Resources

First Draft General-Purpose AI Code of Practice by EU Commission

Musk Adds Microsoft to OpenAI Lawsuit, Expanding Antitrust Allegations

AI tools in recruitment by UK ICO

Discussion Paper: Large Language Models and Personal Data by The Hamburg Commissioner for Data protection and freedom of information

AI Management Essentials by Department for Science, Innovation and Technology

UK to Regulate AI Frontier Models with New Legislation in 2025

Slovenian SA Decision 0603-42/2023/12 against Dodo Pizza

CCTV, Lawfulness of Processing, Legitimate Interest

AI and the audiovisual sector: navigating the current legal landscape by IRIS European Audiovisual Observatory

Harmonised Standards for the European AI Act by EU Commission

AI Principles and Best Practices for Developers and Employers by U.S. DEPARTMENT OF LABOR

Perplexity AI Faces Lawsuit Over Alleged Copyright Violations by Dow Jones and NY Post

AI Toolkit Tracker

Records Management Toolkit Tracker

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Artificial Intelligence (AI) Toolkit Tracker – more information about the Toolkit by UK ICO

Records Management Toolkit Tracker – more information about the Toolkit by UK ICO

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Italian Data Protection Authority (Garante)-Municipality of Nepi (6/20/2024)

Controllers and Processors, Data Processing Agreement (DPA), Lawfulness of Processing, Representative

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Corint Logistic SRL. (5/30/2024)

Access Requests (DSAR), Data Subjects Rights, Lawfulness of Processing, Principles, Right to Object, Sensitive Data

Data Protection Authority of Hessen-Company (7/15/1905)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-INFORMÁTICA MÉDICA, S.L. (11/7/2022)

Controllers and Processors, Data Processing Agreement (DPA)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-ALPHA BANK ROMANIA SA. (4/23/2024)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights

Italian Data Protection Authority (Garante)-NTT Data Italia S.P.A (2/8/2024)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights

Spanish Data Protection Authority (aepd)-HISPAPOST, S.A. (2/1/2024)

Controllers and Processors, Data Processing Agreement (DPA)

French Data Protection Authority (CNIL)-Candidate for parliamentary elections (12/22/2023)

Data Subjects Rights, Right to Object

French Data Protection Authority (CNIL)-Company (12/22/2023)

Principles, Purpose limitation

Icelandic data protection authority (‘Persónuvernd’)-Garðabær municipality (12/6/2023)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Principles

Icelandic data protection authority (‘Persónuvernd’)-City of Hafnarfjörður (12/6/2023)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Principles

Icelandic data protection authority (‘Persónuvernd’)-City of Kópavogur (12/6/2023)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Principles

Icelandic data protection authority (‘Persónuvernd’)-Reykjanesbær municipality (12/6/2023)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Principles

Icelandic data protection authority (‘Persónuvernd’)-City of Reykjavik (12/6/2023)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Principles

National Commission for Data Protection (CNPD)-Unknown (9/21/2023)

Data Subjects Rights, Principles, Purpose limitation, Sensitive Data

Italian Data Protection Authority (Garante)-Autostrade per l’Italia spa (6/22/2023)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Lawfulness of Processing

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-NN Asigurări de Viață S.A. (9/18/2023)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-CONCENTRA CENTRAL DE COMPRAS Y SERVICIOS S.L. (6/7/2023)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-La Risorsa Umana.it s.r.l. (3/23/2023)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Lawfulness of Processing, Principles, Sensitive Data

Italian Data Protection Authority (Garante)-Grizzaffi Management Srl (5/17/2023)

Data Subjects Rights, Lawfulness of Processing, Right to Object

Italian Data Protection Authority (Garante)-Ama S.p.a. (4/27/2023)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Technical and Organisational Measures (TOMs)

Italian Data Protection Authority (Garante)-Razmataz Live s.r.l.. (3/2/2023)

Controllers and Processors, Data Processing Agreement (DPA), Lawfulness of Processing, Representative

Croatian Data Protection Authority (azop)-Debt collection agency (5/4/2023)

Consent, Controllers and Processors, Data Processing Agreement (DPA), Lawfulness of Processing, Technical and Organisational Measures (TOMs)

Austrian Data Protection Authority (dsb)-Operator of a public toilet (8/23/2022)

Lawfulness of Processing, Legitimate Interest, Sensitive Data

Data Protection Authority of Brandenburg-Bank (7/14/1905)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights

Data Protection Authority of Brandenburg-Aid organization (7/14/1905)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights

Spanish Data Protection Authority (aepd)-ECOMM MOVADGENCY S.L. (2/28/2023)

