On 21 July 2026, the Italian data protection authority Garante announced sanctions totalling €7.72 million across four companies involved in a single automated scoring system used to decide […]
The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, has fined Uber €824,990,000 after finding that the company relied on fully automated decision-making processes to decide [...]
Is Your “Anonymous” Data Actually Anonymous? In this article we break down the EDPB Guidelines on Anonymization and what organisations really need to know.
The Italian Data Protection Authority (Garante) has fined Lusha Systems, a US-based data broker, 2 million euros. The case provides interesting compliance lessons for any company evaluating [...]
The Italian data protection authority (Garante) has fined Piaggio & C. S.p.A. €460,000 over its handling of two former employees' company email. The decision is relevant under many aspects […]
The AI Act classifies AI systems into four risk categories. One of them covers systems that pose transparency risks, and those systems are governed by Article 50. The obligations apply [...]
On 26 March 2026, the Italian data protection authority (Garante per la protezione dei dati personali, "Garante") fined Intesa Sanpaolo S.p.A. €31,800,000. This is one of the largest fines the Garante has ever imposed, and it carries clear lessons for a [...]
The Court of Justice of the European Union (CJEU) has clarified in Brillen Rottler (C-526/24) that, in exceptional circumstances, even a first data subject access request (DSAR) may be refused as “manifestly unfounded or excessive” under Article 12 para. [...]
