Daniela Gaub

The European Commission has released an extensive and valuable document: the AI Act Service Desk FAQ. This publication brings together over 100 practical questions and answers on how to apply the EU AI Act. Directly based on queries from companies, legal experts and policymakers during the AI Pact webinars. 💡Why this document is so useful It’s an overview and a living document that is continuously updated by the European Commission itself. It clarifies, among other things: ✔️What the AI Act actually regulates and which systems fall under its scope ✔️The implementation timeline up to 2027 ✔️The definitions of AI systems and AI models, including the distinction between general-purpose AI models and AI systems ✔️The obligations for high-risk AI and the rules on prohibited practices ✔️Insights into the General-Purpose AI Code of Practice and the new AI regulatory sandboxes ✔️Even concrete technical thresholds, such as 10²³ and 10²⁵ FLOPs used to classify models with systemic risk. The document was prepared by the European Commission / AI Act Service Desk and currently represents the most reliable interpretative source of the law.

387

4 Kommentare

New ICO Consultation Alert: Legitimate Interest & Complaints Guidance 🚨 On 21 August 2025, the ICO opened a consultation on two major pieces of draft guidance under the UK data protection law: 1️⃣ Recognized Legitimate Interest Guidance The Data (Use and Access) Act introduced a brand-new lawful basis: recognized legitimate interest – separate from the traditional legitimate interests test. The ICO’s draft guidance explains how organizations can rely on this basis without needing to carry out a balancing test (rights vs. interests) if one of the following pre-approved conditions applies: • Public task disclosure requests • National/public security & defence • Emergencies • Crime prevention/detection • Safeguarding This is a significant shift in how some organizations may justify processing data. 2️⃣ Complaints Guidance By June 2026, organizations must have a clear process for handling data protection complaints. The ICO outlines: ✔️ Provide a way for people to submit complaints ✔️ Acknowledge within 30 days ✔️ Investigate and keep people informed ✔️ Communicate outcomes without undue delay The ICO also recommends keeping detailed records of complaints, acknowledgements, investigations, and outcomes. Why this matters: • For DPOs & privacy teams: time to assess how the new “recognized legitimate interest” fits into your organization’s processing activities. • For compliance leaders: now is the moment to design or update complaint-handling processes well before June 2026. The ICO is seeking feedback. If your organization could be affected, it’s worth getting involved. *See my comments for links to both feedback forms.* What do you think: will “recognized legitimate interest” simplify compliance, or create new grey areas? #DataProtection #ICOUK #DUAA #LegitimateInterest #DPO

79

5 Kommentare

*** Roundtable *** The Future of Privacy Forum and the Brussels Privacy Hub hosted an event titled "Data Protection under the Simplification Agenda: Defining the Right Intervention". The EDPS Wojciech Wiewiorowski joined a multistakeholder group of experts to exchange views on the impact of the European Commission's simplification and competitiveness agenda on the future of #GDPR. In his intervention, the Supervisor said: "the main tension does not lie in incompatibility between the GDPR and AI, but in how to operationalise core data protection principles such as purpose limitation, transparency and data minimisation within the AI context". He also added "as the #AIAct complements existing regulatory frameworks, its implementation will bring new challenges regarding their interplay and possible overlaps". Cooperation remains essential: the growing number of regulatory frameworks reflects the rapid evolution of technologies, services and markets requiring strong collaboration among all relevant stakeholders. To this end, the EDPS has called for the creation of a Digital Clearinghouse 2.0 (DCH 2.0), a platform to enhance collaboration among EU authorities, support coordinated action, and ensure a holistic application of EU law. Learn more about the DCH 2.0 https://lnkd.in/dp5NytJd #DigitalClearinghouse

