ArpokratLeg

Lawyer. Digital sovereignty, encryption, age verification, the AI Act. Co-founder of @ArpokratPrivacy, Switzerland. PT / EN / FR.

[ArpokratLeg @ArpoLegDep]

There is an old way to ban something and a modern way. The old way is written into law, debated in parliament, and leaves a record. The modern way bans nothing. It sets a technical requirement and lets the architecture do the rest.

[ArpokratLeg @ArpoLegDep]

The EDPB has published draft guidelines on web scraping for generative AI training. The European Data Protection Board is the independent body that ensures the GDPR is applied consistently across the EU.
One point stands out. Scraped data was not obtained from the people it describes, so Article 14 GDPR requires telling them. The exception for “impossible or disproportionate effort” exists, but the EDPB says it should not be routinely relied upon outside archiving, research or statistics (para. 27).
Even when it applies, one measure is always required: make the information public. That means a notice with the data categories, purposes, legal basis, and a precise indication of sources, including the crawler’s characteristics (paras. 28 to 30).
These are guidelines open for consultation until 30 October 2026, not binding law. But they show how regulators will read the exception.

[ArpokratLeg @ArpoLegDep]

Since 11 September 2026, manufacturers of products with digital elements in the EU must report to the authorities when a vulnerability in their product is being actively exploited. The same goes for severe security incidents. This is Article 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847).

The clock starts when the manufacturer becomes aware: an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days after a fix or mitigation is available. Reports go through a single platform run by ENISA, the EU cybersecurity agency, to the CSIRT (computer security incident response team) of the country where the manufacturer is mainly established, and ENISA receives them at the same time.

The rest of the Act applies from 11 December 2027. Article 14 does not wait: it also covers products placed on the market before that date (Art. 69(3)).

[ArpokratLeg @ArpoLegDep]

On 18 June 2026 the Court of Justice of the EU ruled on evidence obtained in breach of the GDPR (NTH Haustechnik, C-484/24).
A German company, through one of its employees, accessed a former employee's private eBay account with her login, to show she had sold goods the company said were its own. A German higher labour court asked whether a court may use that personal data as evidence.
The Court's answer: the GDPR does not automatically bar it. Where the statute is silent, clear and foreseeable case law must set the conditions, serve a public interest and be proportionate. The company's failure to inform the person does not, by itself, stop the court from using the data. The court must still protect the data of people who are not parties to the case.
The ruling is about what a court may do with the evidence, not about whether it was lawfully collected.

[ArpokratLeg @ArpoLegDep]

The European Data Protection Board (EDPB), which brings together the EU's data protection authorities, has draft Guidelines 02/2026 on anonymisation open for public consultation until 30 October.
The draft says data is anonymous only if it does not relate to an identified or identifiable person. It proposes three checks. No record can single out one person. No record can be linked to other records about the same person. No specific and meaningful inference about a person can be drawn. If one check fails, a further analysis is needed.
It also says anonymity depends on who holds the data, so the same data can be anonymous for one party and personal for another. This follows the Court of Justice's ruling in EDPS v SRB (C-413/23 P).
The takeaway: swapping names for pseudonyms that can easily be reversed is not anonymisation.

[ArpokratLeg @ArpoLegDep]

5/ The takeaway: the delay covers high-risk AI only. Transparency rules and general-purpose AI obligations already apply. Breaches of Article 50 can be fined up to €15 million or 3% of worldwide annual turnover, whichever is higher.

[ArpokratLeg @ArpoLegDep]

1/ The EU AI Act timeline changed in July. Regulation (EU) 2026/1744, the “Digital Omnibus on AI”, was published in the Official Journal on 24 July 2026 and entered into force on 27 July. It amends the AI Act, the EU’s regulation on artificial intelligence. Here is what applies now and what moved.

[ArpokratLeg @ArpoLegDep]

4/ What comes next. On 2 December 2026 a new ban applies to AI systems made for, or easily able to create, non-consensual intimate images of real people. The same day, providers of generative AI already on the market before 2 August 2026 must comply with the Article 50(2) marking duty.

[ArpokratLeg @ArpoLegDep]

The UK's data protection regulator changed its structure on 30 September. The Information Commissioner's Office (ICO) became the Information Commission, under the Data (Use and Access) Act 2025.
Until then, all the regulator's powers were held by one person, the Information Commissioner. Now they sit with a board, whose executive and non-executive members share responsibility for decisions. Seven non-executive members have been appointed, and the search for a Chair is still open.
Its role and powers do not change, and it is still known as the ICO.
The takeaway: the same regulator, now deciding as a board instead of through one person.

[ArpokratLeg @ArpoLegDep]

The Spanish data protection authority (AEPD) fined Securitas Direct €100,000 because of a phone number.
The company's video surveillance notices told people to call a 902 number to access or object to the recordings of them. That is a special-rate line, so exercising the right cost money. A consumer association complained.
The AEPD found a breach of Article 12(2) GDPR, which requires controllers to facilitate the exercise of data subjects' rights. The free channels on the company's website did not cure it, because the notice itself sent people to the paid line. The company has 12 months to replace the notices.
The takeaway: it is not enough to offer a free route somewhere. The channel the notice points to is the one that counts.

