10x CJEU in Sep + Community Learning Seasons: risks, DPIAs
paid
–
3 min read
🚨 Two key CJEU rulings: EDPS v SRB on personal data & pseudonymisation (3 Sep.) and Latombe v Commission on the EU-US DPF (4 Sep.), plus one more ruling and seven Advocate General opinions. Buckle up!
The UK Data (Use and Access) Act (DUAA) 2025
paid
–
9 min read
ICO launches consultations for amendments | Get quickly up to speed on the new UK Data (Use and Access) Act. 💬 "there is no need to panic. Many of the changes empower rather than require, and even if embraced could be done so incrementally."
EDPS audit of the Commission's MS365 use
paid
–
11 min read
28 July: EDPS closes its investigation into the European Commission’s use of Microsoft 365, now deeming it compliant after previously finding serious EUDPR violations, notably on purpose limitation and international transfers.
EDPB meeting minutes 3-4 Jun 2025
paid
–
2 min read
🚨 AI & Data Protection Training | EDPB-EDPS opinion simplifying Art. 30(5) ROPA | Scientific research GLs discussed but redacted (as was "Smart TVs") | New 🇪🇪 CJEU case & 🇧🇪 IAB Europe update – but no further details | Joint EC-EDPB DMA ↔ GDPR interplay guidelines | 🇫🇷 rec. coming for email pixels.
EU and China discuss new Cross-Border Data Flow Communication Mechanism
paid
–
1 min read
Last year, EU and China began discussing a new Cross-Border Data Flow Communication Mechanism for non-personal data. On 17 July, a second meeting took place. First sector out: automative.
🇮🇪 DPC fines TikTok €530m for China transfers
paid
–
3 min read
10 July: DPC launches new investigation into China transfers. Earlier: transparency breach by failing to disclose the third countries involved and didn't explain the nature of the transfers in its privacy policy --> get compliant in six months or stop the transfers (but order paused until Oct).
CNIL shares transfer impact assessment (TIA) practical template
paid
–
2 min read
NB: On 9 July, CNIL appears to have updated the webpage with that date, though there don’t seem to be any actual changes – and the PDFs are still from January. Either way, here’s a quick reminder! 💬 "CNIL TIA template is one of the best templates available to the public!"
EDPB Helsinki Statement 2 Jul 2025
paid
–
2 min read
In a "landmark statement", the EDPB announces ready-to-use templates, a harmonised breach notification form, practical checklists and case law-style publications, plus more agile guidance updates and cross-regulatory cooperation to simplify GDPR compliance – especially for SMEs!
EDPB Guidelines 2/2024 Article 48
paid
–
5 min read
Update 4 Jul: EDPB shared high-res diagram! Earlier: I've reviewed the final version – mostly clarifications and my annotations on the public consultation one are still valid | EDPB Guidelines on Article 48 covering official requests from third country public authorities for personal data transfers.
EDPB meeting minutes 5 May 2025
paid
–
3 min read
No major news, though lots going on in 🇧🇪 (interesting FATCA decision, "abuse of law by NOYB" and mass rejection of NOYB complaints) | Approved 🇬🇧 GDPR & LED adequacy decisions extensions | Interesting 🇫🇷 case the CNIL will "propose a collective and coordinated action" for.