EDPO (European Data Protection Office)

“The European Data Protection Board's draft ‘Guidelines 02/2026 on Anonymisation’ reflect a recipient-specific approach: the same data may be anonymous for one organization but personal data for another, depending on the means each is reasonably likely to use. Genomic data, which the EU General Data Protection Regulation treats as genetic data under Article 4(13) and as a special category under Article 9, tests that approach, because a patient may be identifiable through a relative's genetic information that neither the disclosing controller nor the recipient holds. Consider a scenario the draft guidelines do not yet address. A hospital wants to share whole-genome sequences with a research institute for a rare-disease project. It removes names, birthdates and other identifiers. The institute receives no key, has no access to the hospital's records and decides for itself how to process the data. Are the sequences anonymous for the institute? The answer has significant legal consequences for both parties. For the research institute, the answer determines whether the GDPR applies to its processing and, if so, whether obligations such as identifying a legal basis and notifying a breach arise. The answer also affects what the hospital can warrant in the data-sharing agreement, whether the dataset may be deposited in an open or controlled-access repository and, under the European Health Data Space, whether a health data access body may release the data in anonymized form or only in pseudonymized form under stricter conditions. For the hospital, which retains the key, the sequences remain personal data regardless”. #GDPR #EDPB #Anonymisation #DataProtection #Privacy Subscribe to EDPO's newsletter here: https://lnkd.in/dwK8sde   *This article was not written by EDPO. The opinions and views of the author(s) do not necessarily reflect those of EDPO. https://lnkd.in/eH5vXxRP

"The Information Commission's Office (ICO) has published a significant new report confirming that ten of the world's largest foundation model developers have made, or committed to make, data protection improvements following regulatory supervision by the ICO. The report also sets out the ICO's broader expectations for model development, making the report of interest to developers beyond the ten named.   This comes at the same time as the ICO has launched a call for evidence on agentic AI. We explore this update further in our recently published 'The ICO's agentic AI call for evidence: what you need to know' article." #Privacy #UKGDPR #ICO #AI Subscribe to EDPO's newsletter here: https://lnkd.in/dwK8sde *This article was not written by EDPO. The opinions and views of the author(s) do not necessarily reflect those of EDPO. https://lnkd.in/e5zcsxuH

"An Israeli surveillance technology firm has run a large-scale operation to infect mobile phones with spyware using online advertisements to hack the devices, researchers said on Thursday. An investigation by the University of Toronto's Citizen Lab and cybersecurity firm Confiant Threat Intelligence laid bare an ad-based infection technique developed by an Israeli company that researchers named ‘AdFection.’ The hacks weaponized legitimate online ad systems for espionage purposes, allowing spyware manufacturers to connect to millions of devices and identify, track and target victims. [...] The scale is striking: An analysis of four billion advertising records found that Discover-Tech's ads appeared across nearly 200,000 websites and mobile apps in dozens of countries over four months. Among the websites that featured the ads were institutional sites of NATO, the United Nations, the European Parliament, European Commission and Council of the EU. The technique exploits real-time bidding — the automated system used by platforms such as Google to sell advertising space and target users. Rather than persuading victims to click a malicious link, attackers can exploit advertisements to identify and potentially infect devices without any interaction from the user — a technique known as ‘zero-click’ infections. [...] The findings triggered calls for further investigation on Thursday. ‘The possibility that EU institutions have been exposed should set off alarm bells across Brussels,’ said Hannah Neumann, a German European Parliament lawmaker of the Greens group. Neumann herself was the victim of a cyber-espionage operation by an Iranian hacking group. ‘Europe cannot claim to defend democracy while leaving its own democratic institutions vulnerable to spyware,’ Neumann said." #Privacy #GDPR #Spyware #AdFection   Subscribe to EDPO's newsletter here: https://lnkd.in/dwK8sde   *This article was not written by EDPO. The opinions and views of the author(s) do not necessarily reflect those of EDPO. https://lnkd.in/gRPrrrKV

