Digital omnibus updates
Privacy advocacy group NOYB analysed more than 1000 amendments that Members of the European Parliament (MEPs) proposed for the GDPR and ePrivacy Directive. The EU is currently in the process of changing its core privacy laws via the so-called Digital Omnibus. The reform package is supposed to bring relief for companies, with lower costs and streamlined procedures, while maintaining a high level of personal data protection. In reality, as the NOYB states, lobby groups have quickly taken over the legislative process, mostly for the benefit of Big Tech and AI companies.
Stay up to date! Sign up to receive our fortnightly digest via email.
Previously, the German Federal Data Protection Commission has also criticised the proposal for not adequately addressing key issues such as data brokerage, child protection, AI and the responsibility of digital providers. In some cases, it goes beyond simply codifying existing case law and simplifying procedures. The proposed change to the personal data definition and AI-related exemptions was cited as a particularly far-reaching example.
NOYB urges Europeans to go to gdpr-omnibus.eu to see who tries to defend privacy and who wants to undermine currently existing protections, by country and political groups. If adopted, the proposals can limit the scope of the GDPR in online advertising or enable personal data usage for AI training and development without consent, etc.
More legal updates
Australian privacy rights reinforced: A DLA Piper law blog reminds us that from 10 December 2026, Australian entities will be required to disclose the use of automated (or substantially automated) decision-making in their privacy policies, in particular the kinds of personal information used in relation to the program, and the kinds of decisions made solely or substantially by the program. To assist entities, the Office of the Australian Information Commissioner has also created targeted resources to support compliance.
New rules for tracking pixels in Italy: By 29 October 2026, companies, platforms, and newsletters will have to adapt their information, consent, and opt-out systems to the Italian data protection authority Garante’s Guidelines on the use of tracking pixels in email communications. In particular, it will be necessary to obtain prior, free, specific, and informed user consent. Specific exceptions are provided, such as for security purposes, strictly necessary technical requirements, or institutional and service communications, always in compliance with the principles of proportionality and data minimisation.
Users must also receive clear and transparent information and be able to withdraw their consent easily. Tracking pixels are tiny, transparent, virtually invisible images inserted into emails to detect their opening and collect information on user behaviour. Garante emphasises that these technologies can be particularly invasive because they often operate without the recipient’s full awareness.
Recognising phishing is becoming more difficult
Phishing remains a common method of deceiving people, according to the Dutch National Cyber Security Centre. Due to the increasing use and growing capabilities of AI, phishing campaigns are becoming increasingly sophisticated. Obvious spelling and grammatical errors are becoming rarer, and login pages look increasingly authentic. However, the fact that a page looks high-quality does not mean that the page is reliable.
To recognise phishing, look out for the signals below:
- The sender email address differs subtly from the real domain.
- The message comes from an organisation with which you have no relationship.
- The salutation is generic (“Dear customer”, “Dear user”).
- Pressure by using final warnings or urgent notifications.
- A request to act quickly is a major red flag.
- Unexpected invoices, documents, or package notifications.
- Check the link address: just move your cursor over the link without clicking on it.
- Go to the website or app yourself.
More from supervisory authorities
Vulnerabilities explained: Every organisation has vulnerabilities that can give an attacker access to systems or sensitive data. A vulnerability is a weak point in a system, device, software program, account, or process that can be exploited with potentially serious consequences. Due to that weak point, an attacker can do something that should normally not be possible. Examples of a weak point include:
- a program containing a security flaw
- a system that has not been updated with the latest security updates
- an account with a simple, standard, or frequently used password
- a management environment that is accessible to everyone on the internet
- an incorrect security setting
- an employee who has more access rights than necessary
- a physical access door that is unintentionally open, etc.
A vulnerability does not automatically mean that an organisation has been hacked. However, a vulnerability can provide an entry point for an attack.
Client voice recording: Organisations record customer telephone calls for a variety of reasons, such as ensuring quality of customer service, dispute resolution, fraud prevention, or training/development of staff. These recordings must be handled appropriately from collection through to disposal. Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) sets the ground rules for how businesses handle personal information in the course of commercial activities:
- The organisation can only record a call for purposes that a person would consider appropriate.
- The organisation must inform the customer, clearly state the purpose of the recording and obtain consent (in multiple ways).
- Customers have a right to request access to the recording at a later date.
- An organisation may only use the information collected for the purposes specified (eg, an organisation should not state that it is recording for quality assurance purposes if it will be used for marketing or profiling).
Professional email address reconstitution
Business email recreation is the process of inferring or “guessing” your business email address from information available online, in particular, for prospecting. It must comply with the GDPR to be legal, the French privacy regulator CNIL explains. The organisations that reconstruct your e-mail addresses must inform you, as soon as possible and clearly, in particular of the objectives pursued and explain to you how your address was obtained. They must also inform you of your rights and how to exercise them. Organisations must:
- not use your reconstructed email address if you have objected/withdrawn your consent (and delete it from any contact database);
- process requests to exercise the rights of access, rectification, erasure and limitation, in compliance with the deadlines and conditions provided for by the GDPR.
