Brussels, 29 January - The EDPB organises a remote event to collect stakeholders’ input on its Guidelines on the processing of personal data to target or deliver political advertisements under the regulation on the transparency and targeting of political advertising. The event will take place on 27 March 2026 (time to be confirmed). This will be an opportunity to inform and support the EDPB’s ongoing work on this topic as per its work programme 2024-2025 and it reflects the EDPB’s commitment to stakeholder engagement, as outlined in the recent Helsinki statement. Find out more: Discussion

Brussels, 28 January - Every day, the European Data Protection Authorities (DPAs) that make up the EDPB work together to ensure the protection of individuals’ personal data. When it comes to children's data, extra vigilance is essential, particularly in today's fast-evolving digital environment where new risks emerge constantly. Children are more at risk online than adults because they do not easily recognise dangers, tend to trust strangers too much, and may share personal data without realising. The apps they use often collect their data and, without adequate protections, they can be exposed

Brussels, 21 January - The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have adopted a Joint Opinion on the European Commission’s Proposal for the ‘Digital Omnibus on AI’. The Proposal seeks to simplify the implementation of certain harmonised rules under the AI Act to ensure their effective application. The EDPB and the EDPS support the objective of addressing practical challenges relating to the implementation of the AI Act. Administrative simplification must not, however, lower the protection of fundamental rights. The Joint Opinion acknowledges

Brussels, 19 January - During its latest plenary, the EDPB adopted a report to support the European Commission’s evaluation of the Law Enforcement Directive (LED). The Commission has to submit its public report* on the evaluation and review of this Directive to the European Parliament and to the Council by 6 May 2026. Ahead of this, the Commission gathered the views of the European Data Protection Authorities (DPAs) on the application and functioning of the LED over the period from January 2022 to 31 August 2025.** “We welcome the European Commission’s regular evaluations of the application of

Brussels, 4 December - During its latest plenary, the EDPB adopted recommendations on the legal basis for requiring the creation of user accounts on e-commerce websites. In addition, the Board had a preliminary discussion on the Digital Omnibus proposal and appointed the new EDPB Deputy Chair. Internet users visit e-commerce websites for a variety of reasons, including making online purchases, taking advantage of promotions, or simply browsing products. When interacting with these websites, they may be asked to create an account, which can result in the collection and processing of personal

Brussels, 3 December - As part of its December’s plenary meeting, the European Data Protection Board (EDPB) held yesterday an online meeting with Commissioners and representatives of Data Protection Authorities (DPAs) from the countries and the organisation with an EU adequacy decision. This meeting marked the second of its kind, following the first gathering in October 2024. An adequacy decision is a key-mechanism in EU data protection legislation which allows free flow of personal data from Europe to third countries or an international organisation offering an adequate level of data

Brussels, 28 November - The EDPB launched a call for expression of interest to establish a new reserve list for the Support Pool of Experts (SPE) programme. The objective is set up a reserve list of legal and technical experts. The legal expertise sought includes a wide range of fields, such as data protection, policy monitoring, technology, cybersecurity, competition, healthcare, online intermediary services and content moderation. As for the technical expertise, the relevant areas include IT auditing, website security, mobile OS and apps, Internet of Things, cloud-computing, behavioural

Background information Date of final decision: 18 Semptember 2025 National case Controller: SAMARITAINE SAS Legal Reference: obligation to process data lawfully and breach of the principle of liability (articles 5-1-a) and 5-2 of the GDPR); Failure to collect adequate, relevant and necessary data (article 5-1-c) of the GDPR); Failure to involve the Data Protection Officer in matters relating to the protection of personal data (article 38-1 of the GDPR) Decision: administrative fine Key words: CCTV cameras, hidden cameras Summary of the Decision Origin of the case In August 2023, due to the

Background information Date of final decision: 10 July 2025 National case Controller: Banco Bilbao Vizcaya Argentaria SA Legal Reference (s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 15 (Right to access by the data subject) Decision: Administrative fine Key words: Administrative fine, Data subject rights, Transparency Summary of the Decision Origin of the case A customer, who was the victim of fraud, contacted the bank to obtain recordings of calls made to customer service, which would be useful in contesting

Background information Date of final decision: 23 October 2025 National case Legal Reference (s): Article 5 (Principles relating to processing of personal data), Article 25 (Data protection by design and by default), Article 32 (Security of processing) Decision: Administrative fine, Reprimand Key words: Administrative fine, Data protection by design and by default, Data security, Personal data breach, Third party access to personal data Summary of the Decision Origin of the case Aktia Bank's strong electronic authentication service experienced a disruption due to a technical change In January