Your cookie preferences
EDPB guidance · Art. 7 GDPR
We use technical cookies essential for the platform to work (login, security, sessions). We would also like to use analytics cookies to understand how to improve it.
You can accept all, reject all, or choose which categories to switch on.Your consent is valid for 6 months and you can withdraw it at any time from the footer.
You will find everything in our privacy notice.
Privacy and GDPR news
Curated updates: Italian DPA decisions, EDPB rulings, fines and regulatory news. Analyzed from a working DPO's perspective.
The invisible pixel in the newsletter: time runs out on 29 October
By decision no. 284 of 17 April 2026, published in the Official Gazette no. 98 of 29 April, the Italian data protection authority set out the rules for tracking pixels in email and allowed six months to comply: the deadline is 29 October 2026. Individual open-tracking for marketing purposes requires the recipient's consent, subject to exceptions. Compliance checks are part of the inspection plan for the second half of the year. For a DPO the point is not a prohibition — there is none — but that a processing operation taken for granted for twenty years now needs a basis, a notice and a way to switch it off on its own.
A dismissal decided by the algorithm is void: from 23 October in Italy
Published in Official Gazette no. 234 of 8 October 2026 and in force since 23 October, decree no. 179/2026 provides that final decisions on the employment relationship cannot be based solely on automated processing, that the worker may request an understandable explanation, and that decisions taken in breach are void. In parallel, AI systems affecting work organisation enter the risk assessment under Article 28 of decree 81/2008. For a DPO this is the rare case where the consequence is not economic but civil, and it changes how the check is framed.
Italian DPA fines Wind Tre €16.7 million: telemarketing despite objections and contracts activated without customers' knowledge
People who had objected kept receiving calls, and some contracts were activated without the person knowing. The Garante fines Wind Tre €16.7 million and restates a principle for every company with an agency network: responsibility is not outsourced along with sales.
Greece: €350,000 for a data breach — both the Ministry and the processor running outdated systems fined, and there was no Article 28 contract
An attack on the systems of the agency running a Ministry's programmes exposed identification, financial and health data of a very large number of people. The Hellenic DPA fines the controller €200,000 and the processor €150,000: notifying well is not enough if the supplier works on outdated systems and the relationship is not governed by a contract.
Smart glasses: the EDPB takes a position — users can be controllers, and people being filmed must be able to tell
They look like ordinary glasses, but they have a camera, a microphone and a connection. The EDPB publishes its first statement on smart glasses: when the user becomes a controller, why manufacturers and app providers cannot pass their obligations on to users, and what making a recording visible means in practice.
Italian DPA fines the municipality of Arvier €4,000: a camera filmed a resident's windows and balconies, and the masking came too late
A small municipality in the Aosta Valley uses cameras for traffic, parking, number plates, the environment and civil protection. A resident finds that one covers her home. The Garante imposes a fine and makes a point that applies to every system: masking private areas is designed before the camera is switched on, not after the complaint.
The mailbox of someone who left: the processing nobody documents
In decision 101/2026 of 12 May 2026 the Litigation Chamber of the Belgian data protection authority sanctioned a company that had left a former collaborator's professional mailbox active for over a year after departure. The findings go beyond retention: processing without a basis, failure of transparency, absence of technical and organisational measures for deletion, failure to honour the right of access. The authority's line has been constant for years and comes down to two dates: deactivation on the day of departure, deletion after one month.
The year the authorities read the privacy notice: CEF 2026 on transparency
On 19 March 2026 the EDPB launched this year's coordinated enforcement action on the transparency and information obligations of Articles 12, 13 and 14 GDPR. Twenty-five authorities are taking part, each free to choose its method: inspections, questionnaires sent to controllers, reading the notices published on websites, sector reviews. National results will be aggregated in the second half of 2026 and the EDPB will publish a summary report with follow-up recommendations. For anyone running compliance the point is that this year the check starts from a text that is already public.
Paying with your face: what changes when the key is you
From 24 to 26 September 2026 Revolut trialled a payment system in three London coffee shops that recognises a customer's face at the till and matches it against the selfie uploaded when the account was opened. Enrolment is opt-in, payments above £200 need a second check, and the company states it complies with UK GDPR. For a DPO the interesting part lies elsewhere: a face used to identify someone is biometric data under Article 9, and the privacy notice holds two distinct data — the biometric template and the photo taken at the till — with different deletion rules.
When a fine, and when not: the EDPB writes down the part that was missing
On 21 September 2026 the European Data Protection Board adopted Guidelines 04/2026 on the exercise of the power to fine in relation to the other corrective powers, open to public consultation until 13 November 2026. They replace the old Article 29 Working Party guidelines and complete the 2022 ones on calculating the amount. The difference is substantive: those said how much, these say whether. And at the fourth step there is a presumption that shifts the burden of the defence.
Poland's UODO: not every breach must be notified. Public-register data on one side, PESEL, health and financial data on the other
If an invoicing system leaks only a sole trader's name, business name, tax number and registered address, already public in the business register, risk is normally unlikely. If it also leaks the national ID number, purchase details revealing health, or financial data, notification is due. Either way, the decision goes into the internal register.
Italian DPA fines security firm €39,000: company-car GPS data withheld from a former employee
A dismissed guard asks for the data from the GPS fitted to his company car to defend himself in disciplinary proceedings. The company neither hands it over nor explains why. The Garante fines La Patria S.p.A. of Bologna and restates a rule many forget: a refusal must be reasoned too.
Sweden fines Miljödata SEK 1.8 million: one vendor, 2.2 million people and two missing controls
Personal identity numbers, contact details and sensitive data on sick leave, rehabilitation and school incidents, published on the darknet after an attack. The Swedish authority identifies two concrete failings and fines the vendor directly. And opens reviews of the customers that chose it.
EDPB Guidelines 04/2026: five steps to decide whether an authority should fine
The European Board has adopted guidelines on when a supervisory authority should impose an administrative fine and when it can stop at a reprimand, an order or a ban. Five steps, fourteen examples, and a clear rule: if the infringement is not minor, a fine is the norm.
Garante fines IQVIA €7 million: one million 'anonymous' patients who were not anonymous
Eight hundred GPs, an add-on in their practice software, a database with the diagnoses and prescriptions of about one million patients used for studies commissioned by the pharmaceutical industry. For the company the data were anonymous. For the Italian authority they were not: the code that followed each patient over time made it possible to single them out. A €7 million fine and 120 days to comply.
CNIL fines Extia €300,000: automatic deletion is not enough, you have to tell the person who asked
An IT consultancy receives hundreds of erasure requests, almost all from job applicants. Much of the data disappears on its own through automatic deletion. But the people who asked get no reply. For the CNIL that infringes Article 12 even when the data is gone: informing the person of the outcome is an obligation separate from the erasure.
The chargeable number on the sign: one hundred thousand euro for putting a price on exercising a right
Article 12(2) does not say rights must be possible: it says the controller must FACILITATE their exercise. A sign pointing to a chargeable number imposes a cost on whoever wants to use them and discourages whoever is hesitating. The existence of other free routes on the website did not remedy the infringement, because it was the sign that pointed to the paid number.
