Resources

First Draft General-Purpose AI Code of Practice by EU Commission

Musk Adds Microsoft to OpenAI Lawsuit, Expanding Antitrust Allegations

AI tools in recruitment by UK ICO

Discussion Paper: Large Language Models and Personal Data by The Hamburg Commissioner for Data protection and freedom of information

AI Management Essentials by Department for Science, Innovation and Technology

UK to Regulate AI Frontier Models with New Legislation in 2025

AI and the audiovisual sector: navigating the current legal landscape by IRIS European Audiovisual Observatory

Harmonised Standards for the European AI Act by EU Commission

AI Principles and Best Practices for Developers and Employers by U.S. DEPARTMENT OF LABOR

Perplexity AI Faces Lawsuit Over Alleged Copyright Violations by Dow Jones and NY Post

AI Toolkit Tracker

Personal Data Breach Management and Reporting Toolkit Tracker

Data Breaches

Artificial Intelligence (AI) Toolkit Tracker – more information about the Toolkit by UK ICO

Personal Data Breach Management and Reporting Toolkit Tracker – more information about the Toolkit by UK ICO

Data Breaches

Polish National Personal Data Protection Office (UODO)-National Prosecutor’s Office (9/2/2024)

Consent, Controllers and Processors, Data Breaches, Lawfulness of Processing, Principles, Sensitive Data

Spanish Data Protection Authority (aepd)-PILLOW HOTELS, S.L. (5/30/2024)

Controllers and Processors, Data Breaches, Data Subjects Rights, Integrity and confidentiality, Principles

Polish National Personal Data Protection Office (UODO)-Association (4/30/2024)

Controllers and Processors, Data Breaches

Italian Data Protection Authority (Garante)-Azienda sanitaria locale Roma 3 (3/21/2024)

Data Breaches

Polish National Personal Data Protection Office (UODO)-Toyota Bank Polska S.A. (3/12/2024)

Controllers and Processors, Data Breaches

Spanish Data Protection Authority (aepd)-URQUÍA & BAS, CORREDURÍA DE SEGUROS S.L. (6/22/2022)

Controllers and Processors, Data Breaches

Hellenic Data Protection Authority (HDPA)-Greek Ministry of Immigration and Asylum (4/2/2024)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Privacy by Design

Spanish Data Protection Authority (aepd)-CTC EXTERNALIZACIÓN, S.L (2/12/2024)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights

Polish National Personal Data Protection Office (UODO)-District Court Krakow (12/19/2023)

Data Breaches

Polish National Personal Data Protection Office (UODO)-Insurance company (10/18/2023)

Controllers and Processors, Data Breaches

Polish National Personal Data Protection Office (UODO)-Santander Bank Polska S.A. (3/12/2024)

Controllers and Processors, Data Breaches, Data Subjects Rights

Polish National Personal Data Protection Office (UODO)-Unknown (1/18/2024)

Controllers and Processors, Data Breaches, Data Subjects Rights

Spanish Data Protection Authority (aepd)-ENDESA ENERGÍA, S.A.U. (10/25/2023)

Data Breaches, Data Subjects Rights, Integrity and confidentiality, Principles

Dutch Supervisory Authority for Data Protection (AP)-International Card Services B.V. (1/15/2024)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Hora Credit IFN SA (12/7/2023)

Controllers and Processors, Data Breaches, Data Subjects Rights, Technical and Organisational Measures (TOMs)

Polish National Personal Data Protection Office (UODO)-Link4 Towarzystwo Ubezpieczeń S. A. (10/8/2023)

Controllers and Processors, Data Breaches

Data Protection Authority of Sweden-Östersund Municipality’s Department for Children and Education (11/28/2023)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Hellenic Data Protection Authority (HDPA)-Athens Urban Transport Organization (9/25/2023)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Storage limitation

Polish National Personal Data Protection Office (UODO)-Company (7/12/2023)

Controllers and Processors, Data Breaches, Data Subjects Rights

Italian Data Protection Authority (Garante)-Bolzano municipality (3/23/2023)

Controllers and Processors, Data Breaches, Data Subjects Rights, Integrity and confidentiality, Principles, Technical and Organisational Measures (TOMs)

