Opinion 38/2021 on the draft decision of the competent supervisory authority of Latvia regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Urgent Binding Decision 01/2023 requested by the Norwegian SA for the ordering of final measures regarding Meta Platforms Ireland Ltd (Art. 66(2) GDPR)

Liability and Penalties, Supervisory Authorities

Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679

Data Subjects Rights, Right to Object

Opinion 08/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of Bioclinica Group |EPDB

Binding Corporate Rules, Data Transfers

European Commision press release on AI Act Agreement

AI, Specific processing situations

Opinion 06/2022 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of Groupon International Limited |EPDB

Binding Corporate Rules, Data Transfers

Privacy-Enhancing and Privacy Preserving Technologies: Understanding the Role of PETs and PPTs in the Digital Age by CIPL

Controllers and Processors, Technical and Organisational Measures (TOMs)

Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications

Connected Vihicles

Opinion 05/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Lundbeck Group |EPDB

Binding Corporate Rules, Data Transfers

Cybersecurity of Artificial Intelligence in the AI Act by the European Commision

Controllers and Processors, Technical and Organisational Measures (TOMs)

Opinion 07/2022 on the draft decision of the Hungarian Supervisory Authority regarding the Controller Binding Corporate Rules of MOL Group |EPDB

Binding Corporate Rules, Data Transfers

New rules for Artificial Intelligence – Questions and Answers by the European Commision

AI, Specific processing situations

Opinion 04/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of Norican Group |EPDB

Binding Corporate Rules, Data Transfers

Guidelines on submission of signals under the Whistleblowing directive by the Bulgarian CPDP

Whistleblowing

Opinion 32/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the Republic of Korea |EPDB

Adequacy Decisions, Data Transfers

[Draft] Guidelines on the processing of personal data in regard to recruitment by the UK ICO

Automated Decision-making, Controllers and Processors, Data Protection Impact Assessment (DPIA), Employment, Specific processing situations

EDPB-EDPS Joint Opinion 1/2022 on the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2021/953 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic |EPDB

Health Data, Principles, Sensitive Data

Meta Platforms Ireland v EDPB (Case T-319/24)

Controllers and Processors, Data Sharing, Data Subjects Rights

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL LAYING DOWN HARMONISED RULES ON ARTIFICIAL INTELLIGENCE (ARTIFICIAL INTELLIGENCE ACT)

AI, Specific processing situations

EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act)

Data Transfers

Case 3:24-cv-04710-TSH DAVID MILLETTE VS OPENAI

Data Subjects Rights

Voluntary AI Safety Standard by the Australian Government

AI, Specific processing situations

Understanding the Role of PETs and PPTs in the Digital Age

Controllers and Processors, Technical and Organisational Measures (TOMs)

Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria |EPDB

Certification, Controllers and Processors

Data protection code of practice for digital identity schemes in Afrtica

Code of Conduct, Controllers and Processors

Safe and responsible AI in Australia Proposals paper for introducing mandatory guardrails for AI in high-risk settings by Australian Government

AI, Specific processing situations

[DRAFT] Data Confidentiality – Identifying and Protecting Assets Against Data Breaches by NIST

Controllers and Processors, Data Breaches

Relying on the legal basis of legitimate interests to develop an AI system by CNIL

Lawfulness of Processing, Legitimate Interest

Decision by Dutch Data Protection Authority to impose an administrative fine on Uber |English

Controllers and Processors, Data Breaches, Data Subjects Rights

Frequently Asked Questions (FAQs) on the Data Act by the EU Commission

Controllers and Processors, Data Sharing

[Draft] Guidelines on the processing of personal data in regard to employment by the UK ICO

Employment, Specific processing situations

The NSW AI Assessment Framework

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Emerging digital technologies in the public sector report by EU Commission

New technology

Global Approaches to Auditing Artificial Intelligence by IPIE

AI, Specific processing situations

International data transfer agreement and guidance by the UK ICO

Data Transfers

Securing Artificial Intelligence: Mitigation Strategy Report by ETSI

AI, Specific processing situations

Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on adapting non-contractual civil liability rules to artificial intelligence (AI Liability Directive)

AI, Liability and Penalties, Specific processing situations, Supervisory Authorities

Artificial Intelligence Security Governance Framework 1.0 by China Cybersecurity Standardization Technical Committee

AI, Specific processing situations

RISK FRAMEWORK FOR BODY-RELATED DATA IN IMMERSIVE TECHNOLOGIES BY FPF

Principles, Sensitive Data

Noyb Complaint Case: C-082-02 to EU Data protection Supervisor against EU Parliament

Controllers and Processors, Data Breaches, Public Administrative Body

Multidisciplinary Perspectives on Artificial Intelligence and the Law by Springer

AI, Specific processing situations

[Press release] Commission opens formal proceedings against X under the Digital Services Act

Digital Services Act

Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies

Data Transfers

Technical Recommendations on the use of APIs by CNIL

Controllers and Processors, Technical and Organisational Measures (TOMs)

Noyb Complaint Case: C-082-01 to EU Data protection Supervisor against EU Parliament

Controllers and Processors, Data Breaches, Public Administrative Body

A Guide to Cookies and Compliance by DMA

Consent, Cookies, Lawfulness of Processing

How Google Uses Information on websites [link]
UNESCO: Consultation paper on AI Regulation

AI, Lawfulness of Processing, Public Interests, Specific processing situations

[DRAFT] FRAMEWORK CONVENTION ON ARTIFICIAL INTELLIGENCE, HUMAN RIGHTS, DEMOCRACY AND THE RULE OF LAW

AI, Specific processing situations

Meta Faces $1.4 Billion Penalty for Unauthorized Biometric Data Collection in Texas
[PRESS RELEASE No 191/23] CJEU on the right to compensation for non-material damages based on the fear of possible misuse

Liability and Penalties, Supervisory Authorities

Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR
Annex: A summary of the Transparency in Health and Social Care guidance impact assessment by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

Directive 2002/58/EC on privacy and electronic communications
Noyb Sues Hamburg DPA Over ‘Pay or OK’ Consent System
Transparency in health and social care by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

Privacy Program 247.ai
The NYT vs OpenAI and Microsoft

AI, Copyright, Specific processing situations

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default

Privacy by Design

AI Meets Media: OpenAI Secures Another Multi-Year Deal with Media Giant

AI

GUIDELINES ON LEGITIMATE INTEREST by the NPC of the Republic of Philippines

Lawfulness of Processing, Legitimate Interest

EO 13800 on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure

Technical and Organisational Measures (TOMs)

Information Commissioner’s Further Response to the Data Protection and Digital Information Bill (DPDI Bill)

Principles, Sensitive Data

EU Parliament Faces noyb Complaints After Major Data Breach
Processing Personal Data on the Basis of Legitimate Interests under the GDPR by FPF

Lawfulness of Processing, Legitimate Interest

Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR

Right to Erasure

Interim Report – Governing AI for Humanity by UN AI Advisory Body

AI, Specific processing situations

Uber Fined €290 Million for GDPR Violations Over Data Transfers to the U.S.
Website privacy controls a guide for business by New York State Attorney General

