Resources

Multidisciplinary Perspectives on Artificial Intelligence and the Law by Springer

AI, Specific processing situations

Artificial Intelligence Security Governance Framework 1.0 by China Cybersecurity Standardization Technical Committee

AI, Specific processing situations

Global Approaches to Auditing Artificial Intelligence by IPIE

AI, Specific processing situations

Frequently Asked Questions (FAQs) on the Data Act by the EU Commission

Controllers and Processors, Data Sharing

Safe and responsible AI in Australia Proposals paper for introducing mandatory guardrails for AI in high-risk settings by Australian Government

AI, Specific processing situations

Voluntary AI Safety Standard by the Australian Government

AI, Specific processing situations

FBI Audit Reveals Major Data Handling Flaws

Technical and Organisational Measures (TOMs)

Council of Europe Unveils First Global AI Treaty

Irish Watchdog Ends Case Against X Following AI Data Restrictions

Meta CAN Use Brazilian User Data for AI Training with Restrictions

Demonstration of a privacy-preserving age verification process by CNIL

Children as data subjects, Data Subjects Rights

Recommendation 1: Regulate the capacity of children to act online by CNIL

Children as data subjects, Data Subjects Rights

Recommendation 2: Encourage children to exercise their rights by CNIL

Children as data subjects, Data Subjects Rights

Recommendation 3: Support parents with digital education by CNIL

Children as data subjects, Data Subjects Rights

Recommendation 4: Seek parental consent for children under 15 by CNIL

Children as data subjects, Consent, Data Subjects Rights, Lawfulness of Processing

Recommendation 5: Promote parental controls that respect the child’s privacy and best interests by CNIL

Children as data subjects, Data Subjects Rights

Recommendation 6: Strengthen the information and rights of children by design by CNIL

Children as data subjects, Data Subjects Rights

Recommendation 7: Check the age of the child and parental consent while respecting the child’s privacy by CNIL

Children as data subjects, Data Subjects Rights

Online age verification: balancing privacy and the protection of minors by CNIL | French

Children as data subjects, Data Subjects Rights

Online age verification: balancing privacy and the protection of minors by CNIL

Children as data subjects, Data Subjects Rights

Effective Cyber Risk Management: A best practice governance guide for digitally secure and resilient organisations by Governance Institute of Australia

Cybersecurity, Risk Management

GDPR in practice – Experiences of data protection authorities by FRA

Data Processing by the Government, Specific processing situations

Briefing EU Legislation in Progress by EPRS on AI Act

AI, Specific processing situations

NSW report: Artificial intelligence in New South Wales

AI, Specific processing situations

Australian Information Commissioner (OAIC): Corporate Plan for 2024-25

Data Processing by the Government, Specific processing situations

Saudi Data & Artificial Intelligence Authority: Rules governing the appointment of Personal DPOs under the Kingdom of Saudi Arabia’s (KSA) Personal Data Protection Law (PDPL)

AI, Specific processing situations

Massive Data Breach: Exposed 31.5 Million Sensitive Records from ServiceBridge

Data Breaches

OpenAI and Anthropic Partner with U.S. Government for AI Safety Research

Dutch DPA Fines Clearview €30.5M: Directors Could be Held Liable

Data Subjects Rights

California’s New AB 3048: Opt-Out Signals in Every Browser

Personal Data Collection

Telegram CEO’s Arrest Sparks Debate on Privacy vs. Regulation

Cybersecurity, Personal Data Collection

Uber Fined €290 Million for GDPR Violations Over Data Transfers to the U.S.

Data Sharing, Data Transfers

EU Parliament Faces noyb Complaints After Major Data Breach

Data Breaches

AI Meets Media: OpenAI Secures Another Multi-Year Deal with Media Giant

UNESCO: Consultation paper on AI Regulation

AI, Lawfulness of Processing, Public Interests, Specific processing situations

Noyb Complaint Case: C-082-01 to EU Data protection Supervisor against EU Parliament

Controllers and Processors, Data Breaches, Public Administrative Body

Noyb Complaint Case: C-082-02 to EU Data protection Supervisor against EU Parliament

Controllers and Processors, Data Breaches, Public Administrative Body

Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on adapting non-contractual civil liability rules to artificial intelligence (AI Liability Directive)

AI, Liability and Penalties, Specific processing situations, Supervisory Authorities

Emerging digital technologies in the public sector report by EU Commission

New technology

Decision by Dutch Data Protection Authority to impose an administrative fine on Uber |English

Controllers and Processors, Data Breaches, Data Subjects Rights

Decision by the Federal Administrative Court Austria W137 2252081-1/6E (german)

Consent, Lawfulness of Processing

X Closes Brazil Operations Citing “Censorship Orders” from Judge

Supervisory Authorities

ICO Provisional £6 Million Penalty for Software Provider Following NHS Data Breach

Data Breaches

NPD Confirms Major Breach: Sensitive Data of Millions Exposed

Data Breaches

Google’s Gemini AI on Android with Enhanced Privacy Features

AI, Data Subjects Rights

The State of Artificial Intelligence in the Pacific Islands

AI, Specific processing situations

Consumer Protection in respect of Use of Generative Artificial Intelligence by Hong Kong Monetary Authority

AI, Specific processing situations

Policy for the responsible use of AI in government by Australian Government

AI, Data Processing by the Government, Specific processing situations

AI models collapse when trained on recursively generated data

AI, Specific processing situations

South Africa National Artificial Intelligence Policy Framework

AI, Specific processing situations

ON THE ANTITRUST IMPLICATIONS OF EMBEDDING GENERATIVE AI IN CORE PLATFORM SERVICES BY SSRN

AI, Specific processing situations

NIST Special Publication_1800: Implementing a Zero Trust Architecture

Cybersecurity

AT&T Privacy Policy

Data Subjects Rights

Conformally Privacy Policy Generator

Data Subjects Rights

UK ICO Privacy Policy Generator

Data Subjects Rights

UK ICO Enforces Data Protection: Reprimands and New Privacy Tech with Meta

Cybersecurity

Meta and OpenAI Unveil New AI Models: Llama 3.1 and SearchGPT

Grok AI Training on X’s Users Data by Default Sparks Investigation

AI, Consent, Data Sharing

EU AI Act Now in Force: Prepare for Compliance

Lithuanian SA Fines Vinted UAB €2.38 Million for GDPR Violations

Data Sharing, Personal Data Collection

KOSPA Passed by Senate: Strengthening Online Protections for Children and Teens

Children as data subjects

Meta Challenges EDPB Opinion on “Consent or Pay” Model at EU Court

Consent

Noyb Files Nine Complaints Against Twitter/X for Unlawful AI Data Usage

Consent, Legitimate Interest

Google Officially Declared a Monopoly by U.S. Federal Judge

Competition law

CNIL open source PIA software – data protection impact assessment

Data Protection Impact Assessment (DPIA)