Spanish Data Protection Authority (aepd)-GSMA LTD. (5/3/2023)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Spanish Data Protection Authority (aepd)-ALBERO FORTE COMPOSITE, S.L. (4/28/2023)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Hellenic Data Protection Authority (HDPA)-Piraeus Bank (2/2/2023)

Data Breaches, Lawfulness of Processing, Principles, Sensitive Data

Polish National Personal Data Protection Office (UODO)-Housing cooperative (3/1/2023)

Controllers and Processors, Data Breaches, Data Subjects Rights

Data Protection Authority of Bremen-Company (7/14/1905)

Controllers and Processors, Data Breaches

Norwegian Supervisory Authority (Datatilsynet)-Argon Medical Devices (3/8/2023)

Controllers and Processors, Data Breaches

Data Protection Authority of Sachsen-Anhalt-Magdeburg University Hospital (7/15/1905)

Controllers and Processors, Data Breaches

Italian Data Protection Authority (Garante)-Azienda Universitaria Friuli Occidentale (12/15/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Principles, Sensitive Data

Italian Data Protection Authority (Garante)-Azienda Universitaria Friuli Centrale (12/15/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Principles, Sensitive Data

Italian Data Protection Authority (Garante)-Azienda Universitaria Giuliano Isontina (12/15/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Principles, Sensitive Data

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Dent Estet Clinic SA (1/31/2023)

Controllers and Processors, Data Breaches

Spanish Data Protection Authority (aepd)-BAYARD REVISTAS, S.A. (9/28/2022)

Controllers and Processors, Data Breaches, Data Subjects Rights, Integrity and confidentiality, Principles

Polish National Personal Data Protection Office (UODO)-University Hospital of the Medical University of Warsaw (7/6/2022)

Controllers and Processors, Data Breaches, Data Subjects Rights

Data Protection Authority of Niedersachsen-Volkswagen (7/26/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights

Spanish Data Protection Authority (aepd)-DKV Seguros y Reaseguros, S.A.E. (7/13/2022)

Controllers and Processors, Data Breaches, Data Subjects Rights, Integrity and confidentiality, Principles

Polish National Personal Data Protection Office (UODO)-Głównego Geodetę Kraju (7/6/2022)

Controllers and Processors, Data Breaches, Data Subjects Rights

Polish National Personal Data Protection Office (UODO)-Esselmann Technika Pojazdowa Sp. z o.o. Sp. k. (6/6/2022)

Controllers and Processors, Data Breaches

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Kredyt Inkaso Investments RO S.A (5/18/2022)

Controllers and Processors, Data Breaches, Principles, Representative, Sensitive Data

Danish Data Protection Authority (Datatilsynet)-Danish National Genome Center (3/25/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Polish National Personal Data Protection Office (UODO)-Santander Bank Polska S. A. (1/19/2022)

Controllers and Processors, Data Breaches

Italian Data Protection Authority (Garante)-Azienda sanitaria unica regionale Marche (1/13/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Integrity and confidentiality, Principles

Data Protection Authority of Ireland-Irish Teacher Council (12/2/2021)

Controllers and Processors, Data Breaches, Data Subjects Rights, Principles

Hellenic Data Protection Authority (HDPA)-Greek Ministry of Tourism (12/29/2021)

Controllers and Processors, Data Breaches, Data Protection Officer (DPO), Data Subjects Rights

Deputy Data Protection Ombudsman-Psykoterapiakeskus Vastaamo (12/7/2021)

Controllers and Processors, Data Breaches, Data Subjects Rights, Integrity and confidentiality, Principles

Polish National Personal Data Protection Office (UODO)-Bank Millennium S.A (10/14/2021)

Controllers and Processors, Data Breaches, Data Subjects Rights

Spanish Data Protection Authority (aepd)-SERVICIOS LOGÍSTICOS MARTORELL SIGLO XXI, S.L. (10/26/2021)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

National Commission for Data Protection (CNPD)-Insurance company (8/5/2021)

Controllers and Processors, Data Breaches, Data Subjects Rights, Integrity and confidentiality, Principles

