735 News

Biometric timekeeping back in the spotlight: ANSPDCP fines an employer over its fingerprint clock-in system

Recently the Romanian Data Protection Authority (ANSPDCP) fined an employer RON 26,236 (approx. EUR 5,000) for using its employees' fingerprints to clock in and out and to open doors on its premises and ordered it to switch to a system that does not rely on biometrics at all. The amount is modest. The message is not: for most employers in Romania, fingerprint or face-based timekeeping is very hard to defend, and neither employee consent nor the Romanian implementing law changes that.

A new member has joined the INPLP: Migle Dewsbury (Lithuania)

MB Hexlaw (Lithuania) has joined the International Network of Privacy Law Professionals.

The CJEU’s Russmedia decision (C-492/23) and the End of Platform Exceptionalism in EU Data Protection Law

For twenty-five years, platforms have operated on a "publish first, remove on notice" model, assuming that the hosting privilege also shielded them from data protection duties. In Russmedia (C-492/23), the CJEU rejected that assumption on the plain wording of Article 1(5)(b) of the eCommerce Directive. A platform that structures and monetises user content is a controller and must build pre-publication review, identity verification and protection against scraping and copying into its architecture. These duties derive from general GDPR provisions, so they are not limited to sensitive data and require a risk assessment of all personal data a platform publishes. Platform operators must adapt or leave the field.

Deleting an Account Is Not the Same as Deleting Personal Data: Lessons from EU GDPR Enforcement

Bidding on Sensitive Data: Norway's Record Fine Against Xandr

The Norwegian Data Protection Authority (Nw.: "Datatilsynet") has, in decision 20/03541-37, imposed the largest fine in its history: NOK 92 million (approximately EUR 8.6 million) against Microsoft-owned AdTech company Xandr Inc. for unlawfully processing and sharing special categories of personal data about Grindr users through real-time bidding (RTB). The decision and the Authority's parallel public guidance illustrate its approach to programmatic advertising, joint controllership among AdTech intermediaries, and reliance on another party's consent mechanism.

INPLP reaches 60 countries: a warm welcome to Maddocks, our first member in Australia

With Maddocks from Sydney, the International Network of Privacy Law Professionals welcomes its first member firm from Australia — and is now represented in 60 countries on six continents.

Ukraine joins INPLP: a warm welcome to Legal IT Group

With Legal IT Group from Kyiv, the International Network of Privacy Law Professionals welcomes its first member firm from Ukraine. INPLP is now represented in 59 countries.

A Review of the EDPB’s Anonymization Guidelines in Light of EDPS v SRB

When, and for whom, does information constitute personal data? The Court of Justice of the European Union (CJEU) addressed this question in EDPS v SRB (C-413/23 P). Its judgment clarified the treatment of pseudonymized data but prompted further debate over implementation. The Digital Omnibus proposal sought to amend the GDPR’s definition of personal data; the June 2026 compromise text removed that amendment and reassigned the proposed pseudonymization powers to the European Data Protection Board (EDPB). Against this background, the EDPB opened its draft Guidelines 02/2026 on Anonymization for consultation on 8 July 2026. The draft reflects much of the CJEU’s reasoning but, in our view, also extends beyond it. This article follows the dispute from the initial complaints through the judgment and the EDPB’s subsequent guidance.

Read, shred and forget? New Swedish case law and the manual-processing gap in the GDPR

Swedish employers routinely ask applicants and employees to show an extract from the criminal records register (belastningsregistret). Article 10 GDPR allows criminal conviction data to be processed only under official authority or where law authorises it, which most private employers lack. In AD 2026 nr 27 (case A 156/24), the Labour Court held that an employer who merely receives, reads and destroys such an extract falls outside the GDPR altogether.

Where Space Data Lands. Ground Stations and the Reach of Data Protection Law

During 2026 the conversation about privacy in outer space has turned toward orbit itself, as proposals for orbital data centres have led scholars, practitioners and the European Parliament’s foresight service to ask whether Article VIII of the Outer Space Treaty, which keeps a space object under the jurisdiction and control of its State of registry, could make that State a digital flag state for the data processed on board. That debate deserves attention, although it overshadows a more immediate fact, which is that almost all personal data collected or relayed by satellites still comes down to Earth through an antenna located in a specific country and subject to a specific data protection law. Under the Ground Station as a Service model, in which operators book antenna passes on demand and receive the data directly in the cloud, a single satellite may land data in several jurisdictions in one day, so the question of which law applies, and to whom, is increasingly answered at the antenna, and Ecuador, whose equatorial position makes it an attractive site for ground infrastructure, offers a useful case study because its law and the GDPR reach different results for the same downlink.

The US Regulatory Landscape of “Surveillance Pricing”

Ever wonder if you’re paying more for the exact same item as another consumer? You may be. Pricing that is set for an individual consumer using that consumer’s personal data — often called “surveillance pricing” or “personalized algorithmic pricing” — has quickly moved from an interesting academic discussion and policy debate to an active compliance problem.

