The full corpus — beyond today's front page.
47 results · page 1 of 2
Employers in the EU using AI-powered recruitment tools face obligations under both GDPR and the EU AI Act, which together impose rules on how candidate data is collected, processed, and used in automated hiring decisions.
Who should care: Lawyers · Privacy officers · AI governance · Administrators · General readers · Policy
Ireland's Data Protection Commission fined Google €403 million on September 21, 2026, following an inquiry into how the company handled location data. The decision included a compliance order and found violations of GDPR rules on lawful processing, data principles, and transparency obligations.
Who should care: Lawyers · Privacy officers · Compliance · AI governance · General readers · Policy
Spain's data protection authority fined Securitas Direct €100,000 after the security company directed people to a paid-rate phone number to exercise their GDPR rights. A consumer association brought the complaint, citing video surveillance notices that routed access and objection requests through a chargeable 902 number.
Who should care: Lawyers · Privacy officers · Compliance · AI governance · Cybersecurity · General readers · Policy
Ireland's Data Protection Commission has fined Google 403 million euros, closing an inquiry that began in 2020 into how the company handled users' location data. The case is one of several large enforcement actions brought against major tech companies under the EU's GDPR framework.
Who should care: Lawyers · Privacy officers · Compliance · General readers · Policy
Ireland's Data Protection Commission has fined Google €403 million for breaching GDPR rules around how it processed users' location data. The fine is one of the larger penalties issued under Europe's data protection framework.
Who should care: Lawyers · Privacy officers · Compliance · AI governance · General readers · Policy
The European Data Protection Board has adopted two sets of guidelines: one standardizing how national data protection authorities decide when and how to impose fines under the GDPR, and another clarifying how the Digital Services Act and the GDPR interact with each other.
Who should care: Lawyers · Privacy officers · Compliance · AI governance · General readers · Policy
Ireland's Data Protection Commission has fined Google €403 million for violations related to how the company processed users' location data. The fine comes from the EU's lead privacy regulator for Google under the GDPR framework.
Who should care: Lawyers · Privacy officers · Compliance · General readers · Policy
A leaked document from the Irish EU Council Presidency proposes making personal data use automatically lawful whenever it occurs 'in the context of AI,' effectively removing GDPR protections to benefit companies like OpenAI, Google, Meta, and Anthropic. Multiple EU member states are reported to informally support the measure.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · AI governance · General readers · Policy
France's data protection authority, the CNIL, fined IT and engineering firm EXTIA €300,000 following complaints from former employees about violations of transparency requirements and the right to erasure under GDPR. The July 2026 decision found the company failed to respect individuals' rights over their personal data.
Who should care: Lawyers · Privacy officers · Compliance · AI governance · General readers · Policy
A coalition of 19 civil society groups, businesses, and academics has published an open letter urging EU institutions to support legally binding automated privacy signals as part of the Digital Omnibus package — a mechanism that would let people set privacy preferences once instead of clicking through cookie banners repeatedly. The tracking industry is opposing the proposal.
Who should care: Lawyers · Privacy officers · AI governance · Cybersecurity · General readers · Policy
France's data protection authority, the CNIL, fined Hôpital Privé de la Loire €500,000 after an attacker gained unauthorized access to its centralized patient records system in summer 2025. The hospital was found in violation of GDPR rules on security of processing and breach notification to affected individuals.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · Healthcare professionals · General readers · Policy
A study found that 86% of licensed UK gambling websites appear to be violating GDPR by nudging users toward accepting tracking, and in many cases harvesting data before any consent is given. The research accuses the industry of widespread non-compliance and what it describes as systematic data surveillance of customers.
Who should care: Lawyers · Privacy officers · AI governance · Compliance · Cybersecurity · General readers · Policy
A new analysis examines how the GDPR and the EU AI Act interact when it comes to AI-powered medical chatbots, focusing on what rights patients hold under both frameworks.
Who should care: Lawyers · Privacy officers · AI governance · Administrators · General readers · Policy
Austria's Supreme Court has ruled that credit reference agency CRIF violated GDPR's purpose limitation principle by collecting personal data from address publishers without a lawful basis. The decision, secured before a full hearing, strengthens a parallel class action brought by privacy group noyb on behalf of millions of affected Austrians.
Who should care: Lawyers · Privacy officers · AI governance
German privacy group noyb has sent a cease-and-desist letter to credit agency SCHUFA after investigations revealed it retained millions of records that should have been deleted, and used them for customer testing. Noyb has opened an interest list for a class action, with up to 69 million people potentially affected.
Who should care: Lawyers · Privacy officers · AI governance
The UK Information Commissioner's Office has formally reprimanded ACRO Criminal Records Office for violating UK GDPR security requirements following a data breach. ACRO is a national police unit that handles sensitive records including criminal history, Police Certificates, and International Child Protection Certificates.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · AI governance
The European Data Protection Board has released draft guidelines on anonymization, offering new technical and legal benchmarks for when data can be considered truly anonymous and therefore outside the scope of GDPR obligations. The guidelines are aimed at clarifying a standard that organizations have long applied inconsistently.
Who should care: Lawyers · Privacy officers · AI governance
The EU AI Act is shaping how companies outside Europe build and deploy AI systems, as firms seeking access to the EU market must comply with its requirements regardless of where they are headquartered. This regulatory reach mirrors the pattern seen with GDPR, where European rules effectively became a global baseline.
Who should care: AI governance · Lawyers · Administrators · General readers · Policy
Privacy advocacy group noyb has filed a GDPR complaint against the online dictionary dict.cc, alleging that the site uses a single-click consent button to grant data access to 1,741 advertising and tracking partners. The complaint argues that bundling that many recipients into one click makes it impossible for users to give the informed, specific consent the GDPR requires.
Who should care: Lawyers · Privacy officers · Compliance · AI governance · Cybersecurity · General readers · Policy
At a July 2026 meeting in Dublin, the European Data Protection Board called for an explicit legal foundation governing how data protection authorities share information with regulators outside their jurisdiction. The EDPB also discussed deepening cooperation among DPAs to strengthen consistent GDPR enforcement across the EU.
Who should care: Lawyers · Privacy officers · AI governance · Compliance · General readers · Policy
The European Data Protection Board has issued a binding decision requiring the Belgian Data Protection Authority to rule on the substance of a cookie banner complaint filed by NOYB against Flemish public broadcaster VRT. The dispute arose after the Belgian DPA, acting as lead supervisory authority, submitted a draft decision that did not address the merits of the case.
Who should care: Lawyers · Privacy officers · Compliance · AI governance · General readers · Policy
A commentary from the IAPP argues that web scraping used to build generative AI training datasets falls within the scope of GDPR, meaning the collection and processing of personal data found online is not exempt simply because it occurs at scale or at the infrastructure level.
Who should care: Lawyers · Privacy officers · AI governance · General readers · Policy
The Center for Democracy and Technology has published a visual guide mapping out how individuals can seek redress for harms caused by AI systems under the GDPR. The resource appears aimed at helping people and advocates understand which legal pathways are available when AI causes harm covered by European data protection law.
Who should care: Lawyers · Privacy officers · AI governance · General readers · Policy
The IAPP's European conference addressed three converging themes: stronger protections for children online, efforts to simplify compliance frameworks, and the latest developments in how GDPR is being interpreted and enforced across the EU.
Who should care: Lawyers · Privacy officers · AI governance