NIST Special Publication_1800-29 Data Confidentiality- Detect, Respond to, and Recover from Data Breaches

Controllers and Processors, Data Breaches

Data protection compliant AI by Bavarian State Office for Data protection Supervision

AI, Specific processing situations

Website privacy controls a guide for business by New York State Attorney General

Data Subjects Rights, Website privacy

Noyb Sues Hamburg DPA Over ‘Pay or OK’ Consent System

Consent, Lawfulness of Processing

Meta Faces $1.4 Billion Penalty for Unauthorized Biometric Data Collection in Texas

Liability and Penalties, Supervisory Authorities

Securing Artificial Intelligence: Mitigation Strategy Report by ETSI

AI, Specific processing situations

The NSW AI Assessment Framework

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Relying on the legal basis of legitimate interests to develop an AI system by CNIL

Lawfulness of Processing, Legitimate Interest

Data protection code of practice for digital identity schemes in Afrtica

Code of Conduct, Controllers and Processors

Case 3:24-cv-04710-TSH DAVID MILLETTE VS OPENAI

Data Subjects Rights

Meta Platforms Ireland v EDPB (Case T-319/24)

Controllers and Processors, Data Sharing, Data Subjects Rights

DECISION UK ICO Snap Inc. and Snap Group Limited

Data Subjects Rights

Formal Opinion 512 on Generative Artificial Intelligence Tools by AMERICAN BAR ASSOCIATION

AI, Specific processing situations

The government-wide vision on Generative Al of the Netherlands

AI, Data Processing by the Government, Specific processing situations

Annual Report 2023 NOYB

Data Subjects Rights

Final State of Texas v Meta Order 2024

Facial Recognition, Specific processing situations

Frequently Asked Questions (FAQ) NIS2 in Belgium by Centre for cybersecurity Belgium

Cybersecurity

Annual Report 2023 by Irish DPA

Data Subjects Rights

AI Possible Risks & Mitigations Named Entity Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

AI Possible Risks & Mitigations Optical Character Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

Second Report on the application of the General Data Protection Regulation by EU Commission

Data Subjects Rights, Data Transfers

The 10-Step Plan for Solid Privacy Compliance Based On The Most Common Fines

Office of the Privacy Commissioner of Canada Sweep Report 2024

Consent, Cookies, Lawfulness of Processing

Confidential Computing and Privacy: Policy Implications of Trusted Execution Environments by Future of Privacy Forum

AI, Specific processing situations

EU-U.S. DATA PRIVACY FRAMEWORK F.A.Q. FOR EUROPEAN BUSINESSES BY EDPB

Data Transfers

Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework by EDPB

AI, Specific processing situations

Responsible AI Governance in Africa: Prospects for Outcomes Based Regulation by African Observatory on Responsible AI

AI, Specific processing situations

JUDGMENT OF THE GENERAL COURT Case T‑1077/23 (ByteDance and EU Commission)

5310-C Privacy Threshold Assessments and Privacy Impact Assessments by Office of Information Security

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Case C‑461/22 CURIA

Data Controller, Definitions

Case C-394/23

Definitions, Processing of personal data

Addictive patterns in the processing of personal data Implications for data protection by AEPD

Definitions, Processing of personal data

Global Third Party Cybersecurity Breaches by SecurityScorecard

Controllers and Processors, Data Breaches

ENFORCEMENT ADVISORY NO. 2024-01 APPLYING DATA MINIMIZATION TO CONSUMER REQUESTS BY CALIFORNIA PRIVACY PROTECTION AGENCY

Data minimisation, Principles

AI system development: CNIL’s recommendations to comply with the GDPR

AI, Specific processing situations

Mobilizing the legal basis of legitimateinterest to develop an AI system by CNIL

AI, Specific processing situations

Data protection impact assessment for AI Solutions by Danish DPA

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

Consent Banner Report Overview of EU and national guidelines on dark patterns by NOYB

Consent, Lawfulness of Processing

Discussion Paper: Large Language Models and Personal Data by The Hamburg Commissioner for Data protection and freedom of information

AI, Specific processing situations

PRIVACY ENHANCING TECHNOLOGY (PET): PROPOSED GUIDE ON SYNTHETIC DATA GENERATION BY PDPC

Principles, Sensitive Data

AI Auditing Checklist for AI Auditing by EDPB

AI, Specific processing situations

EditorsTrends in Data Protection and Encryption Technologies by SpringerProfessional

Technical and Organisational Measures (TOMs)

BEYOND IMAGINATION : PLANNING FOR ONTARIANS’ DIGITAL FUTURE | 2023 annual report

Governance

Patent Landscape Report on Generative AI by WIPO

AI, Specific processing situations

Artificial Intelligence and Algorithms in Risk Assessment by the European Labour Authority

Risk Management

Today’s and tomorrow’s means of payment facing the challenge of data protection by CNIL

Definitions, Processing of personal data

Administrative fine against Grindr LLC by The Norwegian Data Protection Authority

Consent, Lawfulness of Processing, Principles, Sensitive Data

Generative AI Controls Framework Safe, Secure, and Compliant AI Adoption Approach Whitepaper by IBM

AI, Specific processing situations

Relying on the legal basis of legitimate interest to develop an AI system by CNIL

AI, Specific processing situations

National framework for the assurance of artificial intelligence in government by the Australian, state and territory governments

AI, Specific processing situations

AI, DATA GOVERNANCE AND PRIVACY SYNERGIES AND AREAS OF INTERNATIONAL CO-OPERATION BY OECD

AI, Specific processing situations

Guidelines 01/2023 on Article 37 Law Enforcement Directive by EDPB

Data Transfers

GDPR in practice: Experience of data protection authorities by FRA

Data Processing by the Government, Specific processing situations

Neurodata risks report by EDPS and Spanish DPA

AI, Specific processing situations

Artificial intelligence (AI) and human rights: Using AI as a weapon of repression and its impact on human rights by EU Parliament

