EDPO (European Data Protection Office)

“Meta CEO Mark Zuckerberg was the chief architect of the ‘morally binding’ AI accords that emerged from Tuesday’s White House lunch with President Donald Trump, Speaker Mike Johnson and more than a dozen tech executives, according to five people familiar with the private meeting. Zuckerberg, with the help of Nvidia CEO Jensen Huang, pitched the so-called AI accords to senior White House officials and some of the biggest names in tech during the luncheon, three of the people said. Both Huang as well as Trump administration officials helped shape the pact ahead of the meeting, according to two of the people”. #privacy #AI #MarkZuckerberg #DonaldTrump #JensenHuang Subscribe to EDPO's newsletter here: https://lnkd.in/dwK8sde *This article was not written by EDPO. The opinions and views of the author(s) do not necessarily reflect those of EDPO. https://lnkd.in/efndmZJ5

EDPO spent two days at RAID (REGULATION - AI - INTERNET - DATA) in Brussels. The theme was "Europe's New Age of Innovation", and most of the conversation centred on making the existing rules work in practice and supporting growth. Here is what stayed with us: 1. Simplification, yes, but not at the expense of protection. The Digital Omnibus was the topic of the two days. Speakers agreed that the rules need clarity, but the EDPS cautioned that simplification must not weaken data protection or create new legal uncertainty. Industry pushed for urgent fixes to the Data Act, especially on trade-secret protection. 2. Fragmentation is the real pain point. Overlapping regimes (AI Act, GDPR, DMA, Data Act, CRA) and divergent national interpretations came up in almost every panel. One recurring example was the tension between "openness" obligations and security and privacy requirements. 3. The AI Act is moving from text to enforcement. The Commission confirmed that its enforcement powers for general-purpose AI models have applied since 2 August 2026. High-risk obligations have been pushed back to late 2027 and mid-2028, as standards and national authorities are not yet ready. The message: clarity, guidance and harmonised standards matter as much as the law itself. 4. Europe's AI gap is structural. Several speakers argued that the gap comes less from regulation than from fragmented capital markets, limited compute, energy costs and talent retention. Scale-up funding and public procurement were highlighted as levers. 5. Global alignment will be pragmatic, not uniform. Adequacy decisions are slowing, and digital sovereignty is gaining ground. Regulators pointed to practical cooperation as the way forward: joint guidance, expert networks, mapping of laws, and capacity building. The Philippines' registration requirement for foreign processors, with a local legal representative, is a reminder that representation obligations are spreading beyond Europe. 6. Trust is an economic asset. Lack of trust works like a barrier to the single market. Transparency, human accountability, redress mechanisms and well-resourced enforcers were repeatedly named as the foundation for AI adoption, from healthcare to finance. For organisations operating across Europe, our takeaway is that compliance needs to be joined-up: a single view across the GDPR, AI Act, Data Act and NIS2, rather than one silo per regulation. #RAID2026 #AIAct #GDPR #DigitalOmnibus #DataProtection #DataAct #DigitalRegulation

“The European Union has shielded data centers from public scrutiny about how much energy they use, according to a formal complaint filed Monday against the European Commission. The complaint lodged this week by Lighthouse Reports, and first reported by POLITICO, accuses the EU executive of setting up rules keeping the public from seeing how much energy and water are used by individual data centers. This comes as public opposition to power-hungry AI data centers grows across Europe, while energy prices rise. Lighthouse Reports, a Netherlands-based non-profit conducting cross-border investigations of alleged government and corporate wrongdoing, accuses the Commission of building a "wall of silence" about energy consumption.” #Privacy #GDPR #Datacenters #EnergyConsumption Subscribe to EDPO's newsletter here: https://lnkd.in/dwK8sde *This article was not written by EDPO. The opinions and views of the author(s) do not necessarily reflect those of EDPO. https://lnkd.in/eSvi5Esz

"CANBERRA — OpenAI has apologized to Australia for unauthorized access to Medicare statistical data by its agents and its handling of the incident, promising to do better and rebuild trust with the Australian public. OpenAI broke its silence about the June incident, which it described as artificial intelligence models accessing Australian government websites 'in ways they were not authorized to do' during internal training and evaluation. 'We are sorry and working to do better in the future,' OpenAI said in a statement. [...] On Tuesday the Australian government released the OpenAI email of Sept.10 alerting Services Australia to a 'vulnerability'. It said an OpenAI model had achieved access to 'internal program files' through a public reporting interface 'without a private account or password'. [...] OpenAI said it will establish a taskforce with independent Australian expertise to improve processes including notification, to report by the end of 2026. [...] It confirmed that the NSW Bureau of Crime Statistics and Research (BOCSAR), Victorian Department of Health, and Australian Institute of Health and Welfare (AIHW) were also affected. Services Australia and the Victorian department were notified on Sept. 10, BOCSAR on Sept. 18, and the AIHW on Sept. 24 because 'the way it was accessed seemed consistent with public access'." #Privacy #GDPR #OpenAI #Australia   Subscribe to EDPO's newsletter here: https://lnkd.in/dwK8sde   *This article was not written by EDPO. The opinions and views of the author(s) do not necessarily reflect those of EDPO.   https://lnkd.in/egjUCqD7

