Parasociality on Social Media and with AI: Why Policy Must Catch Up to Causes, Not Symptoms
by Johanna L. Degen// When the Cambridge Dictionary named parasocial its Word of the Year for 2025, it recognized a concept researchers have examined for decades, yet only recently observed novel mechanisms that have shifted its meaning in scale and…
CJEU SRP provides guidance on pseudonymized and anonymous data
by Annika Gierich / Johannes Zhou// On September 4, 2025, the European Court of Justice (CJEU) issued an important decision (Case C-413/23 P) concerning the concept of “personal data”. The decision provides further clarity on how to distinguish between personal, pseudonymized,…
France CNIL Breaks New Ground: First Standalone Sanctions Against Data Processors
by Aurélie Banck// In December 2025, CNIL issued two significant penalties against data processors for GDPR violations, marking a watershed moment in European enforcement. For the first time, the French supervisory authority sanctioned processors independently, without simultaneously pursuing the data…
Digital Omnibus: cui bono?
by Ulrich Kelber// The European Commission has, unexpectedly and deviating from long-communicated timelines, presented far-reaching proposals to amend the GDPR (and other regulations) as part of the “Digital Omnibus”. Many are now attempting to interpret the proposed rules, with assessments…
Austrian DPA: YouTube is ordered to honor users’ Right of Access
by Dr. Gerald Trieb and Viktoria Kovacs// The Austrian Data Protection Authority (“Datenschutzbehörde”, hereinafter “DSB”) recently issued a significant decision in a long-running case brought by an individual against Google LLC, represented by NOYB – the European Center for Digital Rights. The dispute concerned the right of access under…
District Court of Amsterdam Prohibits Meta from Using Personal Data for AI Training – Private Enforcement of DMA?
by Sebastian Louven// An interim injunction by the District Court of Amsterdam against Meta prohibits Meta from using the applicant’s personal data for training its AI models.1 The decision is available in the Dutch judicial database.2 Context: Private Enforcement of…
Neurotechnologies and Data Protection – Challenges to Consent
Thorsten Kranz// The emergence of neurotechnologies represent a ground breaking intersection between science, engineering and medicine. Whilst their recent proliferation has been largely contained to the health and research sector, use may enter – and in some cases, already has…
Introduction to Thailand’s Personal Data Protection Act (PDPA)
by Norravich Limpanukorn*// A rapid development of information technology has raised concerns in society across the globe, especially regarding data, as things in the current era are data-driven. The European regional interaction to this issue resulted in a landmark regulation…
CJEU: a “Controller” does not need to have legal personality and legal capacity
by Dr. Gerald Trieb and Viktoria Kovacs// The European Court of Justice (CJEU) recently ruled on a case relating to Austria: The CJEU had to decide on the question referred by the Austrian Supreme Administrative Court (“VwGH”) as to whether or not a Tyrolian State Law designating the…
CJEU lost in translation: the Right to Information on Automated Decision-Making (Dun & Bradstreet Case)
by Dr. Gerald Trieb and Theodor Paul Mach-Walter// In the proceedings submitted from Austria, the CJEU had to decide how the right to obtain information by a data subject whose data has been processed using automated decision-making must be fulfilled…