EDPB backs UK adequacy extension under GDPR but urges strict monitoring
EDPB supports six-year extension of UK adequacy decisions to 2031 but urges the Commission to address legal changes, monitor risks and ensure robust oversight and remedies.
GDPR
EDPS Revises Generative AI Guidance for EU Institutions
EDPS updated guidance strengthens data protection rules for generative AI used by EU institutions, adding a practical compliance checklist and clearer controller/processor responsibilities.
Commission proposes changes to EU cookie consent obligations
The European Commission proposes simplifying cookie consent rules by revising the e-Privacy framework, prompting industry support and privacy-focused opposition ahead of new ad regulation.
Court of Appeal upholds GDPR fine against Grindr
Norwegian court upheld a major GDPR fine against Grindr for improper processing and sharing of sensitive and location data, stressing stricter requirements for consent, minimization and safeguards.
Dutch regulator fines Experian Netherlands €2.7M for unlawful data use
The Dutch regulator fined Experian Netherlands €2.7M for unlawfully collecting and processing personal data for credit assessments without proper transparency, lawful basis, or data subject rights.
NOYB files criminal complaint over Clearview AI’s GDPR violations
Criminal complaint in Austria seeks prosecution of Clearview AI for mass biometric data scraping after multiple EU GDPR fines and bans exposed enforcement limitations against a U.S. company.
EDPB and European Commission Publish Joint Guidelines on DMA and GDPR
EDPB and European Commission issued joint guidelines clarifying how gatekeepers must apply GDPR obligations when complying with the Digital Markets Act; public consultation open until 4 Dec 2025.
EDPB launches coordinated enforcement action on GDPR transparency obligations
The EDPB will coordinate an EU-wide enforcement action on GDPR transparency and information obligations, with national DPAs participating voluntarily and the action launching in 2026.
Austria finds Microsoft illegally tracked students
Austrian regulator found Microsoft 365 Education illegally tracked students via cookies; Microsoft must grant data access and faces scrutiny over transparency and GDPR compliance.
EU delays Chat Control plans after member states fail to agree
EU plans to force scanning of encrypted messages were postponed after Germany opposed Chat Control; critics say it would weaken encryption, harm security and push users to risky alternatives.
CJEU confirms GDPR compensation cannot be replaced by prohibitory injunctions
The CJEU rules prohibitory injunctions cannot reduce or replace GDPR compensation for past non‑material damage from unlawful data disclosures, reaffirming a distinct compensatory right.
EU considers changes to cookie consent rules
EU plans to simplify cookie consent rules to reduce repetitive banners, propose browser-level preferences and possible GDPR alignment, drawing industry support and privacy concerns.