Skip to content
INPLP — International Network of Privacy Law Professionals
Member log in

728 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

728 articles

A Review of the EDPB’s Anonymization Guidelines in Light of EDPS v SRB

When, and for whom, does information constitute personal data? The Court of Justice of the European Union (CJEU) addressed this question in EDPS v SRB (C-413/23 P). Its judgment clarified the treatment of pseudonymized data but prompted further debate over implementation. The Digital Omnibus proposal sought to amend the GDPR’s definition of personal data; the June 2026 compromise text removed that amendment and reassigned the proposed pseudonymization powers to the European Data Protection Board (EDPB). Against this background, the EDPB opened its draft Guidelines 02/2026 on Anonymization for consultation on 8 July 2026. The draft reflects much of the CJEU’s reasoning but, in our view, also extends beyond it. This article follows the dispute from the initial complaints through the judgment and the EDPB’s subsequent guidance.

15 October 2026

Read, shred and forget? New Swedish case law and the manual-processing gap in the GDPR

Swedish employers routinely ask applicants and employees to show an extract from the criminal records register (belastningsregistret). Article 10 GDPR allows criminal conviction data to be processed only under official authority or where law authorises it, which most private employers lack. In AD 2026 nr 27 (case A 156/24), the Labour Court held that an employer who merely receives, reads and destroys such an extract falls outside the GDPR altogether.

15 October 2026

Where Space Data Lands. Ground Stations and the Reach of Data Protection Law

During 2026 the conversation about privacy in outer space has turned toward orbit itself, as proposals for orbital data centres have led scholars, practitioners and the European Parliament’s foresight service to ask whether Article VIII of the Outer Space Treaty, which keeps a space object under the jurisdiction and control of its State of registry, could make that State a digital flag state for the data processed on board. That debate deserves attention, although it overshadows a more immediate fact, which is that almost all personal data collected or relayed by satellites still comes down to Earth through an antenna located in a specific country and subject to a specific data protection law. Under the Ground Station as a Service model, in which operators book antenna passes on demand and receive the data directly in the cloud, a single satellite may land data in several jurisdictions in one day, so the question of which law applies, and to whom, is increasingly answered at the antenna, and Ecuador, whose equatorial position makes it an attractive site for ground infrastructure, offers a useful case study because its law and the GDPR reach different results for the same downlink.

13 October 2026

The Price of a Face

When a public hospital in Madeira introduced facial recognition to monitor staff attendance, it reignited a fundamental question in European data protection law: can biometric processing be justified when simpler alternatives exist? This article examines the legal framework governing biometric attendance systems under the GDPR, Portuguese law, and the EU AI Act, and argues that the principle of necessity (not technological capability) must remain the decisive test.

9 October 2026

Ecuador’s Risk Management Guide for Personal Data Protection. A practical view

Ecuador’s Superintendence of Personal Data Protection has published its first risk management guide. The document is ambitious: it demands that organizations justify every assumption, calibrate expert opinion, and adopt measurable models. However, it leaves a critical question unanswered, as, what methodology should companies actually use? Unlike Spain, where proportionality and maturity guide the choice of methods, Ecuador’s guide presents multiple options without prioritization. This article argues that such neutrality, while flexible, creates practical uncertainty. It suggests that organizations should adopt a mixed model, anchored in the traditional risk matrix but enriched with qualitative rationales and, where possible, quantitative tools.

8 October 2026

Israel's First Administrative Fines under Amendment 13: A New Enforcement Era for Privacy Compliance

Amendment 13 to Israel's Protection of Privacy Law, 1981 (the "PPL") entered into force on 14 August 2025, giving the Israeli Privacy Protection Authority (the "PPA") — for the first time — the ability to impose meaningful financial sanctions directly on organisations that breach Israeli data protection rules. A little over a year later, the first sanctions have arrived. Between July and September 2026 the PPA published three decisions imposing fines on a health fund, a small leisure business and a municipality. Modest in amount, they are significant in signal: Israeli privacy obligations that were long treated as formalities now carry a direct price tag.

8 October 2026

The CNIL's new approach to AI models Memorisation, extractability and anonymisation under the GDPR

As generative AI becomes increasingly powerful, the CNIL’s 2026 guidance shifts the GDPR debate from how personal data is used in training to whether AI models themselves can retain and reveal information about individuals. By focusing on memorisation, extractability, and anonymisation, the framework offers a practical roadmap for assessing when AI models may still pose privacy risks and therefore remain subject to European data protection law.

8 October 2026

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership