Regulatory Blog

On 17 February 2024, the Digital Services Act (DSA) came into effect, applying to all online intermediaries operating within the EU. This comprehensive regulation aims to enhance online safety, fairness, and transparency for users.

On 7 March 2024, in a landmark decision, the Court of Justice of the European Union clarified the rules surrounding the concepts of “personal data” and “data controller” in the context of the auctioning of personal data for advertising purposes under the General Data Protection Regulation.

On 13 March 2024, the European Parliament officially approved the AI Act, the world’s first regulation on artificial intelligence, with an overwhelming majority. The AI Act is a set of regulations designed to govern the deployment and use of AI systems – its mission is to both recognise the transformative potential of AI across various sectors, including healthcare, transportation, manufacturing, and energy, while also acknowledging the need for robust oversight to ensure the technology's safe and ethical utilisation.

On 18 January 2024, the European Data Protection Board published a One-Stop-Shop case digest on Security of Processing and Data Breach Notification. The Case Digest looks at a selection of decisions on security of processing and personal data breach notifications taken from the EDPB’s public register. It is based on a review of 90 decisions made between January 2019 and June 2023, covering Articles 32, 33, and 34 of the GDPR.

The European Data Protection Board recently introduced a website auditing tool to improve compliance with the General Data Protection Regulation. This tool, developed within the framework of the EDPB Support Pool of Experts, is intended to be a pivotal resource for both legal and technical auditors at data protection authorities (DPAs), as well as controllers and processors looking to assess their own websites.

On 14 December 2023, the Court of Justice of the European Union (CJEU) issued a landmark ruling in the case of VB v. Natsionalna agentsia za prihodite (C‑340/21), placing a spotlight on the concept of non-material damage under Article 82 of the EU General Data Protection Regulation (GDPR) and specifically addressing the pivotal issue of the adequacy of technical and organisational measures (TOMs) in the context of a data breach.

On 27 November, the Council of the European Union (the Council) took a significant step towards making the European Union a global leader in the data-driven economy with the formal adoption of the new Data Act.

On 2 February 2024, the EU’s Artificial Intelligence Act was unanimously approved by the Council of EU Ministers.

On 26 October 2023, the Interactive Advertising Bureau, a European association representing digital marketing and advertising companies, released a paper with recommendations for enhancing GDPR enforcement in cross-border cases. This is in response to the European Commission's aim to simplify GDPR enforcement in these cases.