83

1 Kommentar

🏛️ 𝗘𝗨 𝗚𝗲𝗻𝗲𝗿𝗮𝗹 𝗖𝗼𝘂𝗿𝘁 𝗨𝗽𝗵𝗼𝗹𝗱𝘀 𝘁𝗵𝗲 𝗗𝗮𝘁𝗮 𝗣𝗿𝗶𝘃𝗮𝗰𝘆 𝗙𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸 🏛️ A significant relief for European data exporters - but what does this really mean? 🔍 The EU General Court of Justice dismissed Philippe Latombe's challenge to the adequacy decision establishing the EU-US Data Privacy Framework (DPF). This ruling confirms that, as of July 10, 2023, the United States provides adequate protection for personal data transferred from the EU to participating organizations. 𝗞𝗲𝘆 𝗥𝘂𝗹𝗶𝗻𝗴 𝗛𝗶𝗴𝗵𝗹𝗶𝗴𝗵𝘁𝘀(based on the press release): ➡️ Data Protection Review Court (DPRC) Independence: the Court found sufficient safeguards exist to ensure DPRC judges' independence, with dismissal only possible "for cause" by the Attorney General ➡️ Bulk Data Collection: the Court ruled that ex-post judicial oversight by the DPRC meets the requirements established in Schrems II, rejecting the need for prior authorization ➡️ Continuous Monitoring: the Commission must continuously monitor the US legal framework and can suspend, amend, or repeal the decision if circumstances change 💡 𝗣𝗿𝗮𝗰𝘁𝗶𝗰𝗮𝗹 𝗜𝗺𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻𝘀: Having conducted hundreds of Transfer Impact Assessments (TIAs) for dozens of clients over recent years, I've repeatedly analyzed US regulatory robustness and DPF arrangements. In practice, the implementation of robust technical safeguards, such as end-to-end encryption with data exporter-controlled key management, is exceptionally challenging for common cloud processing data transfers. The operational complexities inherent in such measures often render rapid read/write operations impractical. 🔧 This creates a fundamental tension: while encryption with exporter-controlled keys offers the strongest protection, it often renders business processes impractical. A political solution was needed, and this judgment provides that confirmation. ⚖️ 𝗞𝗲𝗲𝗽 𝗶𝗻 𝗠𝗶𝗻𝗱: The DPF only applies to US transfers with participating organizations. For other non-EEA countries without adequacy decisions, Article 46 GDPR mechanisms (SCCs, BCRs, etc.) remain the primary transfer tools. My recommendation: European organizations should leverage this (temporary?) legal certainty for US transfers while exploring complementary technical measures like edge cloud solutions that minimize data residency risks. Through years of practice, we've developed a comprehensive list of specialized DPA clauses that significantly reduce inherent transfer risks - from data localization commitments to enhanced notification obligations. Combining legal certainty with technical innovation and contractual reinforcement provides much-needed operational clarity. Stay tuned and follow TechnoLawgy for more #DataProtection and #PrivacyLaw insights! 🚀

28

The applicability of the EU AI Act is far from straightforward. The Regulation itself is complex and I’ll admit, even for a trained compliance professional, navigating it can be a challenge. Many organizations are still grappling with whether (and how) the Act applies to them, and to what extent. That’s why I’m pleased to collaborate with Data Privacy Office Europe on the launch of their free EU AI Act Gap Assessment initiative. Elena Aliseychik and I will be leading this effort, which includes: 📌A clear determination of whether your AI systems fall within the scope of the Act 📌A risk-based classification in line with the EU AI Act framework 📌 Identification of documentation and transparency gaps 📌A step-by-step action plan to guide your systems toward compliance The Data Privacy Office Europe is offering five complimentary assessment slots. Applications are now open https://lnkd.in/gdab46eH