"The European Union’s two-year-old AI law was once considered too far ahead of the curve. Now U.S. tech executives say it’s outdated. Top bosses from Microsoft and Google have openly questioned whether the EU’s 2024 Artificial Intelligence Act still fits the purpose, after a summer of incidents involving AI agents going rogue and a growing chorus of warnings about the technology’s risks to humanity. [...] That’s sparking an open clash of ideas with top European Commission officials, who insist that the law is strong enough to handle the security risks of the newest AI models. EU tech chief Henna Virkkunen said the law is ‘well-equipped’ to handle AI agents, even though agents weren't mainstream when the law was written in 2023. ‘We are satisfied for now; we have an appropriate system of regulation in place,’ EU Justice Commissioner Michael McGrath, who oversees data protection, told reporters in a huddle on the sidelines in Dublin, responding to POLITICO’s question on whether the law is fit for purpose. [...] But some EU governments have also concluded that the AI Act has loopholes, and that more work is needed to keep the rules up to date with the rapid pace of AI development. [...] One loophole is whether the rules apply to AI models that companies use and test internally but have not yet placed on the market. ‘The AI Act largely applies once a model is placed on the market,’ reads the paper. ‘The 2026 incidents occurred before that point.’ The Hungarians also worry whether authorities have enough information on when models are being trained and tested, and whether a company can be held liable if its agents do harm. ‘We consider that this may require legislative action and therefore propose that the necessary be taken at Union level,’ it said." #Privacy #GDPR #AIAct #AIAgents   Subscribe to EDPO's newsletter here: https://lnkd.in/dwK8sde   *This article was not written by EDPO. The opinions and views of the author(s) do not necessarily reflect those of EDPO. https://lnkd.in/eAZyQPPZ

“We have issued a reprimand and enforcement notice to the Metropolitan Police Service (MPS) after finding that its officers and staff shared personal information using an unapproved third-party retail crime intelligence-sharing platform without appropriate data protection safeguards, governance or oversight. Our investigation found that MPS officers and staff used the platform between March 2023 and September 2024, despite it not being formally approved for use by the force. Around 500 accounts were created, with 375 actively used for policing activities. The investigation found that between January and September 2024 personal information relating to 179 people, three of whom were under the age of 18, was uploaded to the platform as part of efforts to identify individuals suspected of shoplifting. This included names, dates of birth and, in a small number of cases, home addresses.” #Privacy #GDPR #ICO #PoliceService Subscribe to EDPO's newsletter here: https://lnkd.in/dwK8sde *This article was not written by EDPO. The opinions and views of the author(s) do not necessarily reflect those of EDPO. https://lnkd.in/eRQCqxVf

“During its latest plenary, the EDPB has adopted statement on smart glasses and published the report 'The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses', developed in the context of the Support Pool of Expert (SPE) programme. As smart glasses become widely available and more frequently used, they raise significant questions for the protection of individuals’ personal data and rights and freedoms even if they create new opportunities for communication, assistance, and innovation. […] As data controllers, neither the producer nor the provider of a linked application or service can transfer their obligations to users. They must comply with data protection law and ensure any new data processing remains compatible with the original purpose of collection.” #DataProtectionLaw #GDPR #SmartGlasses #EDPB #SPEProgram Subscribe to EDPO's newsletter here: https://lnkd.in/dwK8sde *This article was not written by EDPO. The opinions and views of the author(s) do not necessarily reflect those of EDPO. https://lnkd.in/dfCKkMnT

"On 17 September 2026, the European Commission published a proposal for a new EU Regulation titled the 'EU KIDS ACT – EU Keeping Internet Digital Spaces Accountable and Trustworthy'.   The proposal represents one of the most significant and wide-ranging EU legislative interventions targeting the online safety of children to date, introducing harmonised obligations across the EU on a broad set of digital services.   [...]    The Commission frames the initiative as a response to substantial online risks to minors' health, development and wellbeing, including: cyberbullying, child sexual abuse, grooming, and the mental and physical health impacts of excessive or harmful digital engagement. The Commission President, Ursula von der Leyen, emphasised that technology was not created with children’s wellbeing in mind.   The proposal follows recommendations from a Special Panel on Child Safety Online and is intended to establish EU-wide access restrictions, safety-by-design rules, and proportionate privacy-preserving age assurance, with coverage extending beyond just social media platforms to a range of other services (as further detailed below)." #Privacy #GDPR #KidsAct #AIAct #DSA Subscribe to EDPO's newsletter here: https://lnkd.in/dwK8sde *This article was not written by EDPO. The opinions and views of the author(s) do not necessarily reflect those of EDPO. https://lnkd.in/esmZZUSi

