CJEU: unrestricted public access to shareholder data is disproportionate

Date: September 3, 2026 | Source: Court of Justice of the EU
Link

In Case C-798/24 Jautiva, on a reference from the Constitutional Court of Latvia, the Court of Justice of the EU held that Directive (EU) 2017/1132 does not require the public disclosure of information on all shareholders of public limited liability companies, including minority shareholders, and that the Latvian rule requiring online publication of shareholder names, identification numbers, addresses, email addresses and shareholdings, downloadable in bulk and without restriction, is disproportionate under the GDPR and the Charter.

The Court accepted that business transparency, the prevention of money laundering and terrorist financing and the implementation of sanctions are legitimate objectives but found that unrestricted public access exposes data subjects to significant risks of misuse and that less intrusive means exist, such as access on demonstration of a legitimate interest. The judgment follows the line of case law on public beneficial-ownership registers.

What we recommend

If your organization obtains shareholder data from a public register, monitor changes to access rules and document the legal basis and purpose for obtaining and using the data. Collect only the necessary fields and restrict further disclosure.

Advocate General: Belgian rules on electronic communications data retention fail the necessity test

Date: September 3, 2026 | Source: Court of Justice of the EU (Advocate General)
Link

Advocate General Szpunar delivered his Opinion in Case C-661/24 Académie Fiscale and Others, on five actions before the Belgian Constitutional Court against the 2022 Belgian law on the collection and retention of identification data and metadata in electronic communications. He stated that retention of traffic and location data interferes with the rights to privacy and data protection and is permissible only where provided by law, strictly necessary and proportionate.

The Advocate General proposed that general retention may be compatible with Directive 2002/58/EC where technical safeguards ensure a genuinely watertight separation of the categories of data so that they cannot be combined during the retention period, but concluded that the Belgian law fails the test because it retains excessively broad data without such separation, leaves essential retention choices to providers and lacks clarity and safeguards.

What we recommend

This is an Advocate General’s Opinion and is not binding on the Court. Electronic communications providers and organizations operating messaging or similar services should monitor the case until the Court delivers its final judgment before making structural changes solely in reliance on the Opinion.

In the meantime, review the categories and retention periods of traffic and location data, applicable legal requirements and existing access controls. Identify whether technical segregation of retained data categories may be required if the Court follows the Opinion.

Italian DPA fines IQVIA EUR 7 million over health data that were not anonymous

Date: September 23, 2026 | Source: Garante per la protezione dei dati personali (Italian Data Protection Authority)
Link

The Garante fined IQVIA Solutions Italy S.r.l. EUR 7 million for unlawfully processing health data relating to approximately one million patients of 800 general practitioners in a database used for research and analytics. The authority found that the data were not anonymous: persistent patient codes and detailed clinical information enabled individuals to be singled out, linked over time and potentially re-identified.

The Garante treated IQVIA as a controller from the point of collection and found deficiencies in the legal basis, patient information, retention periods, data protection impact assessment and security measures. IQVIA must bring the processing into compliance within 120 days if it intends to continue the activity; alternatively, the doctors must anonymize the data independently in accordance with the safeguards specified by the authority.

What we recommend

Do not treat coded or pseudonymized datasets as anonymous without a documented assessment showing that individuals cannot reasonably be singled out, linked over time or re-identified using available additional information.

Before collecting, receiving or reusing personal data, document the parties’ controller or processor roles. Verify:

• the legal basis;
• transparency information;
• purpose limitation and data minimization;
• the retention period;
• the need for a data protection impact assessment (DPIA);
• appropriate security measures.

CNIL fines EXTIA EUR 300,000 over unhandled erasure requests

Date: September 9, 2026 | Source: CNIL (French Data Protection Authority)
Link

The CNIL fined the IT and engineering consultancy EXTIA EUR 300,000 for failing to respect the right to erasure and the information obligations under Articles 12 and 17 GDPR. The audit, carried out in April 2025 following complaints and as part of the EDPB Coordinated Enforcement Framework action on the right to erasure, found that of 265 erasure requests received in 2024, mostly from job candidates and former employees, more than three quarters had not been handled or had been handled inadequately.

Twelve requests were not processed at all, 166 people were not informed of the outcome of their request and 27 were informed late, beyond the one-month deadline. The fine reflects the number of people concerned and the fact that the company has already been reminded of its obligations twice.

What we recommend

Review the process for handling erasure requests from all data subjects: intake, identity verification, responsible persons, searches across relevant systems, applicable retention exceptions and deletion from active and backup systems.

Respond to every request within one month, including where it is refused, partly granted or the data have already been deleted. Retain evidence of the assessment, action taken and response.

Cyber Resilience Act reporting obligations now apply

Applies from: September 11, 2026 | Source: Cyber Resilience Act (Regulation (EU) 2024/2847)
Link

From September 11, 2026, the reporting obligations of the Cyber Resilience Act (Regulation (EU) 2024/2847) apply: manufacturers of products with digital elements placed on the EU market, including software such as operating systems and mobile applications, must report actively exploited vulnerabilities and severe incidents affecting the security of their products. An early warning is due within 24 hours of becoming aware, a notification within 72 hours and a final report after resolution.

Reports are submitted once through the CRA Single Reporting Platform, operated by ENISA and launched on September 11, 2026. The platform forwards them to the competent CSIRTs. For manufacturers with their main establishment in Lithuania, the coordinating CSIRT is NKSC. Prior registration on the platform is not required and can be completed when the first early warning is submitted. The obligation also covers products already on the market, but exploitation known before September 11, 2026, need not be reported. The main CRA product requirements apply from December 11, 2027, and open-source software stewards become subject to reporting on the same date.

What we recommend

If your organization develops or supplies software, apps, connected products or components, assess whether it is a manufacturer under the CRA and identify the products and legal entities within scope.

For in-scope products, establish a reporting procedure covering internal escalation, assessment, approval and submission within the applicable 24-hour, 72-hour and final-report deadlines. Coordinate with any DORA, NIS2 and GDPR notification duties that apply.

Ensure supplier and development contracts require timely vulnerability and incident information needed to meet CRA reporting deadlines.

Advocate General: marketing consent must identify the company sending the message

Date: September 17, 2026 | Source: Court of Justice of the EU (Advocate General)
Link

Advocate General Spielmann delivered his Opinion in Case C-317/25 Groupe Canal+, arising from a CNIL fine of EUR 600,000 for electronic direct marketing to about 3.9 million people whose contact data had been obtained from two internet service providers. The subscribers had consented to marketing by the providers’ “partners” without being told which companies those partners were.

The Advocate General considered that valid consent requires the data subject to know the identity of the controller that will use the data; where the partners are not identified at the time of collection, the data subject cannot expect to be contacted by any particular company, so fresh consent must be obtained before the marketing takes place, at the latest at the time of the first communication. An opt-out offered after the campaign has started cannot cure the defect.

What we recommend

If contact details obtained from a partner, data broker or lead generator are used for electronic marketing, verify that the consent specifically identified the organization sending the message. If not, obtain valid consent before the first communication.

Keep evidence of consent and ensure that partner arrangements require notification of withdrawals and objections and the suppression of contacts that may no longer be used.

European Commission proposes the EU KIDS Act on children’s access to social media

Date: September 17, 2026 | Source: European Commission
Link

The European Commission adopted the proposal for an EU KIDS Act, a regulation restricting access by children to social media platforms. The proposal prohibits platforms from giving access to children under 13 and sets an EU-wide minimum age of 15 for opening an account independently, while placing the burden on platforms to demonstrate that their services are age-appropriate and safe by design.

The proposal builds on the Digital Services Act and is intended to give parents more control over children’s online experience. Age-verification methods, enforcement timelines and penalties will be settled in the legislative process.

What we recommend

Providers of social, community, video-sharing, gaming, AI chatbot or similar services used by minors should assess whether they fall within the proposed scope and review age gates, parental controls, default settings and child-safety measures.

Where age assurance is used, collect only the personal data necessary to confirm age and reflect the processing in privacy information, the DPIA where required and supplier arrangements.

Irish DPC fines Google EUR 403 million over location data

Date: September 21, 2026 | Source: Data Protection Commission (Ireland)
Link

The Irish Data Protection Commission announced its final decision in the inquiry it had initiated into Google Ireland Limited’s processing of location data in the “Web & App Activity”, “Location History” and “Location Accuracy” features between May 25, 2018, and February 4, 2020, imposing administrative fines totaling EUR 403 million and ordering Google to bring its processing into compliance within six months.

The DPC found infringements of the lawfulness and fairness principles for Web & App Activity and Location History, of accountability for Location Accuracy, of transparency for all three features and of storage limitation through excessive retention of location data. The inquiry was opened in February 2020 following complaints by consumer organizations including BEUC, and the decision was adopted after cooperation with the concerned supervisory authorities under the one-stop-shop mechanism.

What we recommend

If location data are used, document the legal basis, necessity and retention period for each purpose or feature.

Explain at the point of activation what location data are collected, for which purposes, how account and device settings interact and how long the data are retained.

ENISA Threat Landscape 2026: ransomware and supply-chain risks remain at the top

Date: September 22, 2026 | Source: ENISA
Link

ENISA published the Threat Landscape 2026, covering incidents from January 1 to December 31, 2025. Ransomware remains the most disruptive threat, combining encryption, data theft and extortion. Social engineering, in particular phishing supported by phishing kits and the ClickFix technique, remains the main route to initial compromise. Exploitation of known or zero-day vulnerabilities accounted for 60 percent of unauthorized-access incidents. More than 48,000 new vulnerabilities were disclosed in 2025, a 22 percent annual increase.

Public administration was the most targeted sector (32 percent of incidents, largely ideology-driven DDoS), followed by business services (8 percent), transport (8 percent), manufacturing (7 percent) and finance and banking (6 percent). Seventy-three percent of targeted organizations fall within the NIS2 definitions of essential or important entities. The report highlights supply-chain and third-party dependencies as the source of the largest incidents and notes that online investment fraud alone cost about EUR 4 billion in the EEA in 2024.

What we recommend

Use the ENISA report as an external input to the organization’s ICT and cybersecurity risk assessment. Prioritize ransomware, supply-chain and third-party compromise, and exploitation of internet-facing vulnerabilities.

Update phishing training for ClickFix-style techniques, test incident procedures and review patching and supplier-remediation deadlines.

VDAI publishes a summary of 2025 court decisions on its complaints

Date: September 30, 2026 | Source: VDAI (State Data Protection Inspectorate, Lithuania)
Link

VDAI published a summary of the significant court decisions of 2025 in administrative cases arising from complaints handled by the Inspectorate, covering rulings of the Supreme Administrative Court of Lithuania (LVAT) and the Regional Administrative Court. The summary addresses the Inspectorate’s discretion in choosing corrective measures, the lawfulness of video surveillance, the processing of personal data to comply with a legal obligation or to collect service fees, and other recurring questions.

The summary is published in the “Court decisions (based on VDAI complaints)” section of the VDAI website and is the most direct indication of how Lithuanian courts test VDAI decisions and fines on appeal.

What we recommend

If your organization carries out video surveillance, debt collection, service-fee recovery or processing based on a legal obligation, compare its practices and documentation with the court summary and update them where the courts’ reasoning differs.

When responding to a VDAI investigation or considering an appeal, assess the evidence supporting the legal basis, necessity and safeguards and the proportionality factors relevant to the corrective measure.

EDPB consults on draft guidelines on administrative fines

Date: September 21, 2026 | Source: EDPB
Link

At its September plenary, the EDPB adopted draft guidelines on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR for public consultation. The consultation is open until November 13, 2026. The draft fining guidelines are intended to replace the former WP29 guidelines on administrative fines and complement the 2023 guidelines on the calculation of fines.

Under the draft guidelines, data protection authorities should follow a five-step method:

1. Determine whether the infringement may result in a fine under the GDPR or national law.
2. Determine whether the party under investigation may be fined for the provision breached.
3. Establish whether the infringement was intentional or negligent.
4. Assess aggravating and mitigating factors, with a reprimand generally available for minor infringements and a strong presumption of a fine for non-minor infringements.
5. Determine whether a fine would be effective, proportionate and dissuasive.

The draft also describes other corrective measures and provides 14 practical examples.

For companies, the draft’s approach to negligence is particularly relevant: actual awareness of a GDPR infringement is not necessarily required where the organization could not have been unaware of the risk and, acting with due care, should have identified it. Previous infringements may be treated as aggravating factors, including infringements of a different nature. Repeated minor failures may indicate a systemic compliance problem and support the imposition of a fine. Prompt and voluntary remediation, including timely notification, compensation of affected persons where appropriate, and additional technical or organizational measures, may materially reduce the likelihood or severity of corrective action.

What we recommend

Use the draft guidelines to review how GDPR risks and remedial actions are documented. A company may be considered negligent where it should have identified the risk even if it did not actually recognize the infringement.

Keep records of previous infringements and recurring control failures. After an incident, document prompt notification where required, remediation and measures taken to prevent recurrence, as these factors may affect the supervisory authority’s response.

EDPB adopts final guidelines on the interplay between the DSA and the GDPR

Date: September 17, 2026 | Source: EDPB
Link

The EDPB adopted the final version of Guidelines 3/2025 on the interplay between the Digital Services Act and the GDPR following public consultation. The guidelines are addressed to providers of intermediary services, including online platforms, very large online platforms (VLOPs) and very large online search engines (VLOSEs), that must comply with both the DSA and the GDPR.

