News

the 'policy situation' surrounding Transaction Monitoring Netherlands ⇄

A partial granting of a Woo decision (Ministry of Finance) regarding the 'policy situation' surrounding Transaction Monitoring Netherlands.

Which success factors, clarities, ambiguities, bottlenecks, and gaps regarding the admissibility requirements and procedural rules are experienced by professionals active in the field of the 305a action? ⇄

WODC report 'Five years of WAMCA. Evaluation of the Mass Damage Settlement in Collective Action Act (2020-2025)'. "This legislative evaluation examines how the collective action…

Short : ⇄

"The research is structured around three main questions: (1) What is the legal framework in various European countries for the collection of (online) data for the purpose of the…

SUWI Work Agenda Planning ⇄

SUWI work agenda planning. This contains more information regarding the planning of legislative proposals for inspection 'careful data exchange (legal bases)' and proactive…

Report 'Information Security within Digital Polling Station Tools' ⇄

Fact Sheet ⇄

Fact Sheet ⇄

“The cabinet endorses the importance of the protection of fundamental rights and appreciates that the Commission is also paying attention to this. Nevertheless, the cabinet…

Kort:

'This briefing analyses the establishment of the European Anti-Money Laundering Authority (AMLA) as a cornerstone of the EU’s 2024 Anti-Money Laundering/Countering the Financing…

an article published on the lobbying surrounding the Digital Omnibus ⇄

'Corporate Europe Observatory (CEO)', which describes itself as "a research and action group committed to exposing and tackling the privileged access and influence enjoyed by…

Baton Rouge Acquires a Straight-Up Military Surveillance Drone

The Baton Rouge Police Department announced this week that it will begin using a drone designed by military equipment manufacturer Lockheed Martin and Edge Autonomy, making it one…

EFF to California Appeals Court: First Amendment Protects Journalist from Tech Executive’s Meritless Lawsuit

EFF asked a California appeals court to uphold a lower court’s decision to strike a tech CEO’s lawsuit against a journalist that sought to silence reporting the CEO, Maury…

EFF Condemns FBI Search of Washington Post Reporter’s Home

Government invasion of a reporter’s home, and seizure of journalistic materials, is exactly the kind of abuse of power the First Amendment is designed to prevent. It represents…

Report: ICE Using Palantir Tool That Feeds On Medicaid Data

EFF last summer asked a federal judge to block the federal government from using Medicaid data to identify and deport immigrants. We also warned about the danger of the Trump…

So, You’ve Hit an Age Gate. What Now?

This blog also appears in our Age Verification Resource Hub: our one-stop shop for users seeking to understand what age-gating laws actually do, what’s at stake, how to protect…

#KeepItOn: Iran plunged into digital darkness, concealing human rights abuses

join the international community, including the UN’s Independent International Fact-Finding Mission, in calling on Iran to immediately restore internet and mobile communications…

SO Warszawa - Case C 310/23

Permanent link: The responsible party did not respond adequately and provided unclear information or referred the individual to third parties. As a result, the individual filed a…

CE - 492830

The Supreme Court has reduced the fine imposed on Amazon France Logistique by the Data Protection Authority from 32 million euros to 15 million euros. The court ruled that Amazon…

OGS Zagreb - Case number Pn-1378/2023-18.

Summary: A court has awarded €3,500 to a person whose financial data was accidentally sent to another customer by a bank. The court ruled that this unauthorized disclosure…

Frankfurt am Main Regional Court - Case Number 6 U 81/23.

The court awarded €100 in non-pecuniary damages for the storage and processing of cookies without the consent of the individual. While the violation was considered minor, and the…

Authority for the protection of personal data (Italy) - 10201989

The Italian data protection authority (DPA) has fined Verisure Italy €400,000 for unlawful marketing communications. The company lacked a valid legal basis for its marketing…

Article 39 of the GDPR (General Data Protection Regulation).