Data Subjects Rights, Website privacy

AI fairness in practice by the Alan Turing Institute

AI, Specific processing situations

Guidelines 05/2020 on consent under Regulation 2016/679

Consent, Lawfulness of Processing

Data protection compliant AI by Bavarian State Office for Data protection Supervision

AI, Specific processing situations

Telegram CEO’s Arrest Sparks Debate on Privacy vs. Regulation

Cybersecurity, Personal Data Collection

Case T-1077/23

AI, Copyright, Specific processing situations

Guidelines 9/2022 on personal data breach notification under GDPR [Official EDPB Guidelines] [pdf]

Data Breaches

Connecticut Data Privacy Act
REGULATION (EU) 2018/1725 “GDPR for EU Institutions”
NIST Special Publication_1800-29 Data Confidentiality- Detect, Respond to, and Recover from Data Breaches

Controllers and Processors, Data Breaches

Privacy Notice Template by the UK ICO

Data Subjects Rights

Case 2:24-cv-05140 by the attorney general of California

Consent, Controllers and Processors, Data Sharing, Lawfulness of Processing

How to handle someone’s data subject access request when there is information about other individuals involved by the Irish DPA

Access Requests (DSAR), Data Subjects Rights

Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak

Health Data

THE INTERSECTION BETWEEN COMPETITION AND DATA PRIVACY by OECD – OCDE

Data Subjects Rights

[Draft] Transfer Impact Assessment by the CNIL

Data Transfers

Zapier’s Transfer Impact Assessment

Data Transfers

Supervision of AI systems in the EU by Dutch DPA and RDI (english)

AI, Specific processing situations

Case C 683-2021

Controllers and Processors, Liability and Penalties, Supervisory Authorities

Governance of artificial intelligence (AI) by House of Commons UK

AI, Specific processing situations

EU DATA ACT
Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak

Health Data

Principles on Children & Online Gaming Adopted at the Nordic Data Protection Meeting in Oslo 30 May 2024

Children as data subjects, Data Subjects Rights

Case 4:23-cv-01110-P AHA v. Bacerra

Health Data, Principles, Sensitive Data

GUIDELINES CLOCKING AND ATTENDANCE CONTROL PROCESSING USING BIOMETRIC SYSTEMS BY THE AEPD

Employment, Principles, Sensitive Data, Specific processing situations

Colorado Privacy Act
DECISION OF THE INFORMATION COMMISSIONER Snap Inc. and Snap Group Limited

AI, Specific processing situations

Directive (EU) 2016/1148 “NIS2 Directive”
Artificial intelligence (AI) and human rights: Using AI as a weapon of repression and its impact on human rights by EU Parliament

AI, Specific processing situations

Report on the first review of the functioning of the adequacy decisions adopted pursuant to Article 25(6) of Directive 95/46/EC

Adequacy Decisions, Data Transfers

Guide to Binding Corporate Rules by the UK ICO

Data Transfers

[PROPOSAL 2024] EU AI ACT

AI, Specific processing situations

Generative AI framework for HM Government by the UK Central Digital and Data Office

AI, Specific processing situations

Utah Consumer Privacy Act
Artificial Intelligence Strategy of the CJEU

AI, Specific processing situations

One-stop-shop case digest on Security of Processing and Data Breach Notification by the EDPB

Controllers and Processors, Data Breaches, Technical and Organisational Measures (TOMs)

Draft Impact Assessment Framework by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA)

2023 Coordinated Enforcement Action Designation and Position of Data Protection Officers by EDPB

Controllers and Processors, Data Protection Officer (DPO)

Решение Рег.№ ППН-02-399-2019 КЗЛД – НАП

Controllers and Processors, Data Breaches, Lawfulness of Processing

Guidelines 3/2019 on processing of personal data through video devices

CCTV

UK Data Protection Act 2018
NIST Privacy Framework v1
Наказателно постановление-04-2019-КЗЛД-НАП

Controllers and Processors, Data Breaches, Lawfulness of Processing

Neurodata risks report by EDPS and Spanish DPA

AI, Specific processing situations

NIST Critical Infrastructure Framework
Manipulative, Deceptive, and Exploitative AI Systems report by the Dutch DPA

AI, Lawfulness of Processing, Specific processing situations

European Convention on Human Rights
GDPR in practice: Experience of data protection authorities by FRA

Data Processing by the Government, Specific processing situations

RISK FRAMEWORK FOR BODY-RELATED DATA IN IMMERSIVE TECHNOLOGIES
EDPS Model Administrative Arrangement

Data Processing by the Government, Data Transfers, Specific processing situations

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

Territorial Scope

Guidelines scraping by private organizations and individuals by the Dutch Data Protection Authority

Automated Decision-making, Controllers and Processors

Guidelines 01/2023 on Article 37 Law Enforcement Directive by EDPB

Data Transfers

The EU’s International Cooperation on Cyber Capacity Building| second edition

Cybersecurity

Federal Act on Data Protection (Switzerland)
Artificial Intelligence Risk Management Framework by NIST: Generative Artificial Intelligence Profile

AI, Risk Management, Specific processing situations

AI, DATA GOVERNANCE AND PRIVACY SYNERGIES AND AREAS OF INTERNATIONAL CO-OPERATION BY OECD

AI, Specific processing situations

Recommendations 02/2020 on the European Essential Guarantees for surveillance measures

CCTV, Lawfulness of Processing, Legitimate Interest, Specific processing situations

Secure Future Initiative Report by Microsoft

Cybersecurity

Controller – Processor Assessment Tool

Controllers and Processors

National framework for the assurance of artificial intelligence in government by the Australian, state and territory governments

AI, Specific processing situations

Guide to Technical and Organisational Data Protection Measures (TOM) by the Swiss FDPIC

Controllers and Processors, Technical and Organisational Measures (TOMs)

Cyber Threat Modelling for Risk Assessment by CSB

Cybersecurity, Risk Management

Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects

Contractual Obligation

Board of Directors Handbook for Cloud Risk Governance | Google

Governance

Relying on the legal basis of legitimate interest to develop an AI system by CNIL

AI, Specific processing situations

[UK] International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

Data Transfers

Guide to Good Governance in Cybersecurity by DCSD

Cybersecurity

Generative AI Controls Framework Safe, Secure, and Compliant AI Adoption Approach Whitepaper by IBM

AI, Specific processing situations

[UK] Standard Data Protection Clauses to be issued by the Commissioner under S119A(1) Data Protection Act 2018

Data Transfers

ENISA Threat Landscape 2024 EU Agency for Cybersecurity

Cybersecurity

Regulating targeted and behavioural advertising in digital services by EU Parliament

Marketing and Advertising, Specific processing situations

International Data Transfer Agreements – Transitional Provisions

Data Transfers

Chief Information Security Officer_ HANDBOOK

Risk Management

Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679

Code of Conduct

Orientation guide of the Conference of Independent Federal and State Data Protection Supervisory Authorities by the German Data Protection Conference (DSK)

AI, Specific processing situations

GDPR: a culture of non-compliance? Numbers of evidence-based enforcement efforts by nyob

Liability and Penalties, Supervisory Authorities

AIPact by the European Artificial Intelligence Office

AI, Data Subjects Rights, Specific processing situations

Data protection impact assessment on the processing of personal data on government Facebook Pages

