Client updates /  GDPR

Publicly accessible personal data is not automatically available for AI training use: In Guidelines 03/2026, published for public comment on July 7, 2026, the EDPB clarifies that the mere fact that personal data is publicly accessible online does not, on its own, allow it to be collected and reused for AI training under the GDPR.

The Dutch Data Protection Authority strictly interprets GDPR regarding data scraping, stating that data scraping will almost always be illegal.

The French Data Protection Authority (CNIL) fined a corporation for violation of the GDPR due to flaws in its personal data collection and user consent practices, even though the data was collected by a third party.

The new arrangement for transferring information about EU citizens to the United States offers European and foreign companies a simpler mechanism to enable their privacy protection procedures to be recognized as GDPR-compliant.

Israeli cyber companies operating in Europe are exposed to the GDPR even though they are registered in Israel, and even if the information they collect is not processed or stored in Europe.

New privacy protection regulations drafted by the Israeli Ministry of Justice will obligate Israeli entities to protect data reaching Israel from the European Economic Area, i.e., from EU member states and Iceland, Norway, and Liechtenstein.

This declaration will help to maintain the European Union’s continuing recognition of the State of Israel as a country whose data protection laws are on par with the European Data Protection Regulation.

E-commerce giant Amazon reported in its financial statements at the end of last month that the Luxembourg data protection authority had imposed on it a fine totaling EUR 746 million. The fine appears to have been laid on Amazon for its use of users’ personal data for targeted advertising, in violation of the EU’s General Data Protection Regulation (GDPR).

In early October, the Data Protection Authority in Hamburg, Germany announced that the clothing retailer H&M committed severe violations of its employees’ privacy. Because of these European General Data Protection Regulations (GDPR) violations, the retailer would pay a fine of approximately 35 million euros.

Recently, the UK Information Commissioner’s Office decided to take action against a non-European entity following an alleged breach of the GDPR.