News

English Summary }}}} The DPA fined the Polish national postal operator €232k for a DPO conflict of interest. The DPO concurrently served as a Security Director and company proxy, effectively monitoring their own decisions regarding the means of data processing.The DPA fined the national postal operator €232,000 for appointing a DPO with a conflict of interest. The DPO concurrently served as a Security Director and representative of the controller, effectively monitoring their own decisions regar

Earlier this month, Iran’s internet connectivity faced one of its most severe disruptions in recent years with a near-total shutdown from the global internet and major restrictions on mobile access. EFF joined architects, operators, and stewards of the global internet infrastructure in calling upon authorities in Iran to immediately restore full and unfiltered internet access. We further call upon the international technical community to remain vigilant in monitoring connectivity and to support

News from the European Union.

"This briefing analyzes the establishment of the European Authority for the Prevention of Money Laundering and the Financing of Terrorism (AMLA) as a key component of the reform of EU legislation on anti-money laundering and counter-terrorism financing (AML/CFT) in 2024. Now that AMLA has officially commenced its operations in the summer of 2025, a crucial question arises..."

Government

Een gedeeltelijke inwilliging van een Woo-besluit (Ministerie van Financiën) inzake de 'beleidssituatie' rondom Transactie Monitoring Nederland. (TMNL)

EU News

'This briefing analyses the establishment of the European Anti-Money Laundering Authority (AMLA) as a cornerstone of the EU’s 2024 Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) legislative reform. As AMLA formally began its operations in the summer of 2025, a key question ...

Government.

A partial granting of a request under the Public Access of Information Act (Ministry of Finance) regarding the "policy situation" surrounding Transaction Monitoring Netherlands (TMNL).

(3) Controllers and Processors not Subject to the Territorial Scope of the GDPR The focus on a particular sector is supposed to allow for a cost effective way to achieve data protection compliance by taking into account all the specific characteristics of processing carried out in that sector - with particular emphasis on the needs of micro, small and medium enterprises.<ref>EDPB, ‘Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679’, 4 June 2019 (Version

Legal Text: Commentary ==Commentary====Commentary== Article 41 GDPR complements [[Article 40 GDPR]] by providing that compliance with any approved code of conduct must be monitored by an accredited body with the appropriate level of expertise in the sector covered by the code. Although the Data Protection Directive 95/46/EC (DPD) included a provision on codes of conduct (Article 27(1) DPD), this did not include any information on how compliance with such codes should be monitored. Accordingly, i

(1) Encouragement of CoC <u>EDPB Guidelines</u>:<u>EDPB Guidelines</u>: * EDPB, ‘Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679’, 4 June 2019 (Version 2.0) (available here), and * EDPB, ‘Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679’, 4 June 2019 (Version 2.0) (available [https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201901_v2.0_codesofconduct_en.pdf here]), and * E

Legal text: Explanation ==Explanation====Explanation== Article 41 of the GDPR supplements [[Article 40 of the GDPR]] by stipulating that compliance with an approved code of conduct must be monitored by a recognized body with the appropriate level of expertise in the sector covered by the code. While the Data Protection Directive 95/46/EC (GDPR) contained a provision regarding codes of conduct (article 27(1) GDPR), it did not provide information on how compliance with such codes should be monitored. Therefore, i

Juridische tekst: Toelichting ==Toelichting====Toelichting== Artikel 41 van de AVG vult [[Artikel 40 van de AVG]] aan door te bepalen dat de naleving van een goedgekeurd gedragscode moet worden gecontroleerd door een erkende instantie met het juiste niveau van expertise in de sector die door de code wordt bestreken. Hoewel de Richtlijn gegevensbescherming 95/46/EG (AVG) een bepaling bevatte over gedragscodes (artikel 27(1) AVG), bevatte deze geen informatie over hoe de naleving van dergelijke codes moest worden gecontroleerd. Daarom, i

Commentary CoC are a voluntary accountability tool providing for specific data protection rules for categories of controllers and processors. In other words, CoC can provide a rule book for a group of controllers and processors describing how a GDPR compliant processing operation looks like in the specific processing situation.<ref>EDPB, ‘Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679’, 4 June 2019 (Version 2.0), margin number 7 (available [https://ww

(a) Demonstrated independence and expertise ===== (a) Demonstrated independence and expertise ========== (a) Demonstrated independence and expertise ===== It is clear from Article 41(1) GDPR that the body must have an “''appropriate level of expertise''” in the subject matter the code of conduct aims to ensure effective compliance with. This is also a requirement of the process specified in Article 41(2)(a) GDPR, according to which the monitoring entity “''may be ac

In at least a dozen states, lawmakers believe they can pass laws that prohibit young people from accessing social media, or that require them to obtain parental consent before logging in. Fortunately, almost all courts that have reviewed these laws have ruled that they violate the constitution. It's not just the courts telling these lawmakers they are wrong. The Electronic Frontier Foundation (EFF) has filed briefs with courts across the country over the past year, explaining how these laws violate the freedom of speech of young people, as protected by the First Amendment.