“We’re not based in the EU, so European regulations don’t apply to us.” Many companies still make this assumption when expanding into Europe. But today, where your company is located is only part of the equation. European regulations increasingly look at your activities, the services you provide, and the users you reach. The GDPR was only the starting point. Depending on your business model, other frameworks may also apply, from the Digital Services Act to more specific sector regulations. The challenge is not knowing that regulations exist. It is understanding which ones apply to your organisation. At EDPO, we help organisations understand their representative obligations and navigate the requirements that come with operating in the European market. Because accessing the European market means looking beyond borders.

In case you missed it Here is a brief recap of the news and updates we shared last week. The European Commission proposed restricting social media access for children under 13, with parent-supervised accounts until 15. Enforcement would rely on an EU-developed, open-source age-verification app designed to confirm whether users meet an age threshold without revealing their identity. [1] Ireland’s Data Protection Commission fined Google €403 million following an inquiry into the processing of location data. The regulator found GDPR infringements involving Web & App Activity, Location History and Location Accuracy between 2018 and 2020. [2] The EDPB adopted guidelines on the use of administrative fines alongside other GDPR corrective powers, including a five-step methodology for DPAs. It also adopted the final version of its guidelines on the interplay between the Digital Services Act and the GDPR. [3] In AI governance, the UK announced plans to use its upcoming G20 presidency to pursue a single set of global AI principles and standards. Meanwhile, Italy continues to operationalise the EU AI Act through its national framework, including rules governing police use of AI, criminal sanctions, corporate administrative liability and specialised civil litigation mechanisms. [4] [5] Sweden’s privacy authority fined software provider Miljödata €160,000 for failing to adequately secure personal data following a cyberattack. More than 2.2 million people were reportedly affected, with compromised information including identification and contact details as well as sensitive data. [6] References: [1] Explainer: How the EU's age-verification app for children would work: https://lnkd.in/exiTUjTA [2] Irish privacy regulator fines Google €403 million over location data processing: https://lnkd.in/enM69vbi [3] EDPB harmonises fining methodology and adopts final DSA-GDPR guidelines: https://lnkd.in/ecegWMhm [4] UK will aim for ‘single set’ of global AI standards at G20: https://lnkd.in/eF8fJnDJ [5] Italy's AI framework: Operationalizing the EU AI Act: https://lnkd.in/eFitvvzZ [6] Swedish software provider fined after data breach exposed data of 2.2M people: https://lnkd.in/eMdSyZmX #privacy #GDPR #dataprotection Subscribe to EDPO's newsletter here: https://lnkd.in/dwK8sde These articles were not written by EDPO. The opinions and views of the author(s) do not necessarily represent those of EDPO.

"Two months after OpenAI disclosed the accidental hacking of Hugging Face, the ChatGPT maker is still working to understand the full scope of its rogue agent activity, two people briefed on the matter told Reuters.   The latest example came on Friday when OpenAI said its agents had leaked 53 images from ChatGPT users. OpenAI declined to say if the images were AI-generated or identified real people. It also declined to say when the images were posted.   The disclosure and researcher reports on Friday of other previously unknown activity involving several US agencies reveal a new area of privacy risk for the company, and illustrate how difficult it is even for an AI firm at the cutting edge of the technology to inventory all the unauthorized activity tied to its agents. OpenAI’s ongoing battle also reflects a yawning gap between the strength of the models the company is testing and its capacity to oversee or even track their actions." #privacy #GDPR #dataprotection #openai #chatgpt   Subscribe to EDPO's newsletter here: https://lnkd.in/dwK8sde   *This article was not written by EDPO. The opinions and views of the author(s) do not necessarily represent those of EDPO. https://lnkd.in/dSdEtbyJ

Next week, EDPO will be attending the RAID – Regulation of AI, Internet and Data 2026 Conference (28 - 29 September 2026) in Brussels, Belgium If you're attending too, please let us know if you’d like to meet during one of the coffee breaks. If you're not attending, we're happy to meet for coffee nearby.   Feel free to contact us at info@edpo.com #Privacy #GDPR #RAID2026 Subscribe to EDPO's newsletter here: https://lnkd.in/dwK8sde