AI, Specific processing situations

DECISION OF THE INFORMATION COMMISSIONER Snap Inc. and Snap Group Limited

AI, Specific processing situations

Case 4:23-cv-01110-P AHA v. Bacerra

Health Data, Principles, Sensitive Data

Principles on Children & Online Gaming Adopted at the Nordic Data Protection Meeting in Oslo 30 May 2024

Children as data subjects, Data Subjects Rights

Governance of artificial intelligence (AI) by House of Commons UK

AI, Specific processing situations

Supervision of AI systems in the EU by Dutch DPA and RDI (english)

AI, Specific processing situations

THE INTERSECTION BETWEEN COMPETITION AND DATA PRIVACY by OECD – OCDE

Data Subjects Rights

Case 2:24-cv-05140 by the attorney general of California

Consent, Controllers and Processors, Data Sharing, Lawfulness of Processing

Guidance document on how to approach the protection of personal data and commercially confidential information while using the Clinical Trials Information System (CTIS) Version 2 by EMA

Data Subjects Rights

Risk and control for artificial intelligence and machine learning systems by Cybernetica

AI, Specific processing situations

GDPR & Generative AI A Guide for Customers by Microsoft

AI, Specific processing situations

Report from Multistakeholder Expert group on GDPR application

Data Subjects Rights

Face Analysis Technology Evaluation: Age Estimation and Verification report by NIST

Facial Recognition

Orientations for ensuring data protection compliance when using Generative AI systems by EDPS

AI, Specific processing situations

AI Development Recommendations to Ensure GDPR Compliance by CNIL

AI, Specific processing situations

Opinion 11/2024 on the use of facial recognition to streamline airport passengers’ flow (compatibility with Articles 5(1)(e) and(f), 25 and 32 GDPR by EDPB

Facial Recognition

Exploring the ethical, technical and legal issues of voice assistants by CNIL

Voice Assistants

Guideline on the massive collection of personal data from the web for the training of generative artificial intelligence (GenAI) models by the Italian Data Protection Authority (Garante)

AI, Data scraping, Specific processing situations

Statement on the interplay between AI Act and GDPR for private sector by the The Austrian DPA

AI, Specific processing situations

Controller – Processor Assessment Tool

A Guide to ICO Audit Artificial Intelligence (AI) Audits by UK ICO

AI, Specific processing situations

Report of the work undertaken by the ChatGPT Taskforce bg EDPB

AI, Specific processing situations

Statement 2/2024 on the financial data access and payments package bg EDPB

Finance and Fintech

Convention on AI, Human Rights, Democracy and the Rule of Law – by the Council of Europe (draft)

The Colorado AI Act “Senate Bill SB24-205”

Review of cybersecurity news in Ukraine, tendencies, and world events related to the First World Cyber War by U.S. Agency for International Development

National Security, Specific processing situations

Comments on Guidelines 07/2020 on the concepts of controller and processor in the GDPR from the perspective of the Translation and Interpreting Sector by FIT Europe and EUATC

Controllers and Processors

GDPR & GENERATIVE AI – A GUIDE FOR THE PUBLIC SECTOR BY MICROSOFT

AI, Specific processing situations

The Standard Data Protection Model Version 3.0a by the Conference of Independent Federal and State Data Protection Supervisory Authorities Germany

Automated Decision-Making in Online Platforms: Protection Against Discrimination and Manipulation of Behavior

Automated Decision-making, Controllers and Processors

Data protection impact assessment on the processing of personal data on government Facebook Pages

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Orientation guide of the Conference of Independent Federal and State Data Protection Supervisory Authorities by the German Data Protection Conference (DSK)

AI, Specific processing situations

Regulating targeted and behavioural advertising in digital services by EU Parliament

Marketing and Advertising, Specific processing situations

Artificial Intelligence Risk Management Framework by NIST: Generative Artificial Intelligence Profile

AI, Risk Management, Specific processing situations

Guidelines scraping by private organizations and individuals by the Dutch Data Protection Authority

Automated Decision-making, Controllers and Processors

Rules of Procedure by EDPB on the cooperation and respective roles of national SAs and the EDPB Secretariat regarding the submission of complaints in the redress mechanism available to EU individuals in relation to alleged violations of U.S law with respect to their data collected by U.S. authorities competent for national security

Risk Management

Information note by EDPB on data transfers under the GDPR to the United States after the adoption of the adequacy decision on 10 July 2023

Adequacy Decisions, Data Transfers

Template Complaint Form to the U.S. Office of the Director of National Intelligence’s Civil Liberties Protection Officer (CLPO) by EDPB

Adequacy Decisions, Data Transfers

EU-US Data Privacy Framework Template Complaint Form for Submitting Commercial Related Complaints to EU DPAs by EDPB

Adequacy Decisions, Data Transfers

Rules of Procedure for the “Informal Panel of EU DPAs”according to the EU-US Data Privacy Framework by EDPB

Adequacy Decisions, Data Transfers

Information Note by EDPB on the redress mechanism for EU/EEA individuals in relation to alleged violations of U.S. law with respect to their data collected by U.S authorities competent for national security

Adequacy Decisions, Data Transfers

SUPERIOR COURT OF THE STATE OF CALIFORNIA COUNTY OF LOS ANGELES Case No. BC492959

Opinion 20/2021 on Tobacco Traceability System |EDPB

Controllers and Processors, Data Sharing

EDPB-EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)

AI, Specific processing situations

Opinion 32/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the Republic of Korea |EDPB

Adequacy Decisions, Data Transfers

Opinion 19/2021 on the draft decision of the competent supervisory authority of Hungary regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EDPB

Accreditation

Opinion 15/2021 regarding the European Commission Draft Implementing Decision pursuant to Directive (EU) 2016/680 on the adequate protection of personal data in the United Kingdom |EDPB

Adequacy Decisions, Data Transfers

Opinion 14/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the United Kingdom |EPDB

