Jade Nester

Today: European Commission Evaluates the Data Governance Act The Commission is conducting its formal review of the DGA, assessing its impact on trusted data sharing across the EU. The evaluation, required under Article 35, will inform potential updates to the regulation. For background, read the IAPP’s overview of the DGA—covering public sector data reuse, data sharing services and data altruism: https://bit.ly/3KBfDxH

165

Elaine Fox leads TikTok’s Irish operations — and its privacy agenda for all of Europe. She opens up about regulation, AI, data protection, and how Dublin has become central to TikTok’s future. Read here - https://lnkd.in/e__Eq9SJ

282

5 Comments

New ICO Consultation Alert: Legitimate Interest & Complaints Guidance 🚨 On 21 August 2025, the ICO opened a consultation on two major pieces of draft guidance under the UK data protection law: 1️⃣ Recognized Legitimate Interest Guidance The Data (Use and Access) Act introduced a brand-new lawful basis: recognized legitimate interest – separate from the traditional legitimate interests test. The ICO’s draft guidance explains how organizations can rely on this basis without needing to carry out a balancing test (rights vs. interests) if one of the following pre-approved conditions applies: • Public task disclosure requests • National/public security & defence • Emergencies • Crime prevention/detection • Safeguarding This is a significant shift in how some organizations may justify processing data. 2️⃣ Complaints Guidance By June 2026, organizations must have a clear process for handling data protection complaints. The ICO outlines: ✔️ Provide a way for people to submit complaints ✔️ Acknowledge within 30 days ✔️ Investigate and keep people informed ✔️ Communicate outcomes without undue delay The ICO also recommends keeping detailed records of complaints, acknowledgements, investigations, and outcomes. Why this matters: • For DPOs & privacy teams: time to assess how the new “recognized legitimate interest” fits into your organization’s processing activities. • For compliance leaders: now is the moment to design or update complaint-handling processes well before June 2026. The ICO is seeking feedback. If your organization could be affected, it’s worth getting involved. *See my comments for links to both feedback forms.* What do you think: will “recognized legitimate interest” simplify compliance, or create new grey areas? #DataProtection #ICOUK #DUAA #LegitimateInterest #DPO

79

5 Comments

🇧🇷🇪🇺The European Commission has launched the process for adopting a data protection adequacy decision with Brazil, confirming that Brazil ensures a level of protection comparable to the EU. Once adopted, this decision would enable free and secure data flows between the EU and Brazil—covering businesses, public authorities, and research projects—under one of the broadest scopes possible within the #GDPR framework. In parallel, Brazil is preparing an equivalent decision to facilitate reciprocal data transfers. The draft decision will now be reviewed by the European Data Protection Board, EU Member States, and the European Parliament before the Commission can adopt the final text. Once in place, it will be subject to regular reviews to ensure continued alignment.

59

5 Comments

🔍 #DataProtection: How can we protect privacy in the age of Large Language Models (LLMs)? The Council of Europe’s Committee of Convention 108 has endorsed a groundbreaking expert report by Isabel Barberá and Murielle Popa-Fabre, offering an in-depth analysis of privacy and data protection risks across the Large Language Models (LLM) lifecycle—from model training to real-world deployment. 📌 Key highlights from the report:  ⚠️ Identifies privacy risks in both model architecture and system-level integration.  📊 Maps new forms of profiling and “predictive data-caging” enabled by multimodal data and intention simulation.  🧠 Introduces technological insights on how LLMs encode, memorize, and potentially regurgitate personal data.  🔐 Assesses current mitigation strategies and their limitations—underscoring the need for better safeguards.  🛠️ Proposes a lifecycle-based privacy risk management framework based on Convention 108+.  🤝 Draws from stakeholder interviews across industry, regulators, and civil society to ground the framework in real use cases. The report sets the foundation for a proactive, rights-based approach to innovation—anchored in transparency, accountability, and human dignity:  🔗 Be the first to know: https://lnkd.in/eVDWZaJc 🦉 Convention 108 is the Council of Europe's Convention for the protection of individuals with regard to the processing of personal data has served as the foundation for international data protection law in over 40 European countries. It has also influenced policy and legislation far beyond Europe’s shores. It has been updated in 2018 to deal with challenges resulting from the use of new information and communication technologies and to strengthen the Convention’s effective implementation. Find out more 👇 🔗  https://lnkd.in/eSwSx-Qi #LLM #DigitalGovernance #DataProtection #Convention108 #ResponsibleAI Beatriz de Anchorena Caroline Gloor Scheidegger Anamarija Mladinić Gonzalo Sosa Barreto Ousmane Thiongane Elsa Marie Mein Peter Kimpian Moritz Taylor Vadim Pak  

42

1 Comment

We’re now diving into Panel III: “Data Protection Authorities in the Spotlight: Pathways for Harmonisation.” With Data Protection Authorities (DPAs) across the EU playing an increasingly central role in AI governance, this all-DPA panel is exploring what regulatory leadership looks like at the intersection of the GDPR and the AI Act. Moderated by Dr. Gabriela Zanfir-Fortuna (Future of Privacy Forum), the panel is unpacking: - Whether data protection law is effectively becoming the EU’s AI regulation. - What we’ve learned from DPA guidance and enforcement in AI contexts. - The potential and limits of harmonisation across the EU’s privacy landscape. On stage: 🔹 Sarah Artola, CNIL - Commission Nationale de l'Informatique et des Libertés. 🔹 Guido Scorza, The Italian Data Protection Authority 🔹Sven Stevenson, Autoriteit Persoonsgegevens (Dutch DPA) 🔹Paul McDonagh-Forde, Data Protection Commission Ireland #BPS2025

28

2 Comments