Data Subjects Rights, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Tensa Art Design SRL (4/4/2023)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-Amiu S.p.A. (4/28/2022)

Controllers and Processors, Data Processing Agreement (DPA), Data Protection Officer (DPO), Principles, Representative

Italian Data Protection Authority (Garante)-Verizon Connect Italy S.p.A. (12/15/2022)

Controllers and Processors, Data Processing Agreement (DPA), Lawfulness of Processing, Representative

Italian Data Protection Authority (Garante)-Tecnomed Trento s.r.l. (4/7/2022)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Lawfulness of Processing, Principles, Sensitive Data

Italian Data Protection Authority (Garante)-Douglas Italia S.p.a. (10/20/2022)

Accountability, Lawfulness of Processing, Principles, Purpose limitation, Sensitive Data

Cypriot Data Protection Commissioner-PRINTAFORM Ltd. (7/14/1905)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Tensa Art Design SA (2/1/2023)

Data Subjects Rights, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Societatea Energetică Electrica S.A. (12/15/2022)

Controllers and Processors, Data Processing Agreement (DPA)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Kaufland Romania SCS (12/27/2022)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights

Data Protection Authority of Ireland-Slane Credit Union Ltd. (1/26/2022)

Data Processing Agreement (DPA), Data Subjects Rights, Integrity and confidentiality, Principles

Spanish Data Protection Authority (aepd)-XASTRE DO PETO, S.L. (11/11/2022)

Consent, Data Subjects Rights, Lawfulness of Processing, Right to Object

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-AMPLIFON Hungary Trade and Service Provider LLC (8/11/2022)

Controllers and Processors, Data Subjects Rights, Principles, Purpose limitation, Representative

Italian Data Protection Authority (Garante)-Ginosa municipality (7/21/2022)

Controllers and Processors, Data Processing Agreement (DPA), Lawfulness of Processing, Representative

Italian Data Protection Authority (Garante)-Acqua Novara.VCO S.p.a. (7/21/2022)

Controllers and Processors, Data Processing Agreement (DPA), Lawfulness of Processing, Representative

Spanish Data Protection Authority (aepd)-BANCO BILBAO VIZCAYA ARGENTARIA, S.A. (10/31/2022)

Controllers and Processors, Principles, Purpose limitation, Representative, Technical and Organisational Measures (TOMs)

Hellenic Data Protection Authority (HDPA)-EDYTE SA (9/6/2022)

Controllers and Processors, Data Processing Agreement (DPA)

Polish National Personal Data Protection Office (UODO)-Sułkowice Cultural Center (9/7/2022)

Data Processing Agreement (DPA)

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Company (8/8/2022)

Accountability, Consent, Lawfulness of Processing, Principles, Purpose limitation, Sensitive Data

Spanish Data Protection Authority (aepd)-SOLIVESA MASTER FRANCHISE S.L. (8/28/2022)

Controllers and Processors, Data Processing Agreement (DPA), Technical and Organisational Measures (TOMs)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Alpha Bank Romania SA (8/29/2022)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights

French Data Protection Authority (CNIL)-ACCOR SA (8/19/2022)

Access Requests (DSAR), Data Subjects Rights, Right to Object

Slovak Data Protection Office-Unknown (7/13/1905)

Controllers and Processors, Data Processing Agreement (DPA), Lawfulness of Processing, Representative

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Sephora Cosmetics România SA (8/4/2022)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-ESVETEL, S.L. (7/22/2022)

Controllers and Processors, Data Processing Agreement (DPA), Technical and Organisational Measures (TOMs)

Spanish Data Protection Authority (aepd)-Bar owner (7/19/2022)

Principles, Purpose limitation

French Data Protection Authority (CNIL)-TotalEnergies Electricité et Gaz France (6/23/2022)

Data Subjects Rights, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Wens Experience SRL (6/8/2022)

Controllers and Processors, Data Processing Agreement (DPA)

Data Protection Authority of Hessen-Restaurant (7/13/1905)

Principles, Purpose limitation

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Kaufland Romania SCS (6/3/2022)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights

Norwegian Supervisory Authority (Datatilsynet)-Company (3/15/2022)

Consent, Data Subjects Rights, Lawfulness of Processing, Right to Object

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Workshop (3/29/2022)

Legitimate Interest, Principles, Purpose limitation, Sensitive Data

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-LORIS FUEL SHOP SRL (5/12/2022)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-MAYR MELNHOF PACKAGING ROMANIA S.R.L. (5/17/2022)

Accountability, Lawfulness of Processing, Principles, Purpose limitation, Sensitive Data