Commentary. Article 39 of the GDPR, titled "Tasks of the Data Protection Officer," describes the key responsibilities of the Data Protection Officer (DPO). This provision should…

AEPD (Spain) - EXP202500113

Facts: The data protection authority (DPA) has fined a bank €500,000 after documents belonging to a customer were lost during delivery by a courier service. The authority ruled…

OGS Zagreb - Case Number Pn-1378/2023-18 ⇄

English Summary: A court has awarded €3,500 to an individual whose financial data was accidentally sent by a bank to another customer. The court ruled that this unlawful…

SO Warszawa - C 310/23 ⇄

Permanent link: The data controller did not respond adequately and provided unclear information or referred the data subject to third parties. As a result, the data subject filed…

Article 39 of the GDPR (General Data Protection Regulation). ⇄

Commentary. Article 39 of the GDPR, titled "Tasks of the data protection officer", describes the primary responsibilities of the data protection officer (DPO). This provision must…

CNIL (France) - SAN-2025-015 ⇄

Permanent link: "Regarding the fairness of the procedure:" "Regarding the fairness of the procedure:" In the first instance, the data protection authority (DPA) rejected the…

ICO’s consultation on discounts for early settlement ends on 23 January

The ICO has issued a consultation to seek organisations’ views on the processes the ICO follows when it suspects a breach of the UK GDPR or the Data Protection Act 2018

Things to look out for in 2026

Editorial for UK Report January 2026

More ICO/Government cooperation: Less ICO focus on rights?

Blog for UK Report January 2026

#KeepItOn: Government of Uganda must ensure unrestricted internet access throughout the upcoming elections

Access Now appeals to you, President Yoweri Museveni, to ensure that people in Uganda have unfettered access to the internet, digital platforms, and all other communication…

#KeepItOn coalition raise the alarm on potential shutdown during upcoming elections in Uganda

As millions of people prepare to head to the polls in Uganda on January, 15 2026, Access Now and the #KeepItOn coalition — a global network of over 345 organizations from 106…

CNIL (France) - SAN-2025-015

The data protection authority (DPA) has imposed a fine of €1,700,000 on a data processor that had incorrectly configured a software program. This program processed files related…

ΔΔΚ - 1181/18

A university lecturer (the complainant) has requested access to the content of evaluation reports from independent reviewers and letters of recommendation that were prepared…

User:Claratab

CNIL (France) - SAN-2025-015 AEPD (Spain) - EXP202410264 AEPD (Spain) - EXP202410264

User: Avalang ⇄

Updated biography: "Ava", law student (LL.B), part-time study, is pursuing certification as a Data Protection Officer. Works full-time with databases for the regulation of…

User:Avalang

Updated bio. '''Ava''', LL.B parttime student, in the middle of getting certified as a data protection officer. Working with drug regulatory…

How Hackers Are Fighting Back Against ICE

Read more about how ICE has spent hundreds of millions of dollars on surveillance technology to spy on anyone—and potentially everyone—in the United States, and how to follow the…

Ordre du jour de la séance plénière du 8 janvier 2026

La Commission nationale de l'informatique et des libertés s’est réunie le jeudi 8 janvier 2026 à 9 h 30 avec l’ordre du jour suivant :

DSB (Austria) - 2025-0.276.820

An Austrian media company has been fined €6,820 by the Data Protection Authority because it failed to implement a binding instruction to modify the cookie banner on its website.…

CJEU - Case C-422/24 - AB Storstockholms Lokaltrafik

The Court of Justice of the European Union (CJEU) has ruled that when personal data is collected through cameras worn by inspectors in public transport, the obligation to provide…

VS Rijeka - Us I-199/2025-9 (This appears to be a reference number or code, and is best left as is.)

Facts: A court has declared the decision of the Dutch Data Protection Authority (AP) to reject a complaint regarding the General Data Protection Regulation (GDPR) to be invalid.…

VDAI (Lithuania) - Decision No. 3R-1700.

Facts: The data protection authority (DPA) ruled that a gambling operator had lawfully transferred data to a processor for the purpose of sending invitations to sporting events,…

BGH - I ZR 97/25 (This appears to be a legal citation and doesn't require translation.)

Facts: The court has ruled that the data retention period for information regarding completed payment defaults by private credit agencies is not automatically limited by rules for…

Court of Justice of the European Union - Case C-422/24 - AB Storstockholms Lokaltrafik.

A new page has been created with the following information: ""

AEPD (Spain) - EXP202306073

Facts: The Data Protection Authority has fined a telecommunications company €400,000 for unlawfully changing the ownership of a mobile phone subscription and issuing a dual SIM…

ICE to set up large-scale surveillance program. ⇄

Read more about how enterprising hackers have started projects to monitor the activities of ICE and learn how you can track the expenditures of the Department of Homeland…

VDAI (Litouwen) - Besluit nr. 3R-1700.