The EDPB writes down when to fine, not how much: five steps and a presumption
Since 2022 we have known how the amount is calculated. What was missing was the prior question: should a fine be imposed at all? The guidelines adopted in plenary on 21 September give authorities a five-step path, fourteen practical examples and a rule that changes expectations — if the infringement is not minor, the presumption is that a fine follows. Consultation open until 13 November 2026.
Seventy-three records a minute for five days, and nobody noticed
On 3 September 2026 the CNIL fined Hôpital privé de la Loire 500,000 euros. An attacker entered the electronic patient record system using a doctor's credentials and over five days extracted 524,867 records, at a rate of roughly seventy-three a minute. No alert. There was no multi-factor authentication and no tool capable of noticing that anything was wrong.
The criminal record certificate that says nothing: Spain annuls two million
By judgment no. 359/2026 of 8 July 2026 the Audiencia Nacional annulled the two-million-euro fine the Spanish authority had imposed on Amazon Road Transport Spain for asking candidates for a criminal record certificate. The reasoning: Article 10 covers data relating to convictions and offences, and a certificate attesting the ABSENCE of convictions does not automatically fall within it. The decision can still be appealed.
180 AI products in five years: what the regulator asked
On 25 September 2026 the Irish Data Protection Commission published its report on the supervision of artificial intelligence products and services between 2021 and 2025. Around 180 products engaged on, thousands of pages of assessments read, and two points recurring in almost every file: legitimate interest as the basis for training, and the transparency of processing nobody manages to explain simply.
The vendor's bug turned into a criminal conviction
On 7 September 2026, before the Dublin Metropolitan District Court, Brown Thomas Arnotts Limited pleaded guilty to five sample charges out of twenty-one for breaches of the Irish ePrivacy Regulations. Three concerned the absence of a valid opt-out address, two the sending of marketing without valid consent. The sum paid is two thousand euro. The sum is not the point: this was a criminal prosecution.
The request came from a real government domain
On 12 September 2026 Revolut confirmed it had disclosed customer data in response to fraudulent requests sent from a legitimate government agency email domain. The data included dates of birth, addresses, phone numbers, copies of passports and driving licences, verification selfies, account statements and transaction histories. Around 680 customers were contacted. This is not an intrusion into the systems: it is a personal data breach by unauthorised disclosure, and it turns on a procedure almost nobody has written down.
Google, €403 million: half the findings live in your register
On 21 September 2026 the Irish Data Protection Commission closed the inquiry it opened into Google Ireland in February 2020. Its subject: location data in three features — Web & App Activity, Location History, Location Accuracy — between 25 May 2018 and 4 February 2020. Fines totalling €403 million and six months to come into compliance. The number makes the headlines; for practitioners, the interesting part is elsewhere.
Portugal opens an urgent channel for reports about minors
The channel is called Canal Prioritário and sits on the CNPD website. It covers three situations: improper access to minors' data, collection and disclosure of images or recordings with sensitive or violent content without consent, and advertising targeted at minors. Children themselves can use it, and so can any citizen who spots it. For the DPO this is not one more obligation: it is a change in exposure, and it is worth knowing which processing operations it actually touches.
The Solo plan drops to EUR 9.99 a month, and it is not a promotion
The Solo plan is for those starting out: three clients, one user, all the document areas, the Art. 30 register, breach handling with the 72-hour deadline. At nineteen euros it was an expense to weigh up; at EUR 9.99 it is a decision you take in a minute. The change is to the list price, not to a discount code: whoever signs up today pays this, and will still pay it in six months.
«Not unlawful, the medical management authorised it»: the Italian DPA says no, EUR 24,000
The case is small and the lesson is not. A hospital is at once a place of care and the employer of the same person, and when the two capacities touch, the health record becomes the handiest and most wrong tool. The employer had put it in writing to the prosecutor: that access was not unlawful, it was «carried out on the instructions of the medical management» «for the performance of the work». That is precisely the sentence the authority takes apart.
Cameras in the changing rooms since 2007: the defence lists what they did not film, and loses
The defence brief is a list of things that were not visible: not the cubicles, not the showers, not the toilets; and near the lockers there are no benches «that might induce someone undressing to sit there and so be captured by the video system». It is reasoning by subtraction, and in a changing room it does not work. For the DPO, though, the passage to keep is another: among the provisions breached is Art. 5(1)(e), because the seventy-two hours of retention declared were not supported by any assessment showing they were necessary.
One complainant, ten notifications, EUR 5.5 million: the opt-out that was recorded and never applied
One complaint, one single data subject, contact data, a level of seriousness the authority itself calls «low» — and five and a half million euros. The arithmetic is not punitive: it follows from turnover above EUR 500 million, a July 2025 precedent, and seven months in which the customer's choice sat in one system and was ignored by another. For the DPO the operational point is single: the channel you name in your privacy notice is not the only valid channel.
The 120 days are not the deadline to fine you: they are the deadline to charge you
Anyone who built an appeal on the authority's delay should re-read the calendar. The Court clarifies three things: the complaint procedure and the sanctioning procedure are autonomous, so overrunning the nine-to-twelve months on the complaint does not extinguish the power to fine; the 120 days are for notifying the charge, not for imposing the fine; and they run from the «definitive finding», which is not the first notice but the moment the authority can assess every element — including the hearing of your side. After the charge, only the five-year limitation period remains.
Four weeks, not a day more: how long applicant data may be kept in the Netherlands
Four weeks after the procedure ends is the shortest retention period in Europe for this data, and it is not optional guidance: faced with a complaint it is the first thing the Dutch authority checks. The copy of the identity document is the exception that splits the personnel file in three.
The AI Act is a retention problem, and almost nobody is treating it as one
Everyone reads the AI Act as a risk-classification exercise. Underneath it there is a set of retention periods as concrete as anything in tax law: documentation kept ten years from placing on the market, logs kept at least six months, and incident reports due in fifteen, ten or two days. None of it fits in a record of processing that has one row for “AI system”.
German deletion schedules have been wrong since 1 January 2025 — in both directions
The Fourth Bureaucracy Relief Act shortened two periods and left four untouched. Anyone who set their deletion schedule to a flat eight years is destroying documents a tax audit may still demand. Anyone who left it at ten is breaching storage limitation — on the most complete dataset the company holds.
How long to keep employee files in Poland: ten years or fifty — and why one date decides it
There is no short answer to “how long do we keep personnel files”. There are three regimes, and which one applies is decided by the date the employment began. For one group the period drops from fifty years to ten — but only after a filing, and counted from an entirely different day.
When a DPO is mandatory in Spain: the sixteen cases in Article 34
Spain is one of the few Member States to have listed in statute the cases where a data protection officer is mandatory. Sixteen lettered items, a) to o), and they are additional to — not a replacement for — the three situations in Art. 37(1). The costliest mistake is not in the list: it is in paragraph 2, because an organisation that appoints a DPO voluntarily falls under the same regime and must notify the AEPD within ten days.
Retention periods: why the French regulator thinks in lifecycles, not durations
A record that writes “10 years” in the retention column does not answer the question: it dodges it. The CNIL works in three successive phases, and the second — intermediate archiving — only exists if the data is genuinely separated from the active base. That is where compliance is decided, and it is precisely what nobody documents.