Italian Data Protection Authority (Garante)-ISWEB S.p.A. (4/7/2022)

Controllers and Processors, Data Processing Agreement (DPA)

French Data Protection Authority (CNIL)-DEDALUS BIOLOGIE (4/15/2022)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Technical and Organisational Measures (TOMs)

Italian Data Protection Authority (Garante)-Scanshare S.r.l. (2/10/2022)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights

Polish National Personal Data Protection Office (UODO)-Fortum Marketing and Sales Polska S.A. (1/19/2022)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Integrity and confidentiality, Principles, Privacy by Design

Polish National Personal Data Protection Office (UODO)-PIKA Sp. z o.o. (1/19/2022)

Controllers and Processors, Data Processing Agreement (DPA), Principles, Sensitive Data, Technical and Organisational Measures (TOMs)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-IAMSAT Muntenia SA (2/22/2022)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-T.S.M. s.r.l. (1/27/2022)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-SEGURCAIXA ADESLAS, S.A. DE SEGUROS Y REASEGUROS (2/4/2022)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Lawfulness of Processing

Data Protection Authority of Hamburg-Company (7/12/1905)

Definitions, Joint Controllers

Italian Data Protection Authority (Garante)-Aimon Srl (11/25/2021)

Controllers and Processors, Data Subjects Rights, Lawfulness of Processing, Representative, Right to Object

Norwegian Supervisory Authority (Datatilsynet)-Elektro & Automasjon Systemer AS (12/13/2021)

Lawfulness of Processing, Legitimate Interest

French Data Protection Authority (CNIL)-SLIMPAY (12/28/2021)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights

French Data Protection Authority (CNIL)-FREE MOBILE (12/28/2021)

Data Subjects Rights, Principles, Privacy by Design, Right to Object

Hellenic Data Protection Authority (HDPA)-One Way Private Company (12/8/2021)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Valoris Center S.R.L. (11/26/2021)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Technical and Organisational Measures (TOMs)

Icelandic data protection authority (‘Persónuvernd’)-YAY ehf. (11/23/2021)

Controllers and Processors, Data Processing Agreement (DPA), Principles, Representative, Technical and Organisational Measures (TOMs)

Hellenic Data Protection Authority (HDPA)-ΚΑΠΑ ΛΑΜΔΑ ΩΜΕΓΑ ΔΙΑΦΗΜΙΣΤΙΚΗ ΕΜΠΟΡΙΚΗ ΜΟΝΟΠΡΟΣΩΠΗ ΕΤΑΙΡΕΙΑ ΠΕΡΙΟΡΙΣΜΕΝΗΣ ΕΥΘΥΝΗΣ (10/14/2021)

Data Subjects Rights, Lawfulness of Processing, Right to Object

Bulgarian Commission for Personal Data Protection (KZLD)-Bank (10/26/2021)

Principles, Purpose limitation

Hellenic Data Protection Authority (HDPA)-PREMIUMMEDIA ΠΑΡΑΓΩΓΗ ΟΠΤΙΚΟ-ΑΚΟΥΣΤΙΚΩΝ ΕΡΓΩΝ ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΙΑ (10/4/2021)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (10/19/2021)

Data Subjects Rights, Right to Object

Norwegian Supervisory Authority (Datatilsynet)-Ferde AS (9/27/2021)

Controllers and Processors, Data Processing Agreement (DPA), Integrity and confidentiality, Principles, Representative

Spanish Data Protection Authority (aepd)-Bar owner (9/28/2021)

Principles, Purpose limitation

Data Protection Authority of Ireland-Vodafone Ireland Limited (9/7/2021)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-aiComply S.r.l. (6/10/2021)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Actamedica SRL (8/24/2021)

Controllers and Processors, Data Breaches, Data Processing Agreement (DPA), Data Subjects Rights

Spanish Data Protection Authority (aepd)-Marbella Resorts S.L. (7/6/2021)

Controllers and Processors, Data Processing Agreement (DPA)

Spanish Data Protection Authority (aepd)-Caixabank S.A. (7/8/2021)

Lawfulness of Processing, Legitimate Interest

Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)-Storstockholms Lokaltrafik (6/21/2021)

Data Subjects Rights, Lawfulness of Processing, Legitimate Interest, Principles, Sensitive Data

Spanish Data Protection Authority (aepd)-Vodafone España, SAU (5/25/2021)

Controllers and Processors, Data Processing Agreement (DPA)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Lugera & Makler Broker S.R.L. (4/19/2021)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights

Spanish Data Protection Authority (aepd)-Promotech Digital S.L. (4/6/2021)