Adequacy Decisions, Data Transfers

Opinion 22/2021 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the CGI Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 21/2021 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the CGI Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 31/2021 on the draft decision of the Spanish Supervisory Authority regarding the Processor Binding Corporate Rules of the COLT Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 30/2021 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the COLT Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 29/2021 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of Oregon Tool, Inc (Formerly “Blount”) |EDPB

Binding Corporate Rules, Data Transfers

Opinion 28/2021 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules of Oregon Tool, Inc (formerly “Blount”) |EDPB

Binding Corporate Rules, Data Transfers

Opinion 27/2021 on the draft decision of the Supervisory Authority of North Rhine-Westphalia (Germany) regarding the Processor Binding Corporate Rules of the Internet Initiative Japan Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 26/2021 on the draft decision of the Supervisory Authority of North Rhine-Westphalia (Germany) regarding the Controller Binding Corporate Rules of the Internet Initiative Japan Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 18/2021 on the draft Standard Contractual Clauses submitted by the LT SA (Article 28(8) GDPR) |EDPB

Controllers and Processors, Data Transfers, Standard Contractual Clauses (SCC)

Opinion 17/2021 on the draft decision of the French Supervisory Authority regarding the European code of conduct submitted by the Cloud Infrastructure Service Providers (CISPE) |EDPB

Code of Conduct, Controllers and Processors

Opinion 16/2021 on the draft decision of the Belgian Supervisory Authority regarding the “EU Data Protection Code of Conduct for Cloud Service Providers” submitted by Scope Europe |EDPB

Code of Conduct, Controllers and Processors

Opinion 25/2021 on the draft decision of the competent supervisory authority of Lithuania regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EDPB

Accreditation

Opinion 24/2021 on the draft decision of the competent supervisory authority of Slovakia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EDPB

Code of Conduct, Controllers and Processors

Opinion 23/2021 on the draft decision of the competent supervisory authority of Czech Republic regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EDPB

Code of Conduct, Controllers and Processors

Deploying AI Systems Securely by NSA

AI, Specific processing situations

Perspectives on Issues in AI Governance by Google

AI, Specific processing situations

Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms by EDPB

Consent, Lawfulness of Processing

REGULATION (EU) 2024/900 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 13 March 2024 on the transparency and targeting of political advertising

PRACTICE GUIDE SECURITY OF PERSONAL DATA Version 2024 by CNIL

Definitions, Personal Data

Report and Recommendations of the New York State Bar Association Task Force on Artificial Intelligence

AI, Specific processing situations

The American Privacy Rights Act (APRA) section-by-section draft

American Privacy Rights Act Discussion Draft

Technical and organisational measures signed by Superhosting.bg

Controllers and Processors, Technical and Organisational Measures (TOMs)

Personal data breach report form

Controllers and Processors, Data Breaches

Technical and Organizational Measures by Adobe Cloud Services

Controllers and Processors, Technical and Organisational Measures (TOMs)

META PLATFORMS INC v. FEDERAL TRADE COMMISSION (2024)

Data Sharing Code of Practice by UK ICO

Controllers and Processors, Data Sharing

Generative Artificial Intelligence Risk Assessment by State of California Department of Technology

AI, Risk Management, Specific processing situations

Decision on the merits 46/2024 by the Belgian DPA

Access Requests (DSAR), Data Subjects Rights

Data Protection Fining Guidelines by UK ICO

Liability and Penalties, Supervisory Authorities

Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria |EPDB

Certification, Controllers and Processors

EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act)

Data Transfers

EDPB-EDPS Joint Opinion 1/2022 on the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2021/953 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic |EPDB

Health Data, Principles, Sensitive Data

Opinion 32/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the Republic of Korea |EPDB

Adequacy Decisions, Data Transfers

Opinion 04/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of Norican Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 07/2022 on the draft decision of the Hungarian Supervisory Authority regarding the Controller Binding Corporate Rules of MOL Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 05/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Lundbeck Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 06/2022 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of Groupon International Limited |EPDB

Binding Corporate Rules, Data Transfers

Opinion 08/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of Bioclinica Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 38/2021 on the draft decision of the competent supervisory authority of Latvia regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 37/2021 on the draft decision of the competent supervisory authority of Malta regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Accreditation

Opinion 36/2021 on the draft decision of the competent supervisory authority of Norway regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 35/2021 on the draft decision of the competent supervisory authority of Belgium regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 39/2021 on whether Article 58(2)(g) GDPR could serve as a legal basis for a supervisory authority to order ex officio the erasure of personal data, in a situation where such request was not submitted by the data subject |EPDB

Data Controller, Data Subjects Rights, Definitions

Opinion 34/2021 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules of Otis |EPDB

Binding Corporate Rules, Data Transfers

Opinion 33/2021 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules of Carrier |EPDB

Binding Corporate Rules, Data Transfers

Opinion 31/2021 on the draft decision of the Spanish Supervisory Authority regarding the Processor Binding Corporate Rules of the COLT Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 30/2021 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the COLT Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 03/2022 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the WEBHELP Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 02/2022 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the WEBHELP Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 10/2022 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Controller Binding Corporate Rules of Fresenius Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 09/2022 on the draft decision of the Danish Supervisory Authority regarding the Processor Binding Corporate Rules of Bioclinica Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 26/2022 on the draft decision of the Data Protection Authority of Bavaria for the Private Sector regarding the Controller Binding Corporate Rules of the Munich Re Reinsurance Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 24/2022 on the draft decision of the Swedish Supervisory Authority regarding the Processor Binding Corporate Rules of the Samres Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 23/2022 on the draft decision of the Swedish Supervisory Authority regarding the Controller Binding Corporate Rules of the Samres Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 22/2022 on the draft decision of the Liechtenstein Supervisory Authority regarding the Controller Binding Corporate Rules of Hilti Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 21/2022 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Ellucian Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 20/2022 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the Ellucian Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 19/2022 on the draft decision of the Baden-Württemberg (Germany) Supervisory Authority regarding the Controller Binding Corporate Rules of the MercedesBenz Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 18/2022 on the draft decision of the Baden-Württemberg (Germany) Supervisory Authority regarding the Controller Binding Corporate Rules of the Daimler Truck Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 25/2022 regarding the European Privacy Seal (EuroPriSe ) certification criteria for the certification of processing operations by processors |EPDB