DPIA in Poland: when it is mandatory and what it must contain
A DPIA is not a box to tick after go-live. It is a condition to satisfy BEFORE processing starts, and where the risk cannot be brought down it becomes a duty to consult the authority in advance. The Polish list sets out twelve categories of operations; WP248 gives nine criteria, and meeting two of them is usually enough.
The 250-employee exemption from the record of processing barely exists
«We have fewer than 250 employees, we do not need a record of processing» is the most widespread misconception in the field. The Art. 30(5) exemption is subject to three conditions that apply in the alternative: one is enough. And «not occasional» covers payroll and customer management — that is, practically every business.
Sixteen hours by 24 May 2027: the training every employer must complete
Anyone keeping a training tracker has a row for workers, one for supervisors, one for fire-safety officers. Almost nobody has one for the employer, because until 2025 there was no general training duty: only the Art. 34 course for employers who personally take on the prevention service, a minority. Now there is one for everybody, with a single date.
Workplace safety: one screen instead of six, and the matrix almost nobody shows
The section could already answer four separate questions — which roles are required, which documents, who never took a course, which certificates expire — but nothing joined them up, and to see the effect of your choices you had to reach step six. Now the effect shows while you fill the form.
The Italian matrix reaches 205 rules: healthcare, anti-money-laundering and five sectors
Italy had 155 of its own retention rules against Portugal's 232, and the gap was not evenly spread: it sat in seven domains. Healthcare had 6 against 23, anti-money-laundering 4 against 13. Italy is now at 205 and the structural gap is closed. But the number matters less than the method: every new rule starts unverified, and it shows.
Three rules almost no Italian register contains
These are not obscure rules. One comes from a 2024 guidance document of the Italian DPA, one from a 2023 statute, one from the anti-money-laundering decree everybody cites. What they share is that none of them concerns an archive somebody decided to create: they concern archives that exist on their own, and that is exactly why nobody entered them.
Medical files in a shipping container inside a turf shed: €645,000 for the Irish health service
This is not a cyber incident. It is the storage limitation principle applied to paper: documents kept beyond their term, in places that were not archives, with nobody knowing any longer what was inside.
Sixty seconds is too often: the Italian authority says polling a vehicle's position that fast is continuous monitoring
The question is not whether you may geolocate a company vehicle: you may. The question is how often. And the authority had already said in 2018 that two minutes was disproportionate.
The European Health Data Space applies in a little over six months, and the two opt-outs it contains are not the same thing
It does not replace the GDPR, it sits on top of it. For anyone keeping the record of a healthcare client there are four dates to note, not one, and the first falls in less than seven months.
On 2 August the deadline for having a national AI sandbox expired, and inside those sandboxes data collected for other purposes may be processed
It is the one place in EU law where reusing personal data to train a model is expressly provided for. There are seven conditions and they all have to be met together.
The European campaign on mental health at work starts on 13 October. It creates no obligations, which is exactly why it should be read carefully
An awareness campaign is not a legal act and introduces no new requirement. But the moment an organisation measures psychosocial risk is a moment that also concerns whoever handles data protection — and that is a reading, not content of the source.
Two million to a US data broker: the Italian DPA says legitimate interest does not cover selling contacts
The company is American with no establishment in Italy, and the Regulation applied anyway. Beyond the fine: a ban on processing the data of people located in Italy and an order to delete what was unlawfully collected.
AI Act: who supervises what, and why the "first fines" you are reading about do not exist
The AI Office handles general-purpose models, national authorities everything else, the EDPS the EU institutions. Knowing who your client answers to comes before knowing what they risk. And before that comes telling apart powers that became exercisable from powers that were exercised.
One single point to notify breaches: what the EDPB and EDPS asked for on the cybersecurity package
Notifying a breach today means writing to several authorities in different formats within the same three days. The Board and the European Supervisor back the single entry point, and set limits on ENISA, on certification and on the relationship between security and fundamental rights.
Seven sites switched off the UK rather than protect children
The UK regulator described what happens before formal investigations. Faced with a choice between making the service safe or no longer being reachable from the UK, seven platforms chose the second. It is a win, but it also shows how cheap walking away is.
A million and a half adoption stories on devices nobody could locate any more
The most serious breach came from digitising paper archives between 2013 and 2022: over 1.17 million records, of which 1.14 million on adoptees and about 30,000 on missing children, held on poorly secured devices with no controls tracking their movement. The agency only discovered the devices were missing during checks in 2024 and 2026.
In Brazil, asking for an age and believing the answer cost 153.7 million reais
Decision of 25 August 2026. The Brazilian authority found deficiencies in the age verification mechanism both in the feed accessible without registration and in the one behind an account. Beyond the fine: an order to delete improperly collected data and to default under-16 profiles to the most restrictive settings.
The user never confirmed the account: for the Italian DPA there is no contract and the emails are unlawful
Decision of 18 June 2026, published on 29 July. A citizen receives promotional emails without ever having filled in the membership form. The investigation found that those who did not confirm account creation ended up on the lists anyway: double opt-in existed, but it was wired to nothing.
"We keep it for research purposes": the EDPB explains why that is not an answer
On 15 April 2026 the EDPB adopted draft Guidelines 1/2026 on scientific research. The public consultation closed on 25 June and the final text is not out yet. Anyone who maintains records should read the retention chapter: a research purpose, on its own, does not justify an open-ended period.
You declare contract, then you reject the objections: Norway shows how the two mistakes travel together
SATS asked members for a photo kept in the membership system and used at the desk to check the identity of people coming in. Datatilsynet found the notice stated the wrong legal basis, failed to explain the right to object, and that objections were rejected without demonstrating compelling legitimate grounds. The deadline to fix it is 11 September 2026.
Who answers for the live stream of the under-14 match? Sweden answers the question nobody asks
On 25 August the Swedish authority published guidance on streaming youth sport. Many clubs stream children's matches online, and the guidance sets out the factors that decide what is allowed. But the part worth reading is the other one: responsibility when the municipality owns the venue and the club wants to install cameras.
The score they refuse your credit with can be requested, and it has to be explained
On 19 August the CNIL translated for the public its May 2026 recommendation on assessing creditworthiness. Inside are three numbers and one principle that concern anyone doing scoring: twenty-four months for past incidents, six months for the data of a refused application, and a right of access to the score that cannot be dismissed by invoking trade secrecy.
French tax data stolen, and no passwords: that is what makes this one dangerous
On 14 August the French finance ministry announced that the tax administration's information system had been breached: a third party was able to consult and extract data on individuals and businesses. Identifiers and passwords appear untouched — which is precisely why the risk is not account takeover but phishing built on genuine tax data.
In schools, advertising trackers are prohibited — and consent has nothing to do with it
On 24 August the CNIL published its rules for the digital workspaces used in schools. The decisive point is not the protection of minors but a principle of administrative law: the neutrality of the public education service includes commercial neutrality, so trackers used for advertising or profiling are prohibited in principle. If the tool has them, the controller must switch them off.
Same tool, same day, different rule: why trackers are not banned at university
On 24 August the CNIL published two texts on the same subject, one for schools and one for universities. Anyone who reads only the first and applies it to the second gets one specific thing wrong: in schools advertising trackers are «in principle prohibited», while in higher education the CNIL «recommends preferring» tools that do not use them. Everything else — legal basis, DPIA, processor guarantees, transfers — is the same.