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Actamedica SRL (8/24/2021)

Controllers and Processors, Data Breaches, Data Processing Agreement (DPA), Data Subjects Rights

Polish National Personal Data Protection Office (UODO)-Fundację Promocji Mediacji i Edukacji Prawnej Lex Nostra (6/30/2021)

Controllers and Processors, Data Breaches, Data Subjects Rights

Polish National Personal Data Protection Office (UODO)-Sopockie Towarzystwo Ubezpieczeń ERGO Hestia S.A. (6/21/2021)

Controllers and Processors, Data Breaches, Data Subjects Rights

Lithuanian Data Protection Authority (VDAI)-Unknown (7/12/1905)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Technical and Organisational Measures (TOMs)

Polish Data Protection Authority (UODO)-Cyfrowy Polsat S.A. (4/22/2021)

Controllers and Processors, Data Breaches, Data Subjects Rights, Technical and Organisational Measures (TOMs)

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Budapest Főváros Kormányhivatala XI. kerületi Hivatalát (11th District Public Health Department of the Government Office of the Capital City Budapest) (3/24/2021)

Controllers and Processors, Data Breaches, Sensitive Data, Technical and Organisational Measures (TOMs)

Dutch Supervisory Authority for Data Protection (AP)-PVV Overijssel (6/16/2020)

Controllers and Processors, Data Breaches

Dutch Supervisory Authority for Data Protection (AP)-Booking.com B.V. (12/10/2020)

Controllers and Processors, Data Breaches

Norwegian Supervisory Authority (Datatilsynet)-Ålesund Municipality (3/15/2021)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Polish National Personal Data Protection Office (UODO)-Enea S.A. (1/11/2021)

Controllers and Processors, Data Breaches

Polish National Personal Data Protection Office (UODO)-Unknown (1/5/2021)

Controllers and Processors, Data Breaches

Data Protection Authority of Ireland-University College Dublin (12/17/2020)

Controllers and Processors, Data Breaches, Principles, Sensitive Data, Storage limitation, Technical and Organisational Measures (TOMs)

Polish National Personal Data Protection Office (UODO)-Śląski Uniwersytet Medyczny (Medical University of Silesia) (1/5/2021)

Controllers and Processors, Data Breaches, Data Subjects Rights

Polish National Personal Data Protection Office (UODO)-Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A. (12/28/2020)

Controllers and Processors, Data Breaches, Data Subjects Rights

Polish National Personal Data Protection Office (UODO)-TUiR Warta S.A. (12/9/2020)

Controllers and Processors, Data Breaches, Data Subjects Rights

Data Protection Authority of Ireland-Twitter International Company (12/15/2020)

Controllers and Processors, Data Breaches

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Robinson Tours Ltd. (Robinson Tours Idegenforgalmi és Szolgáltató Kft.) (12/16/2020)

Controllers and Processors, Data Breaches, Lawfulness of Processing, Performance of Contract, Principles, Privacy by Design

Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)-Gnosjö Municipality (11/25/2020)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Representative

Spanish Data Protection Authority (aepd)-Saunier-Tec Mantenimientos de Calor y Frio, SL. (7/2/2020)

Controllers and Processors, Data Breaches

Danish Data Protection Authority (Datatilsynet)-Lejre Municipality (6/30/2020)

Controllers and Processors, Data Breaches, Principles, Representative

Data Protection Authority of Ireland-Tusla Child and Family Agency (6/30/2020)

Controllers and Processors, Data Breaches

Deputy Data Protection Ombudsman-Taksi Helsinki (5/29/2020)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Representative

Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)-National Government Service Centre (NGSC) (4/29/2020)

Controllers and Processors, Data Breaches, Data Subjects Rights

Deputy Data Protection Ombudsman-Kymen Vesi Oy (5/22/2020)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Directorate of Social and Child Welfare Institutions of the Ferencvaros District of Budapest (5/21/2019)

Controllers and Processors, Data Breaches

Data Protection Authority of Hamburg-Hamburger Verkehrsverbund GmbH (HVV GmbH) (7/11/1905)