Certification, Controllers and Processors

EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse

Children as data subjects, Data Subjects Rights

EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space

Health Data, Principles, Sensitive Data

Opinion 17/2022 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the ANTOLIN Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 16/2022 on the draft decision of the competent supervisory authority of Slovenia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 15/2022 on the draft decision of the competent supervisory authority of Luxembourg regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 14/2022 on the draft decision of the competent supervisory authority of Bulgaria regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 13/2022 on the draft decision of the competent supervisory authority of Bulgaria regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 12/2022 on the draft decision of the competent supervisory authority of France regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 11/2022 on the draft decision of the competent supervisory authority of Poland regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 17/2023 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Informatica Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 16/2023 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the Informatica Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 10/2023 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the PROSEGUR Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 9/2023 on the draft decision of the Italian Supervisory Authority regarding the Controller Binding Corporate Rules of Vertiv |EPDB

Binding Corporate Rules, Data Transfers

Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU-US Data Privacy Framework |EPDB

Adequacy Decisions, Data Transfers

Opinion 8/2023 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of Autodesk Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 7/2023 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of Autodesk Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 22/2023 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules for employee data of the UPS Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 21/2023 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of the UPS Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 20/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Comcast Corporation Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 19/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the American Express Global Business Travel Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 18/2023 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of the Collibra Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria |EPDB

Certification, Controllers and Processors

Opinion 14/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Vestas Wind Systems Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 13/2023 on the draft decision of the competent supervisory authority of Croatia regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 12/2023 on the draft decision of the competent supervisory authority of Cyprus regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 11/2023 on the draft decision of the competent supervisory authority of Sweden regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Accreditation

Opinion 32/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Ramboll Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 31/2022 on the draft decision of the Slovak Supervisory Authority regarding the Processor Binding Corporate Rules of Piano Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 30/2022 on the draft decision of the Slovak Supervisory Authority regarding the Controller Binding Corporate Rules of Piano Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 29/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the DSV Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 28/2022 on the Europrivacy criteria of certification regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 (GDPR) |EPDB

Certification, Controllers and Processors

Opinion 27/2022 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of LEYTON Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 6/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of Royal Greenland Group |EPDB

Binding Corporate Rules, Data Transfers

EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

Accreditation

EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro

Accreditation

Opinion 4/2023 on the draft decision of the competent supervisory authority of Malta regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 03/2023 on the draft decision of the competent supervisory authority of Romania regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 02/2023 on the draft decision of the competent supervisory authority of Latvia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to Article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 1/2023 on the draft decision of the competent supervisory authority of Croatia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to Article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 17/2023 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Informatica Group |EPDB

Binding Corporate Rules, Data Transfers

Recommendations 02/2021 on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions |EPDB

Consent, Lawfulness of Processing

Recommendations 01/2021 on the adequacy referential under the Law Enforcement Directive |EPDB

Adequacy Decisions, Data Transfers

Recommendations 02/2020 on the European Essential Guarantees for surveillance measures |EPDB

Specific processing situations, Surveillance

Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data |Version 2.0 |EPDB

Data Transfers

Recommendations 1/2022 on the Application for Approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR) |EPDB

Data Transfers

Recommendation 01/2019 on the draft list of the European Data Protection Supervisor regarding the processing operations subject to the requirement of a data protection impact assessment (Article 39.4 of Regulation (EU) 2018/1725) |EPDB

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Opinion 36/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Booking.com Group |EPDB

Data Transfers

Opinion 04/2024 on the notion of main establishment of a controller in the Union under Article 4(16)(a) GDPR |EPDB

Definitions, Main Establishment

Opinion 3/2024 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Accenture Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 2/2024 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the TELEFÓNICA Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 01/2024 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Booking.com Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 38/2023 on the draft decision of the competent supervisory authority of Slovenian regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR). |EPDB

Certification, Controllers and Processors

Opinion 37/2023 on the draft decision of the competent supervisory authority of Luxemburg regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Certification, Controllers and Processors

Opinion 35/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Carlsberg Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 34/2023 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Processor Binding Corporate Rules of the Cerner Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 33/2023 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Controller Binding Corporate Rules of the Cerner Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 32/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Thalès Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 31/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Thalès Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 30/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Sodexo Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 29/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Sodexo Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 28/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Servier Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 27/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Tessi Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 26/2023 on the draft decision of the Romanian Supervisory Authority regarding the Processor Binding Corporate Rules of the OSF Global Services Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 25/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the SHV Holding N.V. Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 24/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Nestlé Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 23/2023 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules for customer data of the UPS Group |EPDB

Binding Corporate Rules, Data Transfers

Rethinking Privacy in the AI Era | White Paper by Stanford University

AI, Specific processing situations

National Strategy to Advance Privacy-Preserving Data Sharing and Analytics by the EO by the US President

Biometric Data Guidance by the UK ICO

Principles, Sensitive Data

NIST Cybersecurity Framework 2.0: RESOURCE & OVERVIEW GUIDE

Comparison of U.S. State Privacy Laws. Data Protection Assessments by CIPL

Controllers and Processors, Data Protection Impact Assessment (DPIA)

A pro-innovation approach to AI regulation by UK ICO

AI, Specific processing situations

Case ZWO 22/775, Overijssel District, Netherlands

Liability and Penalties, Supervisory Authorities

EO 13800 on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure

PRESS RELEASE No 20/24 | Case C-118-22

Data Subjects Rights, Right to Erasure

THE NEW STANDARD CONTRACTUAL CLAUSES – QUESTIONS AND ANSWERS

Data Transfers, Standard Contractual Clauses (SCC)

EU-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

SWISS-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

[UK EXTENSION] EU-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

Transfer Impact Assessment (TIA) Template by HSE

Data Transfers

Transfer Risk Assessment Tool by the UK ICO

Data Transfers

Transparency and Consent Framework Policies by IAB Europe

Consent, Cookies, Lawfulness of Processing, Principles, Transparency

Analysis of the final compromise text of the EU AI Act with a view to agreement by the Belgian Presidency

AI, Specific processing situations

DRAFT RISK ASSESSMENT REGULATIONS FOR CALIFORNIA PRIVACY PROTECTION AGENCY

CASE STUDIES (2018 – 2023) by the Irish DPC

Access Requests (DSAR), Controllers and Processors, Data Breaches, Data Subjects Rights, Liability and Penalties, Supervisory Authorities

