GDPR Is 4 (Video)

Ireland's Data Protection Commission received a record 16,160 new cases in 2025, marking a 45% increase from the previous year, while imposing over €530 million in administrative fines. The Commission finalized four major inquiries, with the TikTok decision accounting for €530 million of the total penalties, and concluded 208 cross-border complaints as Lead Supervisory Authority.

The European Union's Data Act introduces a groundbreaking "access by design" requirement that fundamentally changes how manufacturers must approach product development for connected devices and IoT products. From September 2026, businesses placing connected products on the EU market must ensure users can directly access their generated data by default, shifting data accessibility from a reactive request-based model to a proactive design imperative.

The European Commission has issued interpretive guidelines on Article 50 of the AI Act, clarifying transparency obligations for emotion recognition systems, biometric categorization, and deepfake content.

The EU Data Act, which became applicable on 12 September 2025, fundamentally reshapes how businesses handle data generated by connected devices and related services. With Ireland's General Scheme published in February 2026 designating ComReg and CCPC as enforcement authorities, companies must now assess their compliance obligations across data sharing frameworks, contractual terms, and user access rights or face significant fines.

The European Data Protection Board's 2025 Annual Report reveals significant developments in EU data protection enforcement and regulatory cooperation. With approximately €1.15 billion...

On 19 November 2025, the European Commission published its draft Digital Omnibus Regulations (EU Regulations 2025/0360 and 2025/0359).

Today the European Commission published its much anticipated decision on the new standard contractual clauses ("SCCs") for the transfer of personal data from the European Union to third countries, and the template SCCs.

The Irish High Court has delivered a landmark judgment in TikTok's appeal against the Data Protection Commission's €530 million fine, establishing that organizations must not only identify appropriate transfer...

On 17 December 2024, the European Data Protection Board ("EDPB"), following a first of its kind request from the Data Protection Commission ("DPC") under Article 64(2) of the GDPR...

The Data Act's "access by design" requirement came into force on 12 September 2026, mandating that manufacturers of connected products and providers of related services must enable direct user access to generated data by default. This article examines the scope of this new obligation and its practical implications for businesses in the Life Sciences sector, particularly those developing medical devices and Internet of Things products.

The Government has published its Autumn 2026 Legislation Programme, identifying 32 bills for priority publication and 32 bills for priority drafting. This article explores a selection of measures likely to be of interest to businesses, spanning digital economy, strategic infrastructure, litigation reform, financial regulation, competition law, corporate structures, employment, pensions, and healthcare sectors.

Ireland has lifted its data centre connection moratorium and introduced a demanding new framework requiring developers to provide their own generation capacity, source 80% of electricity from new Irish renewables within six years, and meet strict grid stability requirements. The policy creates significant opportunities for developers who can navigate the complex intersection of grid connection, planning permission, and renewable energy procurement, though a pending legal challenge adds uncertainty to the la

The European Commission has published comprehensive guidelines on AI transparency obligations under Article 50 of the EU AI Act, with enforcement beginning August 2, 2026. These guidelines establish how organizations must disclose AI systems, mark synthetic content, label deepfakes, and demonstrate compliance, with significant penalties for non-compliance reaching up to €15 million or 3% of global turnover.

The EU's Cyber Resilience Act introduces mandatory cybersecurity obligations for products with digital elements placed on the EU market. Understanding the five key manufacturer obligations—from secure-by-design requirements to incident reporting deadlines—is essential for compliance with this groundbreaking regulatory framework that elevates cybersecurity from best practice to legal requirement.

Following concerns from Ireland's Transmission System Operator (EirGrid) as to overdemand and constraints on the electricity network...

On 18 September 2026, the European Banking Authority (the EBA) published its final report on the new “Guidelines on the sound management of third-party risk regarding non-ICT services (EBA/GL/2026/09)” (the 2026 Guidelines).

Spirit Airlines' proposed $10 million sale of a massive de-identified corporate dataset to Google in its Chapter 11 bankruptcy proceedings raises fundamental questions about whether operational business data can be treated as a realisable asset in insolvency. The transaction highlights the legal tension between preserving a dataset's commercial utility and ensuring individuals cannot be identified, particularly when the data maintains referential integrity across multiple systems.

The European Commission has issued interpretive guidelines on Article 50 of the AI Act, clarifying transparency obligations for emotion recognition systems, biometric categorization, and deepfake content.

The government yesterday published an updated policy statement on electricity interconnection. Interconnection of electricity supply between Ireland...

The Omnibus 1 Directive (EU) 2026/470 (Omnibus 1 Directive) was published in the Official Journal on 26 February. This new Directive, which amends the Corporate Sustainability Reporting Directive (CSRD)...