Controllers and Processors, Data Breaches, Data Subjects Rights

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Hora Credit IFN SA (12/10/2019)

Controllers and Processors, Data Breaches, Data Subjects Rights, Principles, Technical and Organisational Measures (TOMs)

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Unknown (6/25/2019)

Controllers and Processors, Data Breaches

Data Protection Authority of Sweden-School in Skellefteå (8/20/2019)

Controllers and Processors, Data minimisation, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data

Data Protection Authority of Hamburg-Unknown (7/10/1905)

Controllers and Processors, Data Breaches, Data Subjects Rights

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Hungarian political party (4/5/2019)

Controllers and Processors, Data Breaches, Data Subjects Rights

Lithuanian Data Protection Authority (VDAI)-Payment service provider UAB MisterTango (5/16/2019)

Controllers and Processors, Data Breaches, Data Subjects Rights, Principles

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg discussion paper on “Legal Foundations in Data Protection for the Use of AI”

AI, Lawfulness of Processing, Legitimate Interest, Specific processing situations

Guidelines on Securing AI Systems by The Cyber Security Agency of Singapore (CSA)

AI, Risk Management, Specific processing situations

Japan AI Safety Institute’s “Guide to Red Teaming Methodology on AI Safety”

AI, Specific processing situations

Study Finds ChatGPT Can Perform Biometric Tasks: A Closer Look at Privacy Risks

AI, Sensitive Data

Case C‑21/23 CJEU (full text in german)

Controllers and Processors, Data Breaches, Health Data, Lawfulness of Processing, Principles, Sensitive Data

Press Release No 159/24 on Judgment of the Court in Case C-21/23 CJEU

Controllers and Processors, Data Breaches, Health Data, Lawfulness of Processing, Principles, Sensitive Data

Recommendations for the use of AI coding assistants by ANSSI and BSI

AI, Specific processing situations

AIPact by the European Artificial Intelligence Office

AI, Data Subjects Rights, Specific processing situations

Решение Рег.№ ППН-02-399-2019 КЗЛД – НАП

Controllers and Processors, Data Breaches, Lawfulness of Processing

Наказателно постановление-04-2019-КЗЛД-НАП

Controllers and Processors, Data Breaches, Lawfulness of Processing

Manipulative, Deceptive, and Exploitative AI Systems report by the Dutch DPA

AI, Lawfulness of Processing, Specific processing situations

Cyber Threat Modelling for Risk Assessment by CSB

Risk Management, Technical and Organisational Measures (TOMs)

Chief Information Security Officer_ HANDBOOK

Risk Management

FTC Targets Deceptive AI Claims with Operation AI Comply

AI, Lawfulness of Processing

OpenAI, Microsoft, and Amazon Join EU’s AI Pact to Shape Future Regulations

California Governor Vetoes AI Safety Bill

“AI & Algorithmic Risks Report” by Dutch Data Protection Authority

AI, Risk Management, Specific processing situations

National Strategy on AI by Sri Lanka

AI, Lawfulness of Processing, Specific processing situations

The Future of European Competitiveness by EU Commission

AI, New technology, Specific processing situations

Belgian DPA General Secretariat Artificial intelligence systems and the RGPD from a data protection perspective

AI, Lawfulness of Processing, Principles, Specific processing situations, Transparency

Tech Giants Sign Open Letter Urging “Regulatory Certainty on AI” in Europe

Genetic Testing Company 23andMe Pays $30M for Data Breach

Data Breaches, Sensitive Data

LinkedIn Used User Data for AI Training Before Updating Its Terms

AI, Data Sharing, Data Subjects Rights, Lawfulness of Processing

Privacy Impact Assessment (PIA) Templates by CNIL

Data Protection Impact Assessment (DPIA)

Case C 203/22 on AI and automated decisions, the right of access under the GDPR, and the protection of trade secrets

AI, Automated Decision-making, Controllers and Processors, Specific processing situations

Artificial Intelligence and Machine Learning in Health Care and Medical Sciences Best Practices by Pitfalls Gyorgy J. Simon Constantin Aliferis Springer