The guidelines clarify that the DSA advertising-transparency requirements supplement the GDPR information obligations. The DSA prohibits advertising based on profiling using special categories of personal data under Article 9 GDPR, even where the processing might otherwise have a legal basis and an Article 9 derogation under the GDPR.

They also address transparency of recommender systems, content moderation, account suspension and the protection of minors. Age-assurance measures should be proportionate and should not require more personal data than necessary.

What we recommend

If automated content removal or account suspension is used, assess whether Article 22 GDPR applies and provides human review and an effective challenge process where required.

Platforms displaying user advertisements should assess their controller or joint-controller role and prevent advertising or profiling based on special-category data.

Review recommender systems and age-assurance measures for transparency, data minimization and safeguards for minors.

Our view

Before reusing data from partners, public registers or external providers, review the legal basis, the information given to individuals and any limits on further use. According to the Advocate General, consent to marketing must name the organization that sends the message, so contacts obtained from partners may need fresh consent. The Court has yet to rule.

The EXTIA case resulted in a EUR 300,000 fine after more than three quarters of erasure requests were left unhandled or handled inadequately. The EDPB’s draft fining guidelines explain how overlooked risks and repeated failures may affect enforcement. An organization that should have identified a risk may be negligent even if it never noticed the infringement. Repeated minor failures can point to a systemic problem. Prompt, documented remediation can reduce the likelihood or severity of corrective action. Start with processes that generate repeated complaints or leave requests unresolved. Test a sample of requests from receipt to final response and record who is responsible for fixing each gap.

Test CRA reporting procedures before a reportable vulnerability or incident occurs. Legal, security and product teams should know who assesses the vulnerability or incident, obtains information from suppliers and submits the required reports. Proposals such as the EU KIDS Act and Advocate General opinions are worth tracking now, but implementation decisions should reflect their legal status.

How ECOVIS ProventusLaw can help

For the issues covered in this edition, we can assist with:

• Data subject rights: We prepare or review your procedures for handling erasure and access requests, from receipt to final response.
• Anonymization and data sharing: Based on your process documentation, we assess whether data can be treated as anonymous under the GDPR and define controller and processor roles. We also prepare data-sharing agreements and data protection impact assessments (DPIAs).
• Cyber Resilience Act readiness: We assess whether the CRA applies to your products. We also prepare reporting procedures for the 24-hour, 72-hour and final-report deadlines, coordinated with NIS2, DORA and GDPR reporting duties, where applicable.
• GDPR audits and remediation: We run gap analyses and prepare remediation plans and records that show what was fixed and when.
• VDAI investigations and appeals: We represent clients in VDAI investigations and in challenging the Inspectorate’s decisions before the Lithuanian administrative courts.

Contact our team to discuss a specific process, planned use of data or regulatory finding.

Why ECOVIS ProventusLaw

Our technology team advises on data protection and DORA requirements, including ICT risk management, incident reporting, ICT third-party risk and digital operational resilience testing. This is our advantage: one team covers both data protection and operational resilience, so your procedures and reports stay consistent.

The firm is ranked by IFLR1000 for M&A, Financial services regulatory, and Banking and finance. The Legal 500 ranks the firm for TMT, Tax, Real estate and construction, Fintech, Employment, Dispute resolution, and Banking, finance and capital markets. The firm is also ranked by Chambers and Partners in its FinTech and Europe guides.

Data protection and ICT are a core part of our fintech practice. Credit institutions, payment and e-money institutions and other fintech companies deal with GDPR and DORA every day. Read more in our insight on data protection in fintech companies. We also work with telecommunications, defense technology and logistics businesses.

Our advice is practical. We prepare procedures your teams can use, documents that match how your systems work, and evidence you can show a supervisory authority.

ECOVIS ProventusLaw operates across Lithuania, Latvia and Estonia and is part of the ECOVIS International network, present in more than 90 countries worldwide. This allows us to support clients on cross-border processing and multi-jurisdictional matters.

The post RegRally Insights: Personal Data Protection & ICT Regulation, October 2026 appeared first on ECOVIS ProventusLaw.

The September edition of RegRally covers the data protection and information and communication technology (ICT) developments of August that matter most to businesses processing personal data in Lithuania and across the EU.

This month at a glance

• Automated decisions: the Dutch Data Protection Authority fined Uber nearly EUR 825 million under Article 22 GDPR for deactivating drivers by automated decision-making without meaningful human intervention.
• Retention and erasure: noyb sent SCHUFA a cease-and-desist letter over an alleged shadow database, demanding genuine erasure, complete access responses and transparency, and opened an interest list for a possible class action.
• Video surveillance: Lithuania’s National Cyber Security Centre (NKSC), together with the Second Investigation Department under the Ministry of National Defence (AOTD) and the State Security Department (VSD), published recommendations on the secure use of video surveillance cameras.
• Plain-language GDPR: VDAI published material explaining data protection requirements in accessible language, useful for internal policies, staff training and privacy notices.

Uber’s EUR 825 million GDPR fine for automated decisions

Date: 21 August 2026 | Source: Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
Link | Link

What happened?

On 21 August 2026, the Dutch Data Protection Authority fined Uber EUR 824,990,000, nearly EUR 825 million, for the fully automated deactivation (blocking) of drivers. It is one of the largest GDPR penalties ever issued.

The decision turns on Article 22 GDPR. Drivers were deactivated by automated decision-making with no meaningful human intervention, and without the safeguards and transparency that provision requires for decisions producing legal effects or similarly significantly affecting data subjects.

Why does it matter for businesses?

The decision is significant for organizations using AI-supported or other algorithmic decision-making tools affecting individuals, including in HR, onboarding, offboarding, fraud prevention, compliance, risk scoring and account termination. It also confirms that regulators will treat the absence of genuine human review as a substantive breach of Article 22 GDPR rather than a mere procedural defect.

Recommended actions

Businesses using automated decision-making should:

• prepare an inventory of the decisions the organization makes about individuals without human involvement, for example blocking an account, terminating a contract or refusing a client on risk grounds
• assess for each whether Article 22 GDPR allows it to be taken on a fully automated basis
• make sure the human review behind an automated decision is genuine and can be evidenced: the reviewer should see the underlying data, have authority to change the outcome and leave a record of the review
• remember that a formal sign-off alone does not meet the Article 22 GDPR standard, as this was the central failing in the Uber decision
• check that privacy notices tell individuals when a decision about them is automated and what logic is involved
• keep a working procedure through which individuals can contest an automated decision and obtain human review, and document the safeguards in writing

SCHUFA and the GDPR: retention, erasure and access requests

Date: 26 August 2026 | Source: noyb (European Center for Digital Rights)
Link

What happened?

On 26 August 2026, noyb sent a cease-and-desist letter to the German credit information agency SCHUFA over an alleged shadow database and opened an interest list for a prospective class action. noyb demands that SCHUFA stop storing data beyond its own published retention periods, provide affected individuals with their historical data in response to access requests under Article 15 GDPR, and ensure transparency about its processing practices.

SCHUFA rejected the demands, so noyb has confirmed it will file for an injunction, and an interest list has been opened for a possible damages class action.

Why does it matter for businesses?

The dispute turns on retention and genuine erasure, and on the completeness of access responses. The allegation is that records which should have been deleted are only hidden from view and still used, including to develop and test scores.

Recommended actions

Businesses holding personal data should:

• map every dataset in which the organization holds personal data, including archives, backups and historical records
• check that the retention period the organization itself publishes is actually applied, and that data is genuinely erased at the end of that period, not merely hidden from everyday view while remaining available for other uses
• make sure responses to access requests under Article 15 GDPR cover all personal data held about the individual, including archived and historical records, not only what appears in the active system
• state in the privacy notice how long each category of data is kept and on what basis
• where historical data is reused for a further purpose, for example to develop or test scoring models, confirm that the further use has its own lawful basis and is disclosed to the individuals concerned

Video surveillance cameras: security recommendations from Lithuanian authorities

Date: 26 August 2026 | Source: National Cyber Security Centre (NKSC)
Link | Link

What happened?

On 26 August 2026, NKSC, AOTD and VSD jointly published recommendations on the secure use of video surveillance cameras, framing the issue as running from privacy to national security. The authorities stress that even a single unprotected camera can serve both as a source of valuable information and as an access point into the whole network of a home, company or organization.

Cameras deployed for security and monitoring are themselves attractive targets. Attackers who gain access can collect sensitive information for criminal purposes or in the interests of foreign states. The authorities point to the Dutch intelligence services’ July 2026 disclosure of systematic Russian digital espionage operations exploiting internet-connected cameras in the West and in Ukraine, where intercepted video feeds were used to identify military vehicle routes, weapons delivery routes and troop positions.

Why does it matter for businesses?

Poorly configured or unpatched devices create both a personal data exposure and a national security exposure. For businesses, camera security raises both GDPR and ICT security issues. The guidance also highlights the growing focus of public authorities on supply-chain security risks associated with connected devices and surveillance technologies.

Recommended actions

The baseline recommendations issued by the authorities are in substance the following:

• change the factory administrator password on every device to a strong and unique password that is not reused across units, and change it periodically
• update camera software and firmware regularly, and do not use devices the manufacturer no longer supports, replacing them with newer equipment from reliable manufacturers
• make sure there are no abandoned or unmonitored cameras still connected to the network
• where there is no genuine need, do not allow the camera to be reached directly from the internet. For remote access use only the manufacturer’s recommended solution or a VPN, and keep surveillance equipment in a separate network segment
• do not install or upgrade to surveillance equipment from untrusted manufacturers, in particular devices produced in China, Russia or Iran
• use features such as partial blurring where the image may otherwise reveal sensitive information, for example GPS location, and limit the camera’s field of view so that it does not capture excessive detail, such as an exact address, or confidential detail, such as computer screens or documents
• monitor whether cameras that do not belong to the organization have appeared on its property or are pointed at it
• include camera systems in the assessment of security of processing under Article 32 GDPR and, where the organization is subject to ICT rules such as the NIS2 Directive or the Digital Operational Resilience Act (DORA), also in its ICT risk management and incident reporting arrangements

VDAI explains data protection in plain language

Date: 28 August 2026 | Source: State Data Protection Inspectorate (VDAI)
Link

What happened?

On 28 August 2026, VDAI published material explaining data protection requirements in plain and accessible language, as part of its ongoing effort to make GDPR obligations comprehensible to controllers and data subjects.

Why does it matter for businesses?

The material shows how the Inspectorate itself explains key GDPR principles, and is useful when reviewing internal policies, staff training materials and privacy notices.

Recommended actions

Businesses processing personal data should:

• review the Inspectorate’s material and circulate it internally to the staff who handle personal data
• use it as a reference when reviewing internal policies, staff training materials and privacy notices

What should businesses take from this month’s developments?

The Uber decision is relevant to any business that uses automated decisions about individuals. If an account can be blocked, a contract terminated or a client refused without a person genuinely reviewing the decision, human review has to be real, evidenced and capable of changing the outcome.

Retention promises have to be kept in practice. The SCHUFA dispute turns on exactly that pattern: data kept beyond published retention periods, hidden from everyday view but still in use, and access responses that stop at the active system.

Camera systems can raise both data protection and ICT security issues. They belong in the Article 32 GDPR assessment of security of processing, and, for organizations under the NIS2 Directive or DORA, in ICT risk management and incident reporting arrangements.

How ECOVIS ProventusLaw can help

ECOVIS ProventusLaw advises businesses on telecommunications, IT and data protection matters, including GDPR compliance, automated decision-making, retention and erasure practices, privacy notices and the ICT requirements applying to connected devices.

For financial institutions, our team also covers data protection in fintech companies. As your legal advisors, we will be happy to assist with all questions related to these developments, including legal advice as well as the revision and preparation of your internal documents.

The post RegRally Insights: Personal Data Protection & ICT Regulation, September 2026 appeared first on ECOVIS ProventusLaw.

The European Commission’s Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act (20 July 2026), and the accompanying Code of Practice on Transparency of AI-generated Content – what they mean in practice, and when AI-generated content must be marked and labeled.

Summary

• Four duties, two owners. Providers must design interactive systems to disclose themselves (Article 50(1)) and embed an invisible, machine-readable mark in synthetic output (Article 50(2)); deployers must notify people exposed to emotion-recognition and biometric categorization systems (Article 50(3)) and add a visible label on deep fakes and on public-interest text (Article 50(4)). The duties are cumulative, none discharges another, and the same organization frequently owes several.
• Not every AI output has to be marked. Standard editing and minor alterations, AI translation, formatting, source code, single words and captions, machine-to-machine data, and genuine closed-loop internal B2B material all fall outside the scope of duty. That is where most of the practical relief lies.
• AI-generated or manipulated public-interest text deserves particular attention. AI-touched investor and sustainability reports on a company website need a visible label unless genuine human review and editorial responsibility are both documented – and that exception collapses the moment AI edits the text after editorial sign-off.
• Article 50 does not stop at the EU border. A provider or deployer established outside the EU owes the same duties where the output of its system is foreseeably used in the Union – so a third-country group entity generating content targeted at EU audiences is in scope.
• A label is not a license. Marking and labeling answer the question “is this AI?”, not “is this allowed?”. A properly labeled deep fake can still be unlawful on other grounds, and a 50(3) notice does not legitimize a deployment prohibited under Article 5 or unlawful under data protection law.
• One deadline has passed, one is coming – and the fines are real. Chatbot and voice-assistant disclosure under Article 50(1) has been required since 2 August 2026, with no grandfathering; providers of generative systems already on the market have until 2 December 2026 to bring Article 50(2) marking into conformity. Non-compliance amounts to EUR 15 000 000 or 3% of the total worldwide annual turnover, whichever is higher, with RRT supervising in Lithuania.

