RegRally Insights: Personal Data Protection & ICT Regulation, October 2026

Some compliance risks take years to catch up with a business. Others now come with a 24-hour clock. In September, Google was fined EUR 403 million for location data processed between 2018 and 2020. In the same month, software manufacturers became subject to Cyber Resilience Act reporting deadlines measured in hours.

CJEU: unrestricted public access to shareholder data is disproportionate

Date: September 3, 2026 | Source: Court of Justice of the EU
Link

In Case C-798/24 Jautiva, on a reference from the Constitutional Court of Latvia, the Court of Justice of the EU held that Directive (EU) 2017/1132 does not require the public disclosure of information on all shareholders of public limited liability companies, including minority shareholders, and that the Latvian rule requiring online publication of shareholder names, identification numbers, addresses, email addresses and shareholdings, downloadable in bulk and without restriction, is disproportionate under the GDPR and the Charter.

The Court accepted that business transparency, the prevention of money laundering and terrorist financing and the implementation of sanctions are legitimate objectives but found that unrestricted public access exposes data subjects to significant risks of misuse and that less intrusive means exist, such as access on demonstration of a legitimate interest. The judgment follows the line of case law on public beneficial-ownership registers.

What we recommend

If your organization obtains shareholder data from a public register, monitor changes to access rules and document the legal basis and purpose for obtaining and using the data. Collect only the necessary fields and restrict further disclosure.

---

Advocate General: Belgian rules on electronic communications data retention fail the necessity test

Date: September 3, 2026 | Source: Court of Justice of the EU (Advocate General)
Link

Advocate General Szpunar delivered his Opinion in Case C-661/24 Académie Fiscale and Others, on five actions before the Belgian Constitutional Court against the 2022 Belgian law on the collection and retention of identification data and metadata in electronic communications. He stated that retention of traffic and location data interferes with the rights to privacy and data protection and is permissible only where provided by law, strictly necessary and proportionate.

The Advocate General proposed that general retention may be compatible with Directive 2002/58/EC where technical safeguards ensure a genuinely watertight separation of the categories of data so that they cannot be combined during the retention period, but concluded that the Belgian law fails the test because it retains excessively broad data without such separation, leaves essential retention choices to providers and lacks clarity and safeguards.

What we recommend

This is an Advocate General’s Opinion and is not binding on the Court. Electronic communications providers and organizations operating messaging or similar services should monitor the case until the Court delivers its final judgment before making structural changes solely in reliance on the Opinion.

In the meantime, review the categories and retention periods of traffic and location data, applicable legal requirements and existing access controls. Identify whether technical segregation of retained data categories may be required if the Court follows the Opinion.

---

Italian DPA fines IQVIA EUR 7 million over health data that were not anonymous

Date: September 23, 2026 | Source: Garante per la protezione dei dati personali (Italian Data Protection Authority)
Link

The Garante fined IQVIA Solutions Italy S.r.l. EUR 7 million for unlawfully processing health data relating to approximately one million patients of 800 general practitioners in a database used for research and analytics. The authority found that the data were not anonymous: persistent patient codes and detailed clinical information enabled individuals to be singled out, linked over time and potentially re-identified.

The Garante treated IQVIA as a controller from the point of collection and found deficiencies in the legal basis, patient information, retention periods, data protection impact assessment and security measures. IQVIA must bring the processing into compliance within 120 days if it intends to continue the activity; alternatively, the doctors must anonymize the data independently in accordance with the safeguards specified by the authority.

What we recommend

Do not treat coded or pseudonymized datasets as anonymous without a documented assessment showing that individuals cannot reasonably be singled out, linked over time or re-identified using available additional information.

Before collecting, receiving or reusing personal data, document the parties’ controller or processor roles. Verify:

• the legal basis;
• transparency information;
• purpose limitation and data minimization;
• the retention period;
• the need for a data protection impact assessment (DPIA);
• appropriate security measures.

---

CNIL fines EXTIA EUR 300,000 over unhandled erasure requests

Date: September 9, 2026 | Source: CNIL (French Data Protection Authority)
Link

The CNIL fined the IT and engineering consultancy EXTIA EUR 300,000 for failing to respect the right to erasure and the information obligations under Articles 12 and 17 GDPR. The audit, carried out in April 2025 following complaints and as part of the EDPB Coordinated Enforcement Framework action on the right to erasure, found that of 265 erasure requests received in 2024, mostly from job candidates and former employees, more than three quarters had not been handled or had been handled inadequately.

