Germany Adopts New IT Security Act

On November 21, the Data Protection Authority of Baden-Württemberg issued the first fine under the GDPR in Germany against a social media provider for violating data security requirements

On 19 November 2025, the European Commission published two proposed regulations as part of its Digital Package on Simplification...

The EU Data Act (Regulation (EU) 2023/2854), applicable as of Sept. 12, 2025, introduces a user‑centric access and sharing regime for both personal and non-personal data generated by IoT (Internet of Things) products, with a profound impact on how "data holders" design products, structure contracts, and monetize data.

On 31 July 2024 the Higher Regional Court of Koblenz (Oberlandesgericht Koblenz) has rejected an appeal to a verdict of the Regional Court of Koblenz (Landgericht Koblenz) for deletion...

The turn of the year, with the Brexit transitional period ending, finally brought some clarity about the future of data flows between the EU and the UK.

The decision does not introduce fundamentally new principles. Rather, it consistently combines elements that are well established in the Court's case law...

In its March 19, 2026, judgment in Case C-526/24 (Brillen Rottler), the CJEU ruled that even a first request for access to personal data under the GDPR may be deemed abusive if not made in good faith.

Two weeks ago, the German Conference of the Independent Data Protection Authorities of Germany (Datenschutzkonferenz or "DSK") released a report looking into Microsoft 365's...

The Regional Court of Berlin held in a judgment of 16 January 2018 that Facebook's default privacy settings and parts of their terms and conditions were invalid.

On January 21, 2019, French data protection supervisory authority CNIL imposed a fine of 50 million euros on GOOGLE LLC ...

The Code is voluntary, but it will likely become an important reference point for demonstrating compliance with Article 50 of the AI Act.

The Ninth Circuit Court of Appeals vacated a preliminary injunction against Perplexity AI, determining that when an AI agent acts at a user's direction, it is the user—not the AI company—who "accesses" computer systems under federal and California computer fraud statutes. This landmark appellate decision addresses how existing computer-access laws apply to agentic artificial intelligence and has significant implications...

The European Commission has initiated infringement procedures against 20 EU Member States for failing to transpose the EmpCo Directive by the March 27, 2026 deadline. This directive aims to combat greenwashing by requiring substantiation of environmental claims and third-party certification for sustainability labels, with full implementation expected by September 27, 2026.

The European Commission has proposed replacing the EU's three core procurement directives with a single, directly applicable Regulation that would fundamentally reshape how companies compete for public contracts across Member States. The reform introduces mandatory quality criteria thresholds, embeds ESG considerations as evaluation factors, and establishes new security and European-preference provisions that could restrict participation based on ownership, supply chain exposure, and strategic dependencies.

A federal court has struck down New York's Climate Change Superfund Act, which sought to recover $75 billion from fossil fuel companies based on historical emissions. The ruling found the Act preempted by the Clean Air Act, marking the first judicial decision on state climate superfund legislation and establishing that EPA's rescission of the endangerment finding does not alter preemption analysis.

Mexico's comprehensive anti-money laundering framework has undergone a sweeping transformation through Acuerdo 115/2026, introducing mandatory risk-based methodologies, enhanced client due diligence protocols, and automated monitoring requirements. With implementation deadlines beginning March 1, 2027, obligated parties conducting vulnerable activities face compressed timelines to overhaul their compliance infrastructure while navigating heightened enforcement risks and stricter beneficial ownership thresho

France's Anti-Corruption Agency has imposed its first-ever monetary sanctions under the Sapin II Act, penalizing a company €350,000 and its president €60,000 for widespread compliance failures. The landmark decision establishes critical precedents for enforcement strategy, breach assessment timing, and personal executive liability in anti-corruption matters.

The European Commission has adopted final Guidelines on exclusionary abuses of dominance under Article 102 TFEU, introducing a "workable effects approach" that narrows presumptions while expanding guidance on objective justifications and recognizing sustainability benefits as valid efficiencies for the first time. These Guidelines replace the 2008 Enforcement Priorities Guidance and are expected to significantly impact enforcement practices across EU Member States and beyond, particularly for digital market

The user of defective goods benefi ts from several causes of action against the vendor or manufacturer.

On December 3, a federal court in the Central District of California granted plaintiffs' request for preliminary approval of a proposed $22 million settlement ...