Since 2 August 2026, a new layer of Regulation (EU) 2024/1689 (the “AI Act”) applies to almost every business that lets customers talk to a chatbot, generates images or text with artificial intelligence (AI), or edits media with AI tools.

Article 50 of the AI Act imposes a set of transparency obligations: people must be told when they are dealing with AI, and AI-generated or manipulated content must be marked and, in defined cases, visibly labeled. On 20 July 2026, the European Commission (the “Commission”) adopted detailed Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act (the “Guidelines”), complemented by the Code of Practice on Transparency of AI-generated Content (the “Code of Practice”).

The Guidelines are non-binding – only the Court of Justice can give an authoritative interpretation of the AI Act – but they are the clearest practical map of what is in scope, what is out of scope, and who has to do what.

This article walks through the four obligations, with the emphasis on the question clients actually ask: what has to be marked or labeled as AI, and by whom? It pays particular attention to the financial market and its participants – banks, payment and electronic money institutions, investment firms, crypto-asset service providers, insurers and listed issuers – for whom AI-touched investor communications, corporate and sustainability reports, client-facing chatbots, marketing content and biometric onboarding tools sit squarely inside Article 50, on top of the disclosure and conduct duties they already owe under financial services regulation.

The four obligations at a glance

Article 50 contains four distinct transparency duties, each attaching to a different type of AI system or output, and each falling on either the provider (the entity that develops the system and places it on the market under its own name) or the deployer (the entity that uses the system under its own authority, unless the use is purely personal and non-professional). The distinction matters because the same organization can be both at once – for example, a firm that builds an in-house generative tool and then uses it to produce deep fakes wears both hats. The deployer side reaches wider than most clients assume: businesses, public-sector bodies, media outlets, advertising and marketing agencies, and any other legal or natural person using AI content in a professional or economic activity – including influencers monetizing social media. Purely personal, non-professional use is outside Article 50 altogether.

• Article 50(1) – interactive AI. The provider must design the system so that a person is informed that they are interacting with an AI. Think chatbots, voice assistants, and AI agents.
• Article 50(2) – marking of synthetic content. The provider must ensure that AI-generated or manipulated audio, images, videos, or text are marked in a machine-readable format and detectable as artificial.
• Article 50(3) – emotion recognition and biometric categorization. The deployer must inform people exposed to such a system that it is operating.
• Article 50(4) – deepfakes and certain text. The deployer must clearly and visibly label deepfakes and AI-generated or manipulated text published to inform the public on matters of public interest.

A single system can trigger several of these at once. An image generator embedded in a chatbot engages 50(1) and 50(2) for the provider; if the deployer uses it to create a deep fake, 50(4) applies on top. The obligations are cumulative, not alternative.

Article 50 does not stop at the EU border. A provider or deployer established outside the EU is caught where the output of its AI system is used in the Union – so a third-country group entity generating content that is disseminated to, or targeted at, EU audiences owes the same duties as an EU actor. The trigger is foreseeable use of the output in the Union: a deployer who directs or authorizes EU distribution, including by posting deep fakes on the open internet, is in scope, whereas purely incidental or unforeseeable downstream use that reaches the Union through channels outside the actor’s control is not.

Two kinds of “marking” – and why the difference matters

The word “marking” serves two very different functions in Article 50, and conflating them is the most common source of confusion. It is worth pinning down the distinction before going further.

Machine-readable marking (Article 50(2)) is invisible plumbing. It is a technical signal – a watermark, metadata, a cryptographic provenance tag, a fingerprint – embedded in the content so that software can later identify it as AI-generated. It is the provider’s job, and it applies to essentially all synthetic audio, image, video and text output of the system.

Visible labeling (Article 50(4)) is a disclosure a person can see or hear – a caption, a banner, a spoken statement – telling the audience that a deep fake or a public-interest text is artificial. It is the deployer’s job, and it applies to a much narrower set of content.

The Guidelines are explicit that these do not substitute for one another. A deployer cannot discharge the 50(4) labeling duty by pointing to the provider’s machine-readable mark, because that mark is not perceptible to the ordinary viewer without special tools. Conversely, a visible label does not relieve the provider of the duty to provide a machine-readable marking under 50(2).

What must be marked under Article 50(2)

This is the obligation with the widest reach, and the one clients most often ask about. It applies where all of the following are true: the system is an AI system; it generates or manipulates synthetic content; the content is audio, image, video or text (an exhaustive list, but one that includes multimodal, 3-D, and virtual and augmented reality (VR/AR) output); and none of the exceptions applies.

Crucially, content does not have to be wholly AI-generated to count. Content mixed with human-created material still qualifies as synthetic if the AI-generated or manipulated part falls within one of the four modalities. “Generation” means creating new material (an AI-drawn image, a synthesized song); “manipulation” means altering existing content beyond standard editing (a face swap, a voice clone).

Marking is only half of it. Article 50(2) imposes two cumulative duties: the provider must mark the output in a machine-readable format and ensure a means of detection is available to the people exposed to it, one that returns a human-readable result indicating whether the content is AI-generated or manipulated. A mark that no one can read back is not compliance. Where the provider relies on another actor for detection, it remains responsible for ensuring that the solution works and that the result is clearly shown at first exposure.

In scope – must be marked

• AI-generated summaries of text, or paraphrasing/rewriting that changes style, structure or meaning.
• Removal, replacement or insertion of objects or persons in images and videos that change the substance; face replacement or substantial facial modification.
• Synthesis of a specific person’s voice, or a realistic video of events that did not occur; altering a person’s body shape or skin color.
• Composite images or clips that modify the depiction of persons, objects, events or facts.
• AI agent output that is perceptible to a person as audio, image, video or text.

Out of scope – no marking required

The Guidelines carve out a long list of things that do not have to be marked, which is just as useful to know:

• Standard editing and minor alterations – grammar and spell-checking, minor stylistic polishing, AI-generated translations, formatting and format conversion, noise reduction, minor cropping or color correction, red-eye removal, background blurring, video stabilization, and converting black-and-white to color.
• Non-substantial changes – anything that does not significantly alter the input data or its meaning, style or intent.
• Source code – code in any programming, scripting, markup, query or configuration language (including SDKs, SQL, YAML, JSON, APIs), and integral comments.
• Very short outputs – single words, image captions, alt-text, UI labels, icon-scale graphics.
• Machine-to-machine output processed automatically and never perceived by a person; internal analytical extraction and structuring of data; mere reproduction, ranking or arrangement of existing content (playlists, recommender systems).
• Closed-loop and industrial output – strictly technical, business-to-business (B2B) output, perceived only by a limited pre-defined set of professionals inside the organization, not shared externally, with appropriate safeguards. Real-time ephemeral content (e.g. in games or VR) consumed immediately and not stored may also be exempt where marking is not technically feasible, and an in-experience notice is provided.
• Law enforcement use authorized by law to detect, prevent, investigate or prosecute criminal offences.

The technical solution must be effective, interoperable, robust and reliable, as far as technically feasible and in line with the state of the art. Providers may rely on an adequate Code of Practice to demonstrate compliance; those who do not adhere to one must provide equivalent alternative measures and should expect closer scrutiny and more information requests.

What must be labeled under Article 50(4)

This obligation sits on deployers and concerns visible, perceivable disclosure. It has two limbs.

Deepfakes

A “deepfake” is AI-generated or manipulated image, audio or video content that (i) appreciably resembles (ii) an existing (iii) person, object, place, entity or event, and (iv) would falsely appear to a person to be authentic or truthful. “Existing” is read broadly: something that exists, plausibly could exist, or could have plausibly existed. Content that defies physics or biology – a dragon, an elephant driving a car – is not a deepfake, because it cannot mislead.

Minor or cosmetic AI manipulation of existing content does not make it a deepfake in the first place, where the change has too little effect on how a viewer perceives the content’s authenticity or truthfulness – for example, editing out a background passer-by, adjusting lighting or color, noise reduction, re-scaling or file compression. This is a threshold question, not an exemption: such content is simply not a deep fake, so no labelling duty arises. Whether a given edit stays on this side of the line is context-dependent: the Guidelines contrast these cosmetic operations with substantial AI editing of journalistic images, where the expectation of authenticity is high enough that a similar change may affect perceived authenticity and cross into deep fake territory.

The fourth criterion is assessed objectively and in context; the deployer’s intention to deceive is not required. Where the foreseeable audience does not expect the content to be authentic – for instance, standard special effects in a movie – the content may not “falsely appear” authentic and so falls outside the definition. But fully AI-generated actors, digital replicas of real or deceased actors, de-aging, or non-authentic depictions in documentaries generally will be deepfakes.

Deepfakes must be clearly and distinctly labeled. A lighter regime applies to content that is evidently artistic, creative, satirical, fictional or analogous: the disclosure need only be made in a manner that does not hamper enjoyment of the work, but disclosure is still required, and the “evidently” threshold is read strictly. Two limits keep this regime narrow. Where content mixes an informative and a creative character, the informative character prevails labeling, and full labeling applies; and the lighter regime is, in any event, subject to appropriate safeguards for third-party rights, so it is no justification for disregarding data-protection or intellectual-property obligations.

Public-interest text

AI-generated or manipulated text published to inform the public on matters of public interest must also be labeled. “Published” means accessible to an indeterminate, fairly large group; “public interest” covers politics, public administration, justice, fundamental rights, public health and safety, the environment, consumer safety, and economic, financial, scientific or cultural developments meriting public debate.

There is an important exception: text that has undergone genuine human review or editorial control and for which a natural or legal person holds editorial responsibility need not be labeled. Both conditions are cumulative. A superficial spell-check, an automated review, or a mere editorial policy will not do – the review must engage with the substance, and fact-checking is the minimum. If AI makes any substantive change after editorial sign-off, the exception falls away.

For a regulated financial entity, note the concrete examples the Guidelines give as in scope: AI-manipulated corporate reports containing investor information on a listed company’s website, and AI-generated sustainability reports – both of which need labeling unless the human-review/editorial-responsibility exception is satisfied. Conversely, an AI-manipulated advice text prepared by a consultant for a single client on regulatory compliance is not “published” and falls outside 50(4).

How to label in practice

Article 50 does not dictate wording. The Code of Practice does the practical work: the AI Office has published three EU icons – AI involved, fully AI-generated, and human content modified by AI – free to use, and testing showed that an icon on its own is not enough. The icon plus a few plain words are what people actually understand. “AI” is the only abbreviation to use.

What that looks like in practice. An icon and “Image created with AI” in the caption of a social media post – not in the small print. A spoken line in the first seconds of a podcast produced with a synthetic voice. A badge at the top of an AI-drafted news summary, not in the website footer. A mark that stays in the corner of the screen while an AI presenter is speaking. Give the icon alt text so a screen reader conveys it, leave a temporary label up long enough to be read, and use the same icon and the same words everywhere.

A label is not a license. The Guidelines are emphatic that complying with Article 50 does not make the content or its use lawful. A properly labeled deep fake can still be unlawful on other grounds – child sexual abuse material, non-consensual intimate imagery, trademark or copyright infringement, misleading advertising – and a 50(3) notice does not legitimize an emotion-recognition deployment that is prohibited under Article 5 or unlawful under data protection law.

Marking and labeling answer the question “is this AI?”, not “is this allowed?” The two assessments are separate.

The other two obligations, briefly

When must a chatbot tell users that they are interacting with AI?

Providers of systems that interact directly with people – chatbots, voice assistants, AI companions, AI agents – must design them so the person is told they are dealing with AI, at the latest at the first interaction. The disclosure must be clear and in context: a first-turn message, a spoken statement, a persistent badge. Burying it in terms and conditions, or relying on a vague reference to an “assistant” or “this system uses LLMs”, is not enough.

There is an obviousness exception – no disclosure is needed where it would be obvious to a reasonably well-informed, observant and circumspect person that they are dealing with AI. But the Guidelines read this narrowly: general awareness that chatbots exist does not mean people recognize them in a given interaction, and the exception is unavailable where vulnerable groups (children, the elderly, the less digitally literate) may be exposed. A professional-only internal helpdesk assistant may qualify; a public-facing helpdesk chatbot generally will not.

AI agents carry an extra layer. An agent must disclose not only its artificial nature but also the person on whose behalf it acts, reflecting the need for transparency regarding both its origin and delegated authority. Where the provider cannot know in advance whether an agent will meet a natural person, it must be designed to disclose itself in every situation where interaction with a person is reasonably likely, including in multi-agent chains where another agent is the one facing the person. Agents should also re-disclose to the person instructing them at key steps such as authorization, reporting and validation, and at every new interaction.

Emotion recognition and biometric categorization – Article 50(3)

Deployers of these systems must inform the people exposed to them that the system is operating – for example, a notice at the entrance to a space where facial images are captured to infer age, or a pop-up before a game that reads the player’s emotions. This applies whether the system runs in real time or after the fact, and to any biometric categorization system (unless outright prohibited under Article 5).

Timing, accessibility and penalties

Whatever the obligation, Article 50(5) requires the information to be given clearly and distinguishably, at the latest at the first interaction or exposure, and in an accessible format. “First exposure” means the start of a video featuring a deepfake, the start of a public-interest text, or the moment a person scrolling through social media encounters the content. Where children are foreseeably in the audience, the disclosure must be child-friendly and age-appropriate.

