The Brazilian DPA announced it has issued measures on Facebook's processing of WhatsApp user personal data after changes to WhatsApp Terms of Service and Privacy Policy for Brazilian users. See anpd-super.mj.gov.br/sei/publicac...

Greens/EFA in the European Parliament have also sent a letter to EU Commissioner Henna Virkkunen, protesting against several aspects of the leaked digital omnibus and GDPR. See www.linkedin.com/posts/ralf-b...

GDPR

The Rapporteur for the 4th "GDPR" Omnibus has published his Draft Report. See lnkd.in/ddF8wwdw.

The German Supreme Court has confirmed the dismissal of an injunction action brought by a consumer association, which aimed to prohibit the transmission of so-called positive data to SCHUFA. Such sharing can be justified under Art. 6(1)(f) of GDPR. www.bundesgerichtshof.de/SharedDocs/P...

The Commission is taking a “wait-and-see” approach on GPAI standards, with no request expected before mid-2026. By the time they’re ready, likely around 2030, the AI market may have moved on, or Brussels may have further changed its rules. www.mlex.com/mlex/article...

A court in Munich has ruled that OpenAI’s chatbot ChatGPT violated German copyright laws by using hits from top-selling musicians to train its language models in what creative industry advocates described as a landmark European ruling. www.linkedin.com/posts/luisal...

The draft eliminates sensitive personal inferences as sensitive personal data. For instance, using Grind could imply that someone is gay, but under the new draft, this would no longer be considered sensitive personal data.

S&D Group is speaking out with clarity and conviction against the content of the digital omnibus leak. @brandobenifei. www.linkedin.com/posts/anja-w...

It's hard to explain just how bad the leaked "Digital Omnibus" is, but this short video does a good job of it. Imagine if someone so thoroughly lacquered from snorting slop while praying to Sam Altman were asked to edit a privacy law.

AGENDA Twenty-seventh meeting of the Committee established under Article 93 of the GDPR

EDPS just published its Guidance for Risk Management of Artificial Intelligence systems. Read the full guidance document here lnkd.in/dEwVBZVB

The GDPR Reform intends to introduce the "relative" approach to personal data from C-413/23 P EDPS v SRB, possibly extending or codifying its broader aspects. Douwe Korff analyzed GDPR concepts in relation to the CJEU judgment in EDPS v SRB.

The Court of Justice decided to grant Meta leave to intervene in Cases Bindl/European Commission in support of the form of order sought by the European Commission. This includes reviewing Meta's SCCs. Please read Thomas Bindl's thoughts here: www.linkedin.com/feed/update/....

The Commission is set to introduce the Digital Omnibus on November 19. Here's version 2.0 of the analysis of the draft amendments on the GDPR and ePrivacy in the “Digital Omnibus” Overview by Max Schrems here: lnkd.in/dnt_e2v7.

The Commission proposes recognizing preference signals. This change would let individuals set their choices via browsers or device settings, automating decisions on consent and objections. Controllers shall honor these signals. GPC under the GDPR: berjon.com/gpc-under-th.... By @robin.berjon.com.

Special Category Data by Inference and Special Category Data by AI training: The Commission is considering amendments to the GDPR and AI Act that limit the definition and scope of sensitive personal data, as detailed in a recent draft. See www.linkedin.com/posts/luisal....

While the European Commission plans to modify the General Data Protection Regulation (GDPR), the government of Bangladesh has issued gazette notifications on Bangladesh's Personal Data Protection Ordinance, 2025. See www.dpp.gov.bd/bgpress/inde...

Minutes 109th EDPB Plenary meeting Update on the EU DPIA template and possible work on FRIA under the AI Act, at www.edpb.europa.eu/system/files...

Minutes 109th EDPB Plenary meeting Discussion on draft guidelines on consent or pay (Key Provisions ESG), at www.edpb.europa.eu/system/files...

European Commission's plans to modify the General Data Protection Regulation (GDPR) and formalize AI processing under legitimate interests, according to a recently leaked draft. Who will it work?

I think this attack on ePrivacy and the GDPR (which would be hard, if not impossible, to reverse through the courts) is worse than ChatControl. Didn't think the Commission would stoop this low.

Decision from Austrian DPA on the territorial scope of GDPR regarding a company located in Curaçao. See www.ris.bka.gv.at/Dokument.wxe....

The Commission will introduce the Digital Omnibus on November 19, simplifying of the implementation of AI Act. Here's the text shared by netzpolitik.org: lnkd.in/dCTW36pS.

Does this imply that the CNIL and other Data Protection Authorities will no longer have jurisdiction over matters concerning cross-border cookies?