Lawmakers in at least a dozen states believe that they can pass laws blocking young people from social media or require them to get their parents’ permission before logging on. Fortunately, nearly every trial court to review these laws has ruled that they are unconstitutional. It’s not just courts telling these lawmakers they are wrong. EFF has spent the past year filing friend-of-the-court briefs in courts across the country explaining how these laws violate young people’s First Amendment right

Throughout 2025, EFF conducted groundbreaking research into Flock Safety's automated license plate recognition (ALPR) system, uncovering a system designed to enable mass surveillance and vulnerable to serious abuse. Our research led to investigations at the state and federal levels, resulted in significant legal challenges, and exposed a dangerous expansion into voice recognition technology. We documented how Flock's surveillance infrastructure allowed law enforcement to track protestors exercising their right to...

This article highlights alternatives that are evidence-based and strengthen the safety of children, while simultaneously protecting encryption and fundamental rights. It advocates for better enforcement, more targeted tools, and meaningful support for services that focus on child protection, rather than broad surveillance measures. The article "Beyond 'Chat Control': Towards solutions that truly protect children and privacy" originally appeared on European Digital Rights (EDRi).

Brussels, 28 November - The EDPB launched a call for expression of interest to establish a new reserve list for the Support Pool of Experts (SPE) programme. The objective is set up a reserve list of legal and technical experts. The legal expertise sought includes a wide range of fields, such as data protection, policy monitoring, technology, cybersecurity, competition, healthcare, online intermediary services and content moderation. As for the technical expertise, the relevant areas include IT a

Brussel, 28 november - Het EDPB heeft een oproep gepubliceerd om interesse te tonen voor het opstellen van een nieuwe reservepool voor het programma "Support Pool of Experts" (SPE). Het doel is het samenstellen van een reservepool van juridische en technische experts. De gezochte juridische expertise omvat een breed scala aan gebieden, zoals gegevensbescherming, beleidsmonitoring, technologie, cyberveiligheid, concurrentierecht, gezondheidszorg, online intermediaire diensten en contentmoderatie. Met betrekking tot de technische expertise omvatten de relevante gebieden onder meer IT.

Brussels, November 28th - The European Data Protection Board (EDPB) has published a call for expressions of interest for the creation of a new reserve pool for the "Support Pool of Experts" (SPE) program. The objective is to assemble a reserve pool of legal and technical experts. The legal expertise sought covers a wide range of areas, including data protection, policy monitoring, technology, cybersecurity, competition law, healthcare, online intermediary services, and content moderation. Regarding technical expertise, relevant areas include IT.

Since September 2025, the General Data Protection Regulation (GDPR) has been in effect. This new European regulation aims to give consumers within the EU more control over the use of their data. In the Netherlands, enforcement of the GDPR has also begun, as the Implementation Act for the GDPR came into force on November 21st. In the Netherlands, the Authority for Consumers and Markets (ACM) and the Data Protection Authority (AP) are responsible for monitoring compliance.

The results of a controlled experiment using Proctorio, an online system for monitoring exams, indicate that the system is not effective in detecting cheating.

Government.

The report "Monitoring of Inclusive Education in Vocational Education - Measurement 2024" also provides several examples that demonstrate that teachers and institutions alike struggle with data sharing, and particularly lack clarity on when they are permitted to share information and when they are not. (See pages 12 & 29).

Government

Rijksbreed AVG-onderzoek 2024. Deelrapporten van de Auditdienst Rijk (ADR) over het rijksbrede AVG-onderzoek naar de inrichting en implementatie van privacy by design & default en de opvolging en monitoring van de resultaten uit Data Protection Impact Assessment (DPIA's).Deelrapport BZK

The publication of its activity report enables the CNIL to report on its actions with regard to its four major missions: inform and protect the general public, accompany and advise professionals and public authorities, anticipate and innovate to build the digital of tomorrow, and finally monitor and sanction breaches of the General Data Protection Regulation (GDPR) and the French law.     Download the 2022 annual report (in French) Informing and protecting The actions carried out this year

> Read through the most interesting developments at the intersection of human rights and technology from the Netherlands. This is the second update in this series.