Non-compliance is not trivial. Fines can reach EUR 15 000 000 or 3% of total worldwide annual turnover, whichever is higher (EU institutions face up to EUR 750 000; small and medium-sized enterprises (SMEs) and start-ups face the lower of the two figures). Enforcement sits with national market surveillance authorities, the AI Office for systems based on general-purpose AI (GPAI) models, and the European Data Protection Supervisor (EDPS) for EU institutions.

In Lithuania, the Communications Regulatory Authority (RRT) has already issued public guidance of its own on when AI-generated content must be marked and when it need not be – an early signal that the national supervisor intends to engage with these obligations actively rather than wait for complaints.

On timing of application: Article 50 has applied since 2 August 2026 to all in-scope systems on the market on that date, regardless of when they were placed. A targeted grandfathering rule under the AI Omnibus gives providers of existing generative systems until 2 December 2026 to bring the 50(2) marking into conformity – but the 50(1) interaction disclosure had to be in place by 2 August 2026. Content generated before 2 August 2026 need not be marked or labeled retroactively, but pre-existing text published on or after that date does need labeling.

What should businesses pay attention to?

Four practical points to act on:

• Separate the two “markings”. Providers owe invisible, machine-readable markings on synthetic output (50(2)); deployers owe visible labels on deepfakes and public-interest text (50(4)). One does not cover the other.
• Get the label right – and know what needs none. The EU icon, plus a short, plain-language line (“AI” is the only abbreviation to use), placed where the content is consumed, with alt text and an audio disclaimer when there is nothing to see. Standard editing, translation, formatting, source code, short labels and genuine internal B2B output fall outside the marking duty entirely – that is where much of the practical relief lies.
• Watch the text limb closely. AI-touched investor and sustainability reports on a company website count as text published on matters of public interest, so they are squarely in scope unless the human-review and editorial-responsibility exception is properly documented – and that exception collapses if AI edits the text after sign-off.
• Consider the Code of Practice. Adhering to the adequate Code of Practice is the most predictable way to demonstrate compliance with the 50(2) and 50(4) content obligations; non-signatories should run a gap analysis against it and keep evidence of equivalent measures.

Businesses introducing AI systems should assess Article 50 alongside their wider AI governance, data protection and intellectual property obligations. ECOVIS ProventusLaw can assist with this assessment and the implementation of appropriate compliance measures.

This article reflects ECOVIS ProventusLaw’s interpretation of the Commission’s non-binding Guidelines and Code of Practice and is provided for general information purposes only. It does not constitute legal advice; specific advice should be obtained before acting on any part of it.

The post AI made it? Say so. What the Commission’s new AI Act transparency Guidelines require appeared first on ECOVIS ProventusLaw.

This month’s RegRally focuses on developments particularly relevant to organisations that use AI, digital advertising, cloud and online services, blockchain, or process personal data at scale.

This month at a glance:

• AI: Certain high-risk AI compliance deadlines have been deferred, but AI transparency obligations remain applicable.
• AI and GDPR: The EDPB has issued guidance on anonymisation and web scraping for generative AI.
• Blockchain: The EDPB’s final guidance highlights the need to address GDPR requirements at the architecture stage.
• Cookies and tracking: European and Lithuanian regulators continue to scrutinise consent mechanisms and actual website behaviour.
• Data breaches: New EU-level reporting proposals and Lithuanian enforcement statistics underline the importance of effective incident-response processes.
• Cybersecurity: Regulators are placing increasing emphasis on continuous vulnerability management and operational resilience.

Digital Omnibus on AI enters into force: high-risk AI deadlines deferred, but transparency duties remain

Source: European Commission | Date: 27 July 2026
Link

The Digital Omnibus on AI (Regulation (EU) 2026/1744) entered into force on 27 July 2026 and amended the EU AI Act.

The most significant change is the postponement of certain high-risk AI compliance deadlines:

• Annex III high-risk AI systems: 2 December 2027, instead of 2 August 2026;
• Embedded high-risk systems under Annex I: 2 August 2028, instead of 2 August 2027.

The deferral does not apply to Article 50 transparency obligations. Requirements concerning the disclosure of AI interactions, AI-generated content, and deepfakes remain applicable as of 2 August 2026. Obligations applicable to providers of general-purpose AI models also remain in force.

Why does it matter for businesses?

The additional time for certain high-risk AI requirements provides organisations with more room to implement compliance frameworks. It should not, however, be treated as a general postponement of AI governance.

Businesses need to distinguish between obligations whose application has been deferred and requirements that are already applicable. In particular, organisations deploying AI systems that interact directly with individuals should review whether their transparency measures are operational now.

Recommended actions

• Review AI systems against the revised implementation timetable.
• Prioritise Article 50 transparency requirements, including AI interaction disclosures and labelling requirements for AI-generated or manipulated content.
• Continue work on AI governance, risk classification, documentation and accountability rather than postponing implementation generally.
• Update internal AI compliance roadmaps and responsibility matrices to reflect the revised deadlines.

EDPB proposes a relative approach to anonymisation

Source: European Data Protection Board | Date: 7 July 2026
Link

The EDPB published draft Guidelines 02/2026 on anonymisation, intended to replace the former Article 29 Working Party Opinion 05/2014.

The draft takes a relative approach to identifiability. Whether data is anonymous may depend on the realistic means available to the organisation handling the data to identify individuals. As a result, the same dataset may potentially be considered personal data in one context but anonymous in another.

Why does it matter for businesses?

The assessment of anonymisation cannot be reduced to whether identifiers have been removed or whether a particular technical anonymisation method has been applied.

Organisations using data for AI development, analytics, research or data sharing may need to demonstrate why identification is not reasonably possible in their particular circumstances and what means of re-identification are realistically available.

Recommended actions

• Reassess existing anonymisation methodologies against the EDPB’s proposed risk-based approach.
• Document the realistic means available for re-identification when assessing whether data remains personal data.
• Review data-sharing and AI-data projects where the organisation currently relies on anonymisation to take the processing outside the GDPR.
• Monitor the finalisation of the Guidelines before making major changes solely on the basis of the draft.

EDPB clarifies GDPR requirements for web scraping used to train generative AI

Source: European Data Protection Board | Date: 8 July 2026
Link

What happened?

The EDPB published draft Guidelines 03/2026 on the use of web scraping to train generative AI models.

The Guidelines address the processing of personal data obtained through web scraping, including the need to consider lawful basis, purpose limitation and transparency.

The fact that information is publicly accessible does not, by itself, remove it from the scope of the GDPR.

Why does it matter for businesses?

This is particularly relevant to organisations developing AI systems, procuring AI models, or using datasets obtained from publicly accessible websites.

Public availability does not automatically mean that personal data can be collected and reused for AI training without further assessment. Organisations need to consider the original context in which information was collected and whether its proposed use for AI training is compatible with applicable data protection requirements.

Recommended actions

Organisations developing or procuring AI trained on scraped data should:

• identify and document the applicable lawful basis for collecting and using training data;
• assess compatibility between the original purpose of collection and the proposed AI-training purpose;
• review transparency measures and privacy notices covering AI-related processing;
• assess contractual and due-diligence arrangements where AI models or datasets are supplied by third parties.

EDPB adopts final Guidelines on blockchain and data protection

Source: European Data Protection Board | Date: 8 July 2026
Link

What happened?

The EDPB adopted its final Guidelines on blockchain and data protection, addressing how GDPR principles such as data minimisation, storage limitation, rectification and erasure apply to blockchain-based processing.

Why does it matter for businesses?

Blockchain architecture can create a structural tension with GDPR requirements where personal data is stored directly on-chain and cannot subsequently be modified or deleted.

The guidance reinforces the importance of addressing data protection at the design and architecture stage, rather than attempting to resolve GDPR compliance after a blockchain solution has already been implemented.

Recommended actions

Businesses using blockchain in connection with personal data should:

• avoid storing personal data directly on-chain where possible;
• assess whether personal data can instead be kept in appropriately secured off-chain systems;
• consider data minimisation and pseudonymisation before deploying the architecture;
• assess how the proposed architecture will support data-subject rights, particularly erasure and rectification.

EDPB requires the Belgian DPA to assess the cookie-banner complaint on its merits

Source: European Data Protection Board | Date: 14 July 2026
Link

The EDPB ruled that a GDPR complaint concerning cookie banners, lodged with the Belgian DPA, must be assessed on its merits, rejecting the argument that the complaint constituted an abuse of rights.

Why does it matter for businesses?

The decision reinforces that cookie compliance remains an active enforcement area.

For organisations, the question is not simply whether a cookie banner is present. Regulators and complainants can examine whether the underlying consent mechanism actually complies with GDPR requirements, including whether consent is freely given, sufficiently granular and capable of being withdrawn.

Recommended actions

Organisations using cookies and other tracking technologies should:

• test whether consent is genuinely freely given and granular;
• review cookie-banner design for interfaces that steer users towards acceptance;
• verify that non-essential tracking technologies are not activated before valid consent;
• review the configuration and actual behaviour of their consent-management platform.

EDPB’s common data breach notification template moves closer to implementation

Source: European Data Protection Board | Date: 5 August 2026
Link

What happened?

The EDPB’s draft common template for notifying personal data breaches under Article 33 GDPR was open for consultation until 5 August 2026.

The proposed template contains approximately 120 fields across seven sections, with predefined response options, and is intended to harmonise breach reporting across the EU/EEA.

Why does it matter for businesses?

A standardised reporting approach could increase consistency between national supervisory authorities, but it also places greater emphasis on an organisation’s ability to obtain accurate incident information quickly.

For businesses, the practical issue is not the template itself but whether their incident-response process can generate the required information within the GDPR’s 72-hour notification period.

Recommended actions

• Map the proposed information requirements against existing breach-response procedures.
• Identify information that cannot currently be obtained quickly during an incident.
• Clarify responsibilities between legal, IT, security, HR and management teams during a breach.
• Test whether the organisation can assess, document and escalate a personal data breach within the 72-hour timeframe.

Belgian DPA fines IAB Europe €250,000 over Transparency & Consent Framework

Source: Belgian Data Protection Authority | Date: 31 July 2026
Link

What happened?

The Belgian Data Protection Authority, acting in agreement with the other European data protection authorities involved in the procedure, imposed a €250,000 fine on IAB Europe concerning its Transparency and Consent Framework (TCF).

The Belgian DPA identified several GDPR compliance shortcomings, including issues relating to legal basis, DPO appointment, DPIA requirements and records of processing activities. IAB Europe disputes the findings and is considering a legal challenge.

Why does it matter for businesses?

The decision highlights an important distinction between using an industry-standard consent framework and demonstrating compliance with the GDPR as an individual controller.

A standardised consent signal does not necessarily resolve the organisation’s own obligations concerning lawful basis, transparency, accountability, DPIAs or records of processing. This is particularly relevant to publishers, adtech businesses, and other organisations that use consent management and advertising technology frameworks.

Recommended actions

Businesses relying on the TCF or similar industry frameworks should:

• monitor further developments, including any appeal;
• assess whether the consent signals they receive are sufficient for their specific processing activities;
• independently verify their legal basis and transparency requirements;
• review DPIA and accountability documentation where advertising or profiling activities present higher risks.

VDAI reports 140 personal data breaches in Lithuania in H1 2026

Source: State Data Protection Inspectorate (VDAI) | Date: 16 July 2026
Link

What happened?

The VDAI received 140 personal data breach notifications in Lithuania during the first half of 2026, affecting more than 1.64 million data subjects.

Cyber incidents accounted for 36% of reported breaches, while human error accounted for 48%. Reported examples included sending information to the wrong recipient, using “CC” instead of “BCC” and improperly anonymising disclosures.

The VDAI reported that 81% of controllers notified breaches within the required 72-hour period. The authority also imposed fines of €4,500 in March and €450,000 on a healthcare company in June for data security failures.

Why does it matter for businesses?

The figures demonstrate that data protection risk is not limited to sophisticated cyberattacks. Human error remains a significant source of personal data breaches.

This means that effective GDPR compliance depends not only on policies and technical security measures but also on access controls, employee practices, escalation procedures and the organisation’s ability to respond quickly when something goes wrong.

Recommended actions

Organisations should test, rather than merely document, their incident-response and security controls, with particular attention to:

• access management and encryption;
• employee handling of personal data;
• incident detection and escalation;
• internal responsibilities during a breach;
• the ability to assess and notify a reportable breach within 72 hours.

VDAI confirms prior consent is required for non-essential cookies

Source: State Data Protection Inspectorate (VDAI) | Date: 23 July 2026
Link

The VDAI reiterated that non-essential cookies, tracking pixels and similar technologies may only be used after obtaining the website visitor’s prior, freely given consent.

The authority expressly stated that legitimate interest cannot substitute for consent where prior consent is legally required.

Why does it matter for businesses?

Cookie compliance cannot be assessed solely by reviewing the wording of a cookie banner.

The actual technical behaviour of the website and consent-management platform matters. Organisations should verify whether tracking technologies are activated before consent, whether consent is properly recorded and whether users can withdraw it effectively.

Recommended actions

• Test the actual technical behaviour of websites and applications before and after consent is given.
• Verify that non-essential cookies and tracking technologies are blocked until valid consent is obtained.
• Check that consent can be withdrawn as easily as it was given.
• Review whether any processing currently relies on legitimate interest where prior consent is legally required.

NKSC urges organisations to strengthen cyber resilience

Source: National Cyber Security Centre (NKSC) | Date: 28 July 2026
Link

The NKSC highlighted the increasingly short period between the discovery of vulnerabilities and their exploitation. The authority noted that AI-assisted tools are enabling attackers to identify and exploit security weaknesses more rapidly.