AI, Health Data, Principles, Sensitive Data, Specific processing situations

NIST Special Publication NIST SP 800-221A_Information and Communications Technology (ICT) Risk Outcomes Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio

Risk Management

Report of the work undertaken by the ChatGPT Taskforce by EDPB

AI, Specific processing situations

Recommendation 01/2019 on the draft list of the European Data Protection Supervisor regarding the processing operations subject to the requirement of a data protection impact assessment (Article 39.4 of Regulation (EU) 2018/1725) |EPDB

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Rethinking Privacy in the AI Era | White Paper by Stanford University

AI, Specific processing situations

Comparison of U.S. State Privacy Laws. Data Protection Assessments by CIPL

Controllers and Processors, Data Protection Impact Assessment (DPIA)

A pro-innovation approach to AI regulation by UK ICO

AI, Specific processing situations

CASE STUDIES (2018 – 2023) by the Irish DPC

Access Requests (DSAR), Controllers and Processors, Data Breaches, Data Subjects Rights, Liability and Remedies, Supervisory Authorities

Datenschutzkonforme Künstliche Intelligenz Checkliste mit Prüfkriterien nach DS-GVO

AI, Specific processing situations

Analysis of the final compromise text of the EU AI Act with a view to agreement by the Belgian Presidency

AI, Specific processing situations

DRAFT RISK ASSESSMENT REGULATIONS FOR CALIFORNIA PRIVACY PROTECTION AGENCY

Risk Management

Draft Impact Assessment Framework by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA)

One-stop-shop case digest on Security of Processing and Data Breach Notification by the EDPB

Controllers and Processors, Data Breaches, Technical and Organisational Measures (TOMs)

[PROPOSAL 2024] EU AI ACT

AI, Specific processing situations

Generative AI framework for HM Government by the UK Central Digital and Data Office

AI, Specific processing situations

Artificial Intelligence Strategy of the CJEU

AI, Specific processing situations

Interim Report – Governing AI for Humanity by UN AI Advisory Body

AI, Specific processing situations

AI fairness in practice by the Alan Turing Institute

AI, Specific processing situations

Case T-1077/23

AI, Copyright, Specific processing situations

Annex: A summary of the Transparency in Health and Social Care guidance impact assessment by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

Transparency in health and social care by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

[DRAFT] FRAMEWORK CONVENTION ON ARTIFICIAL INTELLIGENCE, HUMAN RIGHTS, DEMOCRACY AND THE RULE OF LAW

AI, Specific processing situations

The NYT vs OpenAI and Microsoft

AI, Copyright, Specific processing situations

[DRAFT] Data Confidentiality – Identifying and Protecting Assets Against Data Breaches by NIST

Controllers and Processors, Data Breaches

[Draft] Guidelines on the processing of personal data in regard to recruitment by the UK ICO

Automated Decision-making, Controllers and Processors, Data Protection Impact Assessment (DPIA), Employment, Specific processing situations

European Commision press release on AI Act Agreement

AI, Specific processing situations

New rules for Artificial Intelligence – Questions and Answers by the European Commision

AI, Specific processing situations

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL LAYING DOWN HARMONISED RULES ON ARTIFICIAL INTELLIGENCE (ARTIFICIAL INTELLIGENCE ACT)

AI, Specific processing situations

Privacy Impact Assessment Tool by the Australian Government

Controllers and Processors, Data Protection Impact Assessment (DPIA)

AI Act Provisional Agreement Press Release

AI, Specific processing situations

PRACTICAL GUIDANCE FOR THE USE OF GENERATIVE ARTIFICIAL INTELLIGENCE IN THE PRACTICE OF LAW by State Bar of California

AI, Specific processing situations

Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence (PROPOSED MEMORANDUM )

AI, Specific processing situations

The impact of the General Data Protection Regulation (GDPR) on artificial intelligence by the EU Parliamnet

AI, Specific processing situations

Guidelines for secure AI system development by UK NCSC and US CISA

AI, Specific processing situations

Benefits and Risks of Generative Artificial Intelligence Report by the State of California

AI, Specific processing situations

DPIA for AI template

Controllers and Processors, Data Protection Impact Assessment (DPIA)