The Price of a Face

When a public hospital in Madeira introduced facial recognition to monitor staff attendance, it reignited a fundamental question in European data protection law: can biometric processing be justified when simpler alternatives exist? This article examines the legal framework governing biometric attendance systems under the GDPR, Portuguese law, and the EU AI Act, and argues that the principle of necessity (not technological capability) must remain the decisive test.

The CNIL's new approach to AI models Memorisation, extractability and anonymisation under the GDPR

As generative AI becomes increasingly powerful, the CNIL’s 2026 guidance shifts the GDPR debate from how personal data is used in training to whether AI models themselves can retain and reveal information about individuals. By focusing on memorisation, extractability, and anonymisation, the framework offers a practical roadmap for assessing when AI models may still pose privacy risks and therefore remain subject to European data protection law.

Brazil’s ECA Digital: Is Child Safety Now a Product Requirement?

Six months after entering into force, Brazil’s Digital Statute for Children and Adolescents (Law No. 15,211/2025) has moved from text to enforcement, and the ANPD’s age-assurance guidance is setting the practical bar. This article maps the core obligations, the six requirements behind “reliable” age assurance and what providers, in Brazil and abroad, should prioritise now.

Legal Alert: Bill Postpones Effective Date of the Personal Data Protection Law

Two regulatory developments marked the beginning of September in the area of personal data protection: the introduction of a bill seeking to postpone the effective date of the new legislation and the formal acknowledgment of the regulations on models for preventing violations.

Israel's First Administrative Fines under Amendment 13: A New Enforcement Era for Privacy Compliance

Amendment 13 to Israel's Protection of Privacy Law, 1981 (the "PPL") entered into force on 14 August 2025, giving the Israeli Privacy Protection Authority (the "PPA") — for the first time — the ability to impose meaningful financial sanctions directly on organisations that breach Israeli data protection rules. A little over a year later, the first sanctions have arrived. Between July and September 2026 the PPA published three decisions imposing fines on a health fund, a small leisure business and a municipality. Modest in amount, they are significant in signal: Israeli privacy obligations that were long treated as formalities now carry a direct price tag.

Ecuador’s Risk Management Guide for Personal Data Protection. A practical view

Ecuador’s Superintendence of Personal Data Protection has published its first risk management guide. The document is ambitious: it demands that organizations justify every assumption, calibrate expert opinion, and adopt measurable models. However, it leaves a critical question unanswered, as, what methodology should companies actually use? Unlike Spain, where proportionality and maturity guide the choice of methods, Ecuador’s guide presents multiple options without prioritization. This article argues that such neutrality, while flexible, creates practical uncertainty. It suggests that organizations should adopt a mixed model, anchored in the traditional risk matrix but enriched with qualitative rationales and, where possible, quantitative tools.

Age Assurance and Privacy: Israel’s Draft Guidance

On 11 June 2026, the Israeli Privacy Protection Authority (“PPA”) published draft guidance for public comment on online age assurance measures. The guidance is addressed to online service providers and treats age assurance as a data processing activity to be designed, assessed, and governed accordingly, rather than merely as a child safety tool. Non-compliance can attract administrative fines and civil claims.

China Implements Strict Requirements for Cybersecurity Incident Reporting

With a rising number of data breaches and cybersecurity incidents in recent years, China has rolled out stringent new rules that set clear requirements on incident reporting items, time limits and procedures for all network operators. This article provides an overview to navigate the incident reporting obligations.

Is Lithuania Finally Ready for B2B Direct Marketing? Almost.

From 1 July 2026, Lithuania's amended Law on Electronic Communications finally lifts its blanket opt-in requirement for B2B electronic direct marketing, allowing businesses to contact other businesses on an opt-out basis – joining the majority of EU member states that never imposed such a restriction in the first place. For B2C direct marketing, however, a strict six-condition regime remains immovably in place, with no room for partial compliance.

North Macedonian Administrative Court Upholds Agency Decision on Unlawful Processing of Patient Health Data

The Administrative Court of North Macedonia has upheld a decision of the Personal Data Protection Agency concerning the unlawful processing of a patient’s personal and health data within the national electronic healthcare system.

When Anonymization Fails: Readable Data in a Published Contract

A decision of the Office for Personal Data Protection of the Slovak Republic confirms that the anonymization of a document intended for publication must be technically effective, rather than merely visual. If personal data become readable after text is copied from a PDF document, the controller may be in breach of its obligation to ensure the ongoing confidentiality of personal data under Article 32(1) of the GDPR, even where contracts are subject to mandatory publication in the Central Register of Contracts.

Decree 356/2025/ND-CP: The Next Chapter in Vietnam’s Personal Data Protection Framework

Vietnam’s data protection landscape just got sharper. Decree No. 356/2025/ND-CP delivers the detailed rules businesses have been waiting for, tighter timelines, clearer roles and fewer grey areas. Now is the time for organisations to put their policies, people and data practices to the test before the new regime takes hold.

Invisible trackers in your Inbox: Italian Data Protection Authority issues binding Guidelines on email tracking pixels