EDPB

Agenda for 20 Jan and 10-11 Feb: EDPB & EDPS Digital Omnibus Joint Opinion due soon | New Joint Opinion on the European Biotech Act proposal | CEF erasure report | Privacy risks for EU citizens travelling to third countries (🇺🇸?) | Latest minutes: 2-3 Dec 2025

2 x meeting minutes today! 🚨 Guidelines: Joint AI Act ↔ EU data protection law interplay; Political advertisements; Web scraping in the context of generative AI | 🚨 Irish, French & Dutch DPAs investigate data brokers | 🇧🇷 & 🇬🇧 adequacy decisions

⏰ New consultation – requiring users to create accounts to shop online | EDPB wants input on templates (DPIAs, breaches WIP) | Overview page for all things EDPB: Guidelines, Opinions, Recommendations, Members, Meetings, Strategy & Work Programs, CEF, SPE, OSS, Art. 65 Decisions, WP29, CSC

Discussing SRB v EDPS, Helsinki Statement and Anonymisation guidelines: stakeholder event coming | Questions on Consent or Pay guidelines | 💡 DPAs focus & challenges | CEF topic 2026 | Joint DMA ↔ GDPR interplay guidelines | ❌ No joint DPIA/FRIA template | GPA resolutions | BCRs: 🇫🇷 Tessi, 🇵🇱 Box

DSA ↔ GDPR interplay guidelines | 🇧🇷 Brazil & 🇬🇧 UK adequacy decisions | Helsinki Statement – practical implementation & Commission on simplifying breach reporting | EDPS C-413/23 update | BCRs: 🇮🇪 Shopify, 🇱🇺 Northern Trust, Ferrero Group, 🇳🇴 Mowi.

Joint EDPB-EDPS simpler ROPA opinion | Data Act MCTs & SCCs | Comments on EC's Art. 28 DSA Guidelines | Update on 🇩🇪 Federal DPA Vodafone €45m fines | BCRs: 🇳🇱 Aramex, 🇳🇴 Wilh. Wilhelmsen Group | Certification criteria: 🇦🇹 BDO, 🇩🇪 TÜV IT

2026 topic: 📝 transparency & information | 2025 report due in "months" | The EDPB created the CEF initiative under its 2021-2023 Strategy to enhance enforcement and strengthen cooperation among DPAs. Each year, they collectively choose a priority enforcement topic for coordinated (voluntary) action.

🚨 AI & Data Protection Training | EDPB-EDPS opinion simplifying Art. 30(5) ROPA | Scientific research GLs discussed but redacted (as was "Smart TVs") | New 🇪🇪 CJEU case & 🇧🇪 IAB Europe update – but no further details | Joint EC-EDPB DMA ↔ GDPR interplay guidelines | 🇫🇷 rec. coming for email pixels.