Feiten: De gegevensbeschermingsautoriteit (DPA) oordeelde dat een aanbieder van kansspelen gegevens op rechtmatige wijze heeft overgedragen aan een verwerker voor het versturen…

CAA - 23VE02156 ⇄

A court has dismissed the appeal of a patient who requested a correction of a medical report. The court ruled that a patient cannot request a correction of a medical examination,…

AEPD (Spain) - EXP202306073 ⇄

Facts: The Data Protection Authority has imposed a fine of 400,000 euros on a telephone company for unlawfully changing the ownership of a mobile phone subscription and issuing a…

KHO - KHO:2025:86 ⇄

The court has ruled that an insurance company may lawfully process the health data of an applicant for voluntary personal insurance during the application phase, under the…

BGH - I ZR 97/25 ⇄

Facts: The court has ruled that the retention period for data concerning settled payment arrears by private credit agencies is not automatically limited by rules for the erasure…

VS Rijeka - Us I-199/2025-9 ⇄

Facts: A court has annulled the decision of the Data Protection Authority (DPA) to dismiss a complaint concerning the General Data Protection Regulation (GDPR). The court…

USR - Reference number I-755/2025-8 ⇄

Facts: A court has ruled that a television station lawfully published a video containing personal data of a board member of a listed company, as this information served the public…

DSB (Austria) - 2025-0.276.820 ⇄

An Austrian media company (the controller) that published local news operated a website that collected personal data from visitors using cookies and a cookie consent banner. The…

ICE Is Going on a Surveillance Shopping Spree

Read more about how enterprising hackers have started projects to do counter surveillance against ICE, and learn how to follow the Homeland Security spending trail. U.S.…

The expenditures of the Department of Homeland Security: How to track money flows via US government databases. ⇄

This guide was written by Andrew Zuker, with support from the Heinrich Boell Foundation. The US government publishes vast amounts of detailed spending data, but searching through…

The Homeland Security Spending Trail: How to Follow the Money Through U.S. Government Databases

This guide was co-written by Andrew Zuker with support from the Heinrich Boell Foundation. The U.S. government publishes volumes of detailed data on the money it spends, but…

EFFecting Change: The Human Cost of Online Age Verification

Age verification mandates are spreading fast, and they’re ushering in a new age of online surveillance, censorship, and exclusion for everyone—not just young people. Age-gating…

Article 40 of the General Data Protection Regulation (GDPR).

(1) Promotion of codes of conduct and supervisory authorities: * EDPB, 'Guidelines 1/2019 on codes of conduct and supervisory authorities pursuant to Regulation 2016/679', June 4,…

Article 41 of the GDPR (General Data Protection Regulation).

(a) Demonstrable independence and expertise (a) Demonstrable independence and expertise (a) Demonstrable independence and expertise It is clear from Article 41(1) of the GDPR that…

Article 40 of the General Data Protection Regulation (GDPR). ⇄

(1) Promotion of codes of conduct and supervisory authorities: * EDPB, 'Guidelines 1/2019 on codes of conduct and supervisory authorities in accordance with Regulation 2016/679',…

Article 41 of the GDPR (General Data Protection Regulation). ⇄

(a) Demonstrable independence and expertise (a) Demonstrable independence and expertise. (a) Demonstrable independence and expertise. It is clear from Article 41(1) of the GDPR…

Article 40 of the GDPR (General Data Protection Regulation). ⇄

Commentary: Codes of Conduct (CoC) are voluntary instruments that establish specific data protection rules for certain categories of controllers and processors. In other words, a…

Caméras touristiques : la CNIL précise les règles à suivre pour protéger la vie privée des personnes

Les caméras dites « touristiques » utilisées par les communes ayant pour but de valoriser un territoire, ne devraient pas permettre la collecte de…

Trophées des classes 2026 - Ensemble, tous protégés sur Internet !

Le ministère de l’Éducation nationale et la CNIL organisent le concours Trophées des classes dont la thématique, pour cette édition, est « Comment je protège ma vie…

Surveillance and self-defense: A review of the year 2025.