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Datenschutzkonforme Künstliche Intelligenz Checkliste mit Prüfkriterien nach DS-GVO

AI, Specific processing situations

Automated Decision-Making in Online Platforms: Protection Against Discrimination and Manipulation of Behavior

Automated Decision-making, Controllers and Processors

CASE STUDIES (2018 – 2023) by the Irish DPC

Access Requests (DSAR), Controllers and Processors, Data Breaches, Data Subjects Rights, Liability and Penalties, Supervisory Authorities

Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43 of the Regulation

Certification

UK ICO Privacy Policy Generator

Data Subjects Rights

DRAFT RISK ASSESSMENT REGULATIONS FOR CALIFORNIA PRIVACY PROTECTION AGENCY

Risk Management

Analysis of the final compromise text of the EU AI Act with a view to agreement by the Belgian Presidency

AI, Specific processing situations

Transfer Impact Assessment (TIA)

Data Transfers

Transparency and Consent Framework Policies by IAB Europe

Consent, Cookies, Lawfulness of Processing, Principles, Transparency

Transfer Risk Assessment Tool by the UK ICO

Data Transfers

Guidelines 4/2018 on the accreditation of certification bodies under Article 43 of the General Data Protection Regulation (2016/679)

Certification

Transfer Impact Assessment (TIA) Template by HSE

Data Transfers

[UK EXTENSION] EU-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

SWISS-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679

Data Transfers

Senate Bill 262 (Delete Act)
EU-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

THE NEW STANDARD CONTRACTUAL CLAUSES – QUESTIONS AND ANSWERS

Data Transfers, Standard Contractual Clauses (SCC)

Administrative fine against Grindr LLC by The Norwegian Data Protection Authority

Consent, Lawfulness of Processing, Principles, Sensitive Data

Conformally Privacy Policy Generator

Data Subjects Rights

PRESS RELEASE No 20/24 | Case C-118-22

Data Subjects Rights, Right to Erasure

Opinion 1/2023 on the draft decision of the competent supervisory authority of Croatia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to Article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Today’s and tomorrow’s means of payment facing the challenge of data protection by CNIL

Definitions, Processing of personal data

EO 13800 on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure

Controllers and Processors, Technical and Organisational Measures (TOMs)

Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679

Data Protection Impact Assessment (DPIA)

Opinion 02/2023 on the draft decision of the competent supervisory authority of Latvia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to Article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Artificial Intelligence and Algorithms in Risk Assessment by the European Labour Authority

Risk Management

Case ZWO 22/775, Overijssel District, Netherlands

Liability and Penalties, Supervisory Authorities

Report of the work undertaken by the Cookie Banner Taskforce [Official EDPB Guidelines] [pdf]

Consent, Cookies

Opinion 03/2023 on the draft decision of the competent supervisory authority of Romania regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Patent Landscape Report on Generative AI by WIPO

AI, Specific processing situations

A pro-innovation approach to AI regulation by UK ICO

AI, Specific processing situations

Opinion 4/2023 on the draft decision of the competent supervisory authority of Malta regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

BEYOND IMAGINATION : PLANNING FOR ONTARIANS’ DIGITAL FUTURE | 2023 annual report

Governance

Comparison of U.S. State Privacy Laws. Data Protection Assessments by CIPL

Controllers and Processors, Data Protection Impact Assessment (DPIA)

EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro

Accreditation

EditorsTrends in Data Protection and Encryption Technologies by SpringerProfessional

Definitions, New technology, Processing of personal data

NIST Cybersecurity Framework 2.0: RESOURCE & OVERVIEW GUIDE
EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

Accreditation

Review of cybersecurity news in Ukraine, tendencies, and world events related to the First World Cyber War by U.S. Agency for International Development

National Security, Specific processing situations

AI Auditing Checklist for AI Auditing by EDPB

AI, Specific processing situations

Biometric Data Guidance by the UK ICO

Principles, Sensitive Data

Opinion 6/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of Royal Greenland Group |EPDB

Binding Corporate Rules, Data Transfers

National Strategy to Advance Privacy-Preserving Data Sharing and Analytics by the EO by the US President

Anonymisation, Controllers and Processors, Technical and Organisational Measures (TOMs)

Opinion 27/2022 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of LEYTON Group |EPDB

Binding Corporate Rules, Data Transfers

Rethinking Privacy in the AI Era | White Paper by Stanford University

AI, Specific processing situations

Opinion 28/2022 on the Europrivacy criteria of certification regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 (GDPR) |EPDB

Certification, Controllers and Processors

Opinion 23/2023 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules for customer data of the UPS Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 29/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the DSV Group |EPDB

Binding Corporate Rules, Data Transfers

The Colorado AI Act “Senate Bill SB24-205”

AI, Specific processing situations

Opinion 24/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Nestlé Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 30/2022 on the draft decision of the Slovak Supervisory Authority regarding the Controller Binding Corporate Rules of Piano Group |EPDB

Binding Corporate Rules, Data Transfers

Convention on AI, Human Rights, Democracy and the Rule of Law – by the Council of Europe (draft)

AI, Specific processing situations

CNIL open source PIA software – data protection impact assessment

Data Protection Impact Assessment (DPIA)

Opinion 25/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the SHV Holding N.V. Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 31/2022 on the draft decision of the Slovak Supervisory Authority regarding the Processor Binding Corporate Rules of Piano Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 26/2023 on the draft decision of the Romanian Supervisory Authority regarding the Processor Binding Corporate Rules of the OSF Global Services Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 32/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Ramboll Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 27/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Tessi Group |EPDB

Binding Corporate Rules, Data Transfers

Joint Guide to ASEAN MCC and EU SCC

Data Transfers, Standard Contractual Clauses (SCC)

Opinion 11/2023 on the draft decision of the competent supervisory authority of Sweden regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Accreditation

Opinion 28/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Servier Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 12/2023 on the draft decision of the competent supervisory authority of Cyprus regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 29/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Sodexo Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 13/2023 on the draft decision of the competent supervisory authority of Croatia regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

California’s New AB 3048: Opt-Out Signals in Every Browser
Opinion 30/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Sodexo Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 14/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Vestas Wind Systems Group |EPDB

Binding Corporate Rules, Data Transfers

AT&T Privacy Policy

Data Subjects Rights

Opinion 31/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Thalès Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria |EPDB

Certification, Controllers and Processors

Opinion 32/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Thalès Group |EPDB

Binding Corporate Rules, Data Transfers

Practice Guide to Anonymising Personal Data by Stiftung Dateschutz

Anonymisation

Opinion 18/2023 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of the Collibra Group |EPDB

Binding Corporate Rules, Data Transfers

Dutch DPA Fines Clearview €30.5M: Directors Could be Held Liable
Opinion 33/2023 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Controller Binding Corporate Rules of the Cerner Group |EPDB

Binding Corporate Rules, Data Transfers

Decision of the Norwegian Data Protection Authority to adopt urgent and provisional measures against Meta (Facebook)

Liability and Penalties, Supervisory Authorities

Human rights Impact Assessments for AI by Access Now

AI, Data Protection Impact Assessment (DPIA)