Eight hundred and twenty-five million for an algorithm that deactivated accounts with nobody looking
It is the second-largest fine ever imposed under the GDPR, behind only Meta's 1.2 billion. It is not about a data transfer or a security breach: it is about Article 22, the rule on automated decisions that almost nobody documents because it looks like a big-platform problem. It is in fact about anyone who lets software decide something that weighs on a person's life.
Poland quadrupled its fines in a year, and the three highest ever all date from 2025
For years Poland was treated as a low-enforcement market. That assumption no longer holds: in twelve months the total went from fourteen to over sixty-four million zloty, and the three largest fines in the country's history all carry the same year. If you look after a client with a branch, a supplier or a service centre in Poland, the risk calculation has changed.
Seventy-seven boxes: what a DPO actually files, and why thirty-one were not enough
We asked the people using the platform a simple question: when a request from an authority lands, which papers do you pull out? The answer contained forty-six categories that had no box of their own and all ended up in "Other documents". We added them. Then we had to rebuild the page, because seventy-seven grey tiles in a grid are worse than thirty-one.
Risk is assessed inside the register, and every feature is one word away
A DPO tried the platform for a few days and wrote that the breach register, the risk assessment, document upload and pricing were all missing. Three of the four were already there. She did not find them because they sit inside the client's file, and the menu does not show them. Hence two additions: the risk assessment, which really was missing from the register, and a search bar that answers «breach», «72 hours», «Art. 33» and tells you where the thing you are looking for lives.
Security measures no longer have to be retyped
The feedback came from a DPO on a free trial: «under security measures I can only type». She was right. Measures are now picked from a catalogue in nine groups, remain freely editable, and the platform brings the relevant ones to the top by looking at the data categories and the transfers. Data categories gain a descriptive second level, and the destination country is no longer a free-text box.
How long data is kept: 960 rules, nine jurisdictions and a method
Storage limitation is the principle that is hardest to demonstrate under review, because the answer changes for every category of data and every country. The platform ships 960 rules already written. But the point is not the number: of 232 Portuguese rules only 99 have a duration expressible as a figure, and 95 are declared «current reference» rather than «verified». Saying so is more useful than hiding it.
The client goes bankrupt, the vendor is left alone with the data — and becomes the controller
A retail chain goes bankrupt. Former employees need their own timesheets to document unpaid wages, but the only party holding them is the time-tracking software vendor, which replies that it may disclose nothing to anyone — "not even to the data subjects themselves" — because the contract with the controller has ended. The Norwegian authority decided the opposite: when you are the only one left deciding about the data, you are the controller.
Real employee data inside the test system: what loss of control is worth
Testing a new HR system with real data is not forbidden: transferring more fields than the test needs is. The German Federal Labour Court ordered an employer to pay two hundred euro because it had uploaded salary, home address, tax ID and marital status although it had agreed a list of nine fields with the works council. And it confirmed that a delayed answer to an access request is not, in itself, a damage.
2 August did not vanish: it narrowed
Anyone who read only the headline — "the AI Act is delayed" — is working from wrong information. The 2 August 2026 date did not disappear: it changed content. What stayed concerns far more clients than what moved.
The Dutch authority publishes a self-assessment for generative AI
Something was needed to hand the client who says "we switched on the AI in our software". The Dutch authority has published a self-assessment on generative AI systems: four moments, and in each one a decision that has to be documented.
NIS2 is law in the Netherlands, with no grace period
The Cyberbeveiligingswet entered into force on 15 August 2026. The number that matters is not eight thousand: it is one hundred and thirty-three thousand — the Dutch SMEs the law reaches not because they are in scope, but because they supply someone who is.
Breach notices have already passed the whole of 2025
The first-half 2026 figures say two different things. The first is that the number of people notified is dominated by very few enormous incidents. The second, less comfortable for anyone assessing risk, is that AI appears in one breach in four.
A DPO who decides cannot supervise themselves
On 10 August 2026 the CNIL set out in writing how to identify and resolve a conflict of interest affecting the DPO. The test is single: if in their other duties the DPO determines the purposes and means of a processing operation, they cannot then supervise it. No one can be judge and party.
You don't delete the article, you delete the name
On 5 August 2026 the CNIL clarified the boundaries of a right that is often exercised and widely misunderstood. Against a press organisation, objection and erasure remain available; access and rectification do not. And a refusal must be reasoned concretely: six generic formulas are named as inadmissible.
In 2026 every European authority is looking at the same thing: privacy notices
Each year the EDPB picks a topic and every national authority checks it together, in the same period, through questionnaires and inspections. For 2026 the topic is transparency: how controllers tell people what happens to their data. In scope are Article 13, where data comes from the data subject, and Article 14, where it comes from elsewhere. The Czech authority has already written the theme into its inspection plan.
Portugal's CNPD sets out where it will be looking until 2029
On 24 July 2026 the Portuguese authority approved its multiannual plan for 2027-2029 and its 2027 activity plan. It is the kind of document almost nobody reads and which says, years in advance, where supervision will concentrate: digital training, digital vulnerability, regulatory capacity for the DSA, AI competences and neurodata.
Portugal: the largest fine ever teaches one thing. Vetting a processor is a substantive duty, not a form to sign
By Decision 2022/1072 the Portuguese CNPD imposed a single fine of EUR 4.3 million on INE for five infringements committed during the 2021 census. The most instructive is not the one about health and religious data: it is that INE, although the supplier had an office in Lisbon, contracted with the US-based company, accepting California jurisdiction and the routing of data across two hundred servers, with standard contractual clauses and no supplementary measures.
Legitimate interest is not the fallback legal basis
In Case C-621/22 the Court of Justice held that a commercial interest can constitute a legitimate interest under Article 6(1)(f). Many people read only that line. The rest of the judgment recalls that the conditions remain three and cumulative, and that the third - the balancing against the data subject's reasonable expectations - is where the case at hand was lost. For the DPO the consequence is practical: legitimate interest exists only if it is written down somewhere.
Damages under the GDPR: what a claimant actually has to prove
Regulatory fines make the headlines; civil claims pay the lawyers. Since 2023 the Court of Justice has held that compensation under Article 82 requires three cumulative elements - infringement, damage, causal link - with no threshold of seriousness. It has also held that a well-founded fear that your data has fallen into the wrong hands is already non-material damage. For the controller this moves the battleground: not the gravity of the harm, but proof of the measures in place.
Competition and data protection: the EDPB opens the table, and there is a deadline
After the DSA and before the DMA and the AI Act, the fourth piece of the European regulatory mosaic concerns the relationship between competition and data protection. This is not theoretical: it touches data as a market asset, mergers, and the position of those who process data because they dominate a market. The EDPB and the Commission are asking for input before they write, and this time the deadline is close.
Anti-money laundering and privacy: the EDPB and AMLA write the sharing rules together
On 1 July 2026 the EDPB and the European Anti-Money Laundering Authority announced joint guidelines on a question neither could solve alone: how banks, professionals and authorities can share information about suspicions without building unchecked lists of suspects. The possibility applies from 10 July 2027 and the public consultation is expected in the first half of that year. Anyone advising obliged entities has a year to prepare.