Organisations are being encouraged to strengthen continuous infrastructure monitoring, vulnerability management and incident response.

Why does it matter for businesses?

The speed of exploitation makes periodic security reviews increasingly insufficient for organisations exposed to significant cyber risk.

Vulnerability management needs to operate as an ongoing process, with the ability to identify, prioritise, and remediate critical vulnerabilities before they are exploited.

Recommended actions

Organisations should assess whether:

• vulnerability monitoring is sufficiently continuous;
• critical vulnerabilities are prioritised according to actual business risk;
• patching processes can respond quickly to newly disclosed vulnerabilities;
• incident-response procedures can operate effectively alongside vulnerability management.

What businesses should take from this month’s developments

Across the EU and Lithuania, regulators are increasingly focusing on how compliance works in practice.

For businesses, the key message is not simply to update policies when new guidance or enforcement decisions are published. Organisations should be able to demonstrate that their controls work: that AI systems are appropriately governed, tracking technologies behave as intended, personal data is protected, and breaches can be assessed and reported quickly.

The same principle applies across GDPR, AI and ICT compliance: documented compliance is becoming less persuasive where operational reality tells a different story.

Need assistance?

ECOVIS ProventusLaw advises organisations on the practical implementation of data protection, AI and ICT regulatory requirements, including:

• GDPR compliance programmes and data protection governance
• AI governance and GDPR compliance for AI systems
• personal data breach assessment and incident response
• DPIAs and data protection risk assessments
• cookie and tracking technology compliance
• cybersecurity and ICT regulatory compliance
• data protection policies, procedures and accountability documentation

If you are reviewing your organisation’s GDPR, AI, or ICT compliance framework in light of recent regulatory developments, our team can help assess your current position and identify areas requiring action.

The post RegRally Insights: GDPR and ICT Regulation, August 2026 appeared first on ECOVIS ProventusLaw.

This edition covers key regulatory updates from the EDPB and the Lithuanian State Data Protection Inspectorate (VDAI), including new guidance on personal data breach notifications, enforcement actions concerning cybersecurity, cookies and lawful processing, as well as practical recommendations to help organisations strengthen their GDPR and ICT compliance frameworks.

Source: EDPB | Date: 12 June 2026
Link

Lithuanian DPA Fines InMedica EUR 450,000 for GDPR Security Failures

The Lithuanian State Data Protection Inspectorate (VDAI) has imposed a EUR 450,000 administrative fine on healthcare provider InMedica for infringements of the General Data Protection Regulation (GDPR) relating to inadequate security measures that resulted in personal data breaches.

The decision follows two separate investigations, which were later consolidated into a single enforcement proceeding.

The first investigation was initiated by the VDAI after publicly available information emerged in September 2024 regarding an alleged security incident affecting Kardiolita. According to reports, an unauthorized third party gained access to the company’s internal patient information system, exposing patients’ personal data. Based on this information, the VDAI launched an ex officio investigation into potential GDPR violations.

The second investigation was opened following InMedica’s notification of a personal data breach involving a ransomware attack. During the incident, four IT systems containing patients’ and employees’ personal data were encrypted by attackers.

Following its investigations, the VDAI concluded that both organisations had failed to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required under the GDPR.

In particular, the authority found that:

• multi-factor authentication (MFA) was not implemented for employees or privileged users accessing systems remotely via the internet;
• access to systems containing personal data was not sufficiently restricted to authorised personnel;
• password requirements did not meet appropriate complexity standards (in the case of Kardiolita); and
• deficiencies in access control and authentication significantly increased the risk of unauthorised access to personal data.

Since 25 June 2025, InMedica became the legal successor to Kardiolita, assuming all of its rights and obligations. Consequently, the administrative fine was imposed on InMedica.

The VDAI found infringements of:

• Article 24(1) GDPR (Responsibility of the controller);
• Article 32(1)(b) GDPR (Security of processing); and
• Article 5(1)(f) GDPR (Integrity and confidentiality principle).

Recommended actions

This decision highlights the importance of implementing risk-based technical and organisational security measures in line with Articles 24 and 32 GDPR. Organisations should regularly review their cybersecurity frameworks, ensure that multi-factor authentication is enabled for remote and privileged access, enforce robust password and access management policies, and periodically assess whether user access rights remain appropriate. Regular security audits, vulnerability assessments, employee cybersecurity training, and tested incident response plans are also essential to reducing the risk of personal data breaches and mitigating potential regulatory sanctions.

Source: VDAI
Link

Lithuanian DPA: Randomly Generated Phone Numbers Are Still Personal Data

VDAI has issued a reprimand to a company after finding that it unlawfully processed an individual’s personal data by calling a randomly generated telephone number for the purposes of a public opinion survey.

The complaint arose after an individual received an unsolicited telephone call inviting her to participate in a survey. The company explained that it did not obtain the individual’s phone number from any database but instead used software that randomly generated telephone numbers. It argued that the processing was based on its legitimate interests under Article 6(1)(f) GDPR.

VDAI rejected this argument. It emphasised that the method by which a telephone number is obtained is not decisive. Once a randomly generated number belongs to an identifiable individual, it constitutes personal data within the meaning of the GDPR. Consequently, generating and calling such a number amounts to the processing of personal data and requires a valid legal basis.

VDAI further noted that although the company relied on legitimate interests, it failed to demonstrate why that legal basis was applicable. In particular, it did not provide evidence that the processing was necessary for its legitimate interests, nor did it demonstrate that it had carried out the required balancing test to assess whether its interests outweighed the rights and freedoms of the data subject.

As the company was unable to substantiate the lawfulness of the processing under any of the legal bases set out in Article 6(1) GDPR, VDAI concluded that it had infringed the GDPR’s lawfulness principle under Article 5(1)(a) and processed personal data without a valid legal basis in breach of Article 6(1). Taking into account the circumstances of the case, including the limited nature of the data involved and the absence of demonstrated harm to the complainant, the authority issued a reprimand.

Why does this matter?

The decision confirms that organisations cannot avoid the application of the GDPR simply because personal data was generated randomly rather than obtained from an existing database. If a randomly generated identifier corresponds to an identifiable individual, it is personal data, and its processing must comply with the GDPR.

The decision also serves as a reminder that relying on legitimate interests requires more than a general statement. Organisations should document the necessity of the processing, conduct and retain a legitimate interests assessment (LIA), and be able to demonstrate compliance with the accountability principle if requested by a supervisory authority.

Recommended actions

Organisations should carefully assess the legal basis before conducting telephone surveys or outreach campaigns, regardless of how contact details are obtained.

In particular, organisations should:

• recognise that randomly generated telephone numbers may constitute personal data where they relate to identifiable individuals, meaning that the GDPR applies from the moment such numbers are processed;
• ensure that a valid legal basis under Article 6 GDPR exists before initiating calls;
• where relying on legitimate interests, carry out and document a Legitimate Interests Assessment (LIA), demonstrating the necessity of the processing and balancing the organisation’s interests against the rights and freedoms of individuals;
• maintain appropriate documentation to demonstrate compliance with the GDPR accountability principle, as supervisory authorities may request evidence supporting the chosen legal basis; and
• periodically review outreach and survey practices to ensure that they remain compliant with both the GDPR and applicable national laws.

Source: VDAI | Date: 25 June 2026
Link

Practical takeaway for organisations

The VDAI has published recommendations on ensuring the security of personal data processed by online stores. The guidance is intended to assist e-commerce businesses and other data controllers in assessing and implementing appropriate organisational and technical measures to protect customers’ personal data.

Online stores process a wide range of personal data, including customers’ names, contact details, delivery addresses, order information and payment-related data. Given the nature of this information, it is essential to ensure that appropriate safeguards are in place to protect personal data against unauthorised access, loss, alteration or disclosure.

The recommendations address the key data security considerations relevant to e-commerce operations and provide practical guidance on strengthening data protection and supporting compliance with the GDPR. The document is intended to be a useful resource for both online store operators and IT professionals responsible for information security and data protection compliance.

Recommended actions

VDAI recommends that online retailers regularly review user access rights, implement multi-factor authentication for administrator accounts, ensure timely installation of security updates, and maintain secure backup and recovery procedures. Businesses should also periodically assess the security of third-party service providers, such as hosting companies and payment service providers, and establish clear procedures for detecting, reporting and responding to personal data breaches. Taking these practical steps can significantly reduce cybersecurity risks while supporting ongoing GDPR compliance.

Source: VDAI | Date: 8 July 2026
Link

The post RegRally Insights: Personal Data Protection and ICT Regulation, July 2026 appeared first on ECOVIS ProventusLaw.

Where AI is already being used

• CV screening and candidate ranking
• Automated recruitment assessments
• Employee productivity monitoring
• Performance scoring and analytics
• Internal investigations
• Workforce planning and allocation of tasks
• Risk and compliance monitoring

AI does not remove employer responsibility

The GDPR challenge

• employee identification data;
• performance metrics;
• communications data;
• behavioural information;
• location data;
• productivity indicators;
• recruitment information.

The AI Act changes the landscape

• recruitment and candidate selection;
• promotion decisions;
• employee evaluation;
• allocation of work;
• monitoring employee behaviour;
• employment termination decisions.

Employee monitoring requires particular caution

• whether monitoring is genuinely necessary;
• whether less intrusive measures could achieve the same objective;
• whether employees have been properly informed;
• whether monitoring remains proportionate to the intended purpose;
• whether sufficient safeguards and oversight mechanisms exist.

Governance is becoming the real compliance challenge

• who approved the system;
• who oversees its operation;
• how decisions are reviewed;
• how bias and errors are managed;
• how employees can challenge outcomes;
• how compliance is documented.

Practical steps for employers

• conducting a legal and regulatory assessment;
• reviewing GDPR compliance requirements;
• determining whether a DPIA is required;
• assessing AI Act implications;
• establishing governance and accountability frameworks;
• documenting human oversight procedures;
• updating employee notices and internal policies;
• ensuring a sufficient level of AI literacy among staff operating or using AI systems.

How ECOVIS ProventusLaw can assist

• AI governance frameworks for HR and workforce management systems;
• GDPR compliance for employee data processing and monitoring tools;
• Legal assessment of AI-assisted recruitment and decision-making processes;
• Data Protection Impact Assessments (DPIAs) for high-risk AI use cases;
• Workplace monitoring policies, including legal review of surveillance and productivity tools;
• Alignment with the EU AI Act, employment law requirements, and internal governance standards;
• Regulatory risk assessment for AI systems used in regulated financial services environments.

The post AI in the Workplace: What Employers Must Know About the AI Act, GDPR and Employee Monitoring appeared first on ECOVIS ProventusLaw.

A key theme this month is the expansion of enforcement beyond individual complaints. Regulators and courts are confirming that investigations may escalate into systemic assessments, leading to broad corrective measures and significant financial exposure for controllers.

Cross-border data transfers remain under sustained scrutiny, with regulators taking a particularly strict approach to transfers outside the EEA and reinforcing the requirement for “essentially equivalent” protection in practice. At the same time, new developments around GDPR certification mechanisms suggest a gradual shift toward more structured, standardised compliance tools for international data flows.

AI and employee data processing are emerging as a new enforcement frontier, with growing attention on how workplace communications and behavioural data are reused for model training and automation. Authorities are increasingly testing the limits of purpose limitation and transparency in this context.

Overall, the regulatory direction is clear: organisations are expected to move beyond formal compliance frameworks and demonstrate operational, auditable adherence to GDPR principles across their data ecosystems.

Meta loses High Court challenge against Irish DPC in GDPR enforcement scope case

The Irish High Court has upheld the authority of the Irish Data Protection Commission (DPC) in a landmark case involving Meta Platforms Ireland Ltd, rejecting Meta’s challenge to the scope of a GDPR investigation originating from a single 2018 user complaint. The case concerned Facebook’s refusal to provide raw personal data stored in its “Hive” system, which the complainant argued was necessary to verify compliance with GDPR rights, including the right of access to special category data.

The DPC’s draft decision (October 2025) found multiple GDPR infringements and proposed significant corrective measures, including a reprimand, binding compliance orders, and administrative fines estimated between EUR 360–430 million. Meta contested the DPC’s authority to extend the investigation beyond the individual complaint to assess systemic processing practices affecting all Facebook users.

The High Court rejected this argument, confirming that complaint-driven investigations under GDPR may lawfully expand to address systemic issues where necessary to ensure effective enforcement. The court held that supervisory authorities are not limited to the narrow facts of the initial complaint and may impose system-wide corrective measures, including fines, where broader infringements are identified.

Key implications of the judgment

• GDPR enforcement scope confirmed: Data protection authorities may expand investigations beyond the original complaint if systemic risks or infringements are identified.
• System-wide remedies permitted: Supervisory authorities can impose corrective measures affecting large user bases, not only individual complainants.
• Strong affirmation of DPC powers: The ruling reinforces the DPC’s broad investigative and enforcement discretion under the GDPR framework.
• Increased compliance exposure for large platforms: Companies processing data at scale face heightened risk of cross-user enforcement actions triggered by individual complaints.

Overall, the decision significantly strengthens the EU data protection enforcement architecture by confirming that complaint-based procedures can evolve into full-scale systemic investigations with substantial financial and operational consequences for data controllers.

Recommendations

This case confirms that supervisory authorities may investigate and impose corrective measures beyond an individual complaint when broader GDPR compliance issues are identified.