Opinion 19/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the American Express Global Business Travel Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 34/2023 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Processor Binding Corporate Rules of the Cerner Group |EPDB

Binding Corporate Rules, Data Transfers

Artificial Intelligence Risk Management Framework (AI RMF 1.0) by NIST

AI

Opinion 20/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Comcast Corporation Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 35/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Carlsberg Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 21/2023 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of the UPS Group |EPDB

Binding Corporate Rules, Data Transfers

OpenAI and Anthropic Partner with U.S. Government for AI Safety Research
Opinion 37/2023 on the draft decision of the competent supervisory authority of Luxemburg regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Certification, Controllers and Processors

Artificial Intelligence and Privacy
Opinion 22/2023 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules for employee data of the UPS Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 38/2023 on the draft decision of the competent supervisory authority of Slovenian regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR). |EPDB

Certification, Controllers and Processors

2025 Update: New SCCs Will Address Missing Rules for Cross-Border Data Transfers
Opinion 7/2023 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of Autodesk Group |EPDB

Binding Corporate Rules, Data Transfers

Massive Data Breach: Exposed 31.5 Million Sensitive Records from ServiceBridge
Opinion 01/2024 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Booking.com Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 8/2023 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of Autodesk Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 2/2024 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the TELEFÓNICA Group |EPDB

Binding Corporate Rules, Data Transfers

Swedish Bank Penalized €1.3 million for Transferring Customer Data to Meta
Dark Patterns in Personal Data Collection: Definition, Taxonomy and Lawfulness
Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU-US Data Privacy Framework |EPDB

Adequacy Decisions, Data Transfers

Opinion 3/2024 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Accenture Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 9/2023 on the draft decision of the Italian Supervisory Authority regarding the Controller Binding Corporate Rules of Vertiv |EPDB

Binding Corporate Rules, Data Transfers

Opinion 04/2024 on the notion of main establishment of a controller in the Union under Article 4(16)(a) GDPR |EPDB

Definitions, Main Establishment

EU Court Upholds €2.4 Billion Fine Against Google for Abusing Market Power
Opinion 10/2023 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the PROSEGUR Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 36/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Booking.com Group |EPDB

Data Transfers

Opinion 16/2023 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the Informatica Group |EPDB

Binding Corporate Rules, Data Transfers

Recommendation 01/2019 on the draft list of the European Data Protection Supervisor regarding the processing operations subject to the requirement of a data protection impact assessment (Article 39.4 of Regulation (EU) 2018/1725) |EPDB

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Belgian DPA Enforces GDPR Compliance on Cookie Banners After noyb Complaints
Opinion 17/2023 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Informatica Group |EPDB

Binding Corporate Rules, Data Transfers

Recommendations 1/2022 on the Application for Approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR) |EPDB

Data Transfers

Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data |Version 2.0 |EPDB

Data Transfers

PRIVACY ENHANCING TECHNOLOGY (PET): PROPOSED GUIDE ON SYNTHETIC DATA GENERATION BY PDPC

Principles, Sensitive Data

Recommendations 02/2020 on the European Essential Guarantees for surveillance measures |EPDB

Specific processing situations, Surveillance

Discussion Paper: Large Language Models and Personal Data by The Hamburg Commissioner for Data protection and freedom of information

AI, Specific processing situations

Saudi Data & Artificial Intelligence Authority: Rules governing the appointment of Personal DPOs under the Kingdom of Saudi Arabia’s (KSA) Personal Data Protection Law (PDPL)

AI, Specific processing situations

Recommendations 01/2021 on the adequacy referential under the Law Enforcement Directive |EPDB

Adequacy Decisions, Data Transfers

Consent Banner Report Overview of EU and national guidelines on dark patterns by NOYB

Consent, Lawfulness of Processing

Australian Information Commissioner (OAIC): Corporate Plan for 2024-25

Data Processing by the Government, Specific processing situations

Recommendations 02/2021 on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions |EPDB

Consent, Lawfulness of Processing

Data protection impact assessment for AI Solutions by Danish DPA

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

NSW report: Artificial intelligence in New South Wales

AI, Specific processing situations

Case C‑740/22

Definitions, Personal Data

The EDPB data protection guide for small business

AI, Risk Management

Mobilizing the legal basis of legitimateinterest to develop an AI system by CNIL

AI, Specific processing situations

Briefing EU Legislation in Progress by EPRS on AI Act

AI, Specific processing situations

Case C‑604/22

Liability and Penalties, Supervisory Authorities

GDPR in practice – Experiences of data protection authorities by FRA

Data Processing by the Government, Specific processing situations

AI system development: CNIL’srecommendations to comply with the GDPR

AI, Specific processing situations

Effective Cyber Risk Management: A best practice governance guide for digitally secure and resilient organisations by Governance Institute of Australia

Cybersecurity, Risk Management

Guide to the Case-Law of the of the European Court of Human Rights

Data Subjects Rights

ENFORCEMENT ADVISORY NO. 2024-01 APPLYING DATA MINIMIZATION TO CONSUMER REQUESTS BY CALIFORNIA PRIVACY PROTECTION AGENCY

Data minimisation, Principles

Global Third Party Cybersecurity Breaches by SecurityScorecard

Controllers and Processors, Data Breaches

Addictive patterns in the processing of personal data Implications for data protection by AEPD

Definitions, Processing of personal data

Case C-394/23, Mousse: Request for a preliminary ruling from the Conseil d’État (France) lodged on 28 June 2023 — Association Mousse v Commission nationale de l’informatique et des libertés (CNIL), SNCF Connect

Definitions, Processing of personal data

Case C‑461/22 CURIA

Data Controller, Definitions

Online age verification: balancing privacy and the protection of minors by CNIL

Children as data subjects, Data Subjects Rights

Approach to Data Spaces from GDPR Perspective (AEPD)

Data Spaces, Risk Management

Guide to Data Protection Impact Assessments by PDPC Singapore

Data Protection Impact Assessment (DPIA)

Federal Data Protection Act (Germany)
Online age verification: balancing privacy and the protection of minors by CNIL | French

Children as data subjects, Data Subjects Rights

Recommendation 7: Check the age of the child and parental consent while respecting the child’s privacy by CNIL

Children as data subjects, Data Subjects Rights

ANAF Case C‑201/14, 1 October 2015

Automated Decision-making, Data Sharing, Data Transfers, Public Administrative Body

Privacy Impact Assessment (PIA) Knowledge Bases by CNIL

Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessments (DPIA) Template by UK ICO

Data Protection Impact Assessment (DPIA)

CCPA Full Text
How to manage DPIAs by Data Protection Network (DPN)

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Templates by CNIL

Data Protection Impact Assessment (DPIA)

Reprimand issued by the UK ICO concerning infringements of Article 5(1)(a), Article 6(1)(a) and Article 7(1) UK GDPR

Consent, Cookies, Lawfulness of Processing, Liability and Penalties

EU-Canada PNR Agreement of 26 July 2017 (Grand Chamber) (EU:C:2017:592)

Data Transfers

Recommendation 6: Strengthen the information and rights of children by design by CNIL

Children as data subjects, Data Subjects Rights

NIST Special Publication NIST SP 800-221A_Information and Communications Technology (ICT) Risk Outcomes Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio

Risk Management

Recommendation 5: Promote parental controls that respect the child’s privacy and best interests by CNIL

Children as data subjects, Data Subjects Rights

Case C 203/22 on AI and automated decisions, the right of access under the GDPR, and the protection of trade secrets

AI, Automated Decision-making, Controllers and Processors, Specific processing situations

Data Protection Impact Assessment (DPIAs) by APDCAT

Data Protection Impact Assessment (DPIA)

Recommendation 4: Seek parental consent for children under 15 by CNIL

Children as data subjects, Consent, Data Subjects Rights, Lawfulness of Processing

Artificial Intelligence and Machine Learning in Health Care and Medical Sciences Best Practices by Pitfalls Gyorgy J. Simon Constantin Aliferis Springer

AI, Health Data, Principles, Sensitive Data, Specific processing situations

Recommendation 3: Support parents with digital education by CNIL

Children as data subjects, Data Subjects Rights

Report and Guidance on Privacy in Social Network Services – ”Rome Memorandum” by International Working Group on Data Protection in Telecommunications

Definitions, Processing of personal data

Prokuratuur (Conditions of access to data relating to electronic communications) (C-746/18, EU:C:2021:152)

Law Enforcement, Local Laws

Recommendation 2: Encourage children to exercise their rights by CNIL

Children as data subjects, Data Subjects Rights

ENFORCEMENT ADVISORY NO. 2024-02 by CALIFORNIA PRIVACY PROTECTION AGENCY AVOIDING DARK PATTERNS: CLEAR AND UNDERSTANDABLE LANGUAGE, SYMMETRY IN CHOICE

Dark Patterns

Privacy Impact Assessment (PIA) Methodology by CNIL

Data Protection Impact Assessment (DPIA)

Risk Management and Impact Assessment (DPIA) by AEPD

Data Protection Impact Assessment (DPIA)

Recommendation 1: Regulate the capacity of children to act online by CNIL

Children as data subjects, Data Subjects Rights

GDPR Full Text
Data Protection Fining Guidelines by UK ICO

Liability and Penalties, Supervisory Authorities

Demonstration of a privacy-preserving age verification process by CNIL

Children as data subjects, Data Subjects Rights

Decision on the merits 46/2024 by the Belgian DPA

Access Requests (DSAR), Data Subjects Rights

Nowak (C-434/16, EU:C:2017:994)

Personal Data

Generative Artificial Intelligence Risk Assessment by State of California Department of Technology

AI, Risk Management, Specific processing situations

Privacy Impact Assessment (PIA) Methodology Mindmap by CNIL

Data Protection Impact Assessment (DPIA)

Guide to Data Protection Impact Assessments (DPIAs) by the Irish DPC

Data Protection Impact Assessment (DPIA)

THE DIGITAL PERSONAL DATA PROTECTION ACT (INDIA)
Salvatore Manni Case C 398/15

Data Retention, Legitimate Interest, Storage limitation

Data Sharing Code of Practice by UK ICO

Controllers and Processors, Data Sharing

GDPR Risk Assessment by the AEPD

Data Protection Impact Assessment (DPIA)

EU AI Act
Google Officially Declared a Monopoly by U.S. Federal Judge
Recommendations for companies planning to use Cloud computing services by CNIL

Cloud Services

Personal Information Protection and Electronic Documents Act (PIPEDA, CANADA)
CNIL and others v Google Case C 136/17

Search Engines, Specific processing situations

Noyb Files Nine Complaints Against Twitter/X for Unlawful AI Data Usage
LinkedIn Used User Data for AI Training Before Updating Its Terms

AI, Data Sharing, Data Subjects Rights, Lawfulness of Processing

META PLATFORMS INC v. FEDERAL TRADE COMMISSION (2024)
Meta Challenges EDPB Opinion on “Consent or Pay” Model at EU Court
Technical and Organizational Measures by Adobe Cloud Services

Controllers and Processors, Technical and Organisational Measures (TOMs)

Genetic Testing Company 23andMe Pays $30M for Data Breach

Data Breaches, Sensitive Data

Personal data protection law (Saudi Arabia)
Google v CNIL Case C 507/17

Search Engines

Personal data breach report form

Controllers and Processors, Data Breaches

KOSPA Passed by Senate: Strengthening Online Protections for Children and Teens
Why a right to explanation of automated decision-making does not exist in the General Data Protection Regulation

Data Subjects Rights

DIRECTIVE (EU) 2016/680 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (Law Enforcement Directive)
Lithuanian SA Fines Vinted UAB €2.38 Million for GDPR Violations
Telegram’s New Policy: User Data to Be Shared with Authorities in Criminal Cases

Data Sharing, Data Subjects Rights

Patrick Breyer v. Germany Case C-582/14, 12 May 2016

Consent, Personal Data

Technical and organisational measures signed by Superhosting.bg

Controllers and Processors, Technical and Organisational Measures (TOMs)

EU AI Act Now in Force: Prepare for Compliance
Tech Giants Sign Open Letter Urging “Regulatory Certainty on AI” in Europe

AI

Fashion ID, 29 July 2019, C-40/17, ECLI:EU:C:2019:629

Data Controller, Data Processors

American Privacy Rights Act Discussion Draft
Grok AI Training on X’s Users Data by Default Sparks Investigation
The American Privacy Rights Act (APRA) section-by-section draft
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH, in the presence of Facebook Ireland Ltd (Case C-210/16).

Data Controller

Meta and OpenAI Unveil New AI Models: Llama 3.1 and SearchGPT
Planet49 GmbH, C-673/17, Grand Chamber, 1 October 2019.

Consent, Cookies

Opinion 11/2022 on the draft decision of the competent supervisory authority of Poland regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

UK ICO Enforces Data Protection: Reprimands and New Privacy Tech with Meta
Opinion 12/2022 on the draft decision of the competent supervisory authority of France regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 23/2021 on the draft decision of the competent supervisory authority of Czech Republic regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EDPB

Code of Conduct, Controllers and Processors

František Ryneš v. Úřad pro ochranu osobních údajů [2014] Case C-212/13, 11 December 2014

CCTV

Opinion 13/2022 on the draft decision of the competent supervisory authority of Bulgaria regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 24/2021 on the draft decision of the competent supervisory authority of Slovakia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EDPB

Code of Conduct, Controllers and Processors

Recommendation on mobile applications or apps by the French DPA

Lawfulness of Processing, Specific processing situations

Opinion 14/2022 on the draft decision of the competent supervisory authority of Bulgaria regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 25/2021 on the draft decision of the competent supervisory authority of Lithuania regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EDPB

Accreditation

“AI & Algorithmic Risks Report” by Dutch Data Protection Authority

AI, Risk Management, Specific processing situations

CJEU Research and Documentation Directorate – Protection of personal data (Fact Sheet)
Weltimmo s.r.o. v. Nemzeti Adatvédelmi és Információszabadság Hatóság [2015] Case C-230/14, 1 October 2015

Main Establishment

[UK] International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

Data Transfers

Opinion 15/2022 on the draft decision of the competent supervisory authority of Luxembourg regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 16/2021 on the draft decision of the Belgian Supervisory Authority regarding the “EU Data Protection Code of Conduct for Cloud Service Providers” submitted by Scope Europe |EDPB

