What 80 privacy law firms are seeing right now

The Politics of How We See AI: What Metaphors Reveal About Trust, Voting and Governance

Artificial Intelligence is becoming political before most political parties have decided what their politics of AI should be. In a new book chapter, INPLP member Dr Gege Gatt and his co-authors examine how the metaphors people use to make sense of AI intersect with political identity and voting behaviour. A survey of 409 adults in Malta shows that around one third of respondents could not meaningfully define AI at all.

13 November 2026 · Mitla Smart City Malta · Malta

Biometric timekeeping back in the spotlight: ANSPDCP fines an employer over its fingerprint clock-in system

Recently the Romanian Data Protection Authority (ANSPDCP) fined an employer RON 26,236 (approx. EUR 5,000) for using its employees' fingerprints to clock in and out and to open doors on its premises and ordered it to switch to a system that does not rely on biometrics at all. The amount is modest. The message is not: for most employers in Romania, fingerprint or face-based timekeeping is very hard to defend, and neither employee consent nor the Romanian implementing law changes that.

12 November 2026 · Wolf Theiss · Romania

A new member has joined the INPLP: Migle Dewsbury (Lithuania)

MB Hexlaw (Lithuania) has joined the International Network of Privacy Law Professionals.

9 November 2026 · MB Hexlaw · Lithuania

The CJEU’s Russmedia decision (C-492/23) and the End of Platform Exceptionalism in EU Data Protection Law

For twenty-five years, platforms have operated on a "publish first, remove on notice" model, assuming that the hosting privilege also shielded them from data protection duties. In Russmedia (C-492/23), the CJEU rejected that assumption on the plain wording of Article 1(5)(b) of the eCommerce Directive. A platform that structures and monetises user content is a controller and must build pre-publication review, identity verification and protection against scraping and copying into its architecture. These duties derive from general GDPR provisions, so they are not limited to sensitive data and require a risk assessment of all personal data a platform publishes. Platform operators must adapt or leave the field.

9 November 2026 · Spirit Legal · Germany

Deleting an Account Is Not the Same as Deleting Personal Data: Lessons from EU GDPR Enforcement

3 November 2026 · JK Law · Slovenia

Bidding on Sensitive Data: Norway's Record Fine Against Xandr

The Norwegian Data Protection Authority (Nw.: "Datatilsynet") has, in decision 20/03541-37, imposed the largest fine in its history: NOK 92 million (approximately EUR 8.6 million) against Microsoft-owned AdTech company Xandr Inc. for unlawfully processing and sharing special categories of personal data about Grindr users through real-time bidding (RTB). The decision and the Authority's parallel public guidance illustrate its approach to programmatic advertising, joint controllership among AdTech intermediaries, and reliance on another party's consent mechanism.

29 October 2026 · Selmer · Norway