Data Subjects Rights, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-S.C. Tip Top Food Industry S.R.L (4/15/2021)

Accountability, Lawfulness of Processing, Principles, Purpose limitation, Sensitive Data

Italian Data Protection Authority (Garante)-Roma Capitale (2/11/2021)

Controllers and Processors, Data Processing Agreement (DPA), Principles, Representative, Technical and Organisational Measures (TOMs)

Spanish Data Protection Authority (aepd)-Equifax Iberica S.L. (3/10/2021)

Lawfulness of Processing, Legitimate Interest

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (3/11/2021)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Data Transfers

Spanish Data Protection Authority (aepd)-Certime S.A. (3/15/2021)

Principles, Purpose limitation

Polish National Personal Data Protection Office (UODO)-Krajowa Szkoła Sądownictwa i Prokuratury (2/11/2021)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Integrity and confidentiality, Principles, Technical and Organisational Measures (TOMs)

Spanish Data Protection Authority (aepd)-I-DE Redes Eléctricas Inteligentes, S.A.U (3/2/2021)

Performance of Contract, Principles, Purpose limitation, Sensitive Data

Spanish Data Protection Authority (aepd)-Vamavi Phone S.L. (2/11/2021)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Data Transfers

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-ING Bank N.V. Amsterdam – Bucharest office (2/10/2021)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights

Italian Data Protection Authority (Garante)-Azienda Unità Sanitaria Locale Toscana Sud Est (12/17/2020)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Integrity and confidentiality, Principles

French Data Protection Authority (CNIL)-Perfomeclic (12/7/2020)

Data minimisation, Data Subjects Rights, Principles, Right to Object, Sensitive Data

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Unknown (12/16/2020)

Principles, Purpose limitation, Sensitive Data

Italian Data Protection Authority (Garante)-Azienda Ospedaliera di Rilievo Nazionale ‘Antonio Cardarelli’ (Private Hospital) (9/30/2020)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Lawfulness of Processing, Representative

Spanish Data Protection Authority (aepd)-Tour & People Max S.L. (7/31/2020)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-Party of the Socialists of Catalonia (8/17/2020)

Principles, Purpose limitation

Spanish Data Protection Authority (aepd)-Bankia S.A. (8/28/2020)

Principles, Purpose limitation

Italian Data Protection Authority (Garante)-Merlini s.r.l. (7/13/2020)

Consent, Controllers and Processors, Data Processing Agreement (DPA), Lawfulness of Processing, Principles, Representative

Spanish Data Protection Authority (aepd)-De Vere Spain S.L. (7/2/2020)

Data Subjects Rights, Right to Object

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Digi Távközlési Szolgáltató Kft. (‘Digi’) (electronic communication service provider) (6/12/2020)

Controllers and Processors, Principles, Purpose limitation, Technical and Organisational Measures (TOMs)

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Financial Enterprise (6/26/2019)

Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Data Protection Authority of Hamburg-Hamburger Volksbank eG (7/11/1905)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-Eni Gas e Luce (12/11/2019)

Access Requests (DSAR), Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Italian Data Protection Authority (Garante)-TIM (telecommunications operator) (1/15/2020)

Access Requests (DSAR), Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Spanish Data Protection Authority (aepd)-Iberia Lineas Aereas de Espana, S.A. Operadora Unipersonal (2/3/2020)

Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Spanish Data Protection Authority (aepd)-Banco Bilbao Vizcaya Argentaria S.L. (2/3/2020)

Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-SC Enel Energie S.A. (Electricity Distributor) (12/16/2019)

Consent, Controllers and Processors, Data Subjects Rights, Lawfulness of Processing, Principles, Representative, Right to Object

Hellenic Data Protection Authority (HDPA)-Wind Hellas Telecommunications (10/18/2019)

Data Subjects Rights, Right to Object

Polish National Personal Data Protection Office (UODO)-Major of Aleksandrów Kujawski (10/18/2019)

Controllers and Processors, Data Processing Agreement (DPA)

Hellenic Data Protection Authority (HDPA)-Telecommunication Service Provider (10/7/2019)

Data Subjects Rights, Right to Object

Data Protection Authority of Berlin-Delivery Hero (9/19/2019)

Access Requests (DSAR), Data Subjects Rights, Right to Object

Data Protection Authority of Hamburg-Kolibri Image Regina und Dirk Maass GbR (12/17/2018)

Controllers and Processors, Data Processing Agreement (DPA)

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Unnamed financial institution (3/4/2019)

Controllers and Processors, Data Subjects Rights, Principles, Purpose limitation, Representative, Right to Erasure

Belgian Data Protection Authority (APD)-Mayor (5/28/2019)

