National DPA news
resource

National DPA news

members – 4 min read
Latest: 🇵🇱 Call to change medical documentation laws | 🇩🇪 Federal DPA update on Facebook page ban case + shares social media guidance | 🇸🇮 Slovenia DPA warns against CSAM | 🇩🇪 Hamburg DPA bridges the gap: GDPR ↔ AI Act
Rie Aleksandra Rie Aleksandra
AI (Act) resources
AI resource DPIA

AI (Act) resources

members – 18 min read
Latest: MIT 1600+ AI Risk Repository | NIST Cyber AI Profile Workshop | 🇳🇱 AI Act Guide (in 🇬🇧) | 🇩🇪 DPAs protest proposal to move AI oversight | Commission seeks feedback on AI dynamics, fairness and contestability in DMA review
Rie Aleksandra Rie Aleksandra
GDPR 2.0?
EDPB EDPS exceptions

GDPR 2.0?

members – 6 min read
16 Sep: Have your say on the upcoming Digital Omnibus (deadline 14 Oct.) | The Commission is proposing to simplify the European Single Market, including the GDPR Articles 4, 30, 40 and 42.
Rie Aleksandra Rie Aleksandra
EDPB meeting agendas and minutes
EDPB

EDPB meeting agendas and minutes

members – 7 min read
11 Sep agenda: 🚨 DSA ↔ GDPR interplay guidelines published (consultation) | Practical implementation of the Helsinki Statement | Transfer SCCs from different jurisdictions | DMA review | EDPS concluding EC MS365 audit | Lots of BCRs
Rie Aleksandra Rie Aleksandra
CJEU C-655/23 Quirin Privatbank 4 Sep 2025
CJEU rights erasure

CJEU C-655/23 Quirin Privatbank 4 Sep 2025

members – 3 min read
GDPR offers no judicial remedy outside erasure requests to stop future unlawful processing, but Member States may. Non-material damage covers negative feelings – if proven. A controller’s fault doesn’t affect compensation, and a court order banning repeat GDPR violations can’t reduce or replace it.
Rie Aleksandra Rie Aleksandra
Adequacy decisions
transfers

Adequacy decisions

members – 3 min read
5 Sep: Commission with 🇧🇷 Brazil draft adequacy decision – Up next: EDPB Opinion, Member States reps approval and EP "right of scrutiny" | 22 July: Commission deems 🇬🇧 UK DUAA adequate.
Rie Aleksandra Rie Aleksandra
CJEU C-383/23 ILVA (GDPR fine) 13 Feb 2025
CJEU fine retention

CJEU C-383/23 ILVA (GDPR fine) 13 Feb 2025

members – 4 min read
2 Sep: 💸 ILVA fined €201k | When fining a controller in a corporate group, DPAs must base the maximum fine on the *group’s* total worldwide turnover from the prior business year. A crucial ruling for anyone in a company group – here's also text you can copy for an email to your Management/Board.
Rie Aleksandra Rie Aleksandra
Events 2025

Events 2025

members – 5 min read
Next up: 16-19 Sep 🇰🇷 Seoul: Global Privacy Assembly | 18 Sep 🇳🇱 Utrecht: DPO Day organised by the DPA | 29-30 Sep 🇸🇪 Stockholm: Nordic Privacy Arena
Rie Aleksandra Rie Aleksandra