Email Tracking Pixels and More: Key Updates from the Italian Garante
In April 2026, the Italian Data protection Authority (Garante per la protezione dei dati personali) adopted guidelines on the use of tracking pixels in email communications [...]
Supervisory Authorities
Garante Fines Four Companies 7.72 Million Euros Over Automated Energy Credit Scoring
On 21 July 2026, the Italian data protection authority Garante announced sanctions totalling €7.72 million across four companies involved in a single automated scoring system used to decide […]
Dutch DPA Fines Uber 824.99 Million Euros for Fully Automated Driver Deactivation
The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, has fined Uber €824,990,000 after finding that the company relied on fully automated decision-making processes to decide [...]
Lusha Fined 2 Million Euros: Important Lessons About Data Enrichment
The Italian Data Protection Authority (Garante) has fined Lusha Systems, a US-based data broker, 2 million euros. The case provides interesting compliance lessons for any company evaluating [...]
Italian DPA Fines Piaggio: Lessons on Employee Rights and Email Backup Management
The Italian data protection authority (Garante) has fined Piaggio & C. S.p.A. €460,000 over its handling of two former employees' company email. The decision is relevant under many aspects […]
Are You Tracking Newsletter Conversions? This Concerns You
For years, the open rate of email communications has been treated as one of the most important numbers in marketing. Every mainstream email platform reports it, teams optimize around it, and [...]
CNIL's IQVIA Decision: The SRB Ruling Is No Free Pass
When the EU Court of Justice issued its Single Resolution Board (SRB) ruling on 4 September 2025 (C-413/23 P), many read it as a turning point. The Court confirmed that pseudonymised data can [...]
The CNIL on AI and Data Subject Information: A Practical Guide for Organizations
The information obligation on the processing of personal data is a requirement that persists whenever a processing is performed. This does not exclude the processing of personal data for the purposes of AI models or system development. Those are the cases, [...]