Controllers and Processors, Principles, Purpose limitation, Representative

Bulgarian Commission for Personal Data Protection (KZLD)-Bank (12/4/2018)

Controllers and Processors, Principles, Purpose limitation, Representative

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg discussion paper on “Legal Foundations in Data Protection for the Use of AI”

AI, Lawfulness of Processing, Legitimate Interest, Specific processing situations

Guidelines on Securing AI Systems by The Cyber Security Agency of Singapore (CSA)

AI, Risk Management, Specific processing situations

Japan AI Safety Institute’s “Guide to Red Teaming Methodology on AI Safety”

AI, Specific processing situations

Study Finds ChatGPT Can Perform Biometric Tasks: A Closer Look at Privacy Risks

AI, Sensitive Data

Case C‑621/22 CJEU

Lawfulness of Processing, Legitimate Interest, Marketing and Advertising, Specific processing situations

Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR by EDPB

Lawfulness of Processing, Legitimate Interest

Recommendations for the use of AI coding assistants by ANSSI and BSI

AI, Specific processing situations

AIPact by the European Artificial Intelligence Office

AI, Data Subjects Rights, Specific processing situations

Manipulative, Deceptive, and Exploitative AI Systems report by the Dutch DPA

AI, Lawfulness of Processing, Specific processing situations

FTC Targets Deceptive AI Claims with Operation AI Comply

AI, Lawfulness of Processing

OpenAI, Microsoft, and Amazon Join EU’s AI Pact to Shape Future Regulations

California Governor Vetoes AI Safety Bill

“AI & Algorithmic Risks Report” by Dutch Data Protection Authority

AI, Risk Management, Specific processing situations

National Strategy on AI by Sri Lanka

AI, Lawfulness of Processing, Specific processing situations

The Future of European Competitiveness by EU Commission

AI, New technology, Specific processing situations

Belgian DPA General Secretariat Artificial intelligence systems and the RGPD from a data protection perspective

AI, Lawfulness of Processing, Principles, Specific processing situations, Transparency

Tech Giants Sign Open Letter Urging “Regulatory Certainty on AI” in Europe

LinkedIn Used User Data for AI Training Before Updating Its Terms

AI, Data Sharing, Data Subjects Rights, Lawfulness of Processing

Case C 203/22 on AI and automated decisions, the right of access under the GDPR, and the protection of trade secrets

AI, Automated Decision-making, Controllers and Processors, Specific processing situations

Artificial Intelligence and Machine Learning in Health Care and Medical Sciences Best Practices by Pitfalls Gyorgy J. Simon Constantin Aliferis Springer

AI, Health Data, Principles, Sensitive Data, Specific processing situations

Report and Guidance on Privacy in Social Network Services – ”Rome Memorandum” by International Working Group on Data Protection in Telecommunications

Definitions, Processing of personal data

Report of the work undertaken by the ChatGPT Taskforce by EDPB

AI, Specific processing situations

Opinion 04/2024 on the notion of main establishment of a controller in the Union under Article 4(16)(a) GDPR |EPDB

Definitions, Main Establishment

Case C‑740/22

Definitions, Personal Data

Case C‑604/22

Joint Controllers, Personal Data

Rethinking Privacy in the AI Era | White Paper by Stanford University

AI, Specific processing situations

A pro-innovation approach to AI regulation by UK ICO

AI, Specific processing situations

Datenschutzkonforme Künstliche Intelligenz Checkliste mit Prüfkriterien nach DS-GVO

AI, Specific processing situations

Analysis of the final compromise text of the EU AI Act with a view to agreement by the Belgian Presidency

AI, Specific processing situations

Recommendations 02/2020 on the European Essential Guarantees for surveillance measures

CCTV, Lawfulness of Processing, Legitimate Interest, Specific processing situations

[PROPOSAL 2024] EU AI ACT

AI, Specific processing situations

Generative AI framework for HM Government by the UK Central Digital and Data Office

AI, Specific processing situations

Artificial Intelligence Strategy of the CJEU

AI, Specific processing situations

Processing Personal Data on the Basis of Legitimate Interests under the GDPR by FPF

Lawfulness of Processing, Legitimate Interest

Case C 683-2021

Data Controller, Data Processors, Joint Controllers

Interim Report – Governing AI for Humanity by UN AI Advisory Body

AI, Specific processing situations

AI fairness in practice by the Alan Turing Institute

AI, Specific processing situations

Case T-1077/23

AI, Copyright, Specific processing situations

GUIDELINES ON LEGITIMATE INTEREST by the NPC of the Republic of Philippines

Lawfulness of Processing, Legitimate Interest

[DRAFT] FRAMEWORK CONVENTION ON ARTIFICIAL INTELLIGENCE, HUMAN RIGHTS, DEMOCRACY AND THE RULE OF LAW

AI, Specific processing situations

The NYT vs OpenAI and Microsoft

AI, Copyright, Specific processing situations

European Commision press release on AI Act Agreement

AI, Specific processing situations

New rules for Artificial Intelligence – Questions and Answers by the European Commision

