Resources

Guideline and Action Points for Hospital Consultants by IHCA

Health Data, Sensitive Data

Становище от 15.05.2012 г. на КЗЛД по искане No ЗАП- 18/23.04.2012

Health Data, Sensitive Data

НАРЕДБА No 1 ОТ 27 ФЕВРУАРИ 2013 Г. ЗА ПРЕДОСТАВЯНЕ НА МЕДИКО- СТАТИСТИЧЕСКА ИНФОРМАЦИЯ И НА ИНФОРМАЦИЯ ЗА МЕДИЦИНСКАТА ДЕЙНОСТ НА ЛЕЧЕБНИТЕ ЗАВЕДЕНИЯ

2025-W03 The Austrian DSB Slaps Down Google’s Controllership Denial, CCPA applicable for AI and more

2025-W05 DeepSeek: A Quantum Leap in AI, A Dead End in GDPR Compliance

2025-W02-Privacy News German Court Awards EUR 10000 for Unlawful Disclosure of Data, EDPB Issues Opinion on AI Models and more

UK ICO Consent Or Pay Guidelines

Consent, Lawfulness of Processing

OPINION OF ADVOCATE GENERAL SPIELMANN ON Case C‑413/23 P

Pseudonymisation, Technical and Organisational Measures (TOMs)

European Commision Guidelines Prohibited AI Practices

Position paper on Interplay between data protection and competition law

Competition law

Cases T-70/23, T-84/23 T-111/23

Supervisory Authorities

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847

FDPIC guideline cookies

Consent, Cookies, Lawfulness of Processing

CNIL GUIDELINES TRANSFER IMPACT ASSESSMENT

Data Transfers, Transfer Impact Assessment

Directive 2225/2023 on credit agreements for consumers

Privacy Navigator Podcast Episodes

W04-2025: Privacy Navigator Podcast

2024 Coordinated Enforcement Action Implementation of the right of access by controllers by EDPB

Access Requests (DSAR), Data Subjects Rights

EDPB Guidelines 1/2025 on Pseudonymisation

Pseudonymisation, Technical and Organisational Measures (TOMs)

AIIA example

AI, Data Protection Impact Assessment (DPIA)

Childrens Online Privacy Protection Rule

AI and privacy – guide for DPOs by CEDPO

W03-2025: Privacy News Podcast

DSB (Austria) – D130.1013 2024-0.743.431 nyob vs Google

Data Controller, Data Subjects Rights, Definitions

CJEU Press Release 2/2025 Case C-394/23 | Mousse

Data minimisation, Principles, Purpose limitation

UK ICO Controller ROPA Template

Records of processing Activities (ROPA)

UK ICO Consultation on GenAI

Legal Advisory – Application of Existing CA Laws to Artificial Intelligence

CNIL Permissions in Mobile Apps

Consent, Lawfulness of Processing

Garante vs OpenAI

UK ICO Introduction to Anonymisation

Anonymisation

CJEU Press Release 1/2025 Case T-354/22 | Bindl v Commission

Administrative Fines, Civil Liability and Damages, Data Transfers, Liability and Remedies

Решение СРС НАХД 14811-2019

Administrative Fines, Data Breaches, Liability and Remedies

W02-2025: Privacy News Podcast

Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models

W50-2024: Privacy News Podcast

Case T-262/24 Commission v EDPS

Data Processing Agreement (DPA), Data Sharing, Records of processing Activities (ROPA)

UK ICO – consultation series on generative AI

Data Protection Impact Assessment (DPIA) – Microsoft CoPilot 365

Data Protection Impact Assessment (DPIA)

Adoption of AI, Blockchain and other emerging technologies within the European public sector A Public Sector Tech Watch report by EU Commission

AI, Public Interests

Draft Methodology for Human Rights, Democracy and the Rule of Law Impact Assessment for AI Systems by Council of Europe

AI, Data Protection Impact Assessment (DPIA)

