Spanish DPA Rewards Public And Private GDPR Compliance Initiatives

Bienvenido al último número de nuestro update de derecho digital y TMT, donde encontrarás algunas de las principales novedades más destacadas del sector a nivel internacional, europeo y español.

On February 23 2026, the Spanish supervisory authority (AEPD) published an article containing recommendations on operational sovereignty when processing personal data. This follows a major incident on October 20 2025, where a cloud provider experienced technical issues in the United States which affected services globally.

En nuestra nueva publicación sectorial 'Code≠Law' exploramos la carrera de la regulación del mundo digital mientras las tecnologías emergentes crean tensiones entre la libertad...

Our new Code≠Law series explores the race to regulate the digital world as emerging technologies create tensions between online freedoms and necessary safeguards.

Bienvenido al último número de nuestro update de derecho digital y TMT, donde encontrarás algunas de las principales novedades más destacadas del sector a nivel internacional, europeo y español.

Agencia Espanola Proteccion Datos (AEPD), the Spanish Agency for Data Protection agreed to initiate sanction against Eurobox S.A. after user was required...

A draft bill promotes minors' positive use of digital environments in areas such as education or social interaction

In today's digital age, where information has become an invaluable resource for the economy, the protection of personal data has emerged as a fundamental pillar for preserving citizens' rights.

The Spanish Data Protection Authority ("Agencia Espanola Proteccion Datos – AEPD") has recently issued its highest fine to date, totaling €8.15 million for several breaches of GDPR...

DLA Piper has published a new guide that summarises the varying approaches of the law on cookies across Europe.

The SEC has proposed a comprehensive modernization of federal transfer agent rules that would expressly permit the use of blockchain technology as a master securityholder file. The proposal introduces technology-neutral language alongside new reporting requirements for distributed ledger technology usage and tokenized securities activity.

As federal climate disclosure rules face rescission and state-level mandates remain largely stalled, California's SB 253 greenhouse gas reporting requirement stands as the sole advancing framework, creating a fragmented compliance landscape where multistate companies must navigate divergent regulatory trajectories. With the SEC's 2024 climate rules stayed and proposed for elimination, and California's Air Resources Board finalizing implementation mechanics for November 2026 reporting deadlines, the operatio

The Ninth Circuit Court of Appeals vacated a preliminary injunction against Perplexity AI, determining that when an AI agent acts at a user's direction, it is the user—not the AI company—who "accesses" computer systems under federal and California computer fraud statutes. This landmark appellate decision addresses how existing computer-access laws apply to agentic artificial intelligence and has significant implications...

A federal court has struck down New York's Climate Change Superfund Act, which sought to recover $75 billion from fossil fuel companies based on historical emissions. The ruling found the Act preempted by the Clean Air Act, marking the first judicial decision on state climate superfund legislation and establishing that EPA's rescission of the endangerment finding does not alter preemption analysis.

The European Commission has adopted final Guidelines on exclusionary abuses of dominance under Article 102 TFEU, introducing a "workable effects approach" that narrows presumptions while expanding guidance on objective justifications and recognizing sustainability benefits as valid efficiencies for the first time. These Guidelines replace the 2008 Enforcement Priorities Guidance and are expected to significantly impact enforcement practices across EU Member States and beyond, particularly for digital market

In a recent PTAB decision, Director Squires addressed whether Microsoft's IPR petition should proceed despite Sandpiper CDN's discretionary denial request. The ruling hinged on two critical factors: the novelty of Microsoft's art citations and Sandpiper CDN's failure to disclose its own commonly assigned prior art during patent prosecution. This case provides important guidance on how patent owners' prosecution conduct can impact discretionary denial outcomes at the Patent Trial and Appeal Board.

The European Commission has proposed replacing the EU's three core procurement directives with a single, directly applicable Regulation that would fundamentally reshape how companies compete for public contracts across Member States. The reform introduces mandatory quality criteria thresholds, embeds ESG considerations as evaluation factors, and establishes new security and European-preference provisions that could restrict participation based on ownership, supply chain exposure, and strategic dependencies.

Early decisions about a start-up's legal structure can dramatically affect tax outcomes and financial returns as the company grows and reaches liquidity events. Understanding the Qualified Small Business Stock (QSBS) exemption and implementing proper structuring from the outset can significantly enhance returns for both founders and investors.

California's Air Resources Board has opened its voluntary reporting platform for the first cycle of greenhouse gas emissions disclosure under SB 253, establishing November 10, 2026 as the deadline and clarifying that companies may submit existing reports rather than creating new CARB-specific documents. The guidance addresses critical implementation questions including consolidated reporting mechanics, fee assessment structures, and first-year enforcement discretion for entities without established data col

The Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation have issued a final rule that formally defines "unsafe or unsound practice" for the first time, tying it to material financial risk rather than subjective factors. The rule raises the threshold for issuing matters requiring attention and introduces a "substantial compliance" standard for terminating enforcement actions, potentially addressing longstanding industry concerns about regulatory overreach and debanking.