The EDPB and DPAs from countries with EU adequacy decisions strengthened cooperation in data protection enforcement and advisory priorities during their second joint meeting.
Regulation (EU) 2025/2518 sets new procedural rules to enhance cooperation and efficiency in enforcing GDPR across EU member states in cross-border cases.
The European Commission seeks more information from Ireland on the appointment of Niamh Sweeney as Data Protection Commissioner amid concerns over independence and conflicts of interest.
The Council approved new rules to speed up and harmonize cross-border GDPR complaints, with uniform criteria, clear procedures, and strict investigation deadlines.
Norwegian court upheld a major GDPR fine against Grindr for improper processing and sharing of sensitive and location data, stressing stricter requirements for consent, minimization and safeguards.
The Dutch regulator fined Experian Netherlands €2.7M for unlawfully collecting and processing personal data for credit assessments without proper transparency, lawful basis, or data subject rights.
Privacy groups warned that the appointment of a former Meta executive as a DPC Commissioner risks conflicts of interest and could undermine independent GDPR enforcement.
Criminal complaint in Austria seeks prosecution of Clearview AI for mass biometric data scraping after multiple EU GDPR fines and bans exposed enforcement limitations against a U.S. company.
The EDPB will coordinate an EU-wide enforcement action on GDPR transparency and information obligations, with national DPAs participating voluntarily and the action launching in 2026.
Austrian regulator found Microsoft 365 Education illegally tracked students via cookies; Microsoft must grant data access and faces scrutiny over transparency and GDPR compliance.
Undercover RTÉ reporting shows minute-by-minute smartphone location data for tens of thousands in Ireland is being sold, enabling re-identification and raising serious privacy and security concerns.
The CNIL fined Google (€325M) and SHEIN (€150M) for cookie and ad consent breaches, stressing free, informed consent and sanctioning covert tracking and cookie-wall practices.