Austria finds Microsoft illegally tracked students
Austrian regulator found Microsoft 365 Education illegally tracked students via cookies; Microsoft must grant data access and faces scrutiny over transparency and GDPR compliance.
GDPR News
EU delays Chat Control plans after member states fail to agree
EU plans to force scanning of encrypted messages were postponed after Germany opposed Chat Control; critics say it would weaken encryption, harm security and push users to risky alternatives.
CJEU confirms GDPR compensation cannot be replaced by prohibitory injunctions
The CJEU rules prohibitory injunctions cannot reduce or replace GDPR compensation for past non‑material damage from unlawful data disclosures, reaffirming a distinct compensatory right.
Investigation reveals sale of precise phone movement data in Ireland
Undercover RTÉ reporting shows minute-by-minute smartphone location data for tens of thousands in Ireland is being sold, enabling re-identification and raising serious privacy and security concerns.
EU considers changes to cookie consent rules
EU plans to simplify cookie consent rules to reduce repetitive banners, propose browser-level preferences and possible GDPR alignment, drawing industry support and privacy concerns.
New EU rules require fingerprints and facial images at Schengen borders
The EU’s Entry/Exit System will record fingerprints, facial images and passport data of non-EU short-stay visitors for up to three years to streamline checks and enforce the 90/180-day rule.
Advocate General: Legal recognition of gender identity must not be conditioned on surgery
EU law may bar national rules requiring surgery to change gender markers in civil documents, protecting free movement, privacy and accurate identity data.
CJEU clarifies GDPR remedies and compensation for moral harm
The CJEU ruled GDPR does not create a mandatory right to a preventive injunction but allows compensation for moral harm even for non‑serious distress, and injunctions cannot replace damages.
Court of Justice clarifies identifiability under GDPR
Court of Justice rules SRB should have informed Banco Popular claimants before sharing their comments, clarifies assessment of pseudonymisation and controller-focused identifiability under EU data law.
Meta asks CJEU to reinstate challenge to EDPB Opinion on valid consent
Meta appeals the General Court’s dismissal of its challenge to EDPB Opinion 08/2024, arguing procedural and legal errors on reviewability, liability, judicial protection, and reasoning.
EU General Court Upholds EU‑US Data Privacy Framework
Eu court dismissed Latombe’s annulment of the EU‑US Data Privacy Framework, allowing data transfers to continue while advocates signal likely further legal challenges.
EU starts GDPR adequacy process with Brazil to enable secure cross-border data flows
The EU has started the process for a GDPR adequacy decision with Brazil, enabling secure cross-border data flows if safeguards, oversight and remedies meet EU standards.