[{"titre":"FDA Proposes Rule to Update Infant Formula Nutrient Requirements","id":3251756,"pubDate":"Fri, 30 Oct 2026 07:53:31 +0100","description":"Today, the U.S. Department of Health and Human Services (HHS) and the Food and Drug Administration (FDA) issued the first of three proposed rules that aim to update infant formula nutrient requirements. While the formal rulemaking process commences, FDA has also released new chemical contaminant testing data demonstrating that most infant formula samples showed low or non-detectable levels of contaminants, according to HHS' press release . FDA intends to conduct a comprehensive review of the 30 nutrients currently required in infant formula marketed in the United States. The FDA intends to consolidate final changes to infant formula nutrient requirements into a single comprehensive final rule. Today's proposed rule (phase 1 of three) would update requirements for iodine, manganese, vitamin A, and vitamin D and reaffirm existing requirements for chloride, potassium, selenium, and sodium. It would also change the units of measure for two nutrients and request public input on potential requirements for ingredients that are currently not required in infant formula but commonly added by manufacturers due to their nutritional value ( e.g ., arachidonic acid (ARA), docosahexaenoic acid (DHA), and L-carnitine). FDA is accepting comments on the proposed rule until February 26, 2027. Keller and Heckman LLP will provide updates throughout the rulemaking","source":"The Daily Intake","url":"https://www.dailyintakeblog.com/2026/10/fda-proposes-rule-to-update-infant-formula-nutrient-requirements/"},{"id":3232003,"pubDate":"Wed, 21 Oct 2026 14:33:39 +0200","titre":"The Old Québec (Vieux-Québec) historic district: Heritage, tourism and real-estate developers since the post-war years","description":"Introduction There are several ways of conceiving heritage conservation. For the purpose of this paper, we need to start from the premise that what we call “heritage” is a dynamic, evolving reality, and that a historic district such as “Old Québec” can undergo structuring transformations rooted in a process of heritage conservation. In Old Québec, the process of conservation —also referred to “patrimonialization”—has not received the attention it deserves. This paper aims to shed light on the process of functional requalification has undergone by Old Québec since the 1950s, within the broader context of its transformation into a historic district. It is based on discourse analysis (Berthold, 2013), supported by a diversifie body of documentation, including primary sources, such as archival documents, press reviews, geospatial and land-use data, and official reports. It is complemented by a body of scholarly literature devoted to Old Québec since the 1970s. First, we explain the sociohistorical process that led to the creation of Old Québec, starting in the 1950s. Then, we highlight the role played by tourism and the real-estate economy —includingdevelopers—in this process. Turning the Champlain District into a historic district At the turn of the 1950s, the area now known as “Old Québec” was referred to as the Champlain District. Named after the city’s main colonial founder, Champlain was one of the first areas to be settled, beginning in the early 17th century. It covers","url":"https://www.cahiers-espi2r.fr/2305","source":"ESPI2R"},{"url":"https://verfassungsblog.de/the-currently-uneven-intelligence-of-ai-in-comparative-constitutional-law/","source":"Scoop.it - Documentation juridique (Stéphan Cottin)","pubDate":"Thu, 15 Oct 2026 08:26:22 +0200","id":3218421,"titre":"The (Currently) Uneven Intelligence of AI in Comparative Constitutional Law","description":"This article belongs to the debate » Thinking Machines, Thinking Lawyers14 October 2026The (Currently) Uneven Intelligence of AI in Comparative Constitutional Law From Years of Research to a Single Prompt? Artificial intelligence (AI) has the potential to accelerate and improve the quality of research. This potential has inspired numerous projects exploring how AI could help scholarship on constitutional law. For example, there is research using AI to interpret constitutions,1) apply constitutional principles,2) and predict court rulings.3) Even the question of whether AI could improve the process of constitution-making has been studied.4) AI’s potential is particularly significant for comparative constitutional research. Systematically comparing legal systems requires locating sources from different jurisdictions, which are often difficult to access and only available in local languages. The creation of comparative legal datasets has thus involved considerable personnel, time, and financial resources. AI can overcome many of these obstacles. AI models can search for and translate foreign-language sources, filter them, and convert the filtered information into a dataset. In doing so, AI