With its judgment in Brillen Rottler (C-526/24), the Court of Justice of the European Union (CJEU) has now clarified that, under specific circumstances, a data controller is entitled to refuse an access request — even if it is the first one submitted by the data subject.
Italy online gambling rules are entering a new enforcement phase as the Italian gaming authority (ADM) introduces stricter controls on retail gambling vouchers, including a € 100 weekly cap and mandatory traceability requirements starting May 2026.
Italy’s 2026 gambling licenses tender could become the most significant regulatory overhaul of the country’s land-based gaming sector in more than a decade.
A recent decision advertising cookie identifiers of the French Conseil d’État has reignited a fundamental debate in EU data protection law: when do online identifiers qualify as personal data under the GDPR?
The European Commission has just published for feedback its long-awaited draft guidance to assist companies in applying the Cyber Resilience Act (CRA), a landmark EU regulation aiming to strengthen cybersecurity across the digital product landscape.
EDPB binding decisions are challengeable under the GDPR: with its judgment of 10 February 2026 in Case C-97/23 P, the Court of Justice of the European Union confirmed that binding decisions adopted by the European Data Protection Board under Article 65 GDPR can be directly challenged before the EU Courts under Article 263 TFEU.
AI liability under the Defective Products Directive will fundamentally change the legal framework for software and artificial intelligence in the European Union from 9 December 2026. Directive (EU) 2024/2853 introduces a clear and disruptive principle: software and AI systems are products for the purposes of strict liability.