A BLUEPRINT FOR GREECE’S AI TRANSFORMATION

AI, Public Interests

FTC decision against IntelliVision Technologies

Facial Recognition

Guidelines 02/2024 on Article 48 GDPR by EDPB

Data Transfers

Norwegian DPA decision Against Familiekanalen for Violating Children’s Privacy

Children as data subjects

Major US Telecom Providers Targeted in Chinese Cyber-Attack

Data Breaches

Sensitive Medical Data Exposed: French Hospital Breach Affects Hundreds of Thousands

Data Breaches

Lawsuit Canadian news vs OpenAI

AI, Copyright

Case C‑169/23 Másdi

Data Subject Rights Restrictions, Data Subjects Rights

Standard contractual clauses for EU-EEA by EU

Standard Contractual Clauses (SCC)

Standard contractual clauses for international transfers by EU

Data Transfers, Standard Contractual Clauses (SCC)

Decision of 19 October 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Andorra

Adequacy Decisions

Decision of 30 June 2003 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Argentina

Adequacy Decisions

Decision of 20 December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act

Adequacy Decisions

Decision of 5 March 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data

Adequacy Decisions

Decision of 21 November 2003 on the adequate protection of personal data in Guernsey

Adequacy Decisions

Decision of 31 January 2011 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data

Adequacy Decisions

Decision of 28 April 2004 on the adequate protection of personal data in the Isle of Man

Adequacy Decisions

Decision (EU) 2019/419 of 23 January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information

Adequacy Decisions

Decision of 8 May 2008 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Jersey

Adequacy Decisions

Decision of 19 December 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by New Zealand

Adequacy Decisions

Decision (EU) 2022/254 of 17 December 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the Republic of Korea under the Personal Information Protection Act

Adequacy Decisions

Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland

Adequacy Decisions

Decision (EU) 2021/1772 of 28 June 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom (notified under document C(2021)4800)

Adequacy Decisions

Decision (EU) 2021/1773 of 28 June 2021 pursuant to Directive (EU) 2016/680 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom

Adequacy Decisions

Decision EU 2023/1795 of 10 July 2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework

Adequacy Decisions

Decision pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data

Adequacy Decisions

Decision pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data

Adequacy Decisions

Decision pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data

Adequacy Decisions

Italy’s Data Protection Authority Fines Foodinho €5 Million for Data Violations

Administrative Fines, Employment, Lawfulness of Processing

Assessing Potential Future AI Risks, Benefits, and Policy Imperatives OECD

AI, Risk Management, Technical and Organisational Measures (TOMs)

Reducing Risks Posed by Synthetic Content by NIST

AI, Risk Management, Technical and Organisational Measures (TOMs)

CAIDP Responds to Outcome of U.S. Convening of AI Safety Institutes

AI, Risk Management, Technical and Organisational Measures (TOMs)

Proof of concept Blockchain and the right to erasure by AEPD

Right to Erasure

REGULATION (EU) 2024/2847 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (CYBER RESILIENCE ACT)

Technical and Organisational Measures (TOMs)

Decision by German Federal Court of Justice (BGH) on case against Facebook for data scraping incident (german)

Civil Liability and Damages, Data scraping, Liability and Remedies

New Australian Law will Mandate Age Checks, Data Deletion for Social Media Platforms

Children as data subjects

WhatsApp Data-Sharing Ban in India: Meta Faces $25.4M Fine

Data Sharing

OH Digitale Dienste version 1.2 by German data protection authority

Decision 114/2024 by Belgian Data Protection Authority (in Dutch)

Consent, Employment

First Draft General-Purpose AI Code of Practice by EU Commission

Mobile Applications recommendations for better privacy protection by CNIL (french)

Product Privacy Design

The Consumer Financial Protection Bureau (CFPB) by Consumer Financial Protection Bureau WASHINGTON, D.C

Finance and Fintech