The Danish DPA found that a municipality was not in compliance with GDPR regulations. This investigation was initiated following the annual report from the municipality's data protection officer (DPO report). See www.datatilsynet.dk/presse-og-ny...

More Data Transfer news: The Irish DPA announced it has opened an inquiry into Infinite Styles Services Co. Ltd. (SHEIN Ireland) for making data transfer to China. dataprotection.ie/en/news-medi...

The Supreme Court has dismissed an appeal from the Data Protection Commission (DPC) on a point of law arising from the commission’s decision to fine social media giant TikTok €530 million and direct it to stop sending user data to China. Decision I: lnkd.in/eUaA9fUS Decision II: lnkd.in/eH_BYP5x.

Today, the Privacy Commissioner of Canada has released new age assurance guidance to help organizations. Meanwhile, LIBE will review the practicality, balance, and impact of different age-checking methods, such as age verification. See www.priv.gc.ca/en/opc-news/...

Capitals reconsider red lines ahead of renewed AI reform talks. Second attempt at striking trilogue deal on “simplifying” AI Act set for Wednesday - Maximilian Henning, at lnkd.in/ez6JKzRR.

The FTC has reached its Kochava's decision, and @cobun can now bring his saga to a close. The FTC will prohibit data broker Kochava and its subsidiary from selling, sharing or disclosing sensitive location data without consumer consent. www.ftc.gov/news-events/...

Amendments to Connecticut Data Privacy Act (CTDPA) (SB 4) were passed by the CT House. Among other things, the bill revises Connecticut’s consumer data privacy law and creates a new data broker registration law. www.cga.ct.gov/2026/BA/PDF/...

The Office of the Privacy Commissioner of Canada has announced a press conference to share the results of their joint investigation into OpenAI’s ChatGPT. Additionally, the Privacy Commissioner has released guidance regarding age assurance. www.priv.gc.ca/en/privacy-t...

The Indonesia Ministry of Communication and Communication Office announced that, as of today, 1.7 million TikTok accounts belonging to users under 16 years old have been deactivated. www.komdigi.go.id/berita/siara...

An employer may be obliged to disclose salary components of a placed employee to a recruitment agency if this information is necessary for the calculation of a contractually agreed recruitment fee. The data transfer can be based on Art. 6 (1) (f) GDPR. www.linkedin.com/feed/update/...

Here we have another decision regarding articles 15(1)(h) and 22 of the GDPR. According to the court's reasoning, if the ADM does not impact the individual, the organization is not required to fulfill the obligations set out in Article 15(1)(h). www.ris.bka.gv.at/Dokument.wxe...

On May 8, 2026, the Antici Group (Simplification) will review the explanatory note on Digital Omnibus - Cyber and Data, which accompanies the Presidency’s updated compromise text.

I'm reading about the synergies between the DMA and GDPR this Saturday. It would be interesting to know if the EDPB has provided any comments on the proposed measures in case Google Search, or if such feedback can be found in its Joint Guidelines on DMA and GDPR.

On February 05, the European Commission has found that Apple's online advertising service Apple Ads and Apple's online intermediation service Apple Maps should not be designated under the Digital Markets Act (‘DMA'). Below's the decision: ec.europa.eu/competition/...

I didn't realize that SOMI had brought a second legal action against Meta in Germany. The proceedings focus on the unlawful use of personal data collected from Instagram and Facebook users, as well as from non-users, for training Meta's AI systems. somi.nl/meta-opnieuw...

SOMI has announced that it will also appeal this decision regarding X. The Bundesgerichtshof (Federal Supreme Court) now has the chance to provide effective collective redress in Germany or to refer the matter to the CJE. somi.nl/somi-ontvang...

Yesterday, Connecticut's AI legislation, Senate Bill 5, was passed by the CT House. Democratic Gov. Ned Lamont is expected to sign the bill. Yesterday, Senator Rodriguez and others introduced SB26-189, a proposal to amend the Colorado AI Act. leg.colorado.gov/bills/sb26-189

Court of Appeal: Collective action against "X" inadmissible due to data protection violations (Press Release 22/2026) Credits: @MichaelSeidlitz

Connecticut's AI legislation, Senate Bill 5, has just been passed by the CT House. Democratic Gov. Ned Lamont is expected to sign the bill.

The Supreme Court has dismissed an appeal from the Data Protection Commission (DPC) on a point of law arising from the commission’s decision to fine social media giant TikTok €530 million and direct it to stop sending user data to China. See www.youtube.com/watch?v=viIo...