EDPB from Dublin: a legal basis is needed so authorities can share information across regulatory fields
The number and complexity of complaints are rising, partly because of increased use of AI, and authorities say openly that resources are not enough. The solutions on the table: joint operations, pooling resources between authorities, and the upcoming Procedural Regulation.
EDPB binding decision 1/2026: a cookie complaint cannot be dismissed by claiming the complainant is abusing their rights
The lead authority wanted to close the case claiming abuse of Art. 77 and Art. 80(1). The Austrian DPA objected and the EDPB agreed: neither the objective nor the subjective component of abuse was demonstrated. The complaint goes back and must be assessed on the merits.
Monitoring staff: the CNIL recalls there are three conditions and all must be met. Proportionality is only the first
On 9 July 2026 the CNIL updated its page on monitoring staff activity. The content looks like revision, but there is one point that practice keeps underrating: the conditions are three, they are cumulative, and two of the three have nothing to do with how intrusive the tool is.
71% of DPOs want the AI Act in their remit. 27% say they know it. 85% have never had AI training
On 3 July 2026 the French labour ministry, the AFCDP and the CNIL published the fifth edition of the DPO Profession Observatory, carried out by the Afpa. The easy reading is that DPOs are becoming the AI point of contact. The useful reading is different: between those who want the AI Act in their remit and those who say they know it there is a 44-point gap, and the AI Act never mentions the DPO at all.
Austria: the Supreme Administrative Court cuts the fine from 18 to 13 million. But the part to read is where it says a compliance programme excuses nothing
On 24 June 2026 the Austrian Verwaltungsgerichtshof closed proceedings pending since 2019, reducing to EUR 13 million the fine for processing 'party affinities' calculated for around 2.2 million people. The headlines will be about the discount. For a DPO what matters is the rest: the Court says that punishing a legal person requires no act by its management bodies, that having resources to take advice raises the bar rather than lowering it, and that the charges on the DPIA and the record of processing fall away by absorption - not because those documents were correct.
Sweden: SEK 6 million for an SQL injection. The hardest part is not the fine, it is that the risk had been sitting in their own risk register since 2021
On 26 January 2026 the Swedish authority fined Sportadmin i Skandinavien AB SEK 6,000,000 for breaching Article 32(1). The platform handles memberships, invoicing and websites for sports clubs: the 16 January 2025 attack exposed the data of 2,126,075 people, mostly children, including allergies and disabilities. But the passage worth reading twice is another one: since 2021 the company had identified the risk of SQL injection in its own annual reviews, and IMY cites exactly that to establish gross negligence.
Netherlands: who supervises the AI Act, and where they will start. Prohibited practices and AI literacy, not high-risk systems
The Dutch government has designated the Autoriteit Persoonsgegevens and the Rijksinspectie Digitale Infrastructuur as coordinating national supervisors for the AI Act. The 2026 work agenda lists five priorities: overarching system supervision, transparency and explainability, frameworks and standards, testing for bias and fairness against discrimination, and AI literacy. The first formal enforcement actions are expected during 2026, starting with organisations using prohibited practices or demonstrably neglecting the AI literacy obligation.
France: 23 fines in six months under the simplified procedure. Small amounts, new target
In the review published on 6 July 2026 the CNIL counts 23 new fines adopted since January under its simplified procedure, totalling EUR 133,750. Three infringements recur: excessive video surveillance, non-compliant cookie banners, and failure to respond to access and erasure requests. One example of the kind of target: EUR 7,500 against a company operating public toilet facilities, on 2 April.
France: EUR 5 million for IQVIA. The pharmacy software kept sending the data even when the patient had said no
On 26 May 2026 the CNIL's restricted committee fined IQVIA Operations France EUR 5 million. The company runs two health data warehouses for third-party studies: LRX, authorised in 2018 and fed by around 14,000 pharmacies, and EMR, authorised in 2021 and fed by several thousand doctors. Among the findings, the most instructive: the practice management software used in pharmacies transmitted customer data to IQVIA even where the customer had objected.
Finland: the Supreme Administrative Court upholds the fine on Verkkokauppa.com. The failing: never having defined how long to keep the data
On 12 June 2026 the Korkein hallinto-oikeus, Finland's Supreme Administrative Court, dismissed Verkkokauppa.com's appeal against the penalty imposed by the Finnish Data Protection Ombudsman's sanctions board (decision KHO 12.6.2026/1604). The original amount was EUR 856,000, reduced by the Administrative Court to EUR 792,639 on the basis of the company's most recent turnover. The finding does not concern a data breach: it concerns the fact that the company had never defined retention periods for customer account data.
Poland: a municipality fined not for publishing the data of 749 petition signatories, but for never reporting it
On 25 May 2026 the President of the UODO fined the mayor of Myslenice PLN 7,700. An un-anonymised petition had been published in the municipality's Public Information Bulletin: names, surnames, home addresses and signature specimens of 749 people. The core of the decision is not the publication, which the municipality corrected by replacing the file: it is that the breach was never notified to the authority, not even after the authority asked.
Netherlands: the Council of State confirms the annulment of the EUR 600,000 fine for Enschede's wifi tracking
On 29 July 2026 the Administrative Jurisdiction Division of the Raad van State dismissed the appeal of the Autoriteit Persoonsgegevens against the municipality of Enschede, upholding the February 2024 judgment of the Overijssel District Court. The EUR 600,000 fine, imposed in March 2021 for counting city-centre visitors through sensors capturing the MAC addresses of wifi-enabled devices, remains annulled. The reason is not that the tracking was lawful: it is that the authority did not sufficiently demonstrate that the MAC addresses collected qualified as personal data and that processing of personal data had therefore taken place.
Poland: WhatsApp in the sales network brings a fine for the processor, and a reprimand for the controller that never vetted it
On 22 June 2026 the President of the UODO, Miroslaw Wroblewski, closed the proceedings opened after a breach notification by Energa-Obrot: reprimands for the controller and the processors, and an administrative fine of PLN 10,145 for one of the processors. At the root of it, the use of WhatsApp by sales representatives of a door-to-door network during the pandemic: on a former agent's private phone there were scans and photographs of customer contracts, in group conversations, for many months.
Ireland: EUR 277,500 for Permanent TSB over a contact centre that could be fooled, and for reporting late
On 8 May 2026 the Irish Data Protection Commission closed its inquiry into a series of personal data breaches at Permanent TSB, first notified in May 2022. Malicious actors, holding certain customer information, called the Open24 contact centre posing as customers, gained access to accounts and amended account details. Some customers lost money. The authority issued a reprimand and fines totalling EUR 277,500.
The Dutch authority names its 2026-2028 priorities: mass surveillance, artificial intelligence, digital resilience
The Autoriteit Persoonsgegevens has set three strategic priorities for 2026-2028: mass surveillance, artificial intelligence and digital resilience. In its 2026 annual plan the authority states that it is allocating more capacity to AI and algorithms and will concentrate on large-scale systems with significant societal impact, without distinguishing between the public and private sectors. For anyone with clients in the Netherlands, or considering that market, it is the most useful piece of information of the year - and it costs nothing.