Datenschutzkonforme Künstliche Intelligenz Checkliste mit Prüfkriterien nach DS-GVO

AI, Specific processing situations

GDPR: a culture of non-compliance? Numbers of evidence-based enforcement efforts by nyob

Liability and Penalties, Supervisory Authorities

[UK] International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

Data Transfers

Guide to Technical and Organisational Data Protection Measures (TOM) by the Swiss FDPIC

Controllers and Processors, Technical and Organisational Measures (TOMs)

Recommendations 02/2020 on the European Essential Guarantees for surveillance measures

CCTV, Lawfulness of Processing, Legitimate Interest, Specific processing situations

NIST Critical Infrastructure Framework

NIST Privacy Framework v1

2023 Coordinated Enforcement Action Designation and Position of Data Protection Officers by EDPB

Controllers and Processors, Data Protection Officer (DPO)

Draft Impact Assessment Framework by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA)

One-stop-shop case digest on Security of Processing and Data Breach Notification by the EDPB

Controllers and Processors, Data Breaches, Technical and Organisational Measures (TOMs)

Artificial Intelligence Strategy of the CJEU

AI, Specific processing situations

Generative AI framework for HM Government by the UK Central Digital and Data Office

AI, Specific processing situations

[PROPOSAL 2024] EU AI ACT

Guide to Binding Corporate Rules by the UK ICO

Data Transfers

Report on the first review of the functioning of the adequacy decisions adopted pursuant to Article 25(6) of Directive 95/46/EC

Adequacy Decisions, Data Transfers

GUIDELINES CLOCKING AND ATTENDANCE CONTROL PROCESSING USING BIOMETRIC SYSTEMS BY THE AEPD

Employment, Principles, Sensitive Data, Specific processing situations

EU DATA ACT

Case C 683-2021

Controllers and Processors, Liability and Penalties, Supervisory Authorities

[Draft] Transfer Impact Assessment by the CNIL

Data Transfers

How to handle someone’s data subject access request when there is information about other individuals involved by the Irish DPA

Access Requests (DSAR), Data Subjects Rights

Privacy Notice Template by the UK ICO

Data Subjects Rights

Case T-1077/23

AI, Copyright, Specific processing situations

AI fairness in practice by the Alan Turing Institute

AI, Specific processing situations

(NEW JERSEY) ACT concerning [commercial Internet websites] online, services, consumers, and [personally identifiable information] personal data and supplementing Title 56 of the Revised Statutes

Interim Report – Governing AI for Humanity by UN AI Advisory Body

AI, Specific processing situations

Processing Personal Data on the Basis of Legitimate Interests under the GDPR by FPF

Lawfulness of Processing, Legitimate Interest

Information Commissioner’s Further Response to the Data Protection and Digital Information Bill (DPDI Bill)

Principles, Sensitive Data

GUIDELINES ON LEGITIMATE INTEREST by the NPC of the Republic of Philippines

Lawfulness of Processing, Legitimate Interest

The NYT vs OpenAI and Microsoft

AI, Copyright, Specific processing situations

Transparency in health and social care by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

Annex: A summary of the Transparency in Health and Social Care guidance impact assessment by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

[PRESS RELEASE No 191/23] CJEU on the right to compensation for non-material damages based on the fear of possible misuse

Liability and Penalties, Supervisory Authorities

[DRAFT] FRAMEWORK CONVENTION ON ARTIFICIAL INTELLIGENCE, HUMAN RIGHTS, DEMOCRACY AND THE RULE OF LAW

A Guide to Cookies and Compliance by DMA

Consent, Cookies, Lawfulness of Processing

[Press release] Commission opens formal proceedings against X under the Digital Services Act

Digital Services Act

RISK FRAMEWORK FOR BODY-RELATED DATA IN IMMERSIVE TECHNOLOGIES BY FPF

Principles, Sensitive Data

International data transfer agreement and guidance by the UK ICO

Data Transfers

[Draft] Guidelines on the processing of personal data in regard to employment by the UK ICO

Employment, Specific processing situations

[DRAFT] Data Confidentiality – Identifying and Protecting Assets Against Data Breaches by NIST

Controllers and Processors, Data Breaches

Understanding the Role of PETs and PPTs in the Digital Age

Controllers and Processors, Technical and Organisational Measures (TOMs)

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL LAYING DOWN HARMONISED RULES ON ARTIFICIAL INTELLIGENCE (ARTIFICIAL INTELLIGENCE ACT)

[Draft] Guidelines on the processing of personal data in regard to recruitment by the UK ICO

Automated Decision-making, Controllers and Processors, Data Protection Impact Assessment (DPIA), Employment, Specific processing situations

New rules for Artificial Intelligence – Questions and Answers by the European Commision

AI, Specific processing situations

Cybersecurity of Artificial Intelligence in the AI Act by the European Commision

Controllers and Processors, Technical and Organisational Measures (TOMs)

Privacy-Enhancing and Privacy Preserving Technologies: Understanding the Role of PETs and PPTs in the Digital Age by CIPL

Controllers and Processors, Technical and Organisational Measures (TOMs)

European Commision press release on AI Act Agreement

AI, Specific processing situations

Urgent Binding Decision 01/2023 requested by the Norwegian SA for the ordering of final measures regarding Meta Platforms Ireland Ltd (Art. 66(2) GDPR)

Liability and Penalties, Supervisory Authorities

Guidelines for evaluating differential priavacy gurantees by NIST

Anonymisation, Controllers and Processors, Technical and Organisational Measures (TOMs)

AI Act Provisional Agreement Press Release

AI, Specific processing situations

Privacy Impact Assessment Tool by the Australian Government

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Personal Data Protection Factsheet by the ECHR

Data Subjects Rights

Practical Guide on Controller to Processor Contracts by the Irish DPC

Controllers and Processors, Data Processing Agreement (DPA)

SME Guide on Information Security Controls by European Digital SME Alliance

Controllers and Processors, Technical and Organisational Measures (TOMs)

Guidelines issued by the Malta Gaming Authority for the Maltese Gaming Industry

Gaming, Specific processing situations

Press Release No 184-23 by the CJEU

Joint Controllers, Liability and Penalties, Supervisory Authorities

Everything Recruiters Need to Know About GDPR by ZOHO

Employment, Specific processing situations

Guidance on the Use of CCTV – For Data Controllers by the Irish DPC

CCTV, Specific processing situations

Benefits and Risks of Generative Artificial Intelligence Report by the State of California