[ArpokratLeg @ArpoLegDep]

The Italian data protection authority (Garante) has fined the Italian branch of the bank BBVA €5,508,000 over one customer's objection to marketing.
The facts (decision of 3 September 2026, published on 11 September): the customer told the bank he objected to marketing and switched off commercial notifications in the app. Between October 2025 and May 2026 he still received at least ten promotional messages in the app. Customer service told him he could ignore the pop-ups. The bank later explained that its opt-out settings had not been synchronised with the unit that sends the messages.
The Garante found breaches of Articles 5, 12, 21 and 24 GDPR. The objection was not acted on correctly or on time, and the information the customer received did not match what the bank was actually doing. It rated the overall intensity as low, given one person and seven months, yet the fine reached €5.5 million.
The point: a right can fail not in the law but in the plumbing between systems. Article 24 is about the organisational measures that make the right work.

[ArpokratLeg @ArpoLegDep]

La clé est de distinguer trois couches : l'obligation du fabricant de corriger et de fournir les mises à jour (le règlement européen sur la cyber-résilience l'imposera dès le 11 décembre 2027), le rôle de l'exploitant du magasin, et ce que prévoit le contrat de maintenance. Les faits sur qui devait déployer le correctif ne sont pas encore publics.

[ArpokratLeg @ArpoLegDep]

Less "should it be connected?" than "who keeps it updated?". Danfoss says the affected units ran outdated firmware (cause not yet confirmed). From 11 Dec 2027 the EU Cyber Resilience Act will require manufacturers to fix vulnerabilities without delay, including with security updates. Reporting of actively exploited ones already applies since 11 Sep 2026.

[ArpokratLeg @ArpoLegDep]

Norway's government has announced it will propose a temporary ban on AI glasses in selected places. The Ministry of Digitalisation and Public Governance said on 5 October 2026 that it will bring a bill to parliament as soon as possible.
The places under consideration include parks, beaches, museums, shopping centres and public events; schools, kindergartens and playgrounds; and places where privacy matters most, such as health facilities, swimming pools and gyms with changing rooms. It is not a total ban. Private use would stay allowed, and exemptions are planned for vulnerable groups and some socially useful uses. An expert group will work on lasting rules in parallel.
What I find interesting is the legal technique. The proposal does not start from what is done with the recordings. It regulates where the device may be used. The government has not yet decided which technology the ban covers: cameras, audio recording, AI functions or other body-worn devices.
For now it is a proposal, not law.

[ArpokratLeg @ArpoLegDep]

The UK Information Commissioner's Office (ICO) has opened a call for evidence on agentic AI: systems that plan and carry out tasks on their own, using tools, rather than just answering questions.
It runs until 20 November 2026. The ICO wants input on how UK data protection law applies in six areas: security, transparency, accountability, automated decision-making, fairness and purpose limitation, and lawfulness of processing. The answers will feed into its future guidance and its forthcoming statutory code of practice on AI and automated decision-making.
The same day, the ICO said ten AI developers have made or committed to data protection changes.
Accountability is the one I will watch. When software acts on its own, "who decided?" gets harder to answer, and so does "who is responsible?"

[ArpokratLeg @ArpoLegDep]

The Italian data protection authority (Garante) has fined IQVIA Solutions Italy €7 million for treating as anonymous health data that was not anonymous.
The company, part of a multinational group that analyses health data, had built a database on about one million patients of 800 family doctors, used for studies partly commissioned by pharmaceutical companies.
The Garante's reasoning (decision of 23 September 2026): each patient carried a code that let the same person be followed over time. Combined with year of birth, sex, diagnoses, prescriptions and location data, this made it possible to single out and re-identify individuals by reasonable means. So it was personal data, and the Garante found failures on the legal basis, information to patients, retention limits, impact assessment and security.
The takeaway: a persistent code plus rich detail is pseudonymisation at best. Calling it anonymous does not make it so.

[ArpokratLeg @ArpoLegDep]

The Irish Data Protection Commission has fined Google Ireland Limited €403 million over how it handled location data. Ireland leads because Google's EU entity is established there, and it worked with other European authorities.
The decision (21 September 2026) covers three Google account features, Web & App Activity, Location History and Location Accuracy, between 25 May 2018 and 4 February 2020. It finds breaches of Articles 5, 6, 12 and 13 GDPR: processing that was not lawful and fair for the first two features, a failure of transparency for all three, and location data kept longer than necessary. Google has six months to bring its processing into compliance.
The part worth noting is transparency: the DPC found users could have been unaware that their location was used for purposes such as ad targeting. Informing people is not a formality. It is part of what makes the processing lawful.

[ArpokratLeg @ArpoLegDep]

An Advocate General of the EU Court of Justice has given his opinion on a question every marketer should know: can you rely on consent that people gave to someone else?
The case (C-317/25, Groupe Canal+): in 2021, Canal+ ran email campaigns to about 3.9 million people. Their consent had been collected by two internet providers, for use by their unnamed “partners”. The French data protection authority (CNIL) fined Canal+ €600,000, and the French Conseil d’État asked the Court of Justice for guidance.
Advocate General Spielmann’s answer (17 September 2026): consent must be informed, which means people must be able to know who the controller is. “Partners” is not enough. Fresh consent is needed at the latest with the first message, and an unsubscribe link does not fix the gap.
An Advocate General’s opinion is not binding, and the Court has not ruled yet.

[ArpokratLeg @ArpoLegDep]

The Dutch data protection authority has fined Uber €824,990,000 for taking fully automated decisions about drivers and for not informing them properly.
The facts: between 2018 and 2022, software deactivated driver accounts over suspected fraud or low ratings. Drivers lost income. The case began with complaints from 171 French drivers. The Dutch authority led it because Uber’s EU headquarters are in the Netherlands.
Article 22 GDPR protects people from decisions based solely on automated processing that significantly affect them. What was missing here was any human assessment before decisions with serious consequences took effect.
Uber is contesting the fine.