IITR Datenschutz GmbH

Digital Omnibus: EU Council backs changes to GDPR, cookies and breach reporting The Council of the European Union has adopted its negotiating position on the Digital Omnibus, proposing targeted changes to GDPR, ePrivacy and cybersecurity reporting. These are not yet binding rules: the European Parliament must establish its position before trilogue negotiations can begin. Personal data and pseudonymisation: The Council would retain the definition of personal data in Article 4(1) GDPR. Pseudonymised data would still generally be personal data, while the requirements for assessing identifiability and safeguards would be clarified. Data subject rights and transparency: The Council supports adjustments for manifestly unfounded or excessive requests under Article 12(5), and limited relief from information duties under Articles 13 and 14 where risks to individuals are low. There would be no blanket exemption from transparency duties; conditions would still need to be assessed and documented. Research and AI: A more principles-based definition of scientific research is envisaged, alongside adjustments to research-related GDPR rules (Articles 5(1)(b) and 89). Clarifications for developing and operating AI systems would address legal bases and processing of special-category data under Article 9, including biometric data for verification, subject to safeguards. Personal data breaches: The current Article 33 notification period of 72 hours could be extended to 96 hours, while notification to the supervisory authority could be limited to breaches likely to pose a high risk. The duty to document breaches under Article 33(5) would remain, as would the separate assessment of notification to individuals under Article 34. Cookies and tracking: More uses of cookies and similar technologies, including those necessary to provide a service, audience measurement or device security, could be exempt from consent. The application would depend on purpose and technical implementation; marketing, profiling and third-party tracking would not become generally consent-free. German businesses would also need to consider Section 25 TDDDG. Incident reporting: The Council envisages national contact points in each Member State and a complementary EU-level information point—not a single EU reporting authority—to improve coordination across legal regimes. 📌 Practical takeaway: Existing obligations continue to apply. Organisations should monitor the legislative process and review cookie management, data subject request handling and incident response, without prematurely changing compliance procedures.

Dginni on a roll: AI can answer questions. But what if it could also look us in the eye while doing so? With our Dginni, we're bringing AI-powered avatars into the world of data protection and compliance. From interactive guidance and clear answers to data protection questions to engaging training sessions, our Dginni make complex topics more accessible, personal, and interactive. What makes them special? When it comes to data protection, they draw on IITR's proprietary knowledge base – with on-premise processing rather than reliance on the cloud. And this is just the beginning! 🎬 See our Dginni in action – watch the video: https://lnkd.in/dDHks-G4

Automated decision-making under the GDPR: Uber fined nearly €825 million The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) has imposed a fine of €824.99 million on Uber over automated decisions to temporarily or permanently deactivate driver accounts. According to the authority’s findings, Uber used software to analyse driving behaviour and customer ratings. Where fraud was suspected or ratings remained consistently low, accounts were automatically deactivated without prior human review. Affected drivers could no longer offer rides through the platform and therefore lost the ability to generate income through it. The case therefore centres on Article 22 GDPR. It protects individuals from decisions based solely on automated processing where those decisions produce legal effects or similarly significantly affect them. Automated systems may still be used to identify irregularities or provide information for further assessment. However, where a decision has significant consequences, the final decision must not rest solely with the system. The AP also emphasised that human review must be effective in practice. Merely confirming an automated result is generally insufficient. The reviewer must independently assess the individual case, consider the relevant information and have sufficient authority to change the automated outcome. Affected persons should also be able to present their position and request a renewed review. Transparency obligations under Articles 13 and 14 GDPR are also relevant. Data subjects should receive sufficiently specific and understandable information about automated decision-making or profiling, including which data are evaluated, the purpose of the assessment and the possible consequences of a negative result. Disclosure of the full source code is not required. The proceedings were led by the Dutch authority because Uber’s European headquarters are in the Netherlands, with the French CNIL closely involved. They originated from complaints by more than 170 French drivers and were handled under the GDPR’s One-Stop-Shop mechanism pursuant to Articles 56 and 60. 📌 Companies using automated systems for decisions affecting access to services, platforms or employment opportunities should ensure genuine human oversight, correction mechanisms and documented internal processes. Depending on the processing, a data protection impact assessment under Article 35 GDPR may also be required.