Netherlands and Poland: two authorities that raised the bar in 2026
The Dutch Autoriteit Persoonsgegevens has increased its budget and headcount and has named transparency, tracking and cookies among its 2026 supervisory priorities, with an approach that is openly less advisory and more enforcement-driven. In Poland the President of the UODO has shifted attention towards small and medium enterprises, a segment until recently little touched by inspections. For anyone with clients in those countries, or considering it, these are two signals that change the cost-benefit balance of compliance.
Piaggio fined 460,000 euro: 112 company emails read, backups kept for five years after termination
The Italian data protection authority has fined Piaggio & C. Spa 460,000 euro over the way the company managed employee email accounts. The investigation, opened after complaints by two former employees, established that 112 emails had been acquired during the employment relationship, some dating from roughly two years before any suspicion arose, made possible by backups retained for the whole duration of employment and up to five years after termination. Alongside the fine, the authority banned the company from accessing the data it had collected.
AI Act in Italy: the data protection authority becomes market surveillance authority for high-risk systems in justice, borders and democratic processes
The Italian data protection authority has issued a favourable opinion on the draft legislative decree implementing the AI Act in Italy. The decree sets out national governance and designates the authority as market surveillance authority for high-risk AI systems used in the areas most sensitive for fundamental rights: justice, law enforcement, immigration, border management and democratic processes. Among the conditions attached, one concerns any organisation: extending the ban on decisions based solely on automated systems to assessments affecting the employment relationship.
Misconfigured document register: 12,000 euro fine for the Metropolitan City of Sassari
Following a data breach notification and a complaint, the Italian data protection authority fined the Metropolitan City of Sassari for misconfiguring its electronic document register, making documents containing personal data accessible to staff who, given their role and duties, were not authorised to process them. The fine is 12,000 euro, but the principle applies to every public body and every company running a document management system: filing is not a neutral activity, and a default of total visibility breaches the principles of integrity and confidentiality.
AI Act, 2 August: what actually applies and what has been postponed to 2027
For two years 2 August 2026 was presented as the day obligations for high-risk AI systems would start. The Digital Omnibus package changed that calendar: requirements for Annex III high-risk systems move to 2 December 2027 for stand-alone systems and 2 August 2028 for those embedded in products already covered by sectoral legislation. 2 August nonetheless remains an operative date: the transparency obligations of Article 50 become applicable, together with the full operation of governance and penalties, with national authorities acquiring full powers.
Denmark: cookies are the 2026 priority, and fines are decided by a court
The Danish authority has flagged cookie consent as a supervisory priority for 2026, coordinating with the Digitaliseringsstyrelsen, which oversees the ePrivacy implementation while Datatilsynet applies the GDPR. But Denmark has a peculiarity that changes how every one of its decisions should be read: its constitutional order does not allow an administrative authority to impose punitive financial penalties. Recital 151 GDPR expressly anticipates this for Denmark and Estonia: the fine is decided by a court as a criminal penalty, following a report by the authority to the police.
Email tracking pixels: France has already closed its grace period, Italy's runs to October
With deliberation no. 2026-042 of 12 March 2026, made public on 14 April, the French CNIL adopted its final recommendation on email tracking pixels: for most marketing uses, prior consent is required, just as for cookies. Existing contact bases were given three months to inform recipients and allow them to object, a period that ended on 14 July 2026, with checks announced from that date. In Italy the authority reached the same conclusion with decision no. 284 of 17 April 2026, but with a longer compliance window.
Wind Tre, EUR 1.7 million: the breach started with a phone call
The Italian DPA fined Wind Tre EUR 1,715,600 (decision no. 348 of 14 May 2026, made public with the 16 July newsletter). The starting point was not a sophisticated cyberattack: people posing as support technicians convinced staff at two retail outlets to allow access to company systems. From there, identification and contact data of 365,048 customers were exfiltrated; for 41,359 of them, payment method information as well, including IBANs, postal payment slips and credit cards with partially masked numbers and expiry dates. The charges: breach of the integrity and confidentiality principle (Art. 5(1)(f)) and of security obligations (Art. 32(1)(b)).
Cookies, France holds the line: EUR 1.5 million to American Express and the topic stays a 2026 priority
In January 2026 the CNIL fined American Express EUR 1.5 million for cookie violations, confirming that the topic remains a standalone enforcement priority alongside artificial intelligence and cybersecurity. In 2025 there had been 21 cookie decisions, totalling over EUR 475 million. The recurring charges are always the same: trackers set before consent, a reject button less visible or further away than the accept button, inadequate information.
Call centre recordings: the customer has a right to access them, and a transcript is enough
A customer had asked to access their own data contained in a recorded call with customer service. The company refused, considering the protection of the agent's confidentiality to prevail. The authority held that the request could be satisfied by providing the transcript, provided the elements identifying other people involved are redacted: given the professional context of the call and its subject, a supply contract, redaction would not have prejudiced the agent's confidentiality.
EDPB adopts guidelines on anonymisation, web scraping for generative AI, and blockchain
At its July 2026 plenary, the European Data Protection Board adopted guidelines on anonymisation and on web scraping in the context of generative artificial intelligence, together with the final version of the guidelines on processing personal data through blockchain technologies. Three documents addressing three recurring questions: when data is truly anonymous, on what conditions data may be collected from the web to train models, and how the immutability of a chain can be reconciled with data subjects' rights.
Spain: EUR 18 million to Amadeus for reusing booking data for product development
The Spanish authority fined Amadeus IT Group EUR 18 million (reduced to 14.4 with voluntary payment) for aggregating travellers' booking data into profiles for product development. The cross-border investigation found the reuse of data collected years earlier from airlines and agencies, for purposes data subjects could not reasonably expect, without an Article 14 notice and without a valid legitimate-interest balancing test.
Norway: loyalty programme under scrutiny, more than six million members involved
The Norwegian authority concluded proceedings opened after an audit of the Nordic entities of a retail group, finding several breaches relating to its loyalty programme: invalid consent, new processing purposes introduced without assessment, insufficient legitimate-interest balancing, and failure to answer data subject requests within the deadline. More than six million members across the Nordic region were affected.
Credit scoring in utilities: the Italian DPA hits the whole chain with three decisions in one day
With three decisions adopted in the same session on 3 July 2026, the Italian DPA targeted the credit-scoring chain applied to energy supply contracts: Experian Italia, Hera Comm and Cerved. The charges are similar and paint a clear picture: deficient notices, breaches of minimisation and storage limitation, privacy by design and by default disregarded, inadequate responses to access requests and poorly governed Article 28 relationships along the chain.
Whistleblowing: without consulting the unions, the procedure is not compliant
A preliminary requirement that almost everyone overlooks is back in the spotlight: Article 4 of Legislative Decree 24/2023 requires internal reporting channels to be activated after hearing worker representatives or trade unions. The ANAC guidelines clarify that failing to do so makes the procedure non-compliant and may trigger a sanction under Article 21. It also applies to substantial updates, not just first activation.
Data breach: Italian DPA fines Wind Tre EUR 1.7 million after exfiltration of 365,000 customers' data
In its 16 July 2026 newsletter the Italian DPA announced a EUR 1.7 million fine to telecom operator Wind Tre following a data breach with exfiltration of roughly 365,000 customers' data. The case confirms the authority's line on large operators: the incident itself is not the fault - the fault lies in security measures inadequate to the risk (Art. 32) and in how the breach was handled. In the same newsletter: two debt-collection companies fined (EUR 50k and 30k) and the customer's right to access the audio of their own support calls (Enel case).