COMMON GUIDEPOSTS TO PROMOTE INTEROPERABILITY IN AI RISK MANAGEMENT | German Ministry of labor and social Affairs

AI, Specific processing situations

Generative AI: The Data Protection Implications by CEDPO

AI, Specific processing situations

Global Toolkit on AI and the Rule of Law for the Judiciary by UNESCO

AI, Specific processing situations

AI Privacy Policy template

AI, Specific processing situations

AI and Data Protection Risk Toolkit by UK ICO

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

Audit Requirements for Personal Data Processing Activities involving AI by AEPD

Controllers and Processors, Data Protection Impact Assessment (DPIA), Technical and Organisational Measures (TOMs)

Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence by the US President

AI, Specific processing situations

Automated Decision-Making Under the GDPR by the FPF

AI, Automated Decision-making, Controllers and Processors, Specific processing situations

Data breach preparation and response by the Australian Information Commisioners

Controllers and Processors, Data Breaches

Human rights Impact Assessments for AI

Controllers and Processors, Data Protection Impact Assessment (DPIA)

AI How-to Sheets by CNIL

AI, Specific processing situations

Description of the dataset template by CNIL

AI, Specific processing situations

Opinion 44/2023 on the Proposal for Artificial Intelligence Act in the light of legislative developments

AI, Specific processing situations

Artificial intelligence and the Information Privacy Principles by the Privacy Commisioner (New Zealand)

AI, Specific processing situations

Data Breach Process Guidance by HSE

Controllers and Processors, Data Breaches

How to use AI and personal data

AI, Specific processing situations

C-460/20

Data Subjects Rights, Right to Erasure, Search Engines, Specific processing situations

C-136/17

Data Subjects Rights, Principles, Right to Erasure, Search Engines, Sensitive Data, Specific processing situations

Voluntary AI Safety Standard by the Australian Government

AI, Specific processing situations

Safe and responsible AI in Australia Proposals paper for introducing mandatory guardrails for AI in high-risk settings by Australian Government

AI, Specific processing situations

Global Approaches to Auditing Artificial Intelligence by IPIE

AI, Specific processing situations

Artificial Intelligence Security Governance Framework 1.0 by China Cybersecurity Standardization Technical Committee

AI, Specific processing situations

Multidisciplinary Perspectives on Artificial Intelligence and the Law by Springer

AI, Specific processing situations

Noyb Complaint Case: C-082-01 to EU Data protection Supervisor against EU Parliament

Controllers and Processors, Data Breaches, Public Administrative Body

UNESCO: Consultation paper on AI Regulation

AI, Lawfulness of Processing, Public Interests, Specific processing situations

Saudi Data & Artificial Intelligence Authority: Rules governing the appointment of Personal DPOs under the Kingdom of Saudi Arabia’s (KSA) Personal Data Protection Law (PDPL)

AI, Specific processing situations

NSW report: Artificial intelligence in New South Wales

AI, Specific processing situations

Briefing EU Legislation in Progress by EPRS on AI Act

AI, Specific processing situations

Effective Cyber Risk Management: A best practice governance guide for digitally secure and resilient organisations by Governance Institute of Australia

Risk Management, Technical and Organisational Measures (TOMs)

Decision by Dutch Data Protection Authority to impose an administrative fine on Uber |English

Controllers and Processors, Data Breaches, Data Subjects Rights

Noyb Complaint Case: C-082-02 to EU Data protection Supervisor against EU Parliament

Controllers and Processors, Data Breaches, Public Administrative Body

ON THE ANTITRUST IMPLICATIONS OF EMBEDDING GENERATIVE AI IN CORE PLATFORM SERVICES BY SSRN

AI, Specific processing situations

South Africa National Artificial Intelligence Policy Framework

AI, Specific processing situations

Policy for the responsible use of AI in government by Australian Government

AI, Data Processing by the Government, Specific processing situations

Consumer Protection in respect of Use of Generative Artificial Intelligence by Hong Kong Monetary Authority

AI, Specific processing situations

The State of Artificial Intelligence in the Pacific Islands

AI, Specific processing situations

Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on adapting non-contractual civil liability rules to artificial intelligence (AI Liability Directive)

