.png)
EU
DATA ACT
Council agrees Digital Omnibus position
On 21 October, the Council agreed a negotiating mandate covering GDPR, data rules and cyber reporting. It backs stronger trade-secret safeguards and national incident-reporting entry points. Negotiations with Parliament must follow: these are proposed changes, not new obligations in force.
DSA
Commission opens Booking.com investigation
Formal proceedings opened on 21 October examine fraudulent listings, phishing involving reservation and guest data, and the labelling of paid-for boosted listings. The Commission is assessing compliance with risk-management and advertising-transparency duties. No infringement finding has been made.
DMA
Publishers challenge Meta’s new terms
On 20 October, German publisher associations MVFP and BDZV asked the Commission to halt Meta’s planned crawling clause pending review. They allege that it breaches fair-access duties under Article 6(12) DMA. This is an industry complaint, not a regulatory finding; the terms are due on 30 October.
DSA
Dialogue on content-moderation appeals
The Commission met very large platforms and Digital Services Coordinators on 20 October to discuss out-of-court dispute settlement. Its 21 October readout covers platform challenges and work on Article 21 best practices. The dialogue concerns implementation, not a new enforcement decision.
Sweden
GDPR
IMY develops public-sector cloud guidance
On 20 October, IMY reported that it had questioned 19 public bodies about cloud use, including information classification, third-country providers and exit strategies. The guidance is expected in winter. This is preparatory work; the completed guidance has not yet been issued.
GDPR
IMY warns of PHP risks to personal data
IMY’s 22 October warning follows disclosure of two critical PHP vulnerabilities on 21 October. It highlights data-leak and fraud risks and urges vigilance against fake update messages. System owners should use trusted suppliers and official sources. This is a security alert, not a GDPR penalty.
DORA
FI changes incident reporting in Fidac
FI’s revised DORA reporting version was scheduled to apply from 19 October, following its 1 October announcement. Changes include a vertical form, a separate affected-entities table, reminder emails and reference-code filtering. This week’s milestone is the scheduled rollout, not a new legal reporting duty.
