The EDPB and EDPS joint opinion on the Digital Omnibus supports the European Commission’s goal of simplifying EU digital rules and strengthening competitiveness.
The European Commission’s latest Digital Omnibus package introduces a significant and much-debated idea: allowing AI training based on legitimate interest, under Article 6(1)(f) GDPR, accompanied by a new Article 88c. The proposal formalises something many expected — that training AI systems or AI models on personal data may rely on legitimate interest as a legal basis.
The Digital Package on Simplification, proposed by the European Commission, updates key EU laws — including the GDPR, the AI Act, the Data Act, the NIS2 Directive, and the ePrivacy Directive — to modernize and simplify the entire European digital regulatory framework.
The European Commission’s proposal to codify legitimate interest as a legal basis for AI training marks the most significant reform to the GDPR since its adoption. By explicitly recognizing legitimate interest as legal basis for AI training, the Commission aims to reconcile data protection with the realities of modern artificial intelligence.
The new EDPB Guidelines 3/2025 on the interplay between the Digital Services Act (DSA) and the GDPR provide a comprehensive roadmap for aligning platform accountability with personal data protection, clarifying how Regulation (EU) 2022/2065 (DSA) and the General Data Protection Regulation (GDPR) must work together to ensure consistent enforcement, lawful data processing, and a unified model of digital governance across the EU.
The Italian Data Protection Authority's recent decision gave guidance on the true meaning of personal data anonymization and the crucial distinction between the DPO as a monitor – not an executor. In a world driven by AI and public surveillance, both concepts are more relevant than ever.
A recent and far-reaching decision by the Italian Data Protection Authority (Garante) has significantly altered the rules governing marketing privacy consent in Italy, introducing a potential obligation to adopt a double opt-in mechanism for collecting consent that exceeds the requirements in other EU countries.
Why This Case Matters: A Shift in Privacy Consent…
The Italian Data Protection Authority (the Garante) issued its first GDPR fine on, among others, the unlawful retention of metadata from employees’ emails and web browsing activities applying in Italy for the first time its highly discussed guidelines of 2024 on the use of metadata in workplace email systems.
In a significant decision, the Italian Data Protection Authority (the Garante) addressed a critical issue concerning the roles of Data Protection Officer (DPO) and legal representative within organizations operating in Italy.
In a recent and thought-provoking decision, the Italian Data Protection Authority (Garante) sanctioned a securitization Special Purpose Vehicle (SPV) for failing to comply with several GDPR requirements — most notably, for not appointing a Data Protection Officer (DPO).