offers the prospect of datasets — which previously required years of research and the efforts of numerous experts and research assistants to compile — being just a prompt away. However, whether AI models can generate comparative law datasets that are qualitatively comparable to human-coded datasets has not yet been addressed (although Guha et al provide an example for a broader legal benchmarking exercise).5) We therefore conducted our own benchmarking study.6) We found evidence suggesting that recent AI models may be able to code simple factual data, but they are likely unreliable substitutes for expert human coders when conceptual or interpretive judgment is required. The Benchmarking Project: Seven Coding Tasks, Four Datasets, Two LLMs In our project, we tested the ability of two large language models (LLMs) to code different types of information relevant to comparative constitutional law. We specifically assessed whether LLMs can reproduce information from four existing comparative constitutional law datasets, all of which were compiled through human coding and which served as a ‘ground truth’ for our exercise. From these datasets, we asked the LLMs to code seven variables, which can be thought of as seven tasks relevant to the creation of comparative constitutional law datasets. Each of these tasks is either a test of fact-finding or reasoning abilities. First, from the Executive Term Limit Evasion Dataset,7) we drew information on whether presidents in 106 presidential systems have evaded constitutionally mandated term limits between 2000 and 2019. The dataset includes one variable on whether presidents attempt to overstay past the end of their term. The second variable captures what strategies executives use for doing so, such as amending the constitution, replacing it with a new one, or asking the court to interpret term limits out of the constitution. While determining whether a president overstayed is a fact-finding task, assessing the strategy used to do so requires reasoning. Second, from the Comparative Constitution Making Dataset,8) we drew information on the process by which constitutions were adopted in democracies between 1900 and 2015. This dataset also includes fact-finding variables such as (1) whether citizens were involved in the formulation, discussion, or submission of reform proposals, and (2) whether citizens participated in popular referendums at any stage in the process. The dataset’s most important variable (3) captures whether constitutions reflect ‘plural elite agreement,’ that is, whether all relevant elite factions in society were involved and represented during the process. The recreation of this variable requires reasoning. Third, from the Characteristics of National Constitutions Dataset9), we drew on its coding of 43 first-generation constitutional"},{"source":"FTC USA Business Blog Posts","url":"https://www.ftc.gov/business-guidance/blog/2016/06/practice-fusion-case-suggests-6-health-privacy-pointers","titre":"Practice Fusion case suggests 6 health privacy pointers","pubDate":"Sat, 03 Oct 2026 08:09:37 +0200","id":3194910,"description":"Practice Fusion case suggests 6 health privacy pointers lfair June 8, 2016 | 9:01AM Practice Fusion case suggests 6 health privacy pointers By Lesley Fair Combine two of the most talked-about consumer protection topics – health privacy and consumer-generated online content – and what do you get? A proposed FTC settlement with Practice Fusion, the largest cloud-based electronic health records company in the country, and six compliance tips for others in the industry. One of San Francisco-based Practice Fusion’s primary products is an electronic records system for outpatient providers. In 2009, the company launched “Patient Fusion,” an online portal where patients whose providers were already using Practice Fusion could view or download their health information or transmit it to another provider. Patient Fusion also let patients send and receive secure messages from their providers. Fast forward several years and the company decided to expand Patient Fusion to include a public directory where current and prospective enrollees could search for doctors geographically or by specialty, read patient reviews of providers, and request appointments. But Practice Fusion had to ask itself a question familiar to many online companies: How do we get the content – in this case, patient reviews? That’s the focus of the FTC’s lawsuit. According to the complaint , Practice Fusion solicited data in a misleading way that led some patients to believe they were sending follow-up messages directly to their doctors about their diagnosis, medical treatment, prescriptions, etc. – and not contributing content to a public website. Practice Fusion, however, populated its new site with the information those people provided, some of which was highly sensitive. Here’s what happened. After appointments with their doctors, patients