The Commission is set to introduce the Digital Omnibus on November 19. Here's the full text published by Dr. Daniela R: lnkd.in/dKT-bHHq. Here's text of the internal draft amendments on the GDPR and ePrivacy in the “Digital Omnibus by Max Schrems here: lnkd.in/d3JRKEpr.

The Commission is set to introduce the Digital Omnibus on November 19. www.linkedin.com/posts/luisal... This text was shared by Max Schrems. Text of the internal draft amendments on the GDPR and ePrivacy in the “Digital Omnibus” Overview based on previously “leaked” documents.t

R.I.P. GDPR!

The Court of Justice of European Union is set to determine if Article 6 of the GDPR applies (or not) when data processing is conducted under the ePrivacy Directive. On 27 March 2025, Advocate General Szpunar issued his long-awaited Opinion. He noted:

The idea is to put the obligation instead on the Commission and member states to foster AI literacy, whatever that means.

Philippe Latombe has filed an appeal against a ruling by the General Court that upheld the validity of the EU-US Data Privacy Framework (DPF).

New legal basis for sensitive data?

On 5 November 2025, the Commission launched work on a code of practice on the marking and labelling of AI-generated content. See digital-strategy.ec.europa.eu/en/policies/...

The Implementing Regulation for Indonesia’s Personal Data Protection Law is pending issuance, and the Constitutional Court is conducting hearings on data transfer matters. See en.mkri.id/news/details...

The Ministry of Electronics and Information Technology (MeitY) has released the India AI Governance Guidelines. static.pib.gov.in/WriteReadDat... How do we ensure lawfulness in AI under India's Digital Personal Data Protection Act, 2023 (DPDP Act)?

After five years of discussions, Paraguay's Senate has ratified and approved its version of the Data Protection Bill, 2019, which is now pending the President's approval or veto. x.com/780AM/status...

Is the DPO suited to be the AI Officer? The French DPA's post seems to indicate that it is not. This also launched a survey to examine the role of DPOs in the context of artificial intelligence. www.cnil.fr/fr/dpo-a-lhe....

During its latest plenary, the EDPB adopted an opinion on the European Commission’s draft decision on the adequate level of protection of personal data in Brazil. www.edpb.europa.eu/system/files...

The much-awaited Sri Lanka's Personal Data Protection (Amendment) Act No. 22 of 2025.

AI Act: Commission publishes a reporting template for serious incidents involving general-purpose AI models with systemic risk. See digital-strategy.ec.europa.eu/en/library/a...

SCOOP: The Commission is moving to recognize “legitimate interest” as the legal basis for training AI models under the GDPR. The proposal, part of the upcoming digital omnibus, is now under formal discussion between DG CNECT and DG JUST. w/ Matthew Newman www.mlex.com/mlex/article...

I initially thought the decision was about copyright without reading further. Thanks, Peter Craddock, for clarifying its relevance from a data protection perspective, as well. www.judiciary.uk/wp-content/u...

The California Privacy Protection Agency Board will be holding a public meeting on Friday, November 7. See lnkd.in/dCCBstee. This memorandum provides for the California Privacy Protection Agency Board’s consideration of several bill proposals that would amend the CCPA.

The CJEU in SCHUFA (C-634/21) found that preparatory acts can be considered ADM (Article 22 GDPR), despite differing opinions among German courts. In Case 17 U 50/25, a German court decided that creating a score without sharing it is internal and not unlawful since no ADM occurs.

In 2023, the Swedish DPA imposed a fine of €1 million on Tele2 for transferring personal data to the United States via Google Analytics. On October 15, 2025, the Stockholm Court of Appeal upheld the decision. This noted: “

Attorney General TX announced that Google has signed the historic $1.375 billion settlement agreement with the State of Texas, marking the conclusion of two of the largest data privacy enforcement actions against the tech giant. See www.texasattorneygeneral.gov/news/release...

The EU declaration on digital sovereignty is converging with the Franco-German summit agenda — EU countries are set to sign it in Berlin. A new draft shifts focus to partners sharing EU values, national control over tech, & drops open-source preferences. www.mlex.com/mlex/article...

111st EDPB Plenary meeting

In 2023, Sweden’s DPA fined four companies for improper EU-U.S. data transfers using Google Analytics; two were penalized with fines. The Stockholm Administrative Court addressed the Tele2 case, involving truncated IP numbers as a form of anonymization. www.linkedin.com/posts/luisal...

California Attorney General Rob Bonta today secured a settlement with Sling TV LLC and Dish Media Sales LLC (Sling TV), a streaming service, resolving allegations that the company violated the California Consumer Privacy Act (CCPA). oag.ca.gov/news/press-r...