Code of Conduct, Controllers and Processors

MITIGATING SECURITY & PRIVACY RISKS by Data Security Council of India

Cybersecurity

[UK] International Data Transfer Agreements – Transitional Provisions

Data Transfers

Opinion 16/2022 on the draft decision of the competent supervisory authority of Slovenia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 17/2021 on the draft decision of the French Supervisory Authority regarding the European code of conduct submitted by the Cloud Infrastructure Service Providers (CISPE) |EDPB

Code of Conduct, Controllers and Processors

Statement on the interplay between AI Act and GDPR for private sector by the The Austrian DPA

AI, Specific processing situations

National Strategy on AI by Sri Lanka

AI, Lawfulness of Processing, Specific processing situations

Opinion 17/2022 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the ANTOLIN Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 18/2021 on the draft Standard Contractual Clauses submitted by the LT SA (Article 28(8) GDPR) |EDPB

Controllers and Processors, Data Transfers, Standard Contractual Clauses (SCC)

Guideline on the massive collection of personal data from the web for the training of generative artificial intelligence (GenAI) models by the Italian Data Protection Authority (Garante)

AI, Data scraping, Specific processing situations

The Future of European Competitiveness by EU Commission

AI, New technology, Specific processing situations

Big Brother Watch and others v United Kingdom (Applications nos 58170/13, 62322/14 and 24960/15), 25 May 2021.

Data minimisation

EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space

Health Data, Principles, Sensitive Data

Opinion 26/2021 on the draft decision of the Supervisory Authority of North Rhine-Westphalia (Germany) regarding the Controller Binding Corporate Rules of the Internet Initiative Japan Group |EDPB

Binding Corporate Rules, Data Transfers

Belgian DPA General Secretariat Artificial intelligence systems and the RGPD from a data protection perspective

AI, Lawfulness of Processing, Principles, Specific processing situations, Transparency

EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse

Children as data subjects, Data Subjects Rights

Opinion 27/2021 on the draft decision of the Supervisory Authority of North Rhine-Westphalia (Germany) regarding the Processor Binding Corporate Rules of the Internet Initiative Japan Group |EDPB

Binding Corporate Rules, Data Transfers

Exploring the ethical, technical and legal issues of voice assistants by CNIL

Call recordings

Opinion 25/2022 regarding the European Privacy Seal (EuroPriSe ) certification criteria for the certification of processing operations by processors |EPDB

Certification, Controllers and Processors

Opinion 28/2021 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules of Oregon Tool, Inc (formerly “Blount”) |EDPB

Binding Corporate Rules, Data Transfers

NIST Special Publication_1800: Implementing a Zero Trust Architecture

Cybersecurity

Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Case C-311/18), 16 July 2020.

Data Transfers

Opinion 18/2022 on the draft decision of the Baden-Württemberg (Germany) Supervisory Authority regarding the Controller Binding Corporate Rules of the Daimler Truck Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 29/2021 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of Oregon Tool, Inc (Formerly “Blount”) |EDPB

Binding Corporate Rules, Data Transfers

Opinion 11/2024 on the use of facial recognition to streamline airport passengers’ flow (compatibility with Articles 5(1)(e) and(f), 25 and 32 GDPR by EDPB

Facial Recognition, Specific processing situations

ON THE ANTITRUST IMPLICATIONS OF EMBEDDING GENERATIVE AI IN CORE PLATFORM SERVICES BY SSRN

AI, Specific processing situations

Opinion 19/2022 on the draft decision of the Baden-Württemberg (Germany) Supervisory Authority regarding the Controller Binding Corporate Rules of the MercedesBenz Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 30/2021 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the COLT Group |EDPB

Binding Corporate Rules, Data Transfers

AI Development Recommendations to Ensure GDPR Compliance by CNIL

AI, Specific processing situations

South Africa National Artificial Intelligence Policy Framework

AI, Specific processing situations

Case C-487/21

Access Requests (DSAR), Data Subjects Rights

Maximillian Schrems v. Data Protection Commissioner [2015] Case C-362/14, 6 October 2015.

Data Transfers

Opinion 20/2022 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the Ellucian Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 31/2021 on the draft decision of the Spanish Supervisory Authority regarding the Processor Binding Corporate Rules of the COLT Group |EDPB

Binding Corporate Rules, Data Transfers

Orientations for ensuring data protection compliance when using Generative AI systems by EDPS

AI, Specific processing situations

AI models collapse when trained on recursively generated data

AI, Specific processing situations

C-252/21

Contractual Obligation, Lawfulness of Processing, Principles, Sensitive Data

Opinion 21/2022 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Ellucian Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 21/2021 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the CGI Group |EDPB

Binding Corporate Rules, Data Transfers

Policy for the responsible use of AI in government by Australian Government

AI, Data Processing by the Government, Specific processing situations

Opinion 22/2022 on the draft decision of the Liechtenstein Supervisory Authority regarding the Controller Binding Corporate Rules of Hilti Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 22/2021 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the CGI Group |EDPB

Binding Corporate Rules, Data Transfers

Consumer Protection in respect of Use of Generative Artificial Intelligence by Hong Kong Monetary Authority

AI, Specific processing situations

Case C-60/22

Accountability, Controllers and Processors, Joint Controllers, Principles

Tele2 Sverige AB v. Post-och telestyrelsen and Secretary of State for the Home Department v. Tom Watson and others Joined Cases C-203/15 and C-698/15

Data minimisation

Opinion 23/2022 on the draft decision of the Swedish Supervisory Authority regarding the Controller Binding Corporate Rules of the Samres Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 14/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the United Kingdom |EPDB

Adequacy Decisions, Data Transfers

C-453/21

Controllers and Processors, Data Protection Officer (DPO)

Sending direct marketing messages: At-a-glance guide (UK ICO)

Consent, Lawfulness of Processing

Opinion 24/2022 on the draft decision of the Swedish Supervisory Authority regarding the Processor Binding Corporate Rules of the Samres Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 15/2021 regarding the European Commission Draft Implementing Decision pursuant to Directive (EU) 2016/680 on the adequate protection of personal data in the United Kingdom |EDPB

Adequacy Decisions, Data Transfers

The State of Artificial Intelligence in the Pacific Islands

AI, Specific processing situations

C-349/21

Access Requests (DSAR), Data Subjects Rights

Digital Rights Ireland Ltd. v. Minister for Communications and Others [2014] Joined Cases C-293/12 and C-594/12
Opinion 26/2022 on the draft decision of the Data Protection Authority of Bavaria for the Private Sector regarding the Controller Binding Corporate Rules of the Munich Re Reinsurance Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 19/2021 on the draft decision of the competent supervisory authority of Hungary regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EDPB

Accreditation

5310-C Privacy Threshold Assessments and Privacy Impact Assessments by Office of Information Security

Controllers and Processors, Data Protection Impact Assessment (DPIA)

C-306/21

Lawfulness of Processing, Public Interests

Opinion 09/2022 on the draft decision of the Danish Supervisory Authority regarding the Processor Binding Corporate Rules of Bioclinica Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 32/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the Republic of Korea |EDPB