received emails titled “How was your visit?” The message continued, “To help improve your service in the future, please let us know how your visit went” and included a link with rating stars. The message ended this way: Thank you, Dr. [Name] In a footer, the message said “This email was sent to you by Patient Fusion®, a tool Doctor [Name] uses to deliver the highest quality of care to patients.” Below that in smaller print it said “Sent on behalf of Doctor [Name]’s office by: Practice Fusion.” If patients clicked the link, they were taken to a page that asked for feedback about things like how long they had to wait for their appointment, the doctor’s bedside manner, and whether their medical concern was addressed. There also was a text box where patients were invited to “leave a review for your provider.” Below that was a pre-checked box with the phrase “Keep this review anonymous.” What did some people put in that box? Highly sensitive information directly addressed to their doctors, not evaluations meant to be shared publicly. Here are just a few examples: “Dr [name], My Xanax prescription that I received on Monday was for 1 tablet a day but usually it’s for 2 tablets a day. I have not taken it to the pharmacy yet. Can I pick up a new one, or can I get a prescription called into a pharmacy? Thanks, [patient’s full name] “I called today and left a message regarding my daughter and no one has returned my call. I think she is depressed and has stated several times this week that she wishes she was dead. Could someone please call me [phone number]?” “The cefuroxime axetil does not seem to be doing anything for me. I did a little research and I think I have a yeast infection called candida. Not sure what to do about it yet. I guess I will first try to change my diet. Medication? [patient’s full name] “I would like to make an appointment for my back pain and possible shingles. Can you please call me @ [phone number]? Thank you! [patient's full name]” “I HAVE NO INFECTION [healthcare provider name].  EVERYTHING WENT"},{"url":"https://www.arthurperret.fr/blog/2023-11-01-document-theory-and-document-design.html","source":"Blog d'Arthur Perret","pubDate":"Thu, 23 Jul 2026 10:17:34 +0200","id":3047509,"titre":"[Article] Document theory and document design","description":"<p>This paper reports on an experiment which connects document design with document theory. Document design is about what documents should do. We use the example of document graphs and of Cosma, a visualization program created during the HyperOtlet research programme, to show how theory can inform design decisions and help conceptualize results. This paper is currently under peer review.</p> <hr/> <section id=\"document-design-or-information-design\" class=\"level1\"> <h1>Document design or information design?</h1> <p><span class=\"citation\" data-cites=\"findeli2015\">Findeli (2015)</span> defines design as diagnostic and prescriptive, an example of “projective” epistemology: designers view the world as a project to realize, rather than an object to know. This definition of design implies that document design is less about what documents <em>are</em> and more about what they <em>should do</em>. This aligns with the evolution of document theory from an ontic view of documents to a functional one, which was pioneered by the European documentation movement in the first half of the twentieth century and reintroduced as “neo-documentation” in the literature during the 1990s.</p> <p>Currently in the literature, document design is mostly considered to be a part of information design.<a href=\"#fn1\" class=\"footnote-ref\" id=\"fnref1\" role=\"doc-noteref\"><sup>1</sup></a> The purpose of information design is to create effective communications <span class=\"citation\" data-cites=\"renkema2006 pettersson2002\">(Renkema 2006 ; see also Pettersson 2002)</span>. Document design is usually taught within communications programs ; in the US, in either English or fine arts departments <span class=\"citation\" data-cites=\"schriver1997\">(Schriver 1997, p. 92‑93)</span> ; in France, in Information and Communication Science departments.</p> <p>Research on information design has very few connections with documentation. It has been criticized for its lack of theory: <span class=\"citation\" data-cites=\"carliner2006\">Carliner (2006, p. 10–14)</span> warned about the field’s tendency to generalize findings despite shaky conceptual foundations and a limited understanding of topics such as the World Wide Web.<a href=\"#fn2\" class=\"footnote-ref\" id=\"fnref2\" role=\"doc-noteref\"><sup>2</sup></a> We believe document theory can help address some of these challenges and bring perspective to information design.