Our guides on privacy protection and self-defense (Surveillance Self-Defense, SSD), which offer practical tips and explanations on how to deal with government and corporate…

The year states prioritized surveillance over security: a look back at 2025. ⇄

2025 was the year in which age verification shifted from a niche experiment to a widespread reality in the United States. Currently, half of the US states require age verification…

Surveillance Self-Defense: 2025 Year in Review

Our Surveillance Self-Defense (SSD) guides, which provide practical advice and explainers for how to deal with government and corporate surveillance, had a big year. We published…

The Year States Chose Surveillance Over Safety: 2025 in Review

2025 was the year age verification went from a fringe policy experiment to a sweeping reality across the United States. Half of the U.S. now mandates age verification for…

Attempts by the US Congress to restrict internet access based on age: a look back at 2025.

Under the guise of "protecting children online," Congress introduced legislation this year that could have severely compromised our privacy and restricted freedom of speech. These…

States attempted to censor the online activities of children. Courts and the Electronic Frontier Foundation (EFF) largely managed to prevent this: a look back at 2025.

In at least a dozen states, lawmakers believe they can pass laws that prohibit young people from accessing social media, or that require them to obtain parental consent before…

Congressional attempts to restrict internet access based on age: a look back at 2025. ⇄

In the name of "protecting children online," Congress introduced legislation this year that could have severely compromised our privacy and restricted freedom of expression. These…

States Tried to Censor Kids Online. Courts, and EFF, Mostly Stopped Them: 2025 in Review

Lawmakers in at least a dozen states believe that they can pass laws blocking young people from social media or require them to get their parents’ permission before logging on.…

Congress's Crusade to Age Gate the Internet: 2025 in Review

In the name of 'protecting kids online,' Congress pushed forward legislation this year that could have severely undermined our privacy and stifled free speech. These…

Legal measures to block websites are always a bad idea: a look back at 2025.

This year, we opposed the resurgence of a terrible idea that has not improved with time: laws that would allow for the blocking of websites. More than a decade ago, the U.S.…

Resistance to new attempts to make internet providers responsible for copyright compliance: A look back at 2025.

You may not be aware, given the numerous reports highlighting new questions about copyright and generative AI, but the biggest copyright case of the year revolves around a…

EFF investigations reveal surveillance abuse by Flock Safety: a 2025 retrospective. ⇄

Throughout 2025, EFF conducted groundbreaking research into Flock Safety's automated license plate recognition (ALPR) system, uncovering a system designed to enable mass…

Legal measures to block websites are always a bad idea: a look back at 2025. ⇄

This year, we resisted the return of a dreadful idea that has not improved over the years: laws that enable the blocking of websites. More than a decade ago, Congress attempted to…

Opposition to new attempts to turn internet service providers into copyright monitors: A retrospective on 2025. ⇄

You may not have noticed, given the numerous reports focusing on new questions regarding copyright and generative AI, but the biggest copyright case of the year concerned a…

Fighting Renewed Attempts to Make ISPs Copyright Cops: 2025 in Review

You might not know it, given the many headlines focused on new questions about copyright and Generative AI, but the year’s biggest copyright case concerned an old-for-the-internet…

Site Blocking Laws Will Always Be a Bad Idea: 2025 in Review

This year, we fought back against the return of a terrible idea that hasn’t improved with age: site blocking laws. More than a decade ago, Congress tried to pass SOPA and PIPA—two…

Künstliche Intelligenz: Datenschutz von Anfang an mitdenken

Künstliche Intelligenz: Datenschutz von Anfang an mitdenken

Programs with drones as first responders: a retrospective on 2025. ⇄

The deployment of drones as first responders (Drone First Responder, DFR) has truly gained momentum in 2025. Although the concept has existed since 2018, this year the technology…

EFF in the news: 2025 Review. ⇄

The lawyers, activists, and technologists at EFF not only do the difficult, ongoing work of defending our digital civil liberties but also devote significant time and energy to…

Operational Security (OPSEC) Trainings: A Review of 2025. ⇄

It is no secret that digital surveillance and other forms of technology-enabled oppression pose serious dangers to people active in liberation movements. The increasing trends of…

Drone as First Responder Programs: 2025 in Review

Drone as first responder (DFR) adoption really took off in 2025. Though the concept has been around since 2018, this year saw more normalization of the technology, its integration…

Operations Security (OPSEC) Trainings: 2025 in Review

It's no secret that digital surveillance and other tech-enabled oppressions are acute dangers for liberation movement workers. The rising tides of tech-fueled…

Avis et notations en ligne : quels sont les droits des professionnels ?

