Digital Omnibus: European data protection authorities against new personal data definition
18 February 26
Elisar Bashir
In a joint opinion, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) highlighted concerns about the proposed amendments to the definition of personal data and the Commission’s power to clarify when pseudonymised data no longer constitutes personal data.
Cable security toolbox encourages prioritising EU-based suppliers
16 February 26
Alessandra Vaes
Key measures in the non-binding cable security toolbox include implementing robust physical and cybersecurity measures, as well as reducing exposure to non-EU suppliers. Similar binding requirements for operators of submarine cable infrastructure and member states could also apply under the targeted amendments to the Directive on measures for a high common level of cybersecurity across the EU (NIS2) and the draft Cybersecurity Act 2 (CSA2).
EU Digital & Media Weekly Report
15 February 26
Miljana Todorovic
This report gathers policy and regulatory developments at EU level covered by Cullen International’s Digital Economy and Media services during the last week. It also lists events taking place this week.
European Data Protection Board decisions are challengeable, EU top court says
12 February 26
Javier Huerta Bravo
The EU Court of Justice overturned a first-instance decision declaring WhatsApp’s action against a decision of the European Data Protection Board inadmissible. It sent the case back to the EU General Court, which will now decide on the substance of the case. The case addressed the nature of “composite procedures”, i.e. those administrative procedures established by EU law where decisions are taken in multiple steps, involving both EU and national bodies.
Brazil and the EU mutually recognise the adequacy of personal data protection frameworks
12 February 26
Pedro Miranda
The decisions confirm that Brazil’s and the EU’s data protection frameworks are adequate. This enables the free flow of personal data belonging to over 650m consumers between the two jurisdictions, since each requires (amongst other conditions) an adequacy decision for cross‑border data flows to be lawful. This is the first time that Brazil adopts an adequacy decision for any region.
Brazil and the EU mutually recognise the adequacy of personal data protection frameworks
12 February 26
Pedro Miranda
The decisions confirm that Brazil’s and the EU’s data protection frameworks are adequate. This enables the free flow of personal data belonging to over 650m consumers between the two jurisdictions, since each requires (amongst other conditions) an adequacy decision for cross‑border data flows to be lawful. This is the first time that Brazil adopts an adequacy decision for any region.