</p> <p><span class=\"citation\" data-cites=\"zacklad2019a\">Zacklad (2019)</span> gives us an example of this. He draws from document theory to define information design as the interplay between textualization (creating content information), documentarization (shaping the medium) and auctorialization (creating author identities). Zacklad puts documentarization at the heart of information design (see fig. <a href=\"#fig:zacklad2019\">1</a>). Documentarization can be internal (the organization of fragments into documents) or external (the relational organization of documents, e.g. classification); it can involve different roles or positions (author, editor, printer/programmer, distributor, reader); it implies significant differences between designing the systems that involve documents (“system-oriented design”) and designing the documents themselves (“author design”).</p> <figure id=\"fig:zacklad2019\"> <img src=\"https://www.arthurperret.fr/img/2023-docam-zacklad2019.png\" class=\"fullwidth\" alt=\"Information design according to"},{"id":2900811,"pubDate":"Fri, 22 May 2026 14:08:22 +0200","titre":"Arcom's notice of May 6, 2026 accompanying the publication of model agreements provided for in article L333-10 of the French Sports Code.","description":"The French regulatory authority for audiovisual and digital communication, Having regard to the French intellectual property code , in particular article L. 331-12 ; Having regard to the French Sports Code , in particular article L.333-10 ; After due deliberation, Adopts the following notice: The year 2025 marked a turning point in the fight against sports broadcasting piracy, with increased involvement of various types of intermediaries, under the impetus of sports rights holders, as part of the dynamic injunctions issued under article L. 333-10 of the French Sports Code . In addition to the legal actions involving Internet Service Providers (ISPs), which have been fully integrated into the scheme since 2022, and in order to strengthen the effectiveness of the blocking measures implemented, rights holders have extended their legal actions, from 2023, to search engine operators, who play a key role as central players in the diffusion of information on the internet and in directing users to sports-related contdnt. Search engine operators are now almost systematically involved in actions taken by rights holders to protect sports competitions. Between 2024 and 2025, the number of delisting measures ordered by the courts and the number of measures notified by Arcom in application of the orders issued has dubbed. In response to the misuse by some Internet users of domain name resolution services or virtual private networks (VPNs), rights holders then extended the scope of players taken to court to prevent access to services dedicated to the unlawful broadcasting of sports competitions. More than 5,000 blocking demands were notified to alternative DNS in 2025. As for virtual private network service providers, they were the subject of the first court verdicts, handed down on the basis of article L. 333-10 of the French Sports Code , in May 2025, and as such are receiving a growing number of blocking demands to update the measures ordered by the judge. Against this backdrop, strengthening cooperation between rights holders of sports-related content and the various intermediaries mentioned in the court orders would therefore appear to be desirable in order to give an even greater impact to the fight agains sports piracy. The parties are also invited to continue their exchanges with Arcom with a view to optimizing the provision of identification data and ensuring the simultaneous application of delisting and blocking measures by all technical intermediaries involved in preventing access to unlawful services. Article L. 331-12 of the French intellectual property code makes provision for the adoption of notices by the Authority for the protection and promotion of creation, with the aim of encouraging the signing of voluntary agreements likely to help remedy infringements of copyright and neighbor rights, or of the audiovisual exploitation rights mentioned in article L. 333-10 of the French Sports Code, on electronic communications networks used for the provision of online public communication services. In addition, under the terms of IV of article L. 333-10 of the French Sports Code, Arcom is responsible for adopting model agreements which the rights holders mentioned in I of the same article are invited to sign. The agreement concluded between the parties specifies, in particular, the measures that the parties undertake to take to put an end to any infringement of the exclusive audiovisual exploitation rights of the sports event or competition. The Autorité recommends that the rights holders mentioned in I of article L. 333-10 of the French Sports Code, on the one hand, and any intermediaries implementing measures ordered on the basis of II of article L. 333-10 of the same code, on the other (notably search engine operators, domain name resolution services and virtual private network providers), enter into discussions with a view to concluding agreements