FIRST PRIVACY at the Brazilian Embassy
Brazil was the partner country at this year's HANNOVER MESSE. The trade fair was opened three weeks ago by Chancellor Merz and President Lula in person. Brazil was represented more strongly than [...]
General
Microsoft Copilot: Flex Routing – Your Data Is Leaving the EU. By Default.
In April 2026, Microsoft introduced a new feature for Microsoft 365 Copilot: "Flex Routing". The name sounds harmless. The data protection implications are not. What Is Flex Routing? Flex Routing allows Microsoft to reroute Copilot AI requests to data centres [...]
Data Act Implementation in Germany: Enforcement Could be Around the Corner – Organisations Should Act Now
Germany has taken a decisive step towards implementing the EU Data Act. On 26 March 2026, the Bundestag passed the Data Act-Durchführungsgesetz (DADG), establishing the national framework for enforcement. While further legislative steps may still follow before the [...]
China's Face Recognition Regulation: What the New Rules Mean for Businesses
On 1 June 2025, China's Cyberspace Administration (CAC) brought into force the Measures for the Security Management of Face Recognition Technology Applications (the "Measures"). This landmark regulation is the first piece of dedicated legislation in Chin [...]
U.S. Data Privacy Developments in 2025 – A Year in Review
Every year at this time I sit down to write a blog article, tying the experiences that I have during the holiday season into the world of data privacy. This year I have struggled to come up with a topic that really spoke to me. But, as I sat down to write [...]
Beyond the Theory: CNIL Sanctions Under the Light of the Digital Omnibus
As the French data protection authority (Commission nationale de l'informatique et des libertés, CNIL) recently imposed two high-amount sanctions, we take this opportunity to try and make a practical application of some rules from the recently published [...]
Finally Here: The Digital Omnibus Proposal and Practical Implications for Organisations Through the Lens of GDPR
The European Commission’s Digital Omnibus Package Proposal (the Proposal) represents one of the most comprehensive realignments of the EU’s digital regulatory landscape since the introduction of the GDPR. This comes in addition to the changes the European [...]
CNIL Fines Samaritaine €100,000 for Hidden Cameras: A Legal Analysis
On 18 September 2025, the French Data Protection Authority (CNIL) issued Deliberation SAN-2025-008, imposing a €100,000 fine on Samaritaine SAS for clandestinely installing surveillance cameras in employee areas. In August 2023, in response to a rise in stockroom thefts, the company inst [...]