Belgian Court of Appeal annuls data protection authority’s decision validating IAB Europe’s action plan to bring cookie consent framework in compliance with GDPR
08 February 26
Marianna Mattera
The Brussels Court of Appeal annulled the Belgian data protection authority (APD)’s decision approving IAB Europe’s action plan to align its Transparency and Consent Framework with the EU General Data Protection Regulation. The court also rejected the APD’s broader view that IAB Europe was acting as joint controller for the data processing carried out in the context of the open real-time bidding protocol.
EU Digital & Media Weekly Report
06 February 26
Elisar Bashir
This report gathers policy and regulatory developments at EU level covered by Cullen International’s Digital Economy and Media services during the last week. It also lists events taking place this week.
Draft Cybersecurity Act 2: changes to the EU cybersecurity certification framework
05 February 26
Alessandra Vaes
The draft CSA2 would introduce a cyber posture certification scheme enabling NIS2 entities operating in multiple EU member states to demonstrate compliance with the directive's security risk-management obligations. EU certification schemes would be developed by the EU cybersecurity agency (ENISA) within 12 months of the European Commission issuing a request.
Poland adopts law restricting high-risk suppliers in critical sectors
03 February 26
Monika Kačeriaková
Through amendments to the Cybersecurity Act, Poland transposes the NIS2 Directive and introduces procedures for phasing out products, services and processes from high-risk suppliers (HRS). The law overlaps with the draft Cybersecurity Act 2, which would empower the European Commission to restrict HRS in critical sectors at EU level.
Stakeholders discuss developments and challenges in the EU data protection framework
03 February 26
Marianna Mattera
Policy makers, academia, industry stakeholders and civil society reflected on whether the EU data protection framework should be “reset” or “refined” following the recent Court of Justice of the EU judgment on the relative nature of personal data, technological changes and the European Commission’s Digital Omnibus proposal. The conference, co-organised by the European Data Protection Supervisor and the Council of Europe provided a forum for in-depth discussion on the evolving definition of personal data and the future regulation of cookies and online tracking technologies.
Draft Cybersecurity Act 2: tech sovereignty and de-risking of ICT supply chains at the centre of first debate in European Parliament
01 February 26
Visiola Pula
The European Commission executive vice-president for Tech Sovereignty, Security and Democracy, Henna Virkkunen, said that the availability of alternatives and the economic impact of potential mitigating measures will be considered when de-risking ICT supply chains.