that would reflect their joint commitment to fight agains the unlawful diffusion of sports-related events and competitions as effectively as possible. To this end, Arcom is","url":"https://www.arcom.fr/en/find-out-more/legal-area/legal-resources/arcoms-notice-may-6-2026-accompanying-publication-model-agreements-provided-article-l333-10-french-sports-code","source":"Arcom Textes juridiques"},{"id":2850552,"pubDate":"Mon, 27 Apr 2026 14:14:32 +0200","titre":"Marking 10 years of the GDPR: the evolution of the European data protection landscape","description":"Brussels, 27 April – Today marks the 10th anniversary of the GDPR’s adoption, the first comprehensive data protection framework spanning an entire continent, establishing clear rights for individuals and obligations for organisations across Europe. The moment that led to the creation of the EDPB The GDPR led to the establishment of the European Data Protection Board (EDPB) on 25 May 2018, replacing the Article 29 Working Party that was previously in charge of dealing with issues relating to the protection of personal data. The GDPR gave the Data Protection Authorities (DPAs) stronger enforcement powers and expanded the scope of their work from focusing mainly on national compliance complaints to routinely dealing with cross-border cases. In the past 10 years, the 31 European DPAs comprising the EDPB have worked together to ensure the consistent enforcement of the GDPR and a harmonised data protection approach across Europe.   A key role in an evolving digital landscape Today, the GDPR is part of a broader and evolving European digital framework, alongside other digital laws such as the Digital Services Act, the Digital Markets Act, and the AI Act . In a world shaped by artificial intelligence, platform economies, and increasing data-driven innovation, the GDPR ensures that technological progress goes hand in hand with the protection of individuals’ fundamental rights . An inspiration for the rest of the world The impact of the GDPR has extended far beyond Europe’s borders, inspiring similar frameworks across the globe and contributing to a growing international recognition of privacy as a fundamental right .   How the GDPR has shaped the data protection landscape: insights from Data Protection Authorities Have you ever wondered what the data protection landscape looked like before the GDPR and how DPAs prepared for its entry into force? How has life for Europeans changed since its adoption? Watch the video for insights and testimonies from Data Protection Authorities which contributed to the shaping of the data protection landscape in Europe.   Sorry, your browser doesn't support embedded","url":"https://www.edpb.europa.eu/news/news/2026/marking-10-years-gdpr-evolution-european-data-protection-landscape_en","source":"EDPB News"},{"titre":"CEF 2026: EDPB launches coordinated enforcement action on transparency and information obligations under the GDPR","id":2769535,"pubDate":"Thu, 19 Mar 2026 14:12:59 +0100","description":"Brussels, 19 March - The EDPB has launched its Coordinated Enforcement Framework (CEF) action for 2026*. Following a year-long coordinated action on the right to erasure in 2025 , the CEF's focus this year will shift to compliance with the obligations of transparency and information under the GDPR . The GDPR ensures that individuals are informed when their data is being processed (under Art. 12, 13 and 14). This right to be informed is a core element of transparency and ensures that individuals have more control over their data. Next steps During 2026, 25 Data Protection Authorities (DPAs) across Europe will take part in this initiative. They will look closely to assess the compliance of controllers with their transparency obligations under the GDPR. Participating DPAs will soon contact controllers from different sectors across Europe, either through enforcement actions or fact-finding exercises. In the latter case, they might also decide to undertake additional follow-up actions if needed. During the second half of the year, participating DPAs will share and discuss their findings together, with a view to aggregate the results of their national actions and generate deeper insight into the topic. A consolidated report will then be drafted and submitted for adoption by the EDPB, allowing for targeted follow-ups on both national and EU levels. Background The CEF is a key action of the EDPB under its 2024-2027 Strategy , aimed at streamlining enforcement and cooperation among DPAs. In 2023, the EDPB published the report on its first coordinated action on the use of cloud-based services by the public sector . In 2024, the EDPB also published the report on the outcome of the second coordinated action on the designation and position of Data Protection Officers . In 2025, the EDPB issued the report on its third coordination action on the implementation of the right of access . In 2026, the EDPB has adopted a report on its Coordinated Enforcement Framework (CEF) action on the right to be forgotten (Art.17 GDPR) .   