AI, Specific processing situations

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL LAYING DOWN HARMONISED RULES ON ARTIFICIAL INTELLIGENCE (ARTIFICIAL INTELLIGENCE ACT)

AI, Specific processing situations

Practical Guide on Controller to Processor Contracts by the Irish DPC

Controllers and Processors, Data Processing Agreement (DPA)

AI Act Provisional Agreement Press Release

AI, Specific processing situations

Press Release No 184-23 by the CJEU

Controllers and Processors, Joint Controllers, Liability and Remedies, Supervisory Authorities

GDPR guidance: Legitimate Inerersts Assessments (LIA) for Digital Advertising

Lawfulness of Processing, Legitimate Interest, Marketing and Advertising, Specific processing situations

PRACTICAL GUIDANCE FOR THE USE OF GENERATIVE ARTIFICIAL INTELLIGENCE IN THE PRACTICE OF LAW by State Bar of California

AI, Specific processing situations

Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence (PROPOSED MEMORANDUM )

AI, Specific processing situations

The impact of the General Data Protection Regulation (GDPR) on artificial intelligence by the EU Parliamnet

AI, Specific processing situations

Guidelines for secure AI system development by UK NCSC and US CISA

AI, Specific processing situations

Benefits and Risks of Generative Artificial Intelligence Report by the State of California

AI, Specific processing situations

COMMON GUIDEPOSTS TO PROMOTE INTEROPERABILITY IN AI RISK MANAGEMENT | German Ministry of labor and social Affairs

AI, Specific processing situations

Generative AI: The Data Protection Implications by CEDPO

AI, Specific processing situations

Global Toolkit on AI and the Rule of Law for the Judiciary by UNESCO

AI, Specific processing situations

AI Privacy Policy template

AI, Specific processing situations

AI and Data Protection Risk Toolkit by UK ICO

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence by the US President

AI, Specific processing situations

Automated Decision-Making Under the GDPR by the FPF

AI, Automated Decision-making, Controllers and Processors, Specific processing situations

AI How-to Sheets by CNIL

AI, Specific processing situations

Description of the dataset template by CNIL

AI, Specific processing situations

Opinion 44/2023 on the Proposal for Artificial Intelligence Act in the light of legislative developments

AI, Specific processing situations

Artificial intelligence and the Information Privacy Principles by the Privacy Commisioner (New Zealand)

AI, Specific processing situations

How to use AI and personal data

AI, Specific processing situations

One-Stop-Shop thematic case digest: RIGHT TO OBJECTAND RIGHT TO ERASURE

Data Subjects Rights, Right to Erasure, Right to Object

Case C-101/01

Data Transfers, Definitions, Principles, Processing of personal data, Sensitive Data

C-597/19

Lawfulness of Processing, Legitimate Interest

C-708/18

CCTV, Lawfulness of Processing, Legitimate Interest, Specific processing situations

C-272/19

Access Requests (DSAR), Data Controller, Data Subjects Rights, Definitions

C-77/21

Principles, Purpose limitation

Case C-60/22

Accountability, Controllers and Processors, Joint Controllers, Principles

Voluntary AI Safety Standard by the Australian Government

AI, Specific processing situations

Safe and responsible AI in Australia Proposals paper for introducing mandatory guardrails for AI in high-risk settings by Australian Government

AI, Specific processing situations

Global Approaches to Auditing Artificial Intelligence by IPIE

AI, Specific processing situations

Artificial Intelligence Security Governance Framework 1.0 by China Cybersecurity Standardization Technical Committee

AI, Specific processing situations

Multidisciplinary Perspectives on Artificial Intelligence and the Law by Springer

AI, Specific processing situations

UNESCO: Consultation paper on AI Regulation

AI, Lawfulness of Processing, Public Interests, Specific processing situations

Saudi Data & Artificial Intelligence Authority: Rules governing the appointment of Personal DPOs under the Kingdom of Saudi Arabia’s (KSA) Personal Data Protection Law (PDPL)