Twelve requests were not processed at all, 166 people were not informed of the outcome of their request and 27 were informed late, beyond the one-month deadline. The fine reflects the number of people concerned and the fact that the company has already been reminded of its obligations twice.

What we recommend

Review the process for handling erasure requests from all data subjects: intake, identity verification, responsible persons, searches across relevant systems, applicable retention exceptions and deletion from active and backup systems.

Respond to every request within one month, including where it is refused, partly granted or the data have already been deleted. Retain evidence of the assessment, action taken and response.

---

Cyber Resilience Act reporting obligations now apply

Applies from: September 11, 2026 | Source: Cyber Resilience Act (Regulation (EU) 2024/2847)
Link

From September 11, 2026, the reporting obligations of the Cyber Resilience Act (Regulation (EU) 2024/2847) apply: manufacturers of products with digital elements placed on the EU market, including software such as operating systems and mobile applications, must report actively exploited vulnerabilities and severe incidents affecting the security of their products. An early warning is due within 24 hours of becoming aware, a notification within 72 hours and a final report after resolution.

Reports are submitted once through the CRA Single Reporting Platform, operated by ENISA and launched on September 11, 2026. The platform forwards them to the competent CSIRTs. For manufacturers with their main establishment in Lithuania, the coordinating CSIRT is NKSC. Prior registration on the platform is not required and can be completed when the first early warning is submitted. The obligation also covers products already on the market, but exploitation known before September 11, 2026, need not be reported. The main CRA product requirements apply from December 11, 2027, and open-source software stewards become subject to reporting on the same date.

What we recommend

If your organization develops or supplies software, apps, connected products or components, assess whether it is a manufacturer under the CRA and identify the products and legal entities within scope.

For in-scope products, establish a reporting procedure covering internal escalation, assessment, approval and submission within the applicable 24-hour, 72-hour and final-report deadlines. Coordinate with any DORA, NIS2 and GDPR notification duties that apply.

Ensure supplier and development contracts require timely vulnerability and incident information needed to meet CRA reporting deadlines.

---

Advocate General: marketing consent must identify the company sending the message

Date: September 17, 2026 | Source: Court of Justice of the EU (Advocate General)
Link

Advocate General Spielmann delivered his Opinion in Case C-317/25 Groupe Canal+, arising from a CNIL fine of EUR 600,000 for electronic direct marketing to about 3.9 million people whose contact data had been obtained from two internet service providers. The subscribers had consented to marketing by the providers’ “partners” without being told which companies those partners were.

The Advocate General considered that valid consent requires the data subject to know the identity of the controller that will use the data; where the partners are not identified at the time of collection, the data subject cannot expect to be contacted by any particular company, so fresh consent must be obtained before the marketing takes place, at the latest at the time of the first communication. An opt-out offered after the campaign has started cannot cure the defect.

What we recommend

If contact details obtained from a partner, data broker or lead generator are used for electronic marketing, verify that the consent specifically identified the organization sending the message. If not, obtain valid consent before the first communication.

Keep evidence of consent and ensure that partner arrangements require notification of withdrawals and objections and the suppression of contacts that may no longer be used.

---

European Commission proposes the EU KIDS Act on children’s access to social media

Date: September 17, 2026 | Source: European Commission
Link

The European Commission adopted the proposal for an EU KIDS Act, a regulation restricting access by children to social media platforms. The proposal prohibits platforms from giving access to children under 13 and sets an EU-wide minimum age of 15 for opening an account independently, while placing the burden on platforms to demonstrate that their services are age-appropriate and safe by design.

The proposal builds on the Digital Services Act and is intended to give parents more control over children’s online experience. Age-verification methods, enforcement timelines and penalties will be settled in the legislative process.

What we recommend

Providers of social, community, video-sharing, gaming, AI chatbot or similar services used by minors should assess whether they fall within the proposed scope and review age gates, parental controls, default settings and child-safety measures.

Where age assurance is used, collect only the personal data necessary to confirm age and reflect the processing in privacy information, the DPIA where required and supplier arrangements.

---

Irish DPC fines Google EUR 403 million over location data

Date: September 21, 2026 | Source: Data Protection Commission (Ireland)
Link

The Irish Data Protection Commission announced its final decision in the inquiry it had initiated into Google Ireland Limited’s processing of location data in the “Web & App Activity”, “Location History” and “Location Accuracy” features between May 25, 2018, and February 4, 2020, imposing administrative fines totaling EUR 403 million and ordering Google to bring its processing into compliance within six months.

