Tainted Training Data and AI: A Case-by-Case Approach
1. When unlawful data enters the AI supply chain Artificial intelligence systems are insatiable consumers…
Browsing: Data, Privacy & Security
Biotech Act: a reading through the lens of the Joint Opinion 3/2026
The European Biotech Act is one of the most ambitious recent attempts to reorganize the…
5G Infrastructure, National Security and EU Constitutionalism: Reflections on Advocate General Ćapeta’s Opinion in Elisa Eesti (C-354/24)
The Opinion of Advocate General Ćapeta in Case C-354/24, Elisa Eesti AS v Vabariigi Valitsuse julgeolekukomisjoni…
Brazil and EU mutual adequacy decisions: what does it take to build the largest area of free and secure personal data flows worldwide?
Introduction In January 2026, the European Union (EU) and Brazil adopted mutual adequacy decisions for…
Quando il datore di lavoro ‘sa troppo’: il Garante privacy interviene sul trattamento dei dati dei dipendenti Amazon
Il Garante per la protezione dei dati personali ha disposto nei confronti di Amazon la…
The Commission Action Plan on Drone and Counter Drone Security
I. Introduction The European Commission presented an ‘Action Plan on Drone and Counter Drone Security’…
FSE, data breach e riparto di competenze in materia sanitaria: una riflessione su Cass. 27558/2025
Il dato sanitario rappresenta tante cose a un medesimo tempo. Esso costituisce anzitutto una delle…
Dior’s China Data Breach: A Personal Information Protection Law Landmark
Introduction On 9 September 2025, the National Cybersecurity Notification Centre (Guojia wangluo anquan tongbao zhongxin…
Online Platforms’ Liability and the Processing of Sensitive Data: A Comment on the CJEU Judgment (Grand Chamber, 2 December 2025) – Case C492/23 X v Russmedia Digital SRL and Inform Media Press SRL
Introduction The judgment delivered by the Court of Justice of the European Union (Grand Chamber,…
“From sceptic to signatory”: Strategic ambivalence in the EU’s approach to the UN Cybercrime Convention
1. The EU signs the UN Cybercrime Convention in Hanoi: A moment to celebrate At…
The Data Omnibus: The Good, the Bad, and The Ugly Behind the DGA and Data Act Rewrite
On November 19, 2025, the European Commission introduced the Digital Omnibus Regulation Proposal (hereafter “Omnibus”)…
A Journey into Data Law in South America
As nations worldwide grapple with the dual challenges of safeguarding data and fostering technological innovation,…
Diversity & Inclusion e dati sensibili: il GDPR rallenta, l’AI Act accelera?
La tematica della Diversity and Inclusion (D&I) è ormai al centro del dibattito della società…
Schrems v. Facebook: Limitations on the Use of Off-Platform Data and Sentive Personal Data
The Schrems Saga continues with the recent judgement (hereinafter, the “Judgment”) of the Court of…
Il diritto alla privacy del soggetto sottoposto ad indagini penali – CGUE, C-548/21
Al diritto alla riservatezza (c.d. privacy) l’ordinamento giuridico dell’Unione Europea conferisce protezione indubbiamente ampia, scomponibile…
Freedom to Conduct a Business and Right to the Protection of Personal Data
Abstract of the research. In the Digital Ecosystem the relationship between freedom to conduct a…
Interpreting the EU Digital Markets Act consistently with the EU Charter’s rights to privacy and protection of personal data
Abstract of the research Depending on implementation details, the EU Digital Markets Act (DMA) may…
Healthcare data: a new currency was born. Examples from Israel and the United States
When talking about healthcare data we usually define it as the currency of the future;…
EU-U.S. Data Privacy Framework: è (finalmente) realtà!
1. Introduzione Annunciata lo scorso 10 luglio, l’adozione, da parte della Commissione europea, della decisione…
Digital Markets Act and the interoperability requirement: is data protection in danger?
The past year has been a landmark period for the regulation of digital platforms in…
AG Opinion on Case C-252/21: The Interplay between Data Protection Law and Competition Law
1. Introduction On 20 September 2022, Advocate General Rantos of the European Court of Justice…
European Data Protection and Social Media: The Quest for Consistency in the Internal Market
A new case has once again inflamed the debate around the role of European data…
Lotta al riciclaggio e nuove tecnologie: il Garante dà il via libera al database centralizzato
Introduzione In data 7 luglio 2022, l’Autorità Garante per la Protezione dei Dati Personali ha…
Data Information Sharing in Cybersecurity: Is it worth for the protection of CIs?
Di Donato Noemi Tommasina* Introduction “We need to build the foundation for collective decision-making…
Will the EU and the US ever agree on a satisfactory data transfer mechanism? The main setbacks of the transatlantic data flow
Introduction: Edward Snowden’s revelations. «I do not want to live in a world where everything…
Safeguarding European democracy in the age of surveillance capitalism: a call for the approval of a ‘Charter of Digital Fundamental Rights’ and the recognition of data as commons
We live in the era of surveillance capitalism[1], where a massive quantity of data, the…
ICO fines Ticketmaster £1.25m for failing to protect customers’ personal data
The Information Commissioner’s Office (ICO), i.e., the UK data protection authority, imposed a £1.25m fine on…
The Spanish Supreme Court of Justice held that the data of the GPS geolocator in a company vehicle is lawful if the employee is informed of its installation
The Spanish Supreme Courtruled on 15 September 2020[1] that the use of data collected by…
“It’s free” or maybe not: the convergent enforcement of Consumer and Data Protection Laws on personal data processing
Summary: 1. Introduction. – 2. The challenged AGCM decision. –3. The Administrative Court ruling. –4.…
According to the CJEU, Member States cannot require Electronic Communications Service Providers to transmit to Authorities or retain traffic data and location data on a general and indiscriminate basis
On October 6, 2020, the Grand Chamber of the Court of Justice of the…
The CJEU rules that certain anti-concentration limits set forth by Italian legislation for the protection of media pluralism are incompatible with EU law
Summary: The CJEU has established that the market concentration thresholds set forth by Article 43(11)…
Unlawful data processing in the phone sector: the Italian Data Protection Authority fines Wind Tre and Iliad
At its July 9 meeting, the Italian Data Protection Authority (“DPA”) assessed the findings of…