GDPR Explicit GDPR Lawful Basis Statements: What Articles 13 and 14 Require in Your Privacy Notice
In January 2023, Ireland’s Data Protection Commission fined Meta a combined 390 million euros over how Facebook and Instagram handled personal data for advertising.
Latest from the Privacy Desk
All dispatches →German Court Says Loyalty Apps Don’t Have to Put a Price on Your Personal Data
When a supermarket offers lower prices only to customers who download an app, create an account and allow the retailer to build…
GDPR Agentic AI Was Built to Improvise. Privacy Law Was Built for Predictability.
Most privacy laws were written around a relatively understandable model of computing.
GDPR Reject All Doesn’t Always Mean No Tracking: Study of One Million Websites Finds Widespread Cookie and Pixel Problems
For years, the basic bargain behind European cookie banners has been straightforward.
Dutch Privacy Regulator Releases Free GDPR Templates for Small and Mid-Sized Businesses
The Dutch Data Protection Authority has released two new GDPR compliance templates designed specifically for small and mid-sized businesses, giving companies a…
Norway’s Privacy Regulator Warns EU “Chat Control” Could Turn Private Messaging Into Mass Surveillance
Norway’s Data Protection Authority says the EU’s proposed framework for combating online child sexual abuse could go too far by enabling broad…
GDPR Data Retention Policy: What It Is, Legal Requirements & Best Practices
Keeping data forever used to be the easy answer. Storage was cheap, deletion was difficult, and nobody wanted to discover that an…
Croatia’s DPA Explains GDPR Certification: What a Seal Proves, and What It Does Not
Croatia’s personal data protection agency, AZOP, has put out a practical explainer on GDPR certification.
NIST, ISO 27701, or Neither? Why Picking a Privacy Framework Is the Wrong First Question
In March 2025, the California Privacy Protection Agency fined American Honda Motor Co.
GDPR ePrivacy Directive Updates
In March 2025, Spain’s data protection authority (AEPD) fined a major telecommunications provider €3.94 million for placing tracking cookies without valid consent…
Italian Garante Hits US Data Broker Lusha with €2 Million Fine and Processing Ban
Italy’s data protection authority, the Garante, has imposed a €2 million fine on Lusha Systems Inc., a United States-based data broker, for…
EU AI Act Enforcement Powers Activate as Rogue Agent Incident Underscores Systemic Risks
The second anniversary of the European Union’s Artificial Intelligence Act is set to unlock significant new supervisory authority for the European Commission…
GDPR EDPB Draft Guidelines on Anonymization and AI Web Scraping Spotlight Re-Identification Risks Amid Digital Omnibus Debates
The European Data Protection Board has opened a public consultation on two closely related draft guidelines that address some of the most…