The DPC found infringements of the lawfulness and fairness principles for Web & App Activity and Location History, of accountability for Location Accuracy, of transparency for all three features and of storage limitation through excessive retention of location data. The inquiry was opened in February 2020 following complaints by consumer organizations including BEUC, and the decision was adopted after cooperation with the concerned supervisory authorities under the one-stop-shop mechanism.

What we recommend

If location data are used, document the legal basis, necessity and retention period for each purpose or feature.

Explain at the point of activation what location data are collected, for which purposes, how account and device settings interact and how long the data are retained.

---

ENISA Threat Landscape 2026: ransomware and supply-chain risks remain at the top

Date: September 22, 2026 | Source: ENISA
Link

ENISA published the Threat Landscape 2026, covering incidents from January 1 to December 31, 2025. Ransomware remains the most disruptive threat, combining encryption, data theft and extortion. Social engineering, in particular phishing supported by phishing kits and the ClickFix technique, remains the main route to initial compromise. Exploitation of known or zero-day vulnerabilities accounted for 60 percent of unauthorized-access incidents. More than 48,000 new vulnerabilities were disclosed in 2025, a 22 percent annual increase.

Public administration was the most targeted sector (32 percent of incidents, largely ideology-driven DDoS), followed by business services (8 percent), transport (8 percent), manufacturing (7 percent) and finance and banking (6 percent). Seventy-three percent of targeted organizations fall within the NIS2 definitions of essential or important entities. The report highlights supply-chain and third-party dependencies as the source of the largest incidents and notes that online investment fraud alone cost about EUR 4 billion in the EEA in 2024.

What we recommend

Use the ENISA report as an external input to the organization’s ICT and cybersecurity risk assessment. Prioritize ransomware, supply-chain and third-party compromise, and exploitation of internet-facing vulnerabilities.

Update phishing training for ClickFix-style techniques, test incident procedures and review patching and supplier-remediation deadlines.

---

VDAI publishes a summary of 2025 court decisions on its complaints

Date: September 30, 2026 | Source: VDAI (State Data Protection Inspectorate, Lithuania)
Link

VDAI published a summary of the significant court decisions of 2025 in administrative cases arising from complaints handled by the Inspectorate, covering rulings of the Supreme Administrative Court of Lithuania (LVAT) and the Regional Administrative Court. The summary addresses the Inspectorate’s discretion in choosing corrective measures, the lawfulness of video surveillance, the processing of personal data to comply with a legal obligation or to collect service fees, and other recurring questions.

The summary is published in the “Court decisions (based on VDAI complaints)” section of the VDAI website and is the most direct indication of how Lithuanian courts test VDAI decisions and fines on appeal.

What we recommend

If your organization carries out video surveillance, debt collection, service-fee recovery or processing based on a legal obligation, compare its practices and documentation with the court summary and update them where the courts’ reasoning differs.

When responding to a VDAI investigation or considering an appeal, assess the evidence supporting the legal basis, necessity and safeguards and the proportionality factors relevant to the corrective measure.

---

EDPB consults on draft guidelines on administrative fines

Date: September 21, 2026 | Source: EDPB
Link

At its September plenary, the EDPB adopted draft guidelines on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR for public consultation. The consultation is open until November 13, 2026. The draft fining guidelines are intended to replace the former WP29 guidelines on administrative fines and complement the 2023 guidelines on the calculation of fines.

Under the draft guidelines, data protection authorities should follow a five-step method:

1. Determine whether the infringement may result in a fine under the GDPR or national law.
2. Determine whether the party under investigation may be fined for the provision breached.
3. Establish whether the infringement was intentional or negligent.
4. Assess aggravating and mitigating factors, with a reprimand generally available for minor infringements and a strong presumption of a fine for non-minor infringements.
5. Determine whether a fine would be effective, proportionate and dissuasive.

The draft also describes other corrective measures and provides 14 practical examples.

For companies, the draft’s approach to negligence is particularly relevant: actual awareness of a GDPR infringement is not necessarily required where the organization could not have been unaware of the risk and, acting with due care, should have identified it. Previous infringements may be treated as aggravating factors, including infringements of a different nature. Repeated minor failures may indicate a systemic compliance problem and support the imposition of a fine. Prompt and voluntary remediation, including timely notification, compensation of affected persons where appropriate, and additional technical or organizational measures, may materially reduce the likelihood or severity of corrective action.

What we recommend

Use the draft guidelines to review how GDPR risks and remedial actions are documented. A company may be considered negligent where it should have identified the risk even if it did not actually recognize the infringement.

