European Union

EDPB Consultation on User Accounts for E-commerce Websites

The European Data Protection Board (EDPB) has launched a public consultation on its Recommendations 2/2025 concerning the legal basis for requiring user accounts on e-commerce websites. The consultation is open for comments until February 12, 2026.

EDPB Public Consultation on Processor Binding Corporate Rules

The European Data Protection Board (EDPB) has launched a public consultation on its Recommendations 1/2026 concerning Processor Binding Corporate Rules. The consultation is open until March 2, 2026, and aims to gather feedback on the application, elements, and principles for these rules under GDPR.

S-Bank Fined EUR 1.8 Million for GDPR Violations

The European Data Protection Board reports that the Finnish Supervisory Authority has fined S-Bank EUR 1.8 million for GDPR violations related to a data security vulnerability. The bank failed to implement adequate safeguards, leading to a personal data breach affecting a significant proportion of its customers.

EDPB Strengthens Global Data Protection Cooperation

The European Data Protection Board (EDPB) held a meeting with Data Protection Authorities from countries and organizations with an EU adequacy decision to strengthen global data protection cooperation. This follows up on a previous meeting in October 2024 and focuses on sharing information and experiences in international data protection enforcement.

EDPB/EDPS Support AI Act Streamlining with Stronger Safeguards

The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) have issued a joint opinion on the EU Commission's proposal to streamline the AI Act. While supporting administrative simplification, they urge stronger safeguards to protect fundamental rights and advise against removing the registration obligation for high-risk AI systems.

EDPB Conference on Cross-Regulatory Cooperation

The European Data Protection Board (EDPB) is hosting a conference on March 17, 2026, in Brussels to discuss cross-regulatory cooperation from a data protection perspective. Registration is open until February 26, 2026.

EDPB/EDPS Joint Opinion on Digital Omnibus Regulation Proposal

The EDPB and EDPS have issued a joint opinion on the Digital Omnibus Regulation proposal, supporting simplification efforts while raising concerns about proposed changes to the GDPR's definition of personal data. They also welcome increased data breach notification thresholds and deadlines.

ESMA Principles for Risk-Based Supervision

The European Securities and Markets Authority (ESMA) has published its principles for risk-based supervision. These principles aim to foster a common and effective EU-wide supervisory culture and strengthen the EU single market by providing a structured framework for identifying, assessing, and addressing risks.

ESAs Joint Guidelines on ESG Stress Testing

The European Supervisory Authorities (ESAs) have published joint guidelines on integrating environmental, social, and governance (ESG) risks into supervisory stress tests for the banking and insurance sectors. These guidelines aim to establish common standards for ESG risk assessment methodologies across the EU financial system and will be subject to a 'comply or explain' procedure by National Competent Authorities.

ESMA Thematic Note on ESG Strategies Clarity

The European Securities and Markets Authority (ESMA) has published a thematic note on ESG strategies, focusing on ESG integration and exclusions. The note aims to promote clarity in communications directed at retail investors and provides practical do's and don'ts to mitigate greenwashing risks.