Adequacy Decisions, Data Transfers

JUDGMENT OF THE GENERAL COURT Case T‑1077/23 (ByteDance and EU Commission)
C-300/21

Liability and Penalties, Supervisory Authorities

Opinion 10/2022 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Controller Binding Corporate Rules of Fresenius Group |EPDB

Binding Corporate Rules, Data Transfers

EDPB-EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)

AI, Specific processing situations

Responsible AI Governance in Africa: Prospects for Outcomes Based Regulation by African Observatory on Responsible AI

AI, Specific processing situations

C-268/21

Data minimisation, Principles

Data Protection Code of Conduct for Cloud Infrastructure Service Providers

Cloud Services

Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González [2014] Case C-131/12

Search Engines

Opinion 20/2021 on Tobacco Traceability System |EDPB

Controllers and Processors, Data Sharing

Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework by EDPB

AI, Specific processing situations

Google’s Gemini AI on Android with Enhanced Privacy Features
C-205/21

Consent, Criminal Convictions and Offences, Lawfulness of Processing, Principles

SUPERIOR COURT OF THE STATE OF CALIFORNIA COUNTY OF LOS ANGELES Case No. BC492959

Liability and Penalties

EU-U.S. DATA PRIVACY FRAMEWORK F.A.Q. FOR EUROPEAN BUSINESSES BY EDPB

Data Transfers

Meta CAN Use Brazilian User Data for AI Training with Restrictions
C-180/21

Criminal Convictions and Offences, Lawfulness of Processing, Principles, Public Interests

Bodil Lindqvist [2003] Case C-101/01, 6 November 2003

Automated Decision-making

Confidential Computing and Privacy: Policy Implications of Trusted Execution Environments by Future of Privacy Forum

AI, Specific processing situations

NPD Confirms Major Breach: Sensitive Data of Millions Exposed
C-154/21

Access Requests (DSAR), Data Subjects Rights

GDPR Data Incidents – The Step-by-Step Playbook for Effective Response

Data Breaches

Elaboration of the Code of Conduct for Cloud Infrastructure Service Providers (CNIL)

Cloud Services

Information Note by EDPB on the redress mechanism for EU/EEA individuals in relation to alleged violations of U.S. law with respect to their data collected by U.S authorities competent for national security

Adequacy Decisions, Data Transfers

Office of the Privacy Commissioner of Canada Sweep Report 2024

Consent, Cookies, Lawfulness of Processing

C-129/21

Consent, Data Subjects Rights, Lawfulness of Processing, Right to Erasure

ICO Provisional £6 Million Penalty for Software Provider Following NHS Data Breach
C-77/21

Principles, Purpose limitation

Irish Watchdog Ends Case Against X Following AI Data Restrictions
C-34/21

Employment, Specific processing situations

Joint statement on data scraping and the protection of privacy

Personal Data Collection

(NEW JERSEY) ACT concerning [commercial Internet websites] online, services, consumers, and [personally identifiable information] personal data and supplementing Title 56 of the Revised Statutes
C-534/20

Controllers and Processors, Data Protection Officer (DPO)

Members of the Code of Conduct for Cloud Infrastructure Service Providers

Code of Conduct

X Closes Brazil Operations Citing “Censorship Orders” from Judge
Council of Europe Unveils First Global AI Treaty
C-319/20

Representation of data subjects

C-245/20

Supervisory Authorities

Rules of Procedure for the “Informal Panel of EU DPAs”according to the EU-US Data Privacy Framework by EDPB

Adequacy Decisions, Data Transfers

FBI Audit Reveals Major Data Handling Flaws
C-184/20

Principles, Sensitive Data

REGULATION (EU) 2022/1925 (Digital Markets Act)
EU-US Data Privacy Framework Template Complaint Form for Submitting Commercial Related Complaints to EU DPAs by EDPB

Adequacy Decisions, Data Transfers

C-102/20

Consent, Lawfulness of Processing

Template Complaint Form to the U.S. Office of the Director of National Intelligence’s Civil Liberties Protection Officer (CLPO) by EDPB

Adequacy Decisions, Data Transfers

C-645/19

Supervisory Authorities

GDPR Fines Tracker

Liability and Penalties, Supervisory Authorities

AI and Data Protection risk toolkit by the UK ICO

AI, Data Protection Impact Assessment (DPIA)

Information note by EDPB on data transfers under the GDPR to the United States after the adoption of the adequacy decision on 10 July 2023

Adequacy Decisions, Data Transfers

C-597/19

Lawfulness of Processing, Legitimate Interest

Rules of Procedure by EDPB on the cooperation and respective roles of national SAs and the EDPB Secretariat regarding the submission of complaints in the redress mechanism available to EU individuals in relation to alleged violations of U.S law with respect to their data collected by U.S. authorities competent for national security

Adequacy Decisions, Data Transfers, Risk Management

C-439/19

Criminal Convictions and Offences, Lawfulness of Processing, Principles, Public Interests

Records of processing activities template by the CNIL

Records of processing Activities (ROPA)

Australian ACMA DoorDash Technologies Australia Pty Ltd

Consent, Liability and Penalties, Spam

C-272/19

Access Requests (DSAR), Data Controller, Data Subjects Rights, Definitions

Building a Cybersecurity and Privacy Learning Program | NIST | Initial Public Draft

Data Breaches, Employment, Risk Management, Technical and Organisational Measures (TOMs)

C-61/19

Consent, Lawfulness of Processing

C-708/18

CCTV, Lawfulness of Processing, Legitimate Interest, Specific processing situations

UK MRC Identifiability, anonymisation and pseudonymisation

Anonymisation

The 10-Step Plan for Solid Privacy Compliance Based On The Most Common Fines
Joined Cases C-511/18, C-512/18 and C-520/18

Criminal Convictions and Offences, National Security, Principles, Specific processing situations

Privacy Impact Assessment – Internet of Things Devices (CNIL)

Data Protection Impact Assessment (DPIA)

C-507/17

Data Subjects Rights, Right to Erasure, Territorial Scope

C-496/17

Lawfulness of Processing, Public Interests

Privacy, seriously by the UK ICO

AI, Privacy by Design, Product Privacy Design

C-136/17

Data Subjects Rights, Principles, Right to Erasure, Search Engines, Sensitive Data, Specific processing situations

Spanish AEPD: 10 MISUNDERSTANDINGS RELATED TO ANONYMISATION

Anonymisation

C-460/20

Data Subjects Rights, Right to Erasure, Search Engines, Specific processing situations

Case C-101/01

Data Transfers, Definitions, Principles, Processing of personal data, Sensitive Data

CALIFORNIA CONSUMER PRIVACY ACT REGULATIONS
CASE OF BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM

National Security, Specific processing situations

GUIDE TO BASIC ANONYMISATION | PDPC Singapore

Anonymisation

OPINION 1/15 OF 26. 7. 2017

Data Transfers

Guidelines 01/2023 on Article 37 Law Enforcement Directive

Data Transfers

CIPL Examples of Legitimate Interest Grounds for Processing of Personal Data [PDF] [Official Guidelines]

Lawfulness of Processing, Legitimate Interest

Recommendations 1-2022 on the Application for Approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR)