AI, Specific processing situations

NSW report: Artificial intelligence in New South Wales

AI, Specific processing situations

Briefing EU Legislation in Progress by EPRS on AI Act

AI, Specific processing situations

ON THE ANTITRUST IMPLICATIONS OF EMBEDDING GENERATIVE AI IN CORE PLATFORM SERVICES BY SSRN

AI, Specific processing situations

South Africa National Artificial Intelligence Policy Framework

AI, Specific processing situations

Policy for the responsible use of AI in government by Australian Government

AI, Data Processing by the Government, Specific processing situations

Consumer Protection in respect of Use of Generative Artificial Intelligence by Hong Kong Monetary Authority

AI, Specific processing situations

The State of Artificial Intelligence in the Pacific Islands

AI, Specific processing situations

Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on adapting non-contractual civil liability rules to artificial intelligence (AI Liability Directive)

AI, Liability and Remedies, Specific processing situations, Supervisory Authorities

Relying on the legal basis of legitimate interests to develop an AI system by CNIL

Lawfulness of Processing, Legitimate Interest

Securing Artificial Intelligence: Mitigation Strategy Report by ETSI

AI, Specific processing situations

Data protection compliant AI by Bavarian State Office for Data protection Supervision

AI, Specific processing situations

Case C‑461/22 CURIA

Data Controller, Definitions

Responsible AI Governance in Africa: Prospects for Outcomes Based Regulation by African Observatory on Responsible AI

AI, Specific processing situations

Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework by EDPB

AI, Specific processing situations

Confidential Computing and Privacy: Policy Implications of Trusted Execution Environments by Future of Privacy Forum

AI, Specific processing situations

Formal Opinion 512 on Generative Artificial Intelligence Tools by AMERICAN BAR ASSOCIATION

AI, Specific processing situations

Case C-394/23, Mousse: Request for a preliminary ruling from the Conseil d’État (France) lodged on 28 June 2023 — Association Mousse v Commission nationale de l’informatique et des libertés (CNIL), SNCF Connect

Definitions, Processing of personal data

National framework for the assurance of artificial intelligence in government by the Australian, state and territory governments

AI, Specific processing situations

Relying on the legal basis of legitimate interest to develop an AI system by CNIL

AI, Specific processing situations

Generative AI Controls Framework Safe, Secure, and Compliant AI Adoption Approach Whitepaper by IBM

AI, Specific processing situations

Patent Landscape Report on Generative AI by WIPO

AI, Specific processing situations

Discussion Paper: Large Language Models and Personal Data by The Hamburg Commissioner for Data protection and freedom of information

AI, Specific processing situations

Data protection impact assessment for AI Solutions by Danish DPA

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

Mobilizing the legal basis of legitimateinterest to develop an AI system by CNIL

AI, Specific processing situations

Today’s and tomorrow’s means of payment facing the challenge of data protection by CNIL

Definitions, Processing of personal data

EditorsTrends in Data Protection and Encryption Technologies by SpringerProfessional

Definitions, New technology, Processing of personal data

Orientations for ensuring data protection compliance when using Generative AI systems by EDPS

AI, Specific processing situations

GDPR & Generative AI A Guide for Customers by Microsoft

AI, Specific processing situations

Risk and control for artificial intelligence and machine learning systems by Cybernetica

AI, Specific processing situations

Governance of artificial intelligence (AI) by House of Commons UK

AI, Specific processing situations

DECISION OF THE INFORMATION COMMISSIONER Snap Inc. and Snap Group Limited

AI, Specific processing situations

Artificial intelligence (AI) and human rights: Using AI as a weapon of repression and its impact on human rights by EU Parliament

AI, Specific processing situations

Neurodata risks report by EDPS and Spanish DPA

AI, Specific processing situations

Orientation guide of the Conference of Independent Federal and State Data Protection Supervisory Authorities by the German Data Protection Conference (DSK)

AI, Specific processing situations

GDPR & GENERATIVE AI – A GUIDE FOR THE PUBLIC SECTOR BY MICROSOFT

AI, Specific processing situations

Convention on AI, Human Rights, Democracy and the Rule of Law – by the Council of Europe (draft)

AI, Specific processing situations

Report of the work undertaken by the ChatGPT Taskforce bg EDPB

A Guide to ICO Audit Artificial Intelligence (AI) Audits by UK ICO

AI, Specific processing situations

Guideline on the massive collection of personal data from the web for the training of generative artificial intelligence (GenAI) models by the Italian Data Protection Authority (Garante)

AI, Data scraping, Specific processing situations

EDPB-EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)

AI, Specific processing situations

Generative Artificial Intelligence Risk Assessment by State of California Department of Technology

AI, Risk Management, Specific processing situations

Report and Recommendations of the New York State Bar Association Task Force on Artificial Intelligence