Note to editors: *The Board selected this topic during its October 2025 plenary","source":"EDPB News","url":"https://www.edpb.europa.eu/news/news/2026/cef-2026-edpb-launches-coordinated-enforcement-action-transparency-and-information_en"},{"description":"Background information Date of final decision: 15 May 2025 National case Controller:  SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months Key words: administrative fine, consent,  unsolicited communication   Summary of the Decision Origin of the case   As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the chain, the primary collectors, who are responsible for collecting prospect data). SOLOCAL MARKETING SERVICES used this data to operate commercial prospecting by SMS or e-mail to individuals concerned, on behalf of its advertiser customer. It may also pass on some of this data to its customers, so that they can carry out their own commercial prospecting by telephone or post. Key Findings  Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code): The restricted committee considered that the misleading appearance of the forms used by data brokers made it impossible to obtain free and unambiguous consent, in compliance with the requirements of the GDPR, which would have formed the basis for the prospecting operations carried out by the company. Failure to demonstrate that the data subject has consented to processing of his or her personal data (Article 7 of the GDPR): The company failed to provide the French SA with proof of consent from individuals whose data has been transferred to it by one of its main suppliers. As a result, the French SA was unable to examine the collection forms used by this supplier and, therefore, the validity of the consent of the data subjects.   Decision  Based on the findings of the inspection, the restricted committee – the French SA body responsible for issuing sanctions – considered that the company had failed to comply with obligations under the French Post and Electronic Communications Code (CPCE) and the General Data Protection Regulation (GDPR) regarding the collection and proof of consent.  It imposed on SOLOCAL MARKETING SERVICES:  a €900 000 fine which was made public; and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months.  The amount of this fine takes into account the very large number of people concerned (several million), the company's historical position on the market, the financial benefit derived from the breaches, and the measures taken by the company to comply with some of its obligations since the checks were carried out. For further information:  •  Courtiers en données : sanction de 900 000 euros à l’encontre de la société SOLOCAL MARKETING SERVICES (French) •  Data brokers: SOLOCAL MARKETING SERVICES fined €900,000  (English)","pubDate":"Tue, 10 Jun 2025 09:51:20 +0200","id":2170441,"titre":"The French SA fines SOLOCAL €900 000","url":"https://www.edpb.europa.eu/news/news/2025/french-sa-fines-solocal-eu900-000_en","source":"EDPB News"},{"url":"https://www.edpb.europa.eu/news/news/2025/french-sa-fines-solocal-900-000-eu_en","source":"EDPB News","description":"Background information Date of final decision: 15 May 2025 National case Controller:  SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of 10 000 € per day overdue after a period of 9 months Key words: administrative fine, consent,  unsolicited communication   Summary of the Decision Origin of the case   As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the chain, the primary collectors, who are responsible for collecting prospect data). SOLOCAL MARKETING SERVICES used this data to operate commercial prospecting by SMS or e-mail to individuals concerned, on behalf of its advertiser customer. It may also pass on some of this data to its customers, so that they can carry out their own commercial prospecting by telephone or post. Key Findings  Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code): The restricted committee considered that the misleading appearance of the forms used by data brokers made it impossible to obtain free and unambiguous consent, in compliance with the requirements of the GDPR, which would have formed the basis for the prospecting operations carried out by the company. Failure to demonstrate that the data subject has consented to processing of his or her personal data (Article 7 of the GDPR): The company failed to provide the French SA with proof of consent from individuals whose data has been transferred to it by one of its main suppliers. As a result, the French SA was unable to examine the collection forms used by this supplier and, therefore, the validity of the consent of the data subjects.   