On October 9, 2026, the Belgian Data Protection Authority (APD) issued a decision (available in French here) finding that a data exporter’s failure to conduct a Transfer Impact Assessment (TIA) rendered its EU Standard Contractual Clauses (SCCs) invalid. For companies sending personal data outside the EU, the message is clear: signing SCCs is only the […]
European Privacy & Cybersecurity
GDPR Meets DSA: Key Takeaways from the EDPB’s Final Guidelines
On 17 September 2026, the European Data Protection Board (EDPB) published its final guidelines on the interplay between the General Data Protection Regulation (GDPR) and the Digital Services Act (DSA) (available here). While the GDPR regulates the processing of personal data, the DSA seeks to create a safer and more transparent online environment by imposing […]
EU Regulators Outline GDPR Requirements for AI Web Scraping
On July 8, 2026, the European Data Protection Board (“EDPB”), the body that coordinates the EU’s national data protection authorities, published its first draft of Guidelines 03/2026 on web scraping in the context of generative AI (the “Guidelines”). The Guidelines address practical compliance challenges for companies that develop AI models or systems and scrape personal […]
Connected Vehicles Under the Spotlight: French DPA Issues Landmark Guidance on Vehicle Data Privacy
On 30 June 2026, the French Data Protection Authority (CNIL) published comprehensive new guidance on the processing of personal data generated by connected vehicles, with a particular focus on geolocation data (available in French here). For automotive manufacturers, suppliers, and mobility companies with operations or customers in the EU, this 60-page guidance provides much-needed clarity […]
Dutch DPA Fines Taxi App €100M Over Unlawful Transfers of Personal Data to Russia, Despite Use of EU Standard Contractual Clauses
On April 1, 2026, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) imposed a €100 million fine on MLU B.V., the Dutch operator of the Yango taxi app. The AP found that personal data of EU users was unlawfully transferred to affiliated entities in Russia, despite the formal use of the EU Standard Contractual Clauses […]