Unpacking compliance, security and AI.
Our DPOs and CISOs regularly share their take on regulatory and technical news here: new CNPD guidelines, notable sanctions, incident lessons learned, evolutions on the AI Act, NIS 2 and DORA. To go beyond the press release.
Italy — AgID fined €55,000 for INAD/INI‑PEC transparency failures
The Italian Garante fined AgID €55,000 for transparency and privacy‑by‑design failures when moving PEC addresses from INI‑PEC to INAD. A warning shot for public registers and data reuse.
Romania: €125,000 fine against Renault for security failures (GDPR Art. 32)
On 25 March 2026, Romania’s ANSPDCP fined Renault Commercial Romania (~€125,000) for GDPR Article 32 failures and processor governance. Modern DLP evidences “appropriate” measures and curbs uncontrolled data transfers.
GDPR Article 6: the Intesa/Isybank lesson on legitimate interest vs consent
Italy’s DPA fined Intesa €17.6M for transferring ~2.4M customers to Isybank without a valid legal basis. Key takeaway: legitimate interest cannot replace valid consent or strict contractual necessity.
DORA — Third-country branches: ICT register due by June 30
DORA’s final stretch in Luxembourg: third‑country bank branches must submit their ICT register to the CSSF by June 30, 2026 at the latest. Here is how to get it done this week.
Clinical Diagnostics (NL): gynecological records leak — GDPR-aligned DLP
After the massive leak at Clinical Diagnostics, a modern DLP aligned with GDPR (Art. 32 and 44–49) reduces exfiltration and provides the evidence authorities expect.
CJEU SCHUFA vs ICO: Is GDPR Article 22 a ban or a right?
The CJEU classified credit scoring as automated individual decision-making under GDPR Article 22. The EDPB reads it as a general ban with exceptions, while the ICO frames it as a right to be activated.
EDPB — Scientific research: last chance to comment
On 25 June 2026, the EDPB closes its public consultation on Guidelines 1/2026 for processing personal data for scientific research. Key clarifications on legal basis, broad consent, and GDPR Article 89 safeguards.
AEPD fines Yoti €950,000 — Automated DPIA becomes essential
On March 10, 2026, the AEPD fined Yoti €950,000 for unlawful biometrics, invalid consent and excessive retention. A tooled, automated DPIA is now key to reduce risk and evidence GDPR compliance.
Information duty (Art. 14 GDPR): the legal exception clarified in 2026
The French Court of Cassation (Jan 29, 2026) confirms the Art. 14(5)(c) GDPR exception where a law mandates disclosure and provides appropriate safeguards. Useful for tax/social flows and certain B2G sharing in Luxembourg.
Evidence and personal data: France’s Supreme Court draws a clear line
On 17 June 2026, the French Supreme Court allowed an analysis report based on pseudonymised data as evidence, where necessary and strictly proportionate. A green light for carefully run internal investigations.
Outsider Enterprise dismantled: urgent need for phishing‑resistant FIDO2 MFA
FBI, Google, and Black Lotus Labs dismantled “Outsider Enterprise,” a PhaaS linked to >1M URLs and ≈$1.9B in losses. Why FIDO2/WebAuthn MFA is now the “appropriate measure” under GDPR Article 32.
Ex-employee mailbox: €176,000 fine and a short-lived legitimate interest
Belgian DPA (Decision 101/2026): keeping an ex-employee’s mailbox active for over a year is unlawful. Legitimate interest only covers a very short redirection (~1 month), with transparency, LIA and offboarding procedures.