EU General Court Upholds EU‑US Data Privacy Framework
Eu court dismissed Latombe’s annulment of the EU‑US Data Privacy Framework, allowing data transfers to continue while advocates signal likely further legal challenges.
GDPR News
EU starts GDPR adequacy process with Brazil to enable secure cross-border data flows
The EU has started the process for a GDPR adequacy decision with Brazil, enabling secure cross-border data flows if safeguards, oversight and remedies meet EU standards.
CNIL fines Google €325 million and SHEIN €150 million for cookie non-compliance
The CNIL fined Google (€325M) and SHEIN (€150M) for cookie and ad consent breaches, stressing free, informed consent and sanctioning covert tracking and cookie-wall practices.
Hundreds of thousands of Grok chats found in search results
Searchable links to Grok chat transcripts have exposed hundreds of thousands of user conversations, raising serious GDPR and privacy concerns about shared AI chats.
Austrian court: Der Standard broke GDPR with pay-or-consent model
The Austrian Federal Administrative Court confirmed that newspaper Der Standard breached the EU’s data protection rules by using a “pay […]
EU Ombudsman Receives Complaints over EDPS Selection Process
Ombudsman complaints and a Parliament–Council split have prolonged the appointment of the next EDPS, centering on independence concerns over a Commission insider versus continuity with the incumbent.
AI browsers leak personal data
Study finds major AI browser assistants transmit sensitive personal data, likely breaching GDPR and requiring stronger consent, transparency, and technical safeguards.
Spains DPA fines hotels over scanning guest identity documents
AEPD fines Iberostar unit €70,000 for requiring full ID copies at booking; authority stresses GDPR data minimisation and that copies are unnecessary and risky for guest registration.
EDPS closes proceedings after Commission fixes Microsoft 365 data protection issues
EDPS finds the European Commission’s Microsoft 365 use compliant with Regulation (EU) 2018/1725 after contractual, technical and organisational measures addressed purpose limitation, transfers and disclosures.
IMY reprimands Flightradar24 for unlawful handling of aircraft owners’ data
IMY reprimanded Flightradar24 for GDPR breaches after routinely demanding aircraft registration certificates, requiring improved erasure procedures and proportional identity verification.
Ireland’s DPA Launches Toolkit to Safeguard Vulnerable Adults’ Data
New DPC Adult Safeguarding Toolkit guides organisations on GDPR-compliant collection, storage and sharing of vulnerable adults’ personal data with practical templates and sector collaboration.
German Court Restricts Police Use of Spyware
German high court restricts law enforcement use of spyware to cases with at least a three-year maximum sentence, citing severe interference with fundamental rights.