Companies should therefore:

• Ensure that data subject rights requests are handled consistently, completely, and within GDPR deadlines.
• Regularly review internal data access, retention, and disclosure practices to identify potential compliance gaps before they become systemic issues.
• Maintain clear documentation demonstrating how GDPR obligations are implemented in practice, including procedures for responding to access requests.
• Conduct periodic audits of privacy governance frameworks to verify that policies, technical controls, and operational processes remain aligned.
• Assess the potential wider impact of any identified compliance issue, as regulators may evaluate consequences affecting large groups of users rather than only the individual complainant.
• Establish effective oversight mechanisms to detect recurring or large-scale compliance risks and implement corrective actions promptly.
• Ensure accountability measures are in place, allowing the organisation to demonstrate compliance during regulatory investigations.

Dutch DPA fines Yango operator MLU EUR 100 million over unlawful data transfers to Russia

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has imposed a EUR 100 million fine on MLU B.V., the Netherlands-based operator of the Yango taxi application, for unlawful transfer and processing of personal data involving users in Norway and Finland. The case was conducted jointly with Norwegian and Finnish supervisory authorities and concerns the transfer of sensitive personal data to Russia, where data protection standards are considered not equivalent to EU standards.

According to the regulator, MLU processed highly sensitive data, including driver’s licence scans, home addresses, and precise geolocation data, and stored or made it accessible on servers located in Russia. The authority concluded that this arrangement failed to meet the GDPR requirements for international data transfers, which require that personal data exported outside the EU be protected at a level essentially equivalent to EU safeguards.

The AP emphasised that data stored in Russia may be accessible to state authorities under legal frameworks that do not meet EU adequacy standards, creating heightened risks for data subjects. The decision is based on findings that the appropriate safeguards under Chapter V of the GDPR (such as adequate transfer mechanisms and technical/organisational measures) were insufficient or not properly implemented.

The AP emphasised that data stored in Russia may be accessible to state authorities under legal frameworks that do not meet EU adequacy standards, creating heightened risks for data subjects.

MLU disputes the findings, arguing that data was stored within the EU in pseudonymised and encrypted form and was not accessible to unauthorised parties. The company also notes that Yango ceased operations in Norway and Finland and has cooperated with regulators. MLU retains the right to appeal.

Key implications:

• Reinforces strict EU stance on international data transfers to third countries without adequacy decisions, particularly Russia-related processing environments.
• Confirms heightened regulatory scrutiny of corporate structures linked to Russian tech groups operating via EU subsidiaries.
• Highlights the importance of robust technical and organisational safeguards (encryption, pseudonymisation, data localisation controls) in cross-border processing.
• Demonstrates strong enforcement coordination between EU/EEA data protection authorities in cross-border GDPR cases.

Overall, the decision underscores that GDPR compliance for international data transfers is assessed not only on contractual safeguards, but also on the practical risk of access by third-country authorities, with significant financial and reputational consequences for non-compliance.

Recommendations

Organisations transferring personal data outside the EEA should not rely solely on contractual arrangements or vendor assurances. They should ensure that appropriate transfer mechanisms are in place, conduct Transfer Impact Assessments (TIAs) and regularly update them, and assess whether the laws and practices of the destination country could undermine the level of protection required under GDPR.

Particular attention should be paid to transfers involving jurisdictions where government access to personal data may be difficult to challenge or where privacy safeguards are not equivalent to those available within the EU. Regulators increasingly expect organisations to demonstrate, not merely assume, that transferred data remains adequately protected.

EDPB expands Europrivacy certification to support GDPR-compliant international data transfers

The European Data Protection Board (EDPB) has issued two opinions expanding the role of Europrivacy certification as a mechanism for GDPR compliance and international data transfer, strengthening regulatory clarity and cross-border data flow governance under the General Data Protection Regulation.

The first opinion extends Europrivacy, the European Data Protection Seal, to organisations established outside the EU/EEA. This allows non-European companies to obtain certification demonstrating alignment with GDPR requirements, thereby broadening the scheme’s applicability to global data processing activities and enabling third-country entities to formally evidence GDPR-level safeguards.

The second opinion introduces a transfer-specific certification framework under Article 46 GDPR. This version of Europrivacy is designed to operate as an international transfer safeguard, allowing data importers outside the EEA to demonstrate “essentially equivalent” protection through certification combined with binding and enforceable commitments. In practice, this creates a structured pathway for lawful cross-border transfers, reducing reliance on bespoke contractual assessments.

Key implications:

• Alternative transfer mechanism: Certification becomes a formal GDPR transfer tool alongside SCCs, BCRs, and adequacy decisions.
• Simplified compliance burden: Certified entities may reduce due diligence and ongoing monitoring obligations for EU data exporters.
• Third-country accessibility: Non-EU organisations can directly obtain GDPR-aligned certification to support market access and data processing arrangements.
• Increased reliance on independent audits: Continuous compliance verification becomes embedded in certification maintenance requirements.

The EDPB positions certification as a compliance-enhancing instrument that operationalises “data protection by design and by default,” while also strengthening trust in international data ecosystems. Compared to standard contractual clauses and binding corporate rules, certification introduces a more standardised, externally validated compliance benchmark, potentially reducing legal uncertainty in cross-border data transfers.

Overall, the development signals a shift toward more structured, auditable international data transfer mechanisms, with certification emerging as a strategic compliance and market-access tool for global data-driven businesses.

Recommendations

In light of the EDPB’s approval of international GDPR certification mechanisms, organisations transferring personal data outside the EEA should consider reviewing their current data transfer arrangements and compliance framework. In particular, businesses should:

• identify and map international data transfers involving personal data;
• review whether existing transfer mechanisms, such as Standard Contractual Clauses (SCCs), remain appropriate and sufficient;
• assess whether GDPR certification schemes, including Europrivacy, could support compliance and reduce transfer-related risks;
• evaluate third-party service providers and data processors located outside the EEA;
• update internal data protection policies and transfer impact assessments where necessary;
• monitor further guidance from the EDPB regarding the practical implementation of certification-based transfer mechanisms.

For organisations that regularly transfer personal data to non-EEA countries, certification may become a valuable tool for demonstrating GDPR compliance, strengthening business credibility and reducing legal uncertainty in cross-border data processing arrangements.

DPC launches GDPR investigation into Shein over transfers of EU customer data to China

The Irish Data Protection Commission (DPC) has opened an investigation into online retailer Shein, focusing on the transfer of EU customers’ personal data to China via its European headquarters, Infinite Styles Services in Dublin. The inquiry assesses whether Shein complies with core GDPR obligations, particularly Articles 5 and 13, as well as the strict requirements governing international data transfers under Chapter V of the GDPR.

Article 5 GDPR requires personal data to be processed lawfully, fairly, and transparently, while Article 13 imposes obligations to provide clear and accessible information to individuals about how their data is collected and used. The DPC is examining whether Shein’s privacy disclosures and data handling practices meet these transparency standards, and whether users are properly informed about cross-border data flows to jurisdictions outside the EU.

A key focus of the investigation is whether transfers of personal data to China meet GDPR requirements for international data transfers, which require “essentially equivalent” protection compared to EU standards. The DPC has emphasised that personal data exported outside the EU must remain subject to a comparable level of protection, regardless of where it is processed.

The case forms part of a broader regulatory trend of increased scrutiny of data transfers to China, particularly in the context of large-scale e-commerce platforms processing vast volumes of consumer data. The DPC confirmed it will coordinate with other EU supervisory authorities to ensure a consistent enforcement approach across jurisdictions.

Shein has stated that it is cooperating with the investigation and maintains that it prioritises data security and GDPR compliance, with ongoing internal initiatives to strengthen its data protection framework.

Key implications:

• Heightened enforcement focus on international data transfers to China under GDPR Chapter V.
• Increased scrutiny of e-commerce platforms operating EU hubs while processing data in third countries.
• Reinforcement of strict transparency obligations under Articles 5 and 13 GDPR.
• Continued convergence of EU supervisory authorities on cross-border data transfer enforcement strategy.

Overall, the investigation underscores the EU regulators’ increasingly strict interpretation of “equivalent protection” requirements for third-country data transfers and signals elevated compliance expectations for global digital commerce platforms operating in the EU.

Recommendations

1. Companies should maintain a clear and up-to-date overview of:

• Where personal data is stored and processed (cloud providers, IT vendors, outsourcing partners)
• Which third countries are involved
• Which third-party service providers have access to customer data

2. SCCs must be supported by:

• A Transfer Impact Assessment (TIA)
• A documented assessment of legal risks in the destination country
• Evidence that the protection level is effectively equivalent to the EU standard

3. For each data transfer, companies should:

• Assess local surveillance and government access risks
• Document legal and technical safeguards
• Justify why the transfer is still compliant under GDPR requirements

4. Strengthen technical and organisational measures

Regulators increasingly assess real-world protection, not just contractual terms. Companies should consider:

• End-to-end encryption (with EU-controlled keys where possible)
• Pseudonymisation before transferring data
• Strict access controls and audit logging
• Data minimisation (only transfer what is strictly necessary)

5. Ensure transparency and documentation readiness

Companies should ensure:

• Privacy notices clearly explain international transfers
• Records of processing activities (ROPA) are complete and updated
• Documentation is audit-ready for supervisory authorities.

Lithuanian DPA clarifies limits of access, erasure, and transparency rights in healthcare data case

The Lithuanian State Data Protection Inspectorate (VDAI) has issued a decision against UAB “Pasaulio optika” concerning alleged GDPR violations in the handling of a patient’s personal data following an eye examination. The case examined the application of Articles 15 (right of access), 17 (right to erasure), and 12 (transparency) of the GDPR in the context of medical data processing.

The complaint arose after the patient requested a copy of the medical examination results, requested the deletion of personal data, and raised concerns about the alleged disclosure of data to a journalist. The controller directed the patient to the national e-health system rather than providing the data directly and refused to delete it, citing statutory retention obligations for medical records.

On the right of access, the VDAI held that referring a data subject to an external system does not satisfy GDPR requirements. Controllers must either provide a direct copy of personal data or ensure equivalent direct access without additional procedural burdens on the data subject.

On the right to erasure, the authority confirmed that medical data may be exempt from deletion under Article 17(3)(b) GDPR where retention is required by national law. However, the controller must still clearly identify and communicate the specific legal basis for retaining the data.

Regarding transparency obligations, the VDAI found that the controller failed to provide a sufficiently clear and legally substantiated explanation for its refusal to delete. This constituted a breach of Article 12(1) GDPR, which requires transparent and comprehensible communication with data subjects.

The allegation of unlawful disclosure to a journalist was referred to the Press Ethics Inspectorate for separate assessment.

Key implications:

• Direct access requirement reinforced: Controllers cannot rely solely on external systems (e.g. e-health portals) to fulfil Article 15 GDPR obligations.
• Erasure exceptions must be properly justified: Even where retention is legally required, controllers must clearly reference applicable legal provisions.
• Transparency obligations remain central: Adequate legal reasoning must be communicated in a clear and understandable manner under Article 12 GDPR.
• Increased scrutiny in healthcare data processing: National DPAs continue to enforce strict compliance standards for sensitive personal data.

Overall, the decision reinforces that GDPR compliance in the healthcare sector requires not only lawful processing and retention, but also precise, transparent, and user-accessible communication of data subject rights and limitations.

Recommendations

1. If a data subject requests their data (GDPR Article 15), companies should not simply:

• point to another platform, portal, or system
• assume the user will retrieve it themselves

Companies should ensure they can directly provide a copy of personal data in a clear and accessible format.

2. Even if data is stored in a national system, database, or customer portal:

• The controller still remains responsible for fulfilling the request;
• Indirect access may not satisfy GDPR requirements

3. When responding to data subjects’ requests for erasure under Article 17 GDPR, any refusal to satisfy such requests must be properly justified.

In such cases, companies should:

• clearly identify the specific legal basis for retaining the personal data;
• provide a clear explanation of why the erasure request cannot be fully or partially granted;
• reference specific legal obligations requiring data retention, rather than relying on general or abstract statements.

4. Under GDPR Article 12 (transparency principle), it is recommended to review and update the Privacy Policy / Privacy Notice to ensure that it is clear, concise, and sufficiently informative for data subjects.

The Privacy Notice should explicitly and clearly include:

• the legal bases on which personal data are processed;
• the circumstances in which personal data may not be deleted (e.g. due to statutory retention obligations);
• specific references to the legal provisions justifying restrictions on the right to erasure under Article 17 GDPR;
• a clear and understandable explanation provided to data subjects, rather than generic or overly broad statements.

Lithuanian DPA flags systemic GDPR failures in insurance data-sharing ecosystem (Lietuvos draudimas case)

The Lithuanian State Data Protection Inspectorate (VDAI) has issued a decision concerning UAB “Lietuvos draudimas” over the handling and sharing of personal data with external service providers in the context of insurance services. The case highlights systemic compliance risks in multi-processor environments, particularly in sectors relying heavily on outsourced claims handling, data enrichment, and third-party service platforms.

The investigation assessed whether the controller ensured lawful and transparent data sharing, maintained adequate oversight of processors, and complied with core GDPR principles when transferring personal data within its service ecosystem.

On processor governance (Article 28 GDPR), the VDAI found that the company failed to demonstrate sufficient control over its external service providers. Key deficiencies included unclear contractual limitations on processor access, insufficiently detailed data processing agreements, and inadequate oversight of how processors handled personal data in practice. As a result, personal data was shared across the service chain without robust and clearly enforceable safeguards.

