.png)
EU
AI ACT
OpenAI sets out EU text watermarking approach
OpenAI said eligible ChatGPT and Codex text in the EU will receive an invisible statistical watermark over the coming weeks. API users worldwide can opt in for select models; API watermarking remains off by default. Detector access will initially go to approved researchers and expert organisations. OpenAI also highlighted reliability limits.
AI ACT
Five EU states still lack AI Act market-surveillance authorities.
More than a year after the designation deadline, five Member States had yet to name their AI Act market-surveillance authority, MLex reported on 8 October. The gap raises questions about readiness for coordinated enforcement as the Act’s obligations begin to apply. 1791540957778
DATA ACT
EU Council postpones Digital Omnibus vote
Coreper postponed its planned 7 October vote on the Council’s Digital Omnibus position after Germany and France raised concerns, especially about trade-secret safeguards in proposed Data Act changes. The package also covers GDPR and cyber-reporting rules; discussions will continue.
GDPR
EDPB publishes Uber automated-decision case
On 8 October, EDPB published the Dutch DPA’s €824.99 million fine over automated driver-account deactivations and inadequate information about profiling. The case concerns incidents in 2018–2022. Uber has appealed and the infringements have stopped; the EDPB publication is this week’s update.
GDPR
EDPB publishes Greek breach decision
On 8 October, EDPB reported the Hellenic DPA’s 28 July decision: €200,000 for the Ministry of Social Cohesion and €150,000 for E.E.T.A.A. over security and controller–processor failings. The authority ordered a processing agreement and stronger security. This is a newly published summary of an earlier decision.
GDPR
EDPB publishes four Italian GDPR case summaries
EDPB published four Italian DPA decisions on 9 October: IQVIA was fined €7 million over patient health data; BBVA €5.508 million for failing to respect a direct-marketing objection; Emirates €180,000 over transparency and retention of passenger health data; and a security company €39,000 over employees’ data.
DSA
Zalando loses EU court challenge over DSA fee documents.
The General Court dismissed Zalando’s action seeking access to Commission documents used to calculate its DSA supervisory fee. In its 7 October judgment, the Court upheld refusal to disclose material to protect commercial interests and related litigation.
NIS2
ENISA hosts health-sector cybersecurity meeting focused on NIS2
The 11th ENISA eHealth Security Conference took place in Nicosia on 7 October. Sessions covered NIS2 implementation in healthcare, the European Health Data Space, and cyber protection for hospitals and healthcare providers.
NIS2
Energy cyber forum calls for practical resilience alongside NIS2
At the 9th E.DSO, EE-ISAC, ENCS and ENISA forum on 8 October, experts discussed the Polish energy cyberattack, Ukraine’s grid under attack, AI and connected devices. The discussion highlighted the work needed to turn regulation into operational readiness.
NIS2
EU cyber-crisis network meets under NIS2
EU-CyCLONe representatives met in Dublin on 8–9 October. The network supports cooperation and shared situational awareness during large cross-border cyber incidents. Article 16 of the NIS2 Directive provides its formal basis.
Sweden
GDPR
IMY examines children’s identity numbers at Åbybadet
IMY opened an inquiry on 7 October into Mölndal’s Åbybadet swimming centre. It asks children arriving without an adult to provide their personal identity number, including for one-off visits. IMY is examining the purpose and legal basis.
GDPR
IMY reviews guidance on targeted political advertising
On 6 October, IMY reported that it had held a roundtable with media, advertisers, political parties and the Media Authority to evaluate guidance for targeted political advertising. IMY supervises the data-protection requirements in Articles 18–19 of the EU Political Advertising Regulation.
GDPR
IMY publishes opinion on employee crime-reporting proposal
On 8 October, IMY published its opinion on a proposed duty for municipalities and regions to report employees suspected of crimes. The publication concerns data protection and crime enforcement. It is an opinion on a proposal, rather than a new reporting rule entering into force.