52

3 Kommentare

𝗛𝗶𝗴𝗵𝗲𝗿 𝗥𝗲𝗴𝗶𝗼𝗻𝗮𝗹 𝗖𝗼𝘂𝗿𝘁: 𝗚𝗗𝗣𝗥 𝗱𝗮𝗺𝗮𝗴𝗲𝘀 𝗱𝘂𝗲 𝘁𝗼 𝗹𝗮𝗰𝗸 𝗼𝗳 𝗰𝗼𝗻𝘁𝗿𝗼𝗹 𝗼𝘃𝗲𝗿 𝗱𝗮𝘁𝗮 𝗱𝗲𝗹𝗲𝘁𝗶𝗼𝗻 𝗯𝘆 (𝘀𝘂𝗯)𝗽𝗿𝗼𝗰𝗲𝘀𝘀𝗼𝗿𝘀 In its decision dated July 10, 2025, the Higher Regional Court of Düsseldorf (OLG Düsseldorf, Case-Nr. 16 U 83/24), addresses the question whether a data subject can receive compensation under Art. 82 GDPR when a violation of the GDPR results from a (sub)processor’s error. - The Case - In 2019, one of the leading music streaming services suffered a data breach. Large quantities of non-sensitive data were sold on the darknet. The streaming service claimed that the breach was caused by a service provider failing to delete the data. As part of the data processing agreement (DPA), it was agreed, among other things, that the data processor and each of its subprocessors must delete the personal data transmitted by the controller within 21 days of the termination of the DPA and confirm this. After termination of the DPA, the subprocessor informed the controller about the upcoming deletion - but the data was factually not deleted. The controller claimed that it had adequate organizational measures in place in order to prevent such data breaches. - The Ruling - Two aspects of the decision are particularly notable. First, the court ruled that the streaming service neglected its obligations under Art. 24 (1) GDPR. According to the ruling, organizational measures were inadequate, as the controller had not exercised sufficient oversight over its processor.  Another important aspect concerns the responsibility question. According to CJEU case law, Art. 83 GDPR does not extend to cases in which the processor has processed personal data for own purposes or has processed such data in a manner that is incompatible with the framework defined in the processing agreement. According to the OLG, this limitation does not extend to Art. 82 GDPR cases where the processor’s breach was enabled by insufficient organizational measures put in place by the controller. The Higher Regional Court awarded the plaintiff EUR 200 in damages. - Practical Relevance - This decision once again underlines the need for controllers to exercise caution when engaging processors. The first step is to ensure that the data processing agreement addresses all required elements in accordance with Article 28 (3) GDPR. Secondly, controllers must implement effective control mechanisms to verify that processors act in compliance with the agreements in place. Finally, in certain cases (especially following contract termination), it is important to actively exercise these oversight rights. Controllers should request proof of data deletion from processors to mitigate the risk of potential compensation claims or administrative fines. Full text of the decision is available here (in German): https://lnkd.in/dD6_nsnV #DSGVO #GDPR #dataprotection

30

𝐄𝐔 𝐃𝐚𝐭𝐚 𝐀𝐜𝐭 𝐬𝐞𝐫𝐢𝐞𝐬 𝐩𝐮𝐛𝐥𝐢𝐜𝐚𝐭𝐢𝐨𝐧 𝟑: 𝐔𝐧𝐟𝐚𝐢𝐫 𝐜𝐨𝐧𝐭𝐫𝐚𝐜𝐭𝐮𝐚𝐥 𝐭𝐞𝐫𝐦𝐬 𝐁𝟐𝐁 𝐝𝐚𝐭𝐚-𝐬𝐡𝐚𝐫𝐢𝐧𝐠 𝐚𝐠𝐫𝐞𝐞𝐦𝐞𝐧𝐭𝐬 The EU Data Act could potentially impact your business contracts and here it's why it's worth a closer look. It introduces clear protections against unfair contractual clauses in B2B data-sharing agreements. Any clause related to data access, use, liability, or remedies that is unilaterally imposed by one party on another will be deemed non-binding if found to be unfair. What is more, the legislation includes a Blacklist of clauses that are irrefutably deemed to be unfair, and a Greylist of clauses presumed to be unfair unless proven otherwise. Following our earlier insights into the regulation and the specific obligations it places on data holders for connected products and related services. To read our full article, click here: https://lawand.tax/4myNKVf #dataact #compliance #lawandtax #data #contract #b2b

29