“An Anthropic AI model submitted a false tip about an unsolved murder to the Philadelphia police. The AI reportedly submitted this incorrect information to a public Philadelphia Police Department (PPD) tip line on July 18, but Anthropic didn’t discover the behavior until September 28. The police had not seen the tip because it was marked as spam. Anthropic notified the PPD about the incident on Wednesday and met with the department the following day. ‘The company must strengthen its safeguards to prevent similar incidents from impacting city systems without the city’s knowledge. The two-month delay in detecting and reporting the incident to the City is unacceptable,’ the PPD said in a statement to 6abc. [...] Anthropic subsequently published a blog post acknowledging the false tip as part of a larger pattern of its models behaving in unintended ways. In response, the company said it will cut off its internal evaluations from the live internet.” #Privacy #GDPR #RogueAI #Philadelphia   Subscribe to EDPO's newsletter here: https://lnkd.in/dwK8sde   *This article was not written by EDPO. The opinions and views of the author(s) do not necessarily reflect those of EDPO. https://lnkd.in/gUrr4yFF

EDPO travelled to Seattle, and spent 9 and 10 October attending sessions across privacy, security, risk and AI governance at the IAPP Privacy. Security. Risk. + AI Governance Global 2026. Much of the discussion reflected the US market, but several of the operational problems will be familiar on both sides of the Atlantic. AI can enter an organisation without a conventional procurement event: through a free tier, an individually expensed subscription, an integration granted broad permissions, or a new feature switched on inside software that has already been approved. In each case, the contract value may be low, or unchanged, while the data and security exposure is anything but. The better diligence questions are therefore not limited to what a tool costs but what the system can access, what it can do without supervision, whether inputs are used for training or fine-tuning, where data flows, which other models and subprocessors sit behind it, and how quickly access can be revoked. The sessions also addressed the need for more reusable AI-assurance evidence. Standards and high-level obligations exist, but organisations still spend considerable time recreating evidence pathways, while downstream actors struggle to rely on technical work already carried out upstream. Another recurring issue was the relationship between AI governance and cybersecurity. Separate programmes can result in duplicated controls, conflicting processes and gaps in ownership. When an incident involves a supplier, and the relevant systems, logs and access are outside the organisation’s direct control, roles, preservation rights, escalation contacts and secure communication channels need to be agreed before the incident occurs. For organisations operating in the EU, that preparation may also need to account for overlapping obligations under the AI Act, GDPR, NIS2 and the Cyber Resilience Act. We also heard a particularly interesting discussion on machine unlearning: the technical and legal challenge of enabling a model to verifiably “forget” specific training data, and what credible proof of unlearning might eventually look like. Thank you to the IAPP, the speakers and everyone we met in Seattle. We can’t wait to be back for next year’s edition in Vancouver. #Privacy #GDPR #IAPPpsr26 Subscribe to EDPO’s newsletter here: https://lnkd.in/dwK8sde

“The European Union's cybersecurity agency and in-house research center have each begun experimenting with open artificial intelligence models from China, three EU officials have told POLITICO. The Joint Research Centre (JRC) — the EU’s in-house scientific research center — is evaluating ‘publicly available open-weight models’ originating from China, European Commission spokesperson Maciej Berestecki confirmed. The head of ENISA, the bloc's agency responsible for cybersecurity, also said in an interview that his team was now testing Chinese AI. The experiments with Chinese models at the JRC are part of a broader research project to evaluate artificial intelligence that also includes leading models from the United States and Europe, Berestecki said. ‘Models from different origins are included in a comparative scientific evaluation of their capabilities, performance, limitations and risks,’ he said, adding that the JRC is also looking into their potential scientific applications. […] Open-weight models are those whose core components are publicly released, allowing anyone to run the model and study how it works. China’s approach to AI has leaned more towards open models than the United States. Some major U.S. tech and AI companies, including chips giant NVIDIA, are investing in open-weight models.” #Privacy #GDPR #ChineseAI #Cybersecurity Subscribe to EDPO's newsletter here: https://lnkd.in/dwK8sde *This article was not written by EDPO. The opinions and views of the author(s) do not necessarily reflect those of EDPO. https://lnkd.in/ezJkHkCr