AI, Liability and Remedies, Specific processing situations, Supervisory Authorities

NIST Special Publication_1800-29 Data Confidentiality- Detect, Respond to, and Recover from Data Breaches

Controllers and Processors, Data Breaches

CNIL open source PIA software – data protection impact assessment

Data Protection Impact Assessment (DPIA)

Securing Artificial Intelligence: Mitigation Strategy Report by ETSI

AI, Specific processing situations

Data protection compliant AI by Bavarian State Office for Data protection Supervision

AI, Specific processing situations

Responsible AI Governance in Africa: Prospects for Outcomes Based Regulation by African Observatory on Responsible AI

AI, Specific processing situations

Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework by EDPB

AI, Specific processing situations

Confidential Computing and Privacy: Policy Implications of Trusted Execution Environments by Future of Privacy Forum

AI, Specific processing situations

Formal Opinion 512 on Generative Artificial Intelligence Tools by AMERICAN BAR ASSOCIATION

AI, Specific processing situations

Global Third Party Cybersecurity Breaches by SecurityScorecard

Controllers and Processors, Data Breaches

Data protection impact assessment for AI Solutions by Danish DPA

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

National framework for the assurance of artificial intelligence in government by the Australian, state and territory governments

AI, Specific processing situations

Relying on the legal basis of legitimate interest to develop an AI system by CNIL

AI, Specific processing situations

Generative AI Controls Framework Safe, Secure, and Compliant AI Adoption Approach Whitepaper by IBM

AI, Specific processing situations

Patent Landscape Report on Generative AI by WIPO

AI, Specific processing situations

Discussion Paper: Large Language Models and Personal Data by The Hamburg Commissioner for Data protection and freedom of information

AI, Specific processing situations

Mobilizing the legal basis of legitimateinterest to develop an AI system by CNIL

AI, Specific processing situations

Artificial Intelligence and Algorithms in Risk Assessment by the European Labour Authority

Risk Management

Orientations for ensuring data protection compliance when using Generative AI systems by EDPS

AI, Specific processing situations

GDPR & Generative AI A Guide for Customers by Microsoft

AI, Specific processing situations

Risk and control for artificial intelligence and machine learning systems by Cybernetica

AI, Specific processing situations

Governance of artificial intelligence (AI) by House of Commons UK

AI, Specific processing situations

DECISION OF THE INFORMATION COMMISSIONER Snap Inc. and Snap Group Limited

AI, Specific processing situations

Artificial intelligence (AI) and human rights: Using AI as a weapon of repression and its impact on human rights by EU Parliament

AI, Specific processing situations

Neurodata risks report by EDPS and Spanish DPA

AI, Specific processing situations

Data protection impact assessment on the processing of personal data on government Facebook Pages

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Orientation guide of the Conference of Independent Federal and State Data Protection Supervisory Authorities by the German Data Protection Conference (DSK)

AI, Specific processing situations

GDPR & GENERATIVE AI – A GUIDE FOR THE PUBLIC SECTOR BY MICROSOFT

AI, Specific processing situations

Convention on AI, Human Rights, Democracy and the Rule of Law – by the Council of Europe (draft)

AI, Specific processing situations

Report of the work undertaken by the ChatGPT Taskforce bg EDPB

A Guide to ICO Audit Artificial Intelligence (AI) Audits by UK ICO

AI, Specific processing situations

Guideline on the massive collection of personal data from the web for the training of generative artificial intelligence (GenAI) models by the Italian Data Protection Authority (Garante)

AI, Data scraping, Specific processing situations

EDPB-EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)

AI, Specific processing situations

Personal data breach report form

Controllers and Processors, Data Breaches

Generative Artificial Intelligence Risk Assessment by State of California Department of Technology

AI, Risk Management, Specific processing situations

Report and Recommendations of the New York State Bar Association Task Force on Artificial Intelligence

AI, Specific processing situations

Perspectives on Issues in AI Governance by Google

AI, Specific processing situations

Deploying AI Systems Securely by NSA

AI, Specific processing situations

Personal data breaches in the health sector: how to avoid them (and how to deal with them when they happen) by the UK ICO