AI, Specific processing situations

Perspectives on Issues in AI Governance by Google

AI, Specific processing situations

Deploying AI Systems Securely by NSA

AI, Specific processing situations

PRACTICE GUIDE SECURITY OF PERSONAL DATA Version 2024 by CNIL

Definitions, Personal Data

Opinion 39/2021 on whether Article 58(2)(g) GDPR could serve as a legal basis for a supervisory authority to order ex officio the erasure of personal data, in a situation where such request was not submitted by the data subject |EPDB

Data Controller, Data Subjects Rights, Definitions

Human rights Impact Assessments for AI by Access Now

AI, Data Protection Impact Assessment (DPIA)

GenAI and data protection: how organisations and their employees can use it appropriately and lawfully

AI, Employment

Opinion on legitimate interests of the data controller (Opinion 06/2014)

Legitimate Interest

Joint statement on data scraping and the protection of privacy

Personal Data Collection

Fashion ID, 29 July 2019, C-40/17, ECLI:EU:C:2019:629

Data Controller, Data Processors

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH, in the presence of Facebook Ireland Ltd (Case C-210/16).

Data Controller

Nowak (C-434/16, EU:C:2017:994)

Personal Data

Patrick Breyer v. Germany Case C-582/14, 12 May 2016

Consent, Personal Data

Weltimmo s.r.o. v. Nemzeti Adatvédelmi és Információszabadság Hatóság [2015] Case C-230/14, 1 October 2015

Main Establishment

Records of Processing Activities under Article 30 GDPR | Irish DPC

Records of processing Activities (ROPA)

What is Personal Data | UK ICO

Personal Data

Data Sharing Code | UK ICO

Data Processing Agreement (DPA)

WORKING PARTY 29 POSITION PAPER on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR

Records of processing Activities (ROPA)

Guidance on ai and data protection 2.0 | UK ICO

Records of processing activities template by the CNIL

Records of processing Activities (ROPA)

Artificial Intelligence Risk Management Framework (AI RMF 1.0) by NIST

Guidelines 07/2020 on the concepts of controller and processor in the GDPR

Data Controller, Data Processors, Definitions

Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679

Data Subjects Rights, Right to Object

CIPL Examples of Legitimate Interest Grounds for Processing of Personal Data [PDF] [Official Guidelines]

Lawfulness of Processing, Legitimate Interest

Telegram CEO’s Arrest Sparks Debate on Privacy vs. Regulation

Personal Data Collection, Technical and Organisational Measures (TOMs)

AI Meets Media: OpenAI Secures Another Multi-Year Deal with Media Giant

AI models collapse when trained on recursively generated data

AI, Specific processing situations

The government-wide vision on Generative Al of the Netherlands

AI, Data Processing by the Government, Specific processing situations

AI Possible Risks & Mitigations Optical Character Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

AI Possible Risks & Mitigations Named Entity Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

AI system development: CNIL’srecommendations to comply with the GDPR

AI, Specific processing situations

Addictive patterns in the processing of personal data Implications for data protection by AEPD

Definitions, Processing of personal data

AI Auditing Checklist for AI Auditing by EDPB

AI, Specific processing situations

AI, DATA GOVERNANCE AND PRIVACY SYNERGIES AND AREAS OF INTERNATIONAL CO-OPERATION BY OECD

AI, Specific processing situations

Supervision of AI systems in the EU by Dutch DPA and RDI (english)

AI, Specific processing situations

Statement on the interplay between AI Act and GDPR for private sector by the The Austrian DPA

AI, Specific processing situations

AI Development Recommendations to Ensure GDPR Compliance by CNIL

AI, Specific processing situations

The Colorado AI Act “Senate Bill SB24-205”

AI, Specific processing situations

Artificial Intelligence Risk Management Framework by NIST: Generative Artificial Intelligence Profile

AI, Risk Management, Specific processing situations

Privacy, seriously by the UK ICO

AI, Privacy by Design, Product Privacy Design

AI and Data Protection risk toolkit by the UK ICO

AI, Data Protection Impact Assessment (DPIA)

Salvatore Manni Case C 398/15

Data Retention, Legitimate Interest, Storage limitation

A Guide to UK GDPR Principles | UK ICO

Accountability, Accuracy, Data minimisation, Integrity and confidentiality, Lawfulness of Processing, Principles, Purpose limitation, Storage limitation, Transparency

A Guide to Lawful Basis | UK ICO

Consent, Lawfulness of Processing, Legal Obligation, Legitimate Interest, Performance of Contract, Public Interests, Vital Interests

The EDPB data protection guide for small business

AI, Risk Management