EU Kids Act draft: Broad age-check requirements proposed for online services A leaked draft of the European Commission’s proposed EU Kids Act would introduce age-assurance requirements for social media, video platforms, online games, chatbots, AI companions and software marketplaces. According to netzpolitik.org, the Commission planned to present the proposal on 17 September 2026. For social-media and video-platform accounts considered risky for minors, the draft would require age verification, including for adults. Users aged 15 and over could have their own account in a reduced youth-protection version; the full experience would only be available from age 18. Existing accounts could be exempt where there is no indication that they belong to minors. No general exemption for small businesses is foreseen. A broader regime would apply to access even without an account. Online games, chatbots, AI companions and software marketplaces would either have to offer a child-appropriate version or use age assurance. The draft distinguishes age verification, for example using identity-document data, from age estimation such as biometric facial analysis. Software marketplaces would also have to apply age labels and check users’ age before installation. Certain services, including non-commercial online encyclopedias, education, science, public administration and open-source software development platforms, would be excluded. Parents or guardians wishing to create an account for a child under 15 would have to verify their own age, verify that the child is at least 13 and prove parental responsibility. The draft mentions temporary self-declaration, public databases and certificates issued by Member States as possible mechanisms. The proposal would also turn several standards from the Commission’s non-binding DSA child-protection guidelines into binding rules. Social-media and video platforms would be prohibited from encouraging compulsive or excessive use by minors, with provisions addressing autoplay, notifications, recommendation systems and contact with strangers. Age-assurance measures would have to meet high standards of accuracy, reliability, security, privacy and non-discrimination. The draft also refers to “zero knowledge proof”. netzpolitik.org questions the technical feasibility and drafting of these requirements and reports criticism from digital-rights groups concerning privacy, anonymity, access and fundamental rights. 📌 From a data-protection perspective, the draft would considerably expand age-assurance mechanisms, including methods involving identity or biometric data. At the time of the article, it had not yet entered the legislative process.

SCCs and third-country transfers: Austrian DPA clarifies requirements In a decision of 31 July 2026 (GZ 2026-0.617.893), the Austrian Data Protection Authority (DSB) dismissed a complaint concerning transfers of personal data to the United States and China. The decision nevertheless provides important guidance on the use of Standard Contractual Clauses (SCCs) for transfers to countries without an adequacy decision. The case concerned an e-commerce marketplace operated by an Irish company. A customer’s data, including name, delivery address, device information and order data, were transferred to recipients in the US and China. For the US transfers, the DSB relied on the European Commission’s adequacy decision for the EU-US Data Privacy Framework. Both US recipients were certified and listed under the Framework. The DSB emphasised that a Commission adequacy decision is binding on Member States and their authorities unless annulled by the Court of Justice of the European Union. For China, no adequacy decision exists. The platform operator relied on SCCs under Article 46(2)(c) GDPR and submitted an overview of technical and organisational measures. Referring to Schrems II, the DSB stressed that SCCs can support a transfer only where the level of protection actually achieved in the recipient country is essentially equivalent to that in the EU. The DSB considered it “extremely doubtful” that the SCCs and measures presented were sufficient. The documentation contained no information on handling access requests by Chinese authorities and no concrete provisions on encryption or key management. General references to industry standards were insufficient to demonstrate the safeguards actually applied. The complaint was nevertheless dismissed because Article 49(1)(b) GDPR applied: the customer had placed an order with a merchant in China, making the transfer of buyer data necessary for performance of the contract. The DSB therefore left open whether the SCCs could support the platform’s systematic transfers and expressly referred to the possibility of ex officio investigations. 📌 SCCs alone are not enough: safeguards must be concrete, demonstrable and documented. Article 49 derogations are intended for individual cases, not as a structural basis for recurring transfers. The decision is not yet final.

AI Act transparency rules: When must companies label AI-generated content? Since August 2026, the transparency obligations under Article 50 of the EU AI Act have been fully applicable. For companies, however, this does not mean that every AI-assisted email, internal note, translation or social-media post must be labelled as AI-generated. Article 50 addresses four specific situations: direct interaction with chatbots or voice assistants, technical marking of synthetic content by AI-system providers, emotion recognition and biometric categorisation, and deepfakes or certain AI-generated texts on matters of public interest. Where companies use chatbots, voicebots or virtual avatars in customer interactions, users must be informed from the beginning that they are interacting with AI. A notice hidden in an imprint or small print is not sufficient. For images, video and audio, disclosure is required where synthetic or manipulated content creates an impression of authenticity. This includes realistic synthetic images, fabricated statements and cloned voices. By contrast, an AI-generated image that is clearly recognisable as an illustration will generally not reach the deepfake threshold. Providers of AI systems are separately required under Article 50(2) to make synthetic outputs machine-readable as artificially generated or manipulated. For texts, human editorial responsibility is decisive. AI-assisted drafts that are subsequently reviewed and approved by a person generally do not require labelling; the same usually applies to translations. Fully automated texts on matters of public interest without human review may, however, trigger the transparency obligation. Operators of emotion-recognition or biometric-categorisation systems must inform the persons concerned about their use. Such transparency does not make the use lawful in itself: certain emotion-recognition practices in workplaces and educational institutions are prohibited under Article 5 AI Act. The AI Act does not replace the GDPR. Where personal data are processed, both legal frameworks must be observed in parallel. In Germany, the Federal Network Agency has been designated as the central contact point for complaints concerning potentially missing or insufficient AI labelling. 📌 Article 50 does not establish a blanket labelling obligation. Companies should focus on the specific use cases covered by the provision and assess whether the relevant transparency requirements apply.