Les professionnels (médecins, avocats, notaires, etc.) sont de plus en plus évalués en ligne via des annuaires intégrant des systèmes de notation et de commentaires. La CNIL vous…

EFFector Audio: Speaking out for your rights – A look back at 2025. ⇄

This year, you may have heard EFF speaking out about our civil liberties on NPR, BBC Radio, or via various podcasts. But in 2025, we also began sharing our message directly with…

EFFector Audio Speaks Up for Our Rights: 2025 Year in Review

This year, you may have heard EFF sounding off about our civil liberties on NPR, BBC Radio, or any number of podcasts. But we also started sharing our voices directly with…

Online stores are generally not allowed to require customers to create an account in many cases.

Online stores are generally not allowed to require customers to create an account before they can make a purchase. This is according to new recommendations from the European Data…

Data Security: 1,700,000 euro fine imposed on NEXPUBLICA FRANCE ⇄

On December 22, 2025, the CNIL sanctioned NEXPUBLICA FRANCE with a fine of 1,700,000 euros for failing to implement sufficient security measures for its PCRM software, a user…

Royaume-Uni : la Commission européenne renouvelle ses décisions d’adéquation

La Commission européenne constatant que le Royaume-Uni continue d’assurer un niveau de protection substantiellement équivalent à celui de l’Union européenne, les transferts de…

La CNIL à Nantes pour sensibiliser à la protection des données personnelles

Les 9, 10 et 12 décembre, dans le cadre de la journée RGPD à Nantes, la CNIL a rencontré des élèves, médiateurs numériques et agents de la métropole. Au programme : des…

Le règlement sur les données (Data Act) : un nouveau cadre européen pour le partage et l’utilisation des données

Le règlement sur les données établit un cadre européen pour organiser le partage et l’utilisation des données des objets connectés. Il renforce les droits des utilisateurs et crée…

Data breach: one million euro fine imposed on MOBIUS SOLUTIONS LTD ⇄

On December 11, 2025, the CNIL sanctioned MOBIUS SOLUTIONS LTD, a processor responsible for a data breach affecting users of the company DEEZER. A fine of one million euros was…

Elektronische Patientenakte: Datenschutz stärkt Vertrauen und Nutzung

Elektronische Patientenakte: Datenschutz stärkt Vertrauen und Nutzung

Ordre du jour de la séance plénière du 18 décembre 2025

La Commission nationale de l'informatique et des libertés s’est réunie le jeudi 18 décembre 2025 à 9 h 30 avec l’ordre du jour suivant :

HAN has been fined €175,000 for inadequate protection of personal data.

The Dutch Data Protection Authority (AP) has fined HAN University of Applied Sciences (HAN) €175,000 for violating the General Data Protection Regulation (GDPR). An investigation…

TikTok illegally tracks your shopping behavior – and your use of dating apps. ⇄

TikTok tracks the activities of its users, even when they are using other apps. As a result, the video platform also knows which dating app you are using.

HAN fined 175,000 euros for insufficient security of personal data ⇄

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has imposed a fine of 175,000 euros on HAN University of Applied Sciences (HAN) for violating the General Data…

DPA warns users: TikTok continues to send personal data to China ⇄

For the time being, TikTok continues to send user data to, among others, China. In doing so, the company is acting against a joint decision by the European privacy regulators, who…

MTN Group must commission an independent investigation into potential human rights violations

Access Now and several human rights groups are deeply alarmed by the allegations of MTN Congo's enabling of human rights abuses.

MTN Group must answer for dangerous bounty SMS campaign in the Republic of Congo

Access Now,together with several human rights organizations, are calling on MTN Group to protect mobile service subscribers and ensure transparency and accountability for data…

G7-Datenschutzbehörden setzen gemeinsames Engagement für den internationalen Datenschutz fort

G7-Datenschutzbehörden setzen gemeinsames Engagement für den internationalen Datenschutz fort