> Personal data protection and whistleblowing are two different topics — different regulations with different purposes, scope and requirements. But, in fact, they are closer than they seem, especially for practical reasons. Both data protection governance and whistleblowing systems are often exercised by the same unit —  the compliance department — or even by the same person. This solution offers several advantages, but also some problematic points that need to be highligh

Een overzicht van de boete die aan IAPP is opgelegd: https://iapp.org/news/a/a-rundown-of-the-greek-dpas-clearview-ai-fine-findings

A rundown of the fine on IAPP: https://iapp.org/news/a/a-rundown-of-the-greek-dpas-clearview-ai-fine-findings

> On October 14, 2022, the Federal Trade Commission announced it is extending the deadline by one month to submit comments on its Advanced Notice of Proposed Rulemaking on commercial surveillance and lax data security practices.

Op 14 oktober 2022 heeft de Federal Trade Commission aangekondigd dat de deadline voor het indienen van commentaren op haar voorlopige voorstel voor regelgeving over commerciële surveillance en inadequate databeveiligingspraktijken met een maand wordt verlengd.

> GDPR RISK ASSESSMENT is intended to assist controllers and processors to identify the risk factors for the rights and freedoms of data subjects whose data are present in the processing, to make an initial assessment of the intrinsic risk, including the need to perform a DPIA, and to estimate the residual risk if measures and safeguards are used to mitigate the specific risk factors.

De GDPR-risicoanalyse is bedoeld om controllers en verwerkers te helpen bij het identificeren van de risicofactoren voor de rechten en vrijheden van de betrokkenen, wiens gegevens worden verwerkt. Het doel is om een eerste inschatting te maken van het inherente risico, inclusief de noodzaak om een Privacy Impact Assessment (DIA) uit te voeren, en om het resterende risico te schatten als maatregelen en beveiligingsmechanismen worden gebruikt om specifieke risicofactoren te verminderen.

The Danish Data Protection Agency has looked into the tool Google Analytics and its settings, and the terms under which the tool is provided. On the basis of this review, the Danish Data Protection Agency concludes that the tool cannot, without more, be used lawfully. Lawful use requires the implementation of supplementary measures in addition to the settings provided by Google.

De Deense Autoriteit voor Persoonsgegevens heeft onderzoek gedaan naar het instrument Google Analytics en de bijbehorende instellingen, evenals de voorwaarden waaronder het instrument wordt aangeboden. Op basis van dit onderzoek concludeert de Deense Autoriteit voor Persoonsgegevens dat het instrument, zonder aanvullende maatregelen, niet op een wettelijke manier kan worden gebruikt. Wettelijk gebruik vereist de implementatie van aanvullende maatregelen, naast de instellingen die door Google worden aangeboden.

> The fine is the result of an investigation that began in 2020 and focused on the company’s processing of children’s personal data. Based on press reports, the investigation focused on children between the ages of 13 and 17 who were allowed to operate business or creator Instagram accounts. As a result, children’s phone numbers and email addresses were publicly accessible.

De boete is het resultaat van een onderzoek dat in 2020 is begonnen en zich richtte op de manier waarop het bedrijf persoonlijke gegevens van kinderen verwerkte. Op basis van berichten in de media richtte het onderzoek zich op kinderen tussen de 13 en 17 jaar oud die toestemming hadden om zakelijke of creatieve Instagram-accounts te gebruiken. Hierdoor waren telefoonnummers en e-mailadressen van kinderen openbaar toegankelijk.

> The proposed fine follows complaints filed by privacy NGO ‘Privacy International’ against Criteo. […] Under the CNIL’s sanction procedure, Criteo has the right to respond to the report, both with respect to the alleged infringements and the proposed sanction.

De voorgestelde boete volgt op klachten die de privacyorganisatie "Privacy International" heeft ingediend tegen Criteo. [...] In het kader van de sanctieprocedure van de CNIL heeft Criteo het recht om te reageren op het rapport, zowel met betrekking tot de vermeende overtredingen als de voorgestelde sanctie.

> DeFine is a translation into a calculator of part of the methodology proposed by the European Data Protection Board to calculate GDPR fines (see EDPB, Guidelines 04/2022 on the calculation of administrative fines under the GDPR, 12 May 2022, available online; it was subject to a public consultation until 27 June 2022).

> Do we need an Chief Privacy Officer, a Data Protection Officer, or do we need both?In the following article, I will examine the benefits of both roles, but I will also look at some of the challenges related to each of the roles and why these have impelled both Data Protection Officers and organisations to question what the ideal setup is for them.