside their jurisdiction. The EDPB also discussed deepening cooperation among DPAs to strengthen consistent GDPR enforcement across the EU.
Who should care: Lawyers · Privacy officers · AI governance · Compliance · General readers · Policy
The European Data Protection Board has issued a binding decision requiring the Belgian Data Protection Authority to rule on the substance of a cookie banner complaint filed by NOYB against Flemish public broadcaster VRT. The dispute arose after the Belgian DPA, acting as lead supervisory authority, submitted a draft decision that did not address the merits of the case.
Who should care: Lawyers · Privacy officers · Compliance · AI governance · General readers · Policy
A commentary from the IAPP argues that web scraping used to build generative AI training datasets falls within the scope of GDPR, meaning the collection and processing of personal data found online is not exempt simply because it occurs at scale or at the infrastructure level.
Who should care: Lawyers · Privacy officers · AI governance · General readers · Policy
The Center for Democracy and Technology has published a visual guide mapping out how individuals can seek redress for harms caused by AI systems under the GDPR. The resource appears aimed at helping people and advocates understand which legal pathways are available when AI causes harm covered by European data protection law.
Who should care: Lawyers · Privacy officers · AI governance · General readers · Policy
The IAPP's European conference addressed three converging themes: stronger protections for children online, efforts to simplify compliance frameworks, and the latest developments in how GDPR is being interpreted and enforced across the EU.
Who should care: Lawyers · Privacy officers · AI governance
The European Data Protection Board has released an updated case digest compiling significant One-Stop-Shop decisions related to individuals' rights to object and to erasure under GDPR, drawn from its public register and developed through its inter-DPA cooperation program.
Who should care: Lawyers · Privacy officers · AI governance · General readers · Policy
EU data protection authorities are continuing to enforce GDPR requirements around the designation of local representatives for non-EU companies doing business in Europe. The trend signals that regulators are treating this structural compliance obligation as a live enforcement priority, not a paper formality.
Who should care: Lawyers · Privacy officers · Compliance · AI governance
The European Data Protection Board has introduced a dedicated online form allowing stakeholders to flag discrepancies in how GDPR is interpreted or enforced across EU member states, including gaps between national supervisory authorities and EDPB positions. The initiative stems from commitments made in the EDPB's Helsinki Statement on clarity and engagement.
Who should care: Lawyers · Privacy officers · Compliance · AI governance
The European Commission proposed replacing cookie consent banners with automated browser-based signals as part of its Digital Omnibus simplification package. However, Google and several EU member states, including Germany and France, have pushed back against the change, apparently preferring the current banner system.
Who should care: Lawyers · Privacy officers · AI governance · Compliance · General readers · Policy
The European Data Protection Board has launched a redesigned website and updated brand identity, marking a communications refresh for the EU body responsible for consistent GDPR enforcement and guidance across member states since 2018.
Who should care: Lawyers · Privacy officers · AI governance · Compliance · General readers · Policy
European regulators are preparing guidance aimed at clarifying how the GDPR and the EU AI Act interact, offering a preview of the framework that will govern personal data use within AI systems across the bloc.
Who should care: Lawyers · Privacy officers · AI governance · Administrators · General readers · Policy