The signal is clear: Europe wants AI-driven innovation in healthcare — but not at the expense of data protection. What Matters • Support for scale: Regulators back efforts to streamline clinical trials and enable cross-border data use • No compromise on fundamentals:…
Spain’s data protection authority, AEPD, has fined Yoti €950,000 over its facial age-verification technology — a clear signal that biometric compliance is now under intense regulatory scrutiny. Key GDPR Breaches Identified • Unlawful processing of biometric data (special category data) • Invalid consent (not sufficiently informed,…
The EU’s Digital Omnibus initiative — aimed at simplifying digital regulations — has taken a notable turn. A leaked Council draft (Feb 2026) shows that EU member states have removed the European Commission’s proposal to redefine “personal data” under the…
DLA Piper’s latest GDPR survey reveals a 22% surge in breach notifications — the first time daily figures have crossed 400 since GDPR came into force in 2018. After years of plateau, the trend has sharply reversed. The drivers? A…
After years of complaints about slow, fragmented GDPR enforcement, Brussels is finally moving. The Council of the EU and the European Parliament had agreed on new procedural rules to streamline how national Data Protection Authorities (DPAs) handle cross-border GDPR cases…
What Actually Changed Under the new framework: • Admissibility criteria are standardized across member states • Procedural timelines are clarified, reducing year-long investigations • Simplified settlements become possible without full cooperation mechanisms • DPAs are nudged toward consistency instead of…
€1.2B in GDPR fines issued across Europe in 2025, keeping pace with 2024 and bringing total fines since 2018 to ~€7.1B. Ireland and France led enforcement, together accounting for over €1B last year. But enforcement today is about more than…
On 13 January 2026, France’s data protection authority CNIL imposed a combined €42 million fine on Free Mobile (€27M) and Free (€15M) following a large-scale personal data breach. What Happened? In October 2024, attackers accessed personal data linked to ~24…
On 5 December 2025, the European Commission imposed a €120 million fine on X (formerly Twitter) for breaching key obligations under the EU Digital Services Act (DSA) — marking the first formal non-compliance decision under the regulation. Key Findings Misleading…
The GDPR enforcement regime is entering a new phase. On 16 June 2025, the European Parliament and the Council of the EU reached a provisional agreement on new procedural rules for cross-border data protection cases. The reform aims to fix…