Keep records of previous infringements and recurring control failures. After an incident, document prompt notification where required, remediation and measures taken to prevent recurrence, as these factors may affect the supervisory authority’s response.

---

EDPB adopts final guidelines on the interplay between the DSA and the GDPR

Date: September 17, 2026 | Source: EDPB
Link

The EDPB adopted the final version of Guidelines 3/2025 on the interplay between the Digital Services Act and the GDPR following public consultation. The guidelines are addressed to providers of intermediary services, including online platforms, very large online platforms (VLOPs) and very large online search engines (VLOSEs), that must comply with both the DSA and the GDPR.

The guidelines clarify that the DSA advertising-transparency requirements supplement the GDPR information obligations. The DSA prohibits advertising based on profiling using special categories of personal data under Article 9 GDPR, even where the processing might otherwise have a legal basis and an Article 9 derogation under the GDPR.

They also address transparency of recommender systems, content moderation, account suspension and the protection of minors. Age-assurance measures should be proportionate and should not require more personal data than necessary.

What we recommend

If automated content removal or account suspension is used, assess whether Article 22 GDPR applies and provides human review and an effective challenge process where required.

Platforms displaying user advertisements should assess their controller or joint-controller role and prevent advertising or profiling based on special-category data.

Review recommender systems and age-assurance measures for transparency, data minimization and safeguards for minors.

---

Our view

Before reusing data from partners, public registers or external providers, review the legal basis, the information given to individuals and any limits on further use. According to the Advocate General, consent to marketing must name the organization that sends the message, so contacts obtained from partners may need fresh consent. The Court has yet to rule.

The EXTIA case resulted in a EUR 300,000 fine after more than three quarters of erasure requests were left unhandled or handled inadequately. The EDPB’s draft fining guidelines explain how overlooked risks and repeated failures may affect enforcement. An organization that should have identified a risk may be negligent even if it never noticed the infringement. Repeated minor failures can point to a systemic problem. Prompt, documented remediation can reduce the likelihood or severity of corrective action. Start with processes that generate repeated complaints or leave requests unresolved. Test a sample of requests from receipt to final response and record who is responsible for fixing each gap.

Test CRA reporting procedures before a reportable vulnerability or incident occurs. Legal, security and product teams should know who assesses the vulnerability or incident, obtains information from suppliers and submits the required reports. Proposals such as the EU KIDS Act and Advocate General opinions are worth tracking now, but implementation decisions should reflect their legal status.

How ECOVIS ProventusLaw can help

For the issues covered in this edition, we can assist with:

• Data subject rights: We prepare or review your procedures for handling erasure and access requests, from receipt to final response.
• Anonymization and data sharing: Based on your process documentation, we assess whether data can be treated as anonymous under the GDPR and define controller and processor roles. We also prepare data-sharing agreements and data protection impact assessments (DPIAs).
• Cyber Resilience Act readiness: We assess whether the CRA applies to your products. We also prepare reporting procedures for the 24-hour, 72-hour and final-report deadlines, coordinated with NIS2, DORA and GDPR reporting duties, where applicable.
• GDPR audits and remediation: We run gap analyses and prepare remediation plans and records that show what was fixed and when.
• VDAI investigations and appeals: We represent clients in VDAI investigations and in challenging the Inspectorate’s decisions before the Lithuanian administrative courts.

Contact our team to discuss a specific process, planned use of data or regulatory finding.

Why ECOVIS ProventusLaw

Our technology team advises on data protection and DORA requirements, including ICT risk management, incident reporting, ICT third-party risk and digital operational resilience testing. This is our advantage: one team covers both data protection and operational resilience, so your procedures and reports stay consistent.

The firm is ranked by IFLR1000 for M&A, Financial services regulatory, and Banking and finance. The Legal 500 ranks the firm for TMT, Tax, Real estate and construction, Fintech, Employment, Dispute resolution, and Banking, finance and capital markets. The firm is also ranked by Chambers and Partners in its FinTech and Europe guides.

Data protection and ICT are a core part of our fintech practice. Credit institutions, payment and e-money institutions and other fintech companies deal with GDPR and DORA every day. Read more in our insight on data protection in fintech companies. We also work with telecommunications, defense technology and logistics businesses.

Our advice is practical. We prepare procedures your teams can use, documents that match how your systems work, and evidence you can show a supervisory authority.

ECOVIS ProventusLaw operates across Lithuania, Latvia and Estonia and is part of the ECOVIS International network, present in more than 90 countries worldwide. This allows us to support clients on cross-border processing and multi-jurisdictional matters.