For sale — contact mail@quant.rocks
The latest enforcement actions, landmark rulings, and speculative analysis on the future of EU data protection law.
Speculative analysis on the most likely changes to EU data protection law through 2028 — AI enforcement, US-EU decoupling, and LLM compliance.
With EDPB guidelines confirming web scraping for AI training requires a lawful basis, coordinated enforcement against major LLM providers is expected across EU jurisdictions.
The Trump administration's dismantling of privacy safeguards is pushing the EU from adequacy thinking toward cloud sovereignty mandates. Major institutions are already migrating from US providers.
NOYB has filed a CJEU lawsuit to annul the EU–US Data Privacy Framework. With FTC independence eliminated and PCLOB paralysed, invalidation appears increasingly inevitable.
Recent GDPR enforcement actions, policy developments, and landmark decisions. Last updated: 31 August 2026.
NOYB issued a formal warning to SCHUFA over an alleged secret shadow database used for credit scoring, opening an interest list for a potential class action.
All AI Act provisions now enforceable. Prohibited practices face fines up to €35M or 7% of global turnover. GPAI providers under active supervision.
Web scraping for LLM training requires a lawful basis. AI models are not automatically anonymous — extraction attacks and memorisation risks must be assessed.
NOYB's CJEU lawsuit argues the DPF's legal foundations have collapsed. "Schrems III" has formally begun.
Member States push for EU cloud mandates for sensitive data. Major EU institutions migrating from US cloud services.
Consent banner allegedly forces users to "agree" to 1,741 ad-tech partner data sharing arrangements without meaningful choice.
The biggest GDPR enforcement actions since 2018, totalling over €5 billion.
Irish DPC. Unlawful data transfers to the US without adequate safeguards.
Irish DPC. Unlawful processing of personal data through the MoPub advertising network.
Irish DPC. Data transfers to China without adequate safeguards; storage of EU data on Chinese servers.