How your data is auctioned off
The Norwegian data protection regulator explains how every time you open an online page with ads, an invisible bidding war for your data begins. In a split second, details about you can be shared with multiple players. The technology that drives this bidding war is called real-time bidding (RTB). When you visit a website or an app, your information is immediately sent out to a giant network of advertising companies. The companies then bid against each other in real time to show you a personalised ad. For instance, the personal data of an average Norwegian since 2022 has been shared with various advertising platforms a whopping 340 times every day.
How to choose an authentication method: risk-based approach
The Dutch National Cyber Security Centre also explains which authentication method suits your organisation depending on the importance of your assets and possible threats that can harm them. Therefore, a data-driven company needs to inventory the different types of users they have on a system, and to which data and system resources these users have access – from user accounts to system administrators.
Authentication is often the primary target of a digital attack. Attackers are eager to break authentication because doing so grants them extensive access to a system or network. To that end, the regulator insists that passkeys (and not passwords, 2FA or even biometrics) become the most secure form of authentication because they are resistant to phishing and most other attack techniques.
In other news
Booking data breach: As a result of cyberattacks on booking service providers, data from numerous hospitality sector guests has been compromised. Criminals are now using this booking information to send deceptively realistic phishing messages via email, SMS, or WhatsApp, the Lower Saxony State Commissioner for Data Protection reports. It is recommended not to click on any links and, if in doubt, contact the accommodation owner directly, ideally using the phone number or email address listed on their official website.
Hotels, campsites, holiday apartment providers, and hostels, meanwhile, remain responsible for their guests’ data under the GDPR. Anyone who becomes aware of a data breach must immediately notify all potentially affected guests and the relevant data protection supervisory authority.
Proof of consent: Companies that send out advertising emails must be able to prove that recipients have consented to the processing of their data. Simply claiming consent or merely submitting technical data is insufficient. This was recently decided by the Düsseldorf Administrative Court, which has thus set clear limits on such business practices. The court made it unequivocally clear that proof of consent, such as a confirmation email, is necessary. In the related case, the IP and DOI IP addresses presented by a company were insufficient for the court to prove consent.
Neither the IP address nor the DOI IP address is suitable for establishing a connection to the individual concerned. The IP address is merely the address of a technical device. It reveals nothing about who was active on that device at the relevant time. The same applies to the DOI IP address with a timestamp, which only indicates that data was transmitted from this device, and does not determine the content, the North Rhine-Westphalia data protection authority sums up.
Receive our digest by email
Sign up to receive our digest by email every 2 weeks
More enforcement decisions
Xandr adtech fine: The Norwegian data protection regulator Datatilsynet has fined Xandr 8, 7 mln euros approx. for unlawful processing of personal data. This is the highest fine the authority has ever imposed. The case began in 2020, when the Norwegian Consumer Council lodged a complaint against the advertising technology company Xandr (then AppNexus, now part of Microsoft). The case concerns real-time bidding in Grindr, a location-based dating app. Xandr processed Grindr users’ personal data – their advertising ID and IP addresses.
These were personal data under GDPR concerning sexual orientation. Xandr was considered a joint controller, both as a supply-side and demand-side platform. The authority concluded that explicit consent was required to process this personal data, but that Xandr did nothing to ensure it. The company instead assumed that this was Grindr’s responsibility. Xandr failed to verify whether the consents from Grindr were valid and took no steps to have a legal basis for processing that covered its own processing.
Plastic surgery clinic fine: The Finnish Data Protection Ombudsman has imposed an administrative penalty of 20,200 euros on Plastic Surgery Centre Helsinki Oy, as the company had not provided patient data to a client despite an order from the regulator. The client had requested his patient data from the clinic (several times between 2016 and 2025 ) to file a complaint about errors in treatment and claim compensation.
Healthcare cookie fine: The Finnish regulator also imposed a 33,000 euro fine on Mindemo Oy, a provider of healthcare services. The company previously operated under the name Heltti Oy. It had implemented cookies and other analytics tools in its online appointment booking service without sufficient assessment and safeguards. The therapy appointment booking service had shared users’ information with Google, Meta, and Microsoft tracking services if they had accepted cookies.
And Finally
Palantir patient tech rejected in the UK: According to a Guardian article, health bodies across the UK say the controversial US firm’s data platform is no better than systems already in use. According to more than two dozen FOI responses reviewed by the Guardian, 16 trusts and health boards declared they do not use it, following its introduction in March 2024. The responses come as Andy Burnham’s government faces a crunch decision about whether to exercise a break clause in the seven-year NHS-Palantir deal.
According to The Conversation’s recent analysis, Palantir had been lobbying to get access to NHS data for a while when it offered to build a COVID data store in early 2020. There was no open competition under emergency COVID procurement rules. However, the latest version of the deal, the Federated Data Platform, was awarded competitively in 2023. Having had the deal previously would have been a big advantage for Palantir – a phenomenon known as “vendor lock-in”. There have also been claims that this includes using NHS data for Palantir AI, but the original contract (heavily redacted for public use) does not suggest this.