I had a really enjoyable conversation with @thewhitehatter.bsky.social about the often overlooked Charter implications of measures like teen social media bans. FYI: Kids have Charter rights and participating in social media is expression.

Is data protection a right reserved only for rich people? Take a look at the latest blog published by NO DPA here: www.datatilsynet.no/aktuelt/aktu...

The Supreme Court of Argentina has declared Article 5(2)(b), 11(3)(b), and 11(3)(c) of Argentina's data protection law as unconstitutional. www.linkedin.com/posts/luisal...

The High Court decided to admit new evidence or argument in Case LinkedIn vs. DPC, with the burden being possibly lighter when such an application is made in an appeal under section 142. See lnkd.in/eUjNUftV.

The Brazilian DPA has published a draft guidance for providers of technology products and services, such as applications, social networks, games, and other internet or communication network tools, under the Brazilian Digital ECA Law.

Malaysia's DPA has recently released three separate guidelines covering automated decision making and profiling, data protection impact assessments, and data protection by design. lnkd.in/ew-JAxm3 lnkd.in/eARWRWub. lnkd.in/eP9yMjnk.

In the U.S., a court-appointed technical committee is expected to suggest privacy protections for sharing user data later this year. www.techpolicy.press/a-counterpro...

House GOP efforts to pass the data privacy law will face difficulties, Rep. John Joyce (R-Pa.) said Wednesday. Joyce said he’s still pushing to pass the bills by the end of the year. punchbowl.news/article/tech...

House Representative @martinyeza has announced that he is collaborating with the Argentina Government to reform the country's current data protection law. Is the new bill available, Representative? Below's the bill that was introduced by House Representative Martin Yeza:

The ICO announced it has concluded its investigations into several data management platforms – businesses that bring together data insights relating to a user's online activity.

I didn't realize that the ICO had completed its guidance on storage and access technologies after holding two consultations on the draft version. Here's the guideline: ico.org.uk/for-organisa....

The Commission has found that Instagram and Facebook may have violated the DSA by not properly addressing risks related to minors under 13 accessing their platforms. To support user-friendly and privacy-preserving age verification, the Commission has created a harmonized method.

The trilogue discussions on the AI omnibus ended without an agreement. Here @lucabertuzzi.bsky.social provides an explanation of the reasons: www.linkedin.com/feed/update/...

The discussions on the AI omnibus concluded without reaching an agreement. Another session may be scheduled in approximately two weeks.

The CIPL has published a report examining the extent to which the GDPR aligns with the newly updated Program Requirements of the Global Cross-Border Privacy Rules (“Global CBPR”) System. www.hunton.com/privacy-and-...

The trilogue is still ongoing. They need Super AI Women Dr. Laura Caroli there.

When does the legal processing of personal data actually start? Here's the last blog published by the Spanish DPA: www.aepd.es/prensa-y-com...

Representative Jay Obernolte and Representative Ted Lieu have introduced consolidated AI bill. See www.linkedin.com/posts/luisal...

Today, the negotiation between the European Parliament and Council regarding the AI Omnibus is expected to conclude. Meanwhile, the Commission has just released the initial review of the DMA. digital-markets-act.ec.europa.eu/about-dma/dm...

The Belgian DPA announced it has issued its guidelines on direct marketing purposes. See www.autoriteprotectiondonnees.be/publications...

Commissioned by SLM Cloud for the central Dutch Government Privacy Company has assessed the privacy risks associated with the use of cloud services provided by STACKIT. Floor Terra, Aleecia McDonald, Rob Herkemij, Šeila Akagić, Sjoera Nas DPIA: lnkd.in/e2vq6-Ya

Today, the California Privacy Protection Agency (CalPrivacy) sent a letter to the House Energy and Commerce Committee opposing H.R. 8413, the SECURE Data Act. See privacy.ca.gov/wp-content/u...

The Court of Justice of the European Union has released its official selection of landmark judgments from 2025. Attached is an extract with summaries of the key data protection rulings. See www.linkedin.com/posts/luisal...

The French DPA has released a draft outlining the process for DPOs to prepare and submit their reports to top management. See lnkd.in/eTaei_QP.

The Philippines DPA issued its guidelines on data scraping. See lnkd.in/eAmV_pcw,

In its updated guidelines on transparency, the Korean DPA highlighted that organizations should verify the effectiveness of their transparency measures, including making sure individuals understand how their data is used to train AI models.

Colorado has agreed to delay enforcement of Colorado AI Act against *ALL* AI companies until later this year.

This is crucial:

The Korean DPA announced it has updated its guidelines on privacy policies, aiming to help organizations meet requirements related to the right to be informed, particularly regarding generative AI.