On September 3, 2026, the CNIL imposed a fine of €500,000 on the Hôpital privé de la Loire for failing to take appropriate measures to ensure the security of its patients’ data and that of some of their relatives...
The growing significance of the right of access in day-to-day data protection practice is also reflected in emerging case law. But how far does this right actually extend – and when may a company reject a request as excessive?
Since 11 September 2026, reporting obligations under the EU Cyber Resilience Act (CRA) are applicable to manufacturers. Many companies still think of the CRA as a 2027 issue, but strict reporting deadlines already apply...
A security vulnerability in the official Pope’s prayer app Click to Pray has exposed a rather modern problem for an institution more commonly associated with centuries-old traditions...
The Polish Data Protection Authority (UODO) imposed a fine of 18,416,400 PLN (approximately 4.3 million euros) on a bank. Between April 1, 2019, and September 23, 2020, the bank...
Noyb (None of Your Business), a Vienna-based non-profit privacy rights organization, has filed a complaint against the popular dictionary platform dict.cc, accusing...
The EDPB has published an update of the One-Stop-Shop (OSS) case digest on right to object and right to erasure. This project has been developed in the framework of the Support Pool of Experts programme, which aims to support cooperation...
The ruling of the US Supreme Court in the case of Trump v. Slaughter calls into question the legality of transatlantic data transfers following its decision of 29.06.2026. The U.S. Supreme Court was to rule on the legality of President Trump's firing...
France's data protection authority (CNIL) has imposed a €5 million fine on IQVIA OPERATIONS FRANCE after finding multiple GDPR and French Data Protection Act violations relating to two large health data warehouses containing...
