digital economy regulation

The Dutch DPA’s fine against Uber is the second largest GDPR fine to date. The Dutch DPA found that, by suspending drivers’ accounts without human intervention, Uber subjected the drivers to decisions based solely on automated processing. Under the GDPR, such automated decision-making (ADM) is generally prohibited where it produces legal or similarly significantly affects the individuals concerned, subject to certain exceptions. Where an exception applies, the data controller must inform the relevant individuals that decisions concerning them are based on ADM.

This edition features a story on the application of the Cyber Resilience Act’s reporting requirements; a new edition of the EU Timeline, highlighting key EU policy and regulatory developments foreseen until the end of 2026; and an update of the Digital Economy Trackers.

This edition of Cullen International’s EU Timeline highlights key policy and regulatory developments foreseen at EU level until the end of 2026.

This edition covers EU-level policy and regulatory developments tracked by Cullen International’s Digital Economy and Media services over the past week, as well as key reports published during the summer. These include an analysis of EU countries’ positions on the framework restricting high-risk suppliers under the proposed Cybersecurity Act 2 (CSA2); reports on the European Commission guidance on the Cyber Resilience Act (CRA); an analysis of core amendments to the EU AI Act, following the entry into force of the AI Omnibus; a story about the reinstatement of temporary rules on voluntary detection of child sexual abuse by messaging apps; a story about France’s Constitutional court ruling against a blanket social media ban for under-15s, with a potential impact on the Commission’s upcoming social media delay proposal; and developments in cases under the Digital Markets Act (DMA) and the Digital Service Act (DSA). It also lists events taking place this week.

According to a document prepared by the Council’s general secretariat and seen by Cullen International, several member states raised concerns over the proposed mechanism to designate high-risk suppliers (HRS) under the Cybersecurity Act 2 (CSA2). They called for an assessment in which suppliers’ links to countries posing cybersecurity concerns are treated as a risk indicator rather than a determining factor. Regarding telecoms networks, several member states questioned the proposed EU-wide three-year timeline for phasing out HRS components from 5G networks, favouring greater flexibility to account for national circumstances and the equipment lifecycles.

This Flash highlights the main aspects addressed in the guidance on the Cyber Resilience Act (CRA) related to free and open-source software (FOSS). It provides examples where FOSS is considered to be supplied during a commercial activity and hence placed on the market, triggering the obligations for manufacturers. The guidance also clarifies the concept of stewards and when they would be subject to the CRA reporting obligations. A steward sustains and supports FOSS intended for commercial use but does not place the software on the market.