AI, Specific processing situations

Guidelines for secure AI system development by UK NCSC and US CISA

AI, Specific processing situations

The impact of the General Data Protection Regulation (GDPR) on artificial intelligence by the EU Parliamnet

AI, Specific processing situations

AUTOMATED DECISIONMAKING TECHNOLOGY REGULATIONS (DRAFT) by CPPA

Automated Decision-making, Controllers and Processors

Opinion on processing of CCTV data in regard to employee performance analytics by the Bulgarian DPA

CCTV, Employment, Specific processing situations

Technical Recommendations on the use of APIs by CNIL

Controllers and Processors, Technical and Organisational Measures (TOMs)

Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence (PROPOSED MEMORANDUM )

GDPR guidance: Legitimate Inerersts Assessments (LIA) for Digital Advertising

Lawfulness of Processing, Legitimate Interest, Marketing and Advertising, Specific processing situations

PRACTICAL GUIDANCE FOR THE USE OF GENERATIVE ARTIFICIAL INTELLIGENCE IN THE PRACTICE OF LAW by State Bar of California

AI, Specific processing situations

AI Privacy Policy template

AI, Specific processing situations

DPIA for AI template

Controllers and Processors, Data Protection Impact Assessment (DPIA)

TOWARDS A SUSTAINABLE, MULTILATERAL, AND UNIVERSAL SOLUTION FOR INTERNATIONAL DATA TRANSFER by the UK Government

Data Transfers

Global Toolkit on AI and the Rule of Law for the Judiciary by UNESCO

AI, Specific processing situations

Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive by EDPB

Consent, Lawfulness of Processing

Exceeding customer expectations by Google

Principles, Privacy by Design

Case C-307-2022

Data Subjects Rights

Generative AI: The Data Protection Implications by CEDPO

AI, Specific processing situations

Artificial intelligence for healthcare and well-being during exceptional times | European Commision

COMMON GUIDEPOSTS TO PROMOTE INTEROPERABILITY IN AI RISK MANAGEMENT | German Ministry of labor and social Affairs

AI, Specific processing situations

DSAR management for controllers by Bailiwick of Guernsey’s DPA

Access Requests (DSAR), Data Subjects Rights

Bulgarian CPPD Newsletter

Children as data subjects, Controllers and Processors, Data Subjects Rights, Technical and Organisational Measures (TOMs)

Study on the essence of the fundamental rights to privacy and to protection of personal data by EDPS

Data Subjects Rights

Protection of workers’ personal data: General principles by ILO

Employment, Specific processing situations

Online Safety Bill | UK

Automated Decision-Making Under the GDPR by the FPF

AI, Automated Decision-making, Controllers and Processors, Specific processing situations

Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence by the US President

Child oriented approach to data processing by DPC Ireland

Children as data subjects, Data Subjects Rights

Audit Requirements for Personal Data Processing Activities involving AI by AEPD

Controllers and Processors, Data Protection Impact Assessment (DPIA), Technical and Organisational Measures (TOMs)

AI and Data Protection Risk Toolkit by UK ICO

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

Legal Risks to being a DPO by IAPP

Controllers and Processors, Data Protection Officer (DPO)

Artificial intelligence and the Information Privacy Principles by the Privacy Commisioner (New Zealand)

AI, Specific processing situations

Data breach preparation and response by the Australian Information Commisioners

Controllers and Processors, Data Breaches

Opinion 44/2023 on the Proposal for Artificial Intelligence Act in the light of legislative developments

AI, Specific processing situations

Mobile Privacy Disclosures by the FTC

Data Subjects Rights, Right to know

Description of the dataset template by CNIL

AI, Specific processing situations

Data Breach Process Guidance by HSE

Controllers and Processors, Data Breaches

AI How-to Sheets by CNIL

AI, Specific processing situations

T‑553-23 R

Data Transfers

Drones and Data Protection Guidelines by AEPD

Drones, Specific processing situations

Data protection and monitoring workers

Employment, Specific processing situations

Baseline Cyber Security for SMEs

Controllers and Processors, Technical and Organisational Measures (TOMs)

How to use AI and personal data

AI, Specific processing situations

Public Benefit and Privacy Panel for Health and Social Care (Guidance for applicants)

Health Data, Principles, Sensitive Data

Decision of the Data Protection Commission made pursuant to Section 111 of the DPA, 2018 and Articles 60 and 65 of the GDPR

Fairness, Liability and Penalties, Principles, Supervisory Authorities

Infographic DPC TikTok Fine

Fairness, Liability and Penalties, Principles, Supervisory Authorities

Government access to datain third countries

Data Processing by the Government, Specific processing situations

Study on the appropriate safeguards under Article 89(1) GDPR for the processing of personal data for scientific research

Scientific Research, Specific processing situations

Study on the national administrative rules impacting the cooperation duties for the national supervisory authorities

Supervisory Authorities

One-Stop-Shop thematic case digest: RIGHT TO OBJECTAND RIGHT TO ERASURE

Data Subjects Rights, Right to Erasure, Right to Object

Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

Recommendations 1-2022 on the Application for Approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR)

Code of Conduct, Controllers and Processors

Guidelines 01/2023 on Article 37 Law Enforcement Directive

Data Transfers

OPINION 1/15 OF 26. 7. 2017

Data Transfers

CASE OF BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM

National Security, Specific processing situations

Case C-101/01

Data Transfers, Definitions, Principles, Processing of personal data, Sensitive Data

C-460/20

Data Subjects Rights, Right to Erasure, Search Engines, Specific processing situations

C-136/17

Data Subjects Rights, Principles, Right to Erasure, Search Engines, Sensitive Data, Specific processing situations

C-496/17

Lawfulness of Processing, Public Interests

C-507/17

Data Subjects Rights, Right to Erasure, Territorial Scope

Joined Cases C-511/18, C-512/18 and C-520/18

Criminal Convictions and Offences, National Security, Principles, Specific processing situations

C-708/18

CCTV, Lawfulness of Processing, Legitimate Interest, Specific processing situations