On transparency obligations (Article 14 GDPR), the authority found that the controller did not properly inform data subjects about the origin of personal data obtained indirectly from third parties, such as public registers or external databases. In particular, the company failed to provide timely and complete information regarding the source of the data, the categories of processed data, and the timing of the disclosure required under Article 14(3) of the GDPR.

On data minimisation (Article 5(1)(c) GDPR), the VDAI concluded that the scope of data shared with external partners was potentially excessive. The controller did not adequately justify the requirement for full datasets in all cases, indicating a lack of strict enforcement of the “need-to-know” principle across its operational processes.

Instead of imposing a financial penalty, the VDAI ordered corrective measures, requiring the company to:

• strengthen its data processing agreements under Article 28 GDPR
• improve transparency notices and disclosures to data subjects
• reinforce internal data minimisation controls
• review and tighten data-sharing practices with external partners

Key implications:

• Reinforces strict expectations for controller oversight in multi-vendor insurance ecosystems
• Confirms heightened scrutiny of Article 14 transparency obligations for indirectly sourced data
• Highlights data minimisation as a practical operational requirement, not a formal policy principle
• Signals regulatory focus on processor chain governance rather than only standalone controller actions

Overall, the decision underscores that GDPR compliance in outsourced service environments requires end-to-end control over data flows, precise contractual limitations, and full transparency to data subjects about all sources and uses of their personal data.

Recommendations

Under GDPR Article 28, companies must ensure that any external service provider processing personal data operates under clear, enforceable, and actively monitored conditions.

1. It is not sufficient to have Data Processing Agreements in place. Organisations must also ensure:

• clear limitation of data access for each processor
• documented and technically enforced access controls
• ongoing oversight of processing activities

2. Lack of transparency in indirect data collection and disclosure of data source (GDPR Article 14).

Under Article 14 GDPR, where personal data is not obtained directly from the data subject, companies must inform individuals about the origin of their personal data, including the specific source of collection.

Regulators expect transparency that ensures individuals are clearly informed about:

• the exact source from which personal data was obtained (e.g. public registers such as the Register Centre or other third parties
• the categories of personal data collected from those sources
• the timing of information provision in accordance with Article 14(3), including the requirement to inform the data subject without undue delay and no later than one month, or at the latest at the first communication

3. Under GDPR Article 5(1)(c), companies may only share personal data that is strictly necessary for the intended purpose. This principle must be applied in practice, not only in policy.

Companies should ensure:

• datasets shared with third parties are purpose-specific
• “full data exports” are avoided by default
• necessity is documented per processing activity

Meta faces EU scrutiny over employee data use in AI training under GDPR

Meta is facing increased regulatory scrutiny in Europe over its internal artificial intelligence training programme, the Model Capability Initiative (MCI), which trains AI systems using employee activity data collected from work devices. The initiative is intended to improve automation capabilities for digital workplace tasks, but has raised significant concerns under the EU General Data Protection Regulation (GDPR).

The key issue concerns whether the scope of data collection exceeds what was originally disclosed. Reports indicate that the system may capture a broad range of workplace communications, including emails and chat messages exchanged between US-based employees and their colleagues in Europe. This raises the possibility that EU personal data could be indirectly incorporated into AI training datasets without a clearly defined legal basis.

Under GDPR, personal data must be processed for specific, explicit, and legitimate purposes, and any further processing must remain compatible with those original purposes. Privacy experts and advocacy groups, including NOYB, argue that using workplace communications for AI model training may constitute a new processing purpose requiring separate legal justification, such as consent or another valid legal basis under Article 6 of the GDPR.

Meta has stated that the programme is limited to US-based employee devices and includes safeguards intended to prevent the inclusion of sensitive information. However, critics argue that the actual scope of data processing may extend beyond publicly stated boundaries, particularly where cross-border communications are involved.

European supervisory authorities, including the Irish Data Protection Commission, are expected to examine the initiative more closely in light of increasing concerns over transparency, purpose limitation, and employee data protection in AI development contexts.

Key implications:

• Potential application of GDPR purpose limitation rules to AI training using workplace communications
• Heightened scrutiny of employee monitoring and internal data reuse for AI model development
• Cross-border risk where EU employee communications are indirectly processed in non-EU AI systems
• Likely regulatory focus on transparency, legal basis, and internal governance of AI training datasets

Overall, the case highlights an emerging regulatory frontier in the EU: the use of employee-generated data for AI training, and the extent to which existing GDPR principles constrain internal corporate AI development practices.

Recommendations

Companies should ensure that any employee data used for AI training is collected transparently and in full compliance with applicable data protection laws, such as the EU GDPR. It is essential to clearly define the purpose of data processing and avoid using workplace communications for secondary purposes without a valid legal basis or informed consent.

Organisations should also regularly review their data collection practices, implement strong anonymisation or minimisation techniques, and maintain clear internal policies on how employee communications are accessed and used. Close cooperation with data protection officers and legal teams can help reduce compliance risks and prevent potential regulatory action.

The post RegRally Insights: Personal Data Protection and ICT Regulation – June 2026 appeared first on ECOVIS ProventusLaw.

From expanding supervisory scrutiny and increased enforcement activity to new expectations in direct marketing, DPIAs, and access rights handling, organisations are facing a steadily maturing regulatory landscape that demands both stronger governance and operational discipline. Stay informed, stay compliant, and ensure your organisation is prepared for the next wave of regulatory change.

The post RegRally Insights: Personal Data Protection and ICT Regulation – May 2026 appeared first on ECOVIS ProventusLaw.

EDPB 2025 Report on the Right to Erasure under GDPR

The European Data Protection Board (EDPB) has published its 2025 report on the right to erasure (“right to be forgotten”) under GDPR, reviewing how the right is applied across the EU.

The report notes that many organisations have processes in place, but practices remain inconsistent. Key challenges include balancing erasure requests with legal retention duties (e.g. tax or criminal law), verifying requester identity, and deleting data from backups or third-party processors.

The EDPB encourages organisations to implement clear procedures, strengthen technical deletion capabilities, and provide regular staff training.

The report is a practical resource for DPOs, legal teams, and businesses seeking stronger GDPR compliance and more effective handling of erasure requests.

Our recommendations:

1. Implement clear and consistent erasure procedures. Ensure standardised processes for handling deletion requests across all systems and business units. Avoid fragmented or ad hoc approaches.

2. Balance erasure requests with legal obligations. Organisations must carefully assess when data can be deleted versus when retention is required (e.g., tax, legal, or regulatory obligations). Document these decisions to demonstrate compliance.

3. Strengthen identity verification processes. Establish secure and proportionate methods to verify requesters’ identities, reducing the risk of unauthorised data deletion while avoiding excessive data collection.

4. Address technical limitations in data deletion. Ensure that personal data can be effectively erased from:

• Active systems
• Backups (where feasible, or ensure restricted access and eventual deletion)
• Third-party processors

5. Improve third-party and vendor coordination. Controllers should ensure that processors:

• Can support erasure requests
• Act promptly on deletion instructions
• Provide confirmation of deletion

6. Maintain transparency and communication. Clearly inform individuals about:

• When their data will be deleted
• When deletion is not possible and why
• Applicable retention periods

7. Invest in tools and automation. Leverage technology to track, manage, and execute erasure requests efficiently, especially in complex IT environments.

8. Train staff and raise awareness. Regular training for customer-facing teams, legal, and IT staff is essential to ensure requests are recognised and handled correctly.

Cyber Incident Affecting European Commission Web Infrastructure

The European Commission disclosed a cyberattack affecting the cloud infrastructure hosting its Europa.eu website.

The incident was quickly contained, with mitigation measures implemented to protect services and data. Website availability was not disrupted, and the Commission confirmed that its internal systems were not affected.

Preliminary findings indicate that data may have been taken from affected websites, and potentially impacted EU entities are being notified. Investigations into the full scope of the incident remain ongoing.

The Commission stated it will use the findings to further strengthen its cybersecurity resilience amid growing cyber and hybrid threats across Europe.

Our recommendations:

The recent cyber incident affecting the European Commission highlights that even highly secured public institutions remain vulnerable to sophisticated cyber-attacks. While the incident was swiftly contained and did not disrupt services, initial findings indicate potential data exfiltration.

In light of this, companies are encouraged to:

• Strengthen cloud security controls – ensure that cloud infrastructure is regularly audited, monitored, and protected against unauthorized access.
• Implement incident response procedures – establish clear internal processes to detect, contain, and report cybersecurity incidents without delay.
• Ensure data breach readiness – be prepared to assess whether a breach triggers notification obligations under applicable data protection laws.
• Regularly test systems and access controls – including penetration testing and review of user permissions.
• Monitor third-party risks – especially where external platforms or hosting services are used.

This incident also underscores the importance of aligning with EU cybersecurity requirements, particularly under the NIS2 Directive, which strengthens obligations in risk management, incident reporting, and resilience across critical sectors.

EU Single Entry Point for Security Incident Reporting

The European Parliament highlighted progress toward creating a Single Entry Point (SEP) for incident reporting under the Commission’s Digital Omnibus package.

The SEP would be a central ENISA-managed platform that allows organisations to submit notifications required under GDPR, NIS2, DORA, CRA, and other EU rules through a single interface, replacing multiple national reporting channels.

Key points:

• Existing reporting triggers remain unchanged.
• GDPR breach notification deadline would extend from 72 to 96 hours.
• ENISA would forward reports to the relevant authorities.
• If unavailable, existing fallback reporting channels must still be used.

The SEP is expected to become operational within 18 months of the legislation entering into force, with possible delays due to security or technical readiness.

One reporting channel: Organisations will be able to report incidents through a single EU platform instead of multiple national authorities.

No change to reporting scope: Existing obligations (what must be reported) remain unchanged.

Extended GDPR deadline: The GDPR’s personal data breach notification period is expected to increase from 72 to 96 hours.

Forwarding mechanism: ENISA will distribute reports to the relevant authorities.

Fallback required: If the SEP is unavailable, organisations must still use existing reporting channels.

Timeline: The SEP is expected to become operational within 18 months after the legislation enters into force (with possible delays).

Spain Fines FC Barcelona €500,000 for Deficient Biometric DPIA

Spain’s data protection authority, the AEPD, fined FC Barcelona €500,000 for failing to carry out a GDPR-compliant Data Protection Impact Assessment (DPIA) before processing biometric data.

The case involved a 2023 digital census of around 143,000 members that included identity scans, facial recognition with liveness checks, and optional voice recordings.

The AEPD found the DPIA was inadequate because it:

• failed to clearly identify biometric data processing;
• did not properly assess less intrusive alternatives;
• underestimated risks linked to sensitive biometric identifiers.

The authority stressed that DPIAs must be substantive, completed before processing starts, and genuinely assess necessity, proportionality, risks, and alternatives.

The decision signals increased scrutiny of biometric technologies and confirms that formal compliance alone is insufficient without a robust risk assessment.

The recent enforcement action by Spanish Data Protection Agency against FC Barcelona highlights critical expectations under the General Data Protection Regulation when deploying biometric technologies.

1. Treat DPIAs as a substantive exercise, not a formality

A Data Protection Impact Assessment must go beyond templates. It should clearly describe the nature of biometric data (e.g., facial recognition, voice patterns), processing purposes, and data flows.

2. Justify the necessity of biometrics

Financial institutions should explicitly assess whether less intrusive alternatives (e.g., MFA, document-based verification) could achieve the same objective. Regulators expect a documented comparison – not assumptions.

3. Identify and assess risks realistically

Biometric data is highly sensitive. DPIAs must include:

Risk of misuse or identity theft

False positives/negatives in authentication

Long-term implications of biometric data breaches

4. Ensure lawful basis and valid consent (if applicable)

If consent is used, it must be:

• Freely given (no coercion or “mandatory” biometrics without alternatives)
• Specific and informed
• Revocable

5. Complete DPIA before processing begins

Regulators emphasize timing. A DPIA conducted after deployment – or one that is incomplete – does not meet compliance requirements.

6. Validate third-party vendors rigorously

Where external providers (e.g., biometric verification vendors) are involved:

• Assess their security and compliance posture
• Clearly define roles (controller vs processor)
• Ensure contractual safeguards are in place

7. Maintain transparency with customers

Clearly communicate:

• What biometric data is collected
• Why it is necessary
• How long it is retained
• What alternatives exist

8. Document mitigation measures and decisions

Authorities expect to see not just risks, but concrete steps taken to reduce them – and why certain approaches were chosen.

Dutch DPA Warns Against OpenClaw AI Agents

The Dutch Data Protection Authority (AP) has warned users and organisations against using OpenClaw and similar experimental autonomous AI agents due to serious cybersecurity and privacy risks.

These tools can receive broad access to a user’s computer, email, files, and online accounts, enabling them to act independently. According to the AP, this creates significant exposure to data breaches, credential theft, malware, and account takeovers.

Reported risks include:

• malicious third-party plug-ins stealing credentials or crypto-assets;
• hidden commands embedded in websites, emails, or chats;
• remote compromise of entire systems;
• unauthorised extraction of personal or confidential data.

The AP advises against using such tools on systems containing sensitive data and reminds organisations and individuals that GDPR compliance and risk mitigation responsibilities remain with the user and deployer, even for open-source systems.

Our recommendations:

1. Avoid deploying experimental AI agents in sensitive environments

Tools like OpenClaw, which require broad system access (email, files, internal systems), should not be used on devices or networks containing confidential or personal data.

