by Stefaan van der Jeught// Ask a seemingly simple question: how do you say “law” in Europe? The answer quickly becomes more interesting than a mere list of translations and reveals two main recurring ideas. Across several linguistic families, words…
Who Does What in the Cloud? The CNIL’s New Guidance on Controller, Processor and Joint-Controller Roles
by Aurélie Banck// On 28 May 2026, the French Data Protection Authority (CNIL) published guidelines on how to qualify the respective roles of cloud computing providers and their clients under the GDPR1. The exercise is timely: in an ecosystem built…
Non-material damages against Meta for intransparent data collection beyond the platform (Munich Higher Regional Court)
by Barbara Schmitz// In its judgment of 18 December 2025 (Case No. 14 U 1068/25e), the Munich Higher Regional Court (OLG München) awarded a Facebook user non-material damages in the amount of EUR 750. The case concerned the processing of…
Parasociality on Social Media and with AI: Why Policy Must Catch Up to Causes, Not Symptoms
by Johanna L. Degen// When the Cambridge Dictionary named parasocial its Word of the Year for 2025, it recognized a concept researchers have examined for decades, yet only recently observed novel mechanisms that have shifted its meaning in scale and…
CJEU SRP provides guidance on pseudonymized and anonymous data
by Annika Gierich / Johannes Zhou// On September 4, 2025, the European Court of Justice (CJEU) issued an important decision (Case C-413/23 P) concerning the concept of “personal data”. The decision provides further clarity on how to distinguish between personal, pseudonymized,…
France CNIL Breaks New Ground: First Standalone Sanctions Against Data Processors
by Aurélie Banck// In December 2025, CNIL issued two significant penalties against data processors for GDPR violations, marking a watershed moment in European enforcement. For the first time, the French supervisory authority sanctioned processors independently, without simultaneously pursuing the data…
Digital Omnibus: cui bono?
by Ulrich Kelber// The European Commission has, unexpectedly and deviating from long-communicated timelines, presented far-reaching proposals to amend the GDPR (and other regulations) as part of the “Digital Omnibus”. Many are now attempting to interpret the proposed rules, with assessments…
Austrian DPA: YouTube is ordered to honor users’ Right of Access
by Dr. Gerald Trieb and Viktoria Kovacs// The Austrian Data Protection Authority (“Datenschutzbehörde”, hereinafter “DSB”) recently issued a significant decision in a long-running case brought by an individual against Google LLC, represented by NOYB – the European Center for Digital Rights. The dispute concerned the right of access under…
District Court of Amsterdam Prohibits Meta from Using Personal Data for AI Training – Private Enforcement of DMA?
by Sebastian Louven// An interim injunction by the District Court of Amsterdam against Meta prohibits Meta from using the applicant’s personal data for training its AI models.1 The decision is available in the Dutch judicial database.2 Context: Private Enforcement of…
Neurotechnologies and Data Protection – Challenges to Consent
Thorsten Kranz// The emergence of neurotechnologies represent a ground breaking intersection between science, engineering and medicine. Whilst their recent proliferation has been largely contained to the health and research sector, use may enter – and in some cases, already has…