Council Approves Regulation to Streamline Cross-Border GDPR Complaints
The Council approved new rules to speed up and harmonize cross-border GDPR complaints, with uniform criteria, clear procedures, and strict investigation deadlines.
DPA
Court of Appeal upholds GDPR fine against Grindr
Norwegian court upheld a major GDPR fine against Grindr for improper processing and sharing of sensitive and location data, stressing stricter requirements for consent, minimization and safeguards.
Dutch regulator fines Experian Netherlands €2.7M for unlawful data use
The Dutch regulator fined Experian Netherlands €2.7M for unlawfully collecting and processing personal data for credit assessments without proper transparency, lawful basis, or data subject rights.
Privacy groups criticise appointment of third Irish DPA Commissioner
Privacy groups warned that the appointment of a former Meta executive as a DPC Commissioner risks conflicts of interest and could undermine independent GDPR enforcement.
NOYB files criminal complaint over Clearview AI’s GDPR violations
Criminal complaint in Austria seeks prosecution of Clearview AI for mass biometric data scraping after multiple EU GDPR fines and bans exposed enforcement limitations against a U.S. company.
EDPB launches coordinated enforcement action on GDPR transparency obligations
The EDPB will coordinate an EU-wide enforcement action on GDPR transparency and information obligations, with national DPAs participating voluntarily and the action launching in 2026.
Austria finds Microsoft illegally tracked students
Austrian regulator found Microsoft 365 Education illegally tracked students via cookies; Microsoft must grant data access and faces scrutiny over transparency and GDPR compliance.
Investigation reveals sale of precise phone movement data in Ireland
Undercover RTÉ reporting shows minute-by-minute smartphone location data for tens of thousands in Ireland is being sold, enabling re-identification and raising serious privacy and security concerns.
CNIL fines Google €325 million and SHEIN €150 million for cookie non-compliance
The CNIL fined Google (€325M) and SHEIN (€150M) for cookie and ad consent breaches, stressing free, informed consent and sanctioning covert tracking and cookie-wall practices.
Spains DPA fines hotels over scanning guest identity documents
AEPD fines Iberostar unit €70,000 for requiring full ID copies at booking; authority stresses GDPR data minimisation and that copies are unnecessary and risky for guest registration.
IMY reprimands Flightradar24 for unlawful handling of aircraft owners’ data
IMY reprimanded Flightradar24 for GDPR breaches after routinely demanding aircraft registration certificates, requiring improved erasure procedures and proportional identity verification.
Ireland’s DPA Launches Toolkit to Safeguard Vulnerable Adults’ Data
New DPC Adult Safeguarding Toolkit guides organisations on GDPR-compliant collection, storage and sharing of vulnerable adults’ personal data with practical templates and sector collaboration.