2. Apply strict access controls and the principle of least privilege

AI assistants should never be granted unrestricted access. Limit permissions to only what is strictly necessary and segregate critical systems wherever possible.

3. Treat third-party plugins as high-risk components

Open-source ecosystems may include unverified or malicious plugins. Organizations should:

• Restrict or disable external plugins
• Perform security vetting before use
• Continuously monitor for suspicious behaviour

4. Mitigate risks of prompt injection and hidden commands

Autonomous agents can be manipulated via emails, websites, or messages containing hidden instructions. Implement safeguards such as:

• Input filtering and monitoring
• Isolation of AI environments from critical systems

5. Strengthen credential and identity protection

Given the risk of account takeover:

• Enforce multi-factor authentication (MFA)
• Rotate passwords and access tokens regularly
• Immediately reset credentials if exposure is suspected

6. Conduct risk assessments before deployment

Even for open-source tools, organisations remain fully responsible for compliance. A documented risk assessment (and, where applicable, a DPIA) should be completed prior to any implementation.

7. Raise internal awareness

Ensure employees understand:

• The risks of installing AI agents locally
• The potential for data leakage and system compromise
• Approved vs. prohibited tools within the organisation

8. Extend controls to remote and home environments

Where employees work remotely, ensure policies cover the use of personal devices for work. Also, encourage vigilance regarding family- or shared-device usage.

Luxembourg Court Annuls €746 Million GDPR Fine Against Amazon

The High Administrative Court of Luxembourg annulled the €746 million fine imposed by the CNPD on Amazon, while confirming that Amazon had breached several GDPR provisions in relation to targeted advertising.

The court upheld findings that Amazon lacked a valid legal basis for behavioural advertising and breached transparency and data subject rights. However, it found procedural flaws in the sanction decision.

Key reasons for annulment:

• failure to properly assess whether Amazon acted intentionally or negligently;
• insufficient analysis of proportionality;
• failure to consider alternative corrective measures before imposing the fine.

The case has been referred back to the CNPD to reassess fault and proportionality before any new sanction is imposed.

The ruling reinforces that even where GDPR breaches are established, supervisory authorities must ensure sanctions are legally robust, proportionate, and procedurally sound.

Our recommendations:

• Reassess your legal basis for targeted advertising (especially if relying on legitimate interest).
• Ensure consent mechanisms meet GDPR standards (granular, documented, withdrawable).
• Review and update privacy notices for clarity and completeness. Strengthen processes for handling data subject rights.
• Document internal assessments (e.g., balancing tests, risk assessments) to demonstrate accountability.

The post RegRally Insights: Personal Data Protection and ICT Regulation – April 2026 appeared first on ECOVIS ProventusLaw.

Lithuanian DPA Fines Hospital Over Unlawful Video and Audio Surveillance

VDAI found that while video surveillance in common areas (e.g., entrances, corridors, lobbies) was lawful to ensure safety, surveillance in operating theatres, emergency examination rooms, and the geriatric day-care unit was unlawful, as it captured patient examination areas and staff workplaces. In these cases, patients’ and employees’ privacy rights outweighed the hospital’s interests.

The authority also determined that audio recording inside the hospital, including in operating theatres, violated the GDPR. Audio recording was not considered necessary for safety or work organisation, particularly given the risk of capturing sensitive health data.

Additionally, the hospital set unclear and excessive retention periods for recordings, failed to ensure proper access controls, and did not fully cooperate with the authority during the investigation.

VDAI ordered corrective measures and, in February 2026, imposed an administrative fine of 6,000 EUR. The decision may be appealed within one month.

Under Article 35 GDPR, a Data Protection Impact Assessment (DPIA) is required where processing is likely to result in a high risk to individuals’ rights and freedoms – including systematic monitoring, employee surveillance, or processing of health data.

A properly conducted DPIA should:

• assess the purpose, necessity and proportionality of the processing,
• evaluate risks to data subjects,
• analyse legal bases,
• assess technical and organisational security measures,
• define concrete mitigation actions.
• Failure to carry out a DPIA where required is itself a GDPR infringement.

Our team assists clients with comprehensive DPIA compliance, including:

• Conducts Data Protection Impact Assessments (DPIAs), including an evaluation of personal data processing operations from an IT security perspective (technical security measures).
• Advises on when a DPIA is required and how to carry it out properly in line with GDPR requirements.
• Prepares and/or reviews internal procedures related to Data Protection Impact Assessments.

The State Data Protection Inspectorate of Lithuania (VDAI) has announced its supervisory priorities for 2026

Planned Inspections and Monitoring Activities

In 2026, the VDAI plans to conduct:

• 15 scheduled inspections in selected public and private sector organisations;
• 10 monitoring activities focusing specifically on technical and organisational security measures;
• Follow-up reviews of 15 organisations previously inspected where deficiencies were identified or corrective measures were ordered.

Although inspections will target selected organisations, the findings are relevant to entire sectors. After completing inspections, the VDAI publishes summaries outlining identified risks and compliance gaps, enabling other organisations to assess their own exposure.

Focus Areas in 2026

The 2026 monitoring activities will concentrate on security measures, including:

• Access control management
• Backup procedures for information, software, and systems
• Event logging and audit trail records

These areas reflect ongoing regulatory focus on accountability, traceability, and operational resilience.

In addition, the authority will verify whether previously issued orders and corrective measures have been properly implemented.

In light of the 2026 supervisory plan announced by the State Data Protection Inspectorate of Lithuania (VDAI), organisations should treat this as a clear signal to reassess not only their documentation, but also the practical implementation of security measures.

Particular attention should be given to:

• Access management controls (role-based access, periodic access reviews, termination procedures);
• Backup and recovery mechanisms (testing of backups, documented recovery procedures, system resilience);
• Logging and monitoring practices (event logs, audit trails, incident traceability);
• Evidence of implementation, not merely internal policies.

Organisations that have previously undergone inspections should conduct an internal follow-up review to ensure that:

• All corrective measures have been fully implemented;
• Supporting documentation is up to date;
• Technical and organisational measures are demonstrably operational in practice.

Lithuanian DPA Orders Company to Provide Call Recording in Direct Marketing Case

On 10 October 2024, the State Data Protection Inspectorate of Lithuania (VDAI) upheld a complaint against DirectMarketing OU for refusing to provide a data subject with a copy of a call recording in which the company claimed he had consented to direct marketing.

After receiving a marketing call, the complainant asked how his personal data had been obtained and requested confirmation of the data processed, details of the alleged survey, and copies of his consent. The company stated that he had participated in a survey on 9 April 2024 and agreed to receive marketing calls but refused to provide the call recording, arguing that recordings were internal documents and that the individual’s identity could not be verified based on name and phone number alone.

During the investigation, the company submitted the recording to the VDAI. The authority found that the same identifiers used for processing the data could not be dismissed as insufficient for identity verification without justification. It emphasized that under Article 12(6) GDPR, additional information may be requested where necessary, but such measures must be proportionate.

The VDAI concluded that the refusal to provide the recording breached Article 15(3) GDPR, issued a reprimand, and ordered the company to provide the recording to the complainant.

In light of the VDAI decision, companies should consider the following:

• Treat call recordings as personal data. Audio recordings containing identifiable individuals fall within the scope of Article 15 GDPR and must be provided upon request.
• Do not rely on “internal document” arguments. Internal classification does not exempt data from disclosure obligations.
• Apply proportionate identity verification. If there are reasonable doubts, request additional information under Article 12(6) of the GDPR, but ensure the measures are necessary and proportionate.
• Ensure recordings are retrievable and shareable. If consent is collected by phone, the relevant recording must be accessible and capable of being provided within the one-month deadline.

State Data Protection Inspectorate: Fewer Personal Data Breaches Reported in 2025, but Over 1.2 Million Data Subjects Affected

In 2025, the State Data Protection Inspectorate (VDAI) received 223 notifications of personal data breaches (PDBs). The total number of affected data subjects in Lithuania reached 1,249,409.

Compared to the previous year, the number of reported breaches decreased. In 2024, VDAI received 273 breach notifications. The number of affected data subjects in Lithuania also decreased by nearly 200,000 (1,467,368 in 2024).

Nature of Breaches

By type, confidentiality breaches accounted for the majority of cases in Lithuania in 2025. Integrity breaches accounted for 6%, availability breaches for 10%, and in 1% of cases, the incident was not considered a personal data breach (did not meet the legal definition).

Main Causes

After analysing the 2025 notifications, VDAI found that:

• 58% of breaches occurred due to human error (carelessness, lack of awareness that certain actions may cause a breach, or actions that cannot normally be prevented by technical and organisational measures).
• 13% were caused by other factors, including IT system failures, programming errors, insufficient system testing before launch, or delayed data updates that prevented timely service provision and led to unauthorised access to personal data.
• 29% were caused by cybersecurity incidents.

Cybersecurity Incidents Breakdown

Among breaches resulting from cybersecurity incidents:

• 16% were ransomware (data encryption and ransom demand) attacks,
• 45% involved unauthorised access to IT systems,
• 26% resulted from social engineering attacks,
• 7% were credential stuffing attacks,
• 3% involved SQL injection attacks,
• 3% involved denial-of-service attacks.

It is important to note that cybersecurity incidents accounted for 57% of all affected data subjects in 2025 (713,644 individuals), while other causes affected 43% (535,765 individuals).

Reporting Obligations Under the GDPR

VDAI reminds data controllers that once they become aware of a personal data breach likely to result in a risk to the rights and freedoms of individuals, they must notify VDAI without undue delay, and no later than 72 hours after becoming aware of it, as required by the GDPR.

In 2025, 63% of data controllers notified VDAI within the 72-hour deadline, while 37% reported breaches after the required 72-hour deadline.

Enforcement Actions

In 2025, VDAI imposed 5 fines on public and private entities for GDPR violations, totalling EUR 27,529.

Additionally, after assessing breach notifications and identifying insufficient safeguards for personal data security, VDAI issued 9 corrective orders to data controllers or processors to align processing operations with GDPR requirements. The Inspectorate also provided 22 recommendations to help ensure compliance with GDPR obligations.

AI-generated imagery and protection of privacy: EDPB supports the joint Global Privacy Assembly’s statement

EDPB has signed a Joint Statement on AI-Generated Imagery and the Protection of Privacy on behalf of the EDPB. The statement, coordinated by the Global Privacy Assembly’s (GPA) International Enforcement Cooperation Working Group (IEWG), represents the united position of 61 authorities worldwide. This reflects the Board’s commitment to contributing to the global dialogue on data protection as outlined in the fourth pillar of its work programme 2026-2027.

The statement addresses serious concerns about AI systems that generate realistic images and videos depicting identifiable individuals without their knowledge or consent. Whilst AI has the potential to bring numerous benefits to individuals and society, recent developments – particularly the integration of AI image and video generation into widely accessible social media platforms – have enabled the creation of non-consensual intimate imagery, defamatory depictions, and other harmful content featuring real individuals. The co-signatories are especially concerned about potential harms to children and other vulnerable groups, such as cyber-bullying and/or exploitation.

Expectations for organisations

The co-signatories remind organisations developing and using AI content generation systems that these systems must be developed and used in compliance with applicable legal frameworks, including data protection and privacy rules.

Although specific legal requirements vary by jurisdiction, fundamental principles should guide all organisations developing and using AI content generation systems. These principles include:

implementing robust safeguards,

• ensuring meaningful transparency,
• providing effective and accessible mechanisms to protect individuals, and
• addressing specific risks to children.

Joining forces to address a global risk

The harms arising from the non-consensual generation of intimate, defamatory, or otherwise harmful content depicting real individuals are significant and warrant urgent regulatory attention. The co-signatories are committed to addressing this global risk and will join efforts. To achieve this, the co-signatories aim to share information on their approaches to addressing these concerns.

Finally, the co-signatories call on organisations to engage proactively with regulators, implement robust safeguards from the outset, and ensure that technological advancements do not come at the expense of privacy, dignity, safety, and other fundamental rights – particularly for the most vulnerable members of our global society.

EU Council Rejects Changes to GDPR Personal Data Definition

EU member states have agreed to remove the European Commission’s proposal to change the definition of personal data from the Digital Omnibus package. This decision stems from a Council compromise reached on February 20, obtained by Euractiv. The proposed amendment aimed to alter the definition of personal data under the General Data Protection Regulation (GDPR), but it faced significant opposition from several countries and data protection authorities.

The Commission had suggested that personal data should be defined based on the data holder’s ability to re-identify an individual, even if others receiving the data could not. This change would have allowed data processors to potentially avoid GDPR obligations by arguing that they cannot re-identify the data subjects. Critics, including the European Data Protection Board (EDPB), warned that this approach oversimplifies legal nuances and could weaken privacy protections.

The Council’s compromise also removes the Commission’s power to use secondary legislation to set criteria for when data is considered sufficiently pseudonymised. Instead, the text emphasises the EDPB’s role and its updated guidelines on pseudonymisation. Pseudonymisation is a key privacy technique in which personal data is processed in a way that prevents the individual from being identified without additional information, which remains protected under the GDPR.

This decision reflects the EDPB’s concerns raised in its negative opinion on the Digital Omnibus proposal. The Board highlighted risks that the Commission’s changes could undermine existing privacy standards. While some EU countries were uncertain about the best path forward, the EDPB’s opinion appears to have influenced the Council’s decision to reject the Commission’s proposed amendments to the definition of personal data.

The post RegRally Insights: Personal Data Protection and ICT Regulation – March 2026 appeared first on ECOVIS ProventusLaw.