Character.AI fined EUR 158,000: minors, late DPIA and missing EU representative
With a decision of 3 July 2026 (announced 9 July) the Italian DPA fined Character Technologies Inc., the US company behind Character.AI, EUR 158,000: deficient privacy notice (Arts. 12-14), a DPIA prepared late relative to the service launch, late designation of the EU representative (Art. 27) and shortcomings in minor protection and age verification. Beyond the fine, corrective measures within 120 days: working age verification, an effective cooling-off period against re-registration by blocked minors, minors' profiles private by default.
Children's photos on social media: both parents must consent
In its 17 June 2026 newsletter the Italian DPA restated a principle that matters well beyond family disputes: publishing photos of minor children on social media requires the consent of BOTH parents. In case of disagreement, the child's protection prevails. For the DPO it is an operational criterion affecting schools, nurseries, sports clubs, parishes and companies publishing images of minors for promotional purposes.
Italian DPA to hoteliers: do not keep copies of guests' ID documents
In a notice addressed to the hospitality sector, the Italian DPA reiterated that hoteliers may not keep copies of guests' identity documents: the legal duty (Art. 109 of the Italian public-security code) is to identify the guest and transmit the data to the police via the Alloggiati Web portal - after that, document copies must be destroyed or deleted. A widespread habit becomes a concrete sanction risk.
Data breach: EDPB puts a new EU-wide notification template up for consultation
The EDPB has opened a public consultation on a new harmonised data-breach notification template, designed to align the information requested by authorities across Member States. For DPOs it is operational news: the content of the Art. 33 notification is becoming standardised, and anyone with a structured internal procedure (facts, categories, risk assessment, measures) will find the work already done.
Enel Energia fined EUR 563,052: the 'administrative' call that turns into a sales pitch
With decision no. 170/2026 the Italian DPA fined Enel Energia EUR 563,052: during purely administrative contacts (supply paperwork, takeover confirmations), including via third parties, commercial offers were made without a valid legal basis - even to customers on the opt-out register or who had expressly refused marketing consent. Also challenged: a re-contact mechanism based on opt-out (an SMS with 90 seconds to refuse) and partner vetting - one agency was contracted two months after being sanctioned by the DPA for marketing.
Italy's DPA fines AgID: EUR 55,000 to the Agency for Digital Italy over transparency and privacy by design
With injunction order no. 419 of 28 May 2026 the Italian DPA declared unlawful certain personal data processing carried out by AgID - the Agency for Digital Italy, with a EUR 55,000 fine and publication of the decision on the authority's website. The breaches concern lawfulness, fairness and purpose limitation (Art. 5), information duties towards data subjects (Arts. 12 and 14) and data protection by design (Art. 25).
Italy's DPA halts stress and emotion monitoring at work: not even in aggregate form
With decision no. 342 of 2026, the Italian DPA reaffirmed that data on employees' health or psychological journey cannot be made accessible to the employer, not even in aggregate form. The case closes the loop with the AI Act, which expressly prohibits AI systems that infer people's emotions in the workplace (Art. 5): organisational wellbeing cannot turn into emotional surveillance.
Trenitalia tells customers about a data breach eight months after the attack: an Art. 34 lesson
In July 2026 Trenitalia informed its customers of a data breach suffered roughly eight months earlier. Beyond the outcome, the case is a textbook lesson on the difference between notifying the authority within 72 hours (Art. 33) and communicating to data subjects 'without undue delay' when the risk to their rights is high (Art. 34): eight months are hard to justify, and in the meantime the persons affected could not protect themselves.
Italian DPA annual report: collected fines +54.5%, almost 7 data breaches notified per day, AI at the centre
On 2 July 2026 the Italian DPA presented its 2025 activity report to Parliament: 807 collegial decisions, 506 corrective and sanctioning measures, over EUR 37.7 million in fines collected (+54.5% on 2024), 2,415 data breaches notified (+10%), 130 inspections. AI takes centre stage: from DeepSeek to deepfakes, from facial recognition at the airport to worker surveillance.
SPID under scrutiny: Lepida fined, data of 1.5 million citizens viewable 'out of mere curiosity'
With a decision of 29 April 2026, the Italian DPA fined Lepida (EUR 100,000), one of Italy's main SPID identity providers: over 7,000 counter operators could view data and download copies of ID documents and health cards of more than 1.5 million citizens, even with no operational need. The DPA found accesses 'out of mere curiosity' and documents left stored on operators' workstations after identification.
Digital Omnibus: EU Council approves changes to the AI Act. What it means if you are preparing
On 29 June 2026 the EU Council approved the proposed regulation that streamlines and simplifies certain AI rules, amending the AI Act (the 'Digital Omnibus' package). Negotiations with Parliament continue: until final adoption, the current AI Act text remains the reference, including the August 2026 transparency deadlines.
Italy's DPA fines Emirates EUR 180,000: passenger health data kept for 7 years and an unclear notice
The Italian DPA fined Emirates EUR 180,000 over the handling of reduced-mobility passengers' health data. The case started from a complaint by a passenger asked to fill in a medical form despite not being in the categories required to do so. The key point for DPOs: the collection itself was lawful, but the authority faulted an inadequate notice and excessive retention (7 years).
Loyalty-card data used to fire an employee: Italy's DPA says no. A lesson on purpose limitation
With decision no. 311 of 29 April 2026, the Italian DPA found unlawful the employer's use of data collected through the loyalty card to support an employee's dismissal. That data had been collected to run the loyalty programme, not to monitor or discipline staff. The point for DPOs: having a piece of data does not mean you can use it for any purpose.
EDPB 2026: the EU coordinated action targets transparency (Art. 12-14). What to check in privacy notices
For 2026 the EDPB chose TRANSPARENCY as the topic of its coordinated enforcement action: authorities will examine how organisations inform data subjects under Art. 12-14. In short: clear, complete, verifiable notices. A good moment to review your clients' documents.
GDPR fines top EUR 7.1 billion: enforcement accelerates and SMEs are not exempt
Cumulative GDPR fines have passed EUR 7.1 billion across 1,400+ decisions. Enforcement is accelerating, not plateauing. And contrary to a common myth, SMEs do get fined: smaller amounts, same proportional severity.
France fines IQVIA EUR 5M: pseudonymisation does not take you out of the GDPR
In France the authority (CNIL) fined IQVIA EUR 5 million, clarifying a point many confuse: pseudonymising data - even health data - is not the same as anonymising it. Pseudonymised data remains personal data and must be handled with all the safeguards of the Regulation, including the enhanced ones in Art. 9.
Rome Court annuls the Garante's EUR 15M fine against OpenAI: the one-stop-shop decides
The Rome Court annulled the EUR 15M fine the Italian Garante imposed on OpenAI in 2024. The judge does not rule on the merits (legal basis, notice, age verification): it upholds the jurisdiction argument. For cross-border processing the one-stop-shop and lead authority govern.
The Garante's 2026 inspection plan: six areas and how to be ready
The Italian Garante set its 2026 inspection areas, backed by the Finance Police tech-fraud unit. Topics include data breaches in public databases and abusive access. Those who document self-assessment and lesson learning get treated differently.
France: CNIL fines France Travail EUR 5 million - 36.8 million data subjects and a social-engineering attack
The CNIL fined France Travail (formerly Pole Emploi) EUR 5 million after a breach exposing the data of around 36.8 million people. Attackers used social engineering against partner advisers' accounts. The lesson: having security plans is not enough, they must actually be implemented.
France: EUR 1.7 million to Nexpublica - health and disability data accessible to other users through long-known flaws
The CNIL fined software vendor Nexpublica EUR 1.7 million: its PCRM tool, used by social services, exposed sensitive documents (including disability data) to other users. The flaws were known from prior audits but left open. A textbook case for anyone processing health data.
Spain: AEPD fines Aena EUR 10 million for biometric boarding without adequate DPIA
The Spanish Data Protection Agency fined Aena over EUR 10 million for launching its biometric boarding programme without completing an adequate DPIA. Not a data breach: a failure of preventive accountability.
Netherlands: the EUR 290 million Uber fine and the Dutch Authority's new priorities for 2026
The Autoriteit Persoonsgegevens confirmed the EUR 290 million fine against Uber for unlawful transfers to the US. Meanwhile the Authority sets three strategic priorities for the next two years every DPO should know.
Data breach: Italy's DPA fines The European House - Ambrosetti EUR 85,000 over plaintext passwords and late notification
The Italian DPA fined The European House - Ambrosetti spa EUR 85,000 following a 2024 data breach affecting 61,670 people. The attack, via a technical vulnerability, led to the exfiltration of names, emails, usernames and passwords. The point for DPOs: the breach was notified to the regulator within 72 hours, but data subjects were informed only after two months and after the authority stepped in.
EDPB CEF 2026: 25 European DPAs verify transparency of privacy notices
The European Data Protection Board has launched the 2026 coordinated action on transparency and information obligations. 25 national DPAs (including the Italian Garante) are already contacting controllers in various sectors. What to expect and how to prepare.
Italian DPA cracks down on WhatsApp and Telegram in public administration: ban on operational communications with citizens from July 1, 2026
The Italian DPA (Garante) issued a general provision banning Italian public administrations from using WhatsApp, Telegram, Messenger and other commercial messaging apps for operational communications with citizens. Banned also for requesting documents, certificates or personal data. PAs must use institutional channels (PEC, portals, SPID-auth) by July 1, 2026. Fines up to 100,000 EUR.
Spain: AEPD publishes Europe's first guidance on agentic AI and data protection
The Spanish Data Protection Agency is the first European Authority to publish elaborate guidance on agentic AI. It explains the concept, the vulnerabilities in processing personal data and mitigation measures for controllers and processors.
Vodafone Germany fined EUR 45 million: the Art. 28 GDPR lesson on processor controls
The German Federal Commissioner for Data Protection (BfDI) imposed a total fine of EUR 45 million on Vodafone GmbH: 15M for Art. 28 violation (processor oversight) and 30M for Art. 32 (security). A decision that redefines accountability expectations on processors.
NIS2 and GDPR: how to orchestrate them operationally after Italian Decree 138/2024. The DPO checklist for the NIS Operator
After the NIS2 transposition with Legislative Decree 138/2024, Italian companies qualified as 'essential entities' or 'important entities' must coordinate NIS2 obligations (cyber security, 24h incident reporting) with GDPR obligations (72h data breach). The DPO is not the NIS Coordinator but must interface: risk of double sanctions if not properly orchestrated.
EDPB publishes guidelines on public DPO profiles: transparency, accountability and data subject rights
The EDPB clarifies how to process the professional data of DPOs exposed publicly on online directories: legal basis, purposes, data subject rights and platform responsibilities.
AI Act August 2026: high-risk systems deadline. Mandatory DPIA for enterprise LLMs
The EU AI Act enters its critical phase: August 2026 triggers obligations for high-risk systems. The Italian Garante has already anticipated enforcement with the EUR 5M fine to Luka (Replika). What DPOs must do now.
AI Act and DPO: how the DPO role changes with deployer obligations entering into force in August 2026
In less than 3 months, the AI Act sections dedicated to deployers (users) of high-risk AI systems enter into force. The DPO becomes a key interlocutor for impact assessment, data subject information and monitoring.
Corporate email post-termination: Italian DPA fines ITAS Mutua
The Italian Data Protection Authority addresses the management of corporate emails after employment termination. ITAS Mutua sanctioned for undocumented access and retention beyond necessary.
TikTok vs Irish DPC: Supreme Court suspends 530 million euro fine
The Irish Supreme Court confirms the suspension of the record 530M EUR fine imposed by the DPC on TikTok for EEA data transfer to China. The case exposes the structural problem of enforcement timing against big tech.
Email tracking pixels: new Italian DPA Guidelines
On April 17, 2026, the Italian DPA adopted Guidelines on tracking pixels in emails. For DPOs: 6 months to align privacy notices, consent flows, and privacy-by-design techniques.
Intesa Sanpaolo: 31.8M euro fine from the Italian DPA
The Italian Data Protection Authority fines Intesa Sanpaolo for a data breach affecting 2.4 million customers. Late notification and incomplete information among the key issues.
Rome Court annuls 15M euro fine against OpenAI
The Rome Court annuls the fine that the Italian DPA had imposed on OpenAI for the ChatGPT case. A decision that redefines the scope of GDPR enforcement on generative AI models.
Enel Energia fined over 500,000 euros: telemarketing without consent
The Italian DPA fines Enel Energia for promotional calls to subjects who had not provided consent or had registered their number in the public opposition register.
Italian Supreme Court 984/2026: the DPA 120-day deadline is final
With its January 17, 2026 ruling, the Italian Supreme Court confirms that the 120-day deadline for concluding the DPA's enforcement proceedings is final. A relevant decision for those handling privacy litigation.
EDPB: DPOs are under-resourced and disconnected from top management
EDPB publishes the results of the coordinated enforcement action: insufficient resources, lack of access to top management, conflict of interest risk. A snapshot that also concerns Italian external DPOs.
France's Conseil d'Etat: the line between anonymization and pseudonymization narrows
France's State Council confirms CNIL's approach on pseudonymized health data. A ruling that redefines the practical scope of GDPR anonymization and impacts all data analytics projects.
EDPS strengthens DPO independence: new binding rules
The European Data Protection Supervisor (EDPS) adopts new binding rules to protect DPO independence within Union institutions. A signal strengthening the role.
Digital Omnibus: EDPB and EDPS call for simplification without setbacks
EDPB and EDPS publish the joint opinion on the EU Commission's Digital Omnibus package. Positive measures on data breach and DPIA, but strong opposition to the revision of the personal data definition.
Italian DPA 2026 inspection plan: data breach, whistleblowing, AI in schools
The Italian DPA published its inspection activities plan for January-June 2026. Sectors at risk: banking data breaches, health dossiers, energy telemarketing, and AI in schools.
CNIL fines Free Mobile and Free 42 million euros: 24 million customer data breach
The French Authority separately fines Free Mobile (27M) and Free (15M) for a breach that exposed 24 million subscribers in October 2024. A decision that clarifies the scope of Art. 34 GDPR.