Decision  Based on the findings of the inspection, the restricted committee – the French SA body responsible for issuing sanctions – considered that the company had failed to comply with obligations under the French Post and Electronic Communications Code (CPCE) and the General Data Protection Regulation (GDPR) regarding the collection and proof of consent.  It imposed on SOLOCAL MARKETING SERVICES:  a 900 000 € fine which was made public; and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of 10 000 € per day overdue after a period of 9 months.  The amount of this fine takes into account the very large number of people concerned (several million), the company's historical position on the market, the financial benefit derived from the breaches, and the measures taken by the company to comply with some of its obligations since the checks were carried out. For further information:  •   Courtiers en données : sanction de 900 000 euros à l’encontre de la société SOLOCAL MARKETING SERVICES (French) •   Data brokers: SOLOCAL MARKETING SERVICES fined €900,000  (English)","id":2130472,"pubDate":"Wed, 21 May 2025 15:52:14 +0200","titre":"The French SA fines SOLOCAL 900 000 €"},{"pubDate":"Tue, 06 May 2025 15:51:59 +0200","id":2099053,"titre":"European Patent Organisation and extension of adequacy decisions for the UK: EDPB adopts opinions","description":"Brussels, 06 May - During its latest plenary, the European Data Protection Board (EDPB) adopted an opinion on the European Commission’s draft adequacy decision under the GDPR concerning the European Patent Organisation (EPO) . In addition, the Board adopted an opinion on the European Commission’s proposal to extend the validity of the UK adequacy decisions under the GDPR and the Law Enforcement Directive (LED) . Finally, the EDPB agreed to grant the status of observer to the Personal Data Protection Agency of Bosnia and Herzegovina.   Adequate protection of personal data by the EPO At the European Commission’s request, the Board adopted an opinion on the Commission’s draft adequacy decision regarding the European Patent Organisation (EPO). Once formally adopted by the Commission, this will be the first adequacy decision concerning an international organisation and not a country or a region. An adequacy decision is a key-mechanism in EU data protection legislation which allows the European Commission to determine whether a third country or an international organisation offers an adequate level of data protection. The effect of such a decision is that personal data can flow freely from Europe to that third country or international organisation. EDPB Chair, Anu Talus, said: “The EDPB welcomes the Commission’s initiative to work on the first adequacy decision concerning an international organisation. This decision shows how the legal framework of such organisations can be recognised as ensuring an adequate level of protection on the basis of Art.45 GDPR. The EDPB underlines the importance of ongoing dialogue between the Commission and international organisations, with a view to developing this category of adequacy decisions in addition to those relating to third countries.” In its opinion, the Board positively notes that the EPO data protection framework is largely aligned with the European Union data protection framework, including on data protection rights and principles. This shows that the GDPR and, in particular, its transfer provisions, can facilitate safe data flows from Europe to international organisations, while taking into account their status.   Six-month extension of the UK adequacy decisions The EDPB opinion, requested by the European Commission, addresses the proposed extension of the two UK adequacy decisions under the GDPR and the LED, which are set to expire on 27 June 2025. The opinion only concerns the proposed 6-month extension of these adequacy decisions and does not address the level of protection for personal data afforded in the UK, which will be examined by the EDPB following the Commission’s assessment, and if the renewal of the UK adequacy decisions is proposed. Since the UK‘s data protection reform is still pending in the UK parliament, the EDPB recognises the need for a technical and time-limited extension of the adequacy decisions until 27 December 2025.This will give the European Commission sufficient time to evaluate the updated UK legal framework once it has been adopted.   The EDPB stresses that this extension is exceptional and is due to the ongoing legislative developments in the UK. It should not, in principle, be further prolonged. The Board recalls the validity of its opinions 14/2021 and 15/2021 on the two UK adequacy decisions, adopted in April 2021, and invites the European Commission to take them into account in its future assessments.  The Board also recalls the Commission’s obligation to monitor all relevant developments in the UK during the extension period.   