Proposed Spanish decree on network security and resilience would also apply to data centres
11 January 26
Carmen Mateas
A draft royal decree on network security and resilience would impose detailed security risk-management, incident reporting and service continuity obligations on operators of public electronic communications services (ECS) and networks (ECN) that meet certain criteria, and also underlying digital infrastructure such as data centres.
Sweden transposes NIS2 Directive
11 January 26
Visiola Pula
The new Cybersecurity Act and an ordinance designating NIS2 competent authorities will enter into force on 15 January 2026. The national telecoms authority (PTS) will specify the measures telecoms providers and digital entities (e.g. cloud, data centres) should implement to meet the obligations of the act. For digital entities, these measures might apply in addition to the Commission’s NIS2 implementing act.
EU 2030 consumer agenda: parliament calls for digital fairness and stronger enforcement
19 December 25
Olha Hruba
While members of the European Parliament broadly welcomed the European Commission 2030 consumer agenda, many raised concerns about persistent market barriers and enforcement gaps.
BEREC organises a workshop on submarine cable connectivity in Europe
16 December 25
Loïc Le Floch
BEREC, the assembly of European national regulatory authorities (NRAs), organised a public workshop following its report on submarine cable connectivity in Europe and the European Commission confirmed the timeline for delivering the submarine cable security toolbox.
EU top court clarifies personal data processing obligations for online marketplaces
15 December 25
Alessandra Vaes
According to the court, the operator of an online marketplace will have a proactive duty to identify, verify and potentially refuse publication of an advertisement generated by a user of the platform which contains sensitive personal data. The advertisement should not be published if the sensitive data was unlawfully processed (e.g. without the data subject’s explicit consent). The court also confirmed that the operator of the platform, as a data controller for personal data processed on its platform, may not absolve itself of its obligations under the GDPR by invoking the intermediary liability provisions set out in the e-Commerce Directive (eCD). These intermediary liability provisions have since been moved to the Digital Services Act (DSA).
EU Digital & Media Weekly Report
14 December 25
Javier Huerta Bravo
This report gathers policy and regulatory developments at EU level covered by Cullen International’s Digital Economy and Media services during last week. It also lists events taking place this week. This is the last EU Digital & Media Weekly Report before 2026, when discussions in Brussels around the different policy and regulatory initiatives will resume after the end-of-year holiday period.