C-61/19

Consent, Lawfulness of Processing

C-272/19

Access Requests (DSAR), Data Controller, Data Subjects Rights, Definitions

C-439/19

Criminal Convictions and Offences, Lawfulness of Processing, Principles, Public Interests

C-597/19

Lawfulness of Processing, Legitimate Interest

C-645/19

Supervisory Authorities

C-102/20

Consent, Lawfulness of Processing

C-184/20

Principles, Sensitive Data

C-245/20

Supervisory Authorities

C-319/20

Representation of data subjects

C-534/20

Controllers and Processors, Data Protection Officer (DPO)

C-34/21

Employment, Specific processing situations

C-77/21

Principles, Purpose limitation

C-129/21

Consent, Data Subjects Rights, Lawfulness of Processing, Right to Erasure

C-154/21

Access Requests (DSAR), Data Subjects Rights

C-180/21

Criminal Convictions and Offences, Lawfulness of Processing, Principles, Public Interests

C-205/21

Consent, Criminal Convictions and Offences, Lawfulness of Processing, Principles

C-268/21

Data minimisation, Principles

C-300/21

Liability and Penalties, Supervisory Authorities

C-306/21

Lawfulness of Processing, Public Interests

C-349/21

Access Requests (DSAR), Data Subjects Rights

C-453/21

Controllers and Processors, Data Protection Officer (DPO)

Case C-60/22

Accountability, Joint Controllers, Principles

Guide to the Case-Law of the of the European Court of Human Rights

Data Subjects Rights, Principles, Sensitive Data

C-252/21

Contractual Obligation, Lawfulness of Processing, Principles, Sensitive Data

Case C-487/21

Access Requests (DSAR), Data Subjects Rights

Certified Data Protection Officer by PECB

Controllers and Processors, Data Protection Officer (DPO)

ЕО Order on Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern

Artificial Intelligence and Privacy

AI, Specific processing situations

[UK] International Data Transfer Agreements – Transitional Provisions

Data Transfers

[UK] International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

Data Transfers

RISK FRAMEWORK FOR BODY-RELATED DATA IN IMMERSIVE TECHNOLOGIES BY FPF

Transfer Impact Assessment (TIA)

Data Transfers, Transfer Impact Assessment

Zapier’s Transfer Impact Assessment

Data Transfers, Transfer Impact Assessment

American Data Privacy And Protection Act (DRAFT)

Cybersecurity panel session: An introduction to incident response, common cyber threats and ways to mitigate risk by the UK ICO

Data Breaches, Technical and Organisational Measures (TOMs)

Cybersecurity panel session: Supply chain attacks by the UK ICO

Technical and Organisational Measures (TOMs)

Cybersecurity panel session: SME Focus by the UK ICO

Technical and Organisational Measures (TOMs)

Personal data breaches in the health sector: how to avoid them (and how to deal with them when they happen) by the UK ICO

Data Breaches

Balancing transparency and empathy in request and complaint handling by the UK ICO

Access Requests (DSAR)

Handling vexatious requests under FOIA by the UK ICO

Access Requests (DSAR)

GenAI and data protection: how organisations and their employees can use it appropriately and lawfully

How to deal with SARs as an employer by the UK ICO

Access Requests (DSAR), Employment

Good FOI practice – a panel discussion by the UK ICO

Access Requests (DSAR)

The IDTA, Addendum and TRA: practical guidance for cross-border transfers by the UK ICO

Data Transfers

Lifecycle of a complaint by the UK ICO

Access Requests (DSAR), Data Subjects Rights

Section 40(2) FOIA – the personal data exemption – a practical approach by the UK ICO

Access Requests (DSAR), Data Subjects Rights

Insight into audit and assurance by the UK ICO

Children as data subjects, Data protection audit

A 10-step guide to sharing information to safeguard children by the UK ICO

Children as data subjects

Privacy, seriously by the UK ICO

AI, Privacy by Design, Product Privacy Design

AI and Data Protection risk toolkit by the UK ICO

Federal Data Protection Act (Germany)

Human rights Impact Assessments for AI by Access Now

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Practice Guide to Anonymising Personal Data by Stiftung Dateschutz

Anonymisation, Controllers and Processors

Senate Bill 262 (Delete Act)

REGULATION (EU) 2022/868 (Data Governance Act)

DIRECTIVE (EU) 2016/680 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (Law Enforcement Directive)

Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines | NIST

Controllers and Processors, Technical and Organisational Measures (TOMs)

DIRECTIVE (EU) 2019/1937 on the protection of persons who report breaches of Union law (Whistleblower Directive)

Guidance Note: Employer Vehicle Tracking | Irish DPC

Automated Decision-making, Consent, Employment, Lawfulness of Processing, Legitimate Interest

Opinion on legitimate interests of the data controller (Opinion 06/2014)

Lawfulness of Processing, Legitimate Interest

Building a Cybersecurity and Privacy Learning Program | NIST | Initial Public Draft

Data Breaches, Employment, Risk Management, Technical and Organisational Measures (TOMs)

REGULATION (EU) 2022/1925 (Digital Markets Act)

Joint statement on data scraping and the protection of privacy

Governance, Personal Data Collection

Bodil Lindqvist [2003] Case C-101/01, 6 November 2003

Automated Decision-making

Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González [2014] Case C-131/12

Data Controller, Personal Data

Digital Rights Ireland Ltd. v. Minister for Communications and Others [2014] Joined Cases C-293/12 and C-594/12

Data minimisation

Tele2 Sverige AB v. Post-och telestyrelsen and Secretary of State for the Home Department v. Tom Watson and others Joined Cases C-203/15 and C-698/15

Data minimisation

Maximillian Schrems v. Data Protection Commissioner [2015] Case C-362/14, 6 October 2015.

Adequacy Decisions, Data Transfers

Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Case C-311/18), 16 July 2020.

Adequacy Decisions, Data Transfers

Big Brother Watch and others v United Kingdom (Applications nos 58170/13, 62322/14 and 24960/15), 25 May 2021.

Data minimisation

Weltimmo s.r.o. v. Nemzeti Adatvédelmi és Információszabadság Hatóság [2015] Case C-230/14, 1 October 2015

Territorial Scope

František Ryneš v. Úřad pro ochranu osobních údajů [2014] Case C-212/13, 11 December 2014

Material scope