What 80 privacy law firms are seeing right now

Biometric timekeeping back in the spotlight: ANSPDCP fines an employer over its fingerprint clock-in system

Recently the Romanian Data Protection Authority (ANSPDCP) fined an employer RON 26,236 (approx. EUR 5,000) for using its employees' fingerprints to clock in and out and to open doors on its premises and ordered it to switch to a system that does not rely on biometrics at all. The amount is modest. The message is not: for most employers in Romania, fingerprint or face-based timekeeping is very hard to defend, and neither employee consent nor the Romanian implementing law changes that.

12 November 2026 · Wolf Theiss · Romania

A new member has joined the INPLP: Migle Dewsbury (Lithuania)

MB Hexlaw (Lithuania) has joined the International Network of Privacy Law Professionals.

9 November 2026 · MB Hexlaw · Lithuania

The CJEU’s Russmedia decision (C-492/23) and the End of Platform Exceptionalism in EU Data Protection Law

For twenty-five years, platforms have operated on a "publish first, remove on notice" model, assuming that the hosting privilege also shielded them from data protection duties. In Russmedia (C-492/23), the CJEU rejected that assumption on the plain wording of Article 1(5)(b) of the eCommerce Directive. A platform that structures and monetises user content is a controller and must build pre-publication review, identity verification and protection against scraping and copying into its architecture. These duties derive from general GDPR provisions, so they are not limited to sensitive data and require a risk assessment of all personal data a platform publishes. Platform operators must adapt or leave the field.

9 November 2026 · Spirit Legal · Germany

Deleting an Account Is Not the Same as Deleting Personal Data: Lessons from EU GDPR Enforcement

3 November 2026 · JK Law · Slovenia

Bidding on Sensitive Data: Norway's Record Fine Against Xandr

The Norwegian Data Protection Authority (Nw.: "Datatilsynet") has, in decision 20/03541-37, imposed the largest fine in its history: NOK 92 million (approximately EUR 8.6 million) against Microsoft-owned AdTech company Xandr Inc. for unlawfully processing and sharing special categories of personal data about Grindr users through real-time bidding (RTB). The decision and the Authority's parallel public guidance illustrate its approach to programmatic advertising, joint controllership among AdTech intermediaries, and reliance on another party's consent mechanism.

29 October 2026 · Selmer · Norway

INPLP reaches 60 countries: a warm welcome to Maddocks, our first member in Australia

With Maddocks from Sydney, the International Network of Privacy Law Professionals welcomes its first member firm from Australia — and is now represented in 60 countries on six continents.

27 October 2026 · Maddocks · Australia