Code of Conduct, Controllers and Processors

Guidelines 04/2022 on the calculation of administrative fines under the GDPR

Liability and Penalties

Anonymisation: managing data protection risk code of practice | UK ICO

Anonymisation

Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679
One-Stop-Shop thematic case digest: RIGHT TO OBJECTAND RIGHT TO ERASURE

Data Subjects Rights, Right to Erasure, Right to Object

A 10-step guide to sharing information to safeguard children by the UK ICO

Children as data subjects

Study on the appropriate safeguards under Article 89(1) GDPR for the processing of personal data for scientific research

Material scope, Scientific Research, Specific processing situations

Guidance on Anonymisation and Pseudonymisation | Irish DPC

Anonymisation

Second Report on the application of the General Data Protection Regulation by EU Commission

Data Subjects Rights, Data Transfers

Study on the national administrative rules impacting the cooperation duties for the national supervisory authorities

Supervisory Authorities

Guidelines on Data Protection Officers (‘DPOs’)

Data Protection Officer (DPO)

India Digital Personal Data Protection Act (2023)
AI Possible Risks & Mitigations Optical Character Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

Government access to datain third countries

Data Processing by the Government, Specific processing situations

AI Possible Risks & Mitigations Named Entity Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

Guidelines 03/2021 on the application of Article 65(1)(a) GDPR

Supervisory Authorities

Opinion 05/2014 on Anonymisation Techniques | WP216

Anonymisation

Annual Report 2023 by Irish DPA

Data Subjects Rights

Infographic DPC TikTok Fine

Fairness, Liability and Penalties, Principles, Supervisory Authorities

Guidelines on transparency under Regulation 2016/679

Transparency

Insight into audit and assurance by the UK ICO
Frequently Asked Questions (FAQ) NIS2 in Belgium by Centre for cybersecurity Belgium

Cybersecurity

Decision of the Data Protection Commission made pursuant to Section 111 of the DPA, 2018 and Articles 60 and 65 of the GDPR

Fairness, Liability and Penalties, Principles, Supervisory Authorities

Public Benefit and Privacy Panel for Health and Social Care (Guidance for applicants)

Health Data, Principles, Sensitive Data

Guidelines 8/2022 on identifying a controller or processor’s lead supervisory authority

Supervisory Authorities

How to use AI and personal data

AI, Specific processing situations

Guidance on the rules on use of cookies and similar technologies [pdf] [Official Guidelines]

Consent, Cookies

WORKING PARTY 29 POSITION PAPER on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR

Records of processing Activities (ROPA)

Report and Recommendations of the New York State Bar Association Task Force on Artificial Intelligence

AI, Specific processing situations

Data Breach Process Guidance by HSE

Controllers and Processors, Data Breaches

Section 40(2) FOIA – the personal data exemption – a practical approach by the UK ICO

Access Requests (DSAR), Data Subjects Rights

Baseline Cyber Security for SMEs

Controllers and Processors, Technical and Organisational Measures (TOMs)

PRACTICE GUIDE SECURITY OF PERSONAL DATA Version 2024 by CNIL

Definitions, Personal Data

Data protection and monitoring workers

Employment, Specific processing situations

C-340/21

Controllers and Processors, Liability and Penalties, Supervisory Authorities, Technical and Organisational Measures (TOMs)

Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement
Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679

Automated Decision-making

REGULATION (EU) 2024/900 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 13 March 2024 on the transparency and targeting of political advertising

Marketing and Advertising, Specific processing situations

Practice Guide to Anonymising Personal Data

Anonymisation, Controllers and Processors

Lifecycle of a complaint by the UK ICO

Data Subjects Rights

Human rights Impact Assessments for AI

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Guidance on ai and data protection 2.0 | UK ICO

AI

Drones and Data Protection Guidelines by AEPD

Drones, Specific processing situations

Cookies Instructions Kit by DMA Italy, FedoWEB et al.

Consent, Cookies

T‑553-23 R

Data Transfers

COMMISSION IMPLEMENTING DECISION of 10.7.2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework

Adequacy Decisions, Data Transfers

Children and the GDPR | UK ICO

Children as data subjects

AI How-to Sheets by CNIL

AI, Specific processing situations

Guidelines 01/2022 on data subject rights – Right of access

Data Subjects Rights

Description of the dataset template by CNIL

AI, Specific processing situations

Mobile Privacy Disclosures by the FTC

Data Subjects Rights, Right to know

The Employment Practices Code | UK ICO

Data Subjects Rights, Employment

Opinion 44/2023 on the Proposal for Artificial Intelligence Act in the light of legislative developments

AI, Specific processing situations

Guidelines 07/2022 on certification as a tool for transfers

Certification

Face Analysis Technology Evaluation: Age Estimation and Verification report by NIST

Face Analysis

Data Sharing Code | UK ICO

Data Sharing

Report from Multistakeholder Expert group on GDPR application

Data Subjects Rights

Data breach preparation and response by the Australian Information Commisioners

Controllers and Processors, Data Breaches

GDPR & Generative AI A Guide for Customers by Microsoft

AI, Specific processing situations

Artificial intelligence and the Information Privacy Principles by the Privacy Commisioner (New Zealand)

AI, Specific processing situations

Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR

Territorial Scope

Risk and control for artificial intelligence and machine learning systems by Cybernetica

AI, Specific processing situations

AI and Data Protection Risk Toolkit by UK ICO

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

Guide to Accountability and Governance | UK ICO

Accountability

The IDTA, Addendum and TRA: practical guidance for cross-border transfers by the UK ICO

Access Requests (DSAR), Data Transfers

Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms by EDPB

Consent, Lawfulness of Processing

Guidance document on how to approach the protection of personal data and commercially confidential information while using the Clinical Trials Information System (CTIS) Version 2 by EMA

Data Subjects Rights

Audit Requirements for Personal Data Processing Activities involving AI by AEPD

Controllers and Processors, Data Protection Impact Assessment (DPIA), Technical and Organisational Measures (TOMs)

Perspectives on Issues in AI Governance by Google

AI, Specific processing situations

Child oriented approach to data processing by DPC Ireland

Children as data subjects, Data Subjects Rights

Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them

Privacy by Design

Good FOI practice – a panel discussion by the UK ICO

Freedom of expression and information

Deploying AI Systems Securely by NSA

AI, Specific processing situations

Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence by the US President

AI, Specific processing situations

Automated Decision-Making Under the GDPR by the FPF

AI, Automated Decision-making, Controllers and Processors, Specific processing situations

Guidance on Video Surveillance | UK ICO

CCTV

REGULATION (EU) 2022/868 (Data Governance Act)
Online Safety Bill | UK
Guidelines 06/2022 on the practical implementation of amicable settlements
How to deal with SARs as an employer by the UK ICO

Access Requests (DSAR), Employment

Protection of workers’ personal data: General principles by ILO

Employment, Specific processing situations

Study on the essence of the fundamental rights to privacy and to protection of personal data by EDPS

Data Subjects Rights

California Governor Vetoes AI Safety Bill

AI

A Guide to Lawful Basis | UK ICO

Consent, Contractual Obligation, Lawfulness of Processing, Legal Obligation, Legitimate Interest, Public Interests, Vital Interests