Data Breaches, Health Data

Human rights Impact Assessments for AI by Access Now

AI, Data Protection Impact Assessment (DPIA)

GenAI and data protection: how organisations and their employees can use it appropriately and lawfully

AI, Employment

Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González [2014] Case C-131/12

Search Engines

CNIL and others v Google Case C 136/17

Search Engines, Specific processing situations

Google v CNIL Case C 507/17

Search Engines

Guide to Data Protection Impact Assessments by PDPC Singapore

Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessments (DPIA) Template by UK ICO

Data Protection Impact Assessment (DPIA)

How to manage DPIAs by Data Protection Network (DPN)

Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessment (DPIAs) by APDCAT

Data Protection Impact Assessment (DPIA)

Guide to Data Protection Impact Assessments (DPIAs) by the Irish DPC

Data Protection Impact Assessment (DPIA)

GDPR Risk Assessment by the AEPD

Data Protection Impact Assessment (DPIA)

Guidance on ai and data protection 2.0 | UK ICO

Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Knowledge Bases by CNIL

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Methodology by CNIL

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Methodology Mindmap by CNIL

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment – Internet of Things Devices (CNIL)

Data Protection Impact Assessment (DPIA)

Artificial Intelligence Risk Management Framework (AI RMF 1.0) by NIST

Guidelines 01/2021 on Examples regarding Personal Data Breach Notification

Data Breaches

Guidelines 9/2022 on personal data breach notification under GDPR [Official EDPB Guidelines] [pdf]

Data Breaches

AI Meets Media: OpenAI Secures Another Multi-Year Deal with Media Giant

AI models collapse when trained on recursively generated data

AI, Specific processing situations

The NSW AI Assessment Framework

Controllers and Processors, Data Protection Impact Assessment (DPIA)

The government-wide vision on Generative Al of the Netherlands

AI, Data Processing by the Government, Specific processing situations

AI Possible Risks & Mitigations Optical Character Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

AI Possible Risks & Mitigations Named Entity Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

5310-C Privacy Threshold Assessments and Privacy Impact Assessments by Office of Information Security

Controllers and Processors, Data Protection Impact Assessment (DPIA)

AI system development: CNIL’srecommendations to comply with the GDPR

AI, Specific processing situations

AI Auditing Checklist for AI Auditing by EDPB

AI, Specific processing situations

AI, DATA GOVERNANCE AND PRIVACY SYNERGIES AND AREAS OF INTERNATIONAL CO-OPERATION BY OECD

AI, Specific processing situations

Supervision of AI systems in the EU by Dutch DPA and RDI (english)

AI, Specific processing situations

Statement on the interplay between AI Act and GDPR for private sector by the The Austrian DPA

AI, Specific processing situations

AI Development Recommendations to Ensure GDPR Compliance by CNIL

AI, Specific processing situations

The Colorado AI Act “Senate Bill SB24-205”

AI, Specific processing situations

Artificial Intelligence Risk Management Framework by NIST: Generative Artificial Intelligence Profile

AI, Risk Management, Specific processing situations

Rules of Procedure by EDPB on the cooperation and respective roles of national SAs and the EDPB Secretariat regarding the submission of complaints in the redress mechanism available to EU individuals in relation to alleged violations of U.S law with respect to their data collected by U.S. authorities competent for national security

Adequacy Decisions, Data Transfers, Risk Management

Privacy, seriously by the UK ICO

AI, Privacy by Design, Product Privacy Design

AI and Data Protection risk toolkit by the UK ICO

AI, Data Protection Impact Assessment (DPIA)

Building a Cybersecurity and Privacy Learning Program | NIST | Initial Public Draft

Data Breaches, Employment, Risk Management, Technical and Organisational Measures (TOMs)

Risk Management and Impact Assessment (DPIA) by AEPD

Data Protection Impact Assessment (DPIA)

The EDPB data protection guide for small business

AI, Risk Management

Approach to Data Spaces from GDPR Perspective (AEPD)

Data Spaces, Risk Management

GDPR Data Incidents – The Step-by-Step Playbook for Effective Response

Data Breaches