New observer to the EDPB’s activities Finally, EDPB members agreed to grant observer status to the EDPB’s activities to the Bosnia and Herzegovina Data Protection Authority, in line with Art. 8 EDPB Rules of Procedure .","url":"https://www.edpb.europa.eu/news/news/2025/european-patent-organisation-and-extension-adequacy-decisions-uk-edpb-adopts_en","source":"EDPB News"},{"source":"EDPB News","url":"https://www.edpb.europa.eu/news/news/2025/cef-2024-edpb-identifies-challenges-full-implementation-right-access_en","description":"Brussels, 20 January - The European Data Protection Board (EDPB) has adopted a report on the implementation of the right of access by controllers . The report summarises the outcome of a series of coordinated national actions carried out in 2024 under the Coordinated Enforcement Framework (CEF). It lists the issues that were observed for some controllers, along with a series of recommendations to help them implement the right of access. A central element is controllers’ awareness of the EDPB Guidelines 01/2022 on data subjects rights – Right of access and whether these guidelines were followed in practice. EDPB Deputy Chair Zdravko Vukíc said: “The CEF is a valuable initiative that helps strengthen the cooperation among Data Protection Authorities (DPAs): by tackling selected topics in a coordinated fashion, they achieve greater efficiency and more consistency. How controllers implement the right of access lies at the heart of data protection and it is one of the most frequently exercised data subject rights.” Throughout 2024, 30 DPAs across Europe launched coordinated investigations into the compliance of controllers with the right of access, by opening formal investigations, assessing whether a formal investigation was warranted and/or carrying out fact-finding exercises.  A total of 1,185 controllers, consisting of small and medium-sized enterprises (SMEs) and big companies active in different industries and fields, as well as various types of public entities, responded to the action. Areas of improvement and main challenges The results suggest that more awareness raising about Guidelines 01/2022 is necessary , both at national and EU level, as the guidelines help controllers implement the right of access, explain how exercising this right can be made easier, and list the exceptions and limitations of the right to access. As a result of the 2024 CEF action, seven challenges were identified. One of them is the lack of documented internal procedures to handle access requests. In addition, inconsistent and excessive interpretations of the limits to the right of access were also observed, such as overly relying on certain exceptions to automatically refuse access requests. Another example is the barriers that individuals could encounter when exercising their right of access, such as  formal requirements or being requested to provide excessive identification documents. For each challenge identified, the report provides a list of non-binding recommendations to be taken into account by controllers and DPAs. Positive findings Despite the existing challenges, two thirds of participating DPAs evaluated the level of compliance of responding controllers with respect to the right of access from ‘average’ to ‘high’. One important factor identified as having an impact on the level of compliance was the volume of access requests received by controllers, as well as the size of the organisation. More specifically, large-sized controllers or controllers receiving more requests were more likely to reach a higher level of compliance than small organisations with less resources. Positive findings were observed across Europe. These include the implementation of best practices by controllers, such as user-friendly online forms enabling individuals to submit an access request easily as well as self-service systems to allow individuals to autonomously download their personal data in a few clicks and at any time. Background and next steps The CEF is a key action of the EDPB under its 2024-2027 Strategy, aimed at streamlining enforcement and cooperation among DPAs.  In the past three years, two previous CEF actions were carried out. The results of these national actions are aggregated and analysed together to generate deeper insight into the topic and allowing for targeted follow-up on both national and EU level. In 2023, the EDPB published the report on its first coordinated action on the use of cloud-based services by the public sector . In 2024, the EDPB also published the","titre":"CEF 2024: EDPB identifies challenges to the full implementation of the right of access","pubDate":"Mon, 20 Jan 2025 15:49:16 +0100","id":1857297},{"pubDate":"Wed, 18 Dec 2024 15:47:16 +0100","id":1792119,"titre":"EDPB opinion on AI models: GDPR principles support responsible AI","description":"Brussels, 18 December - The European Data Protection Board (EDPB) has adopted an opinion* on the use of personal data for the development and deployment of AI models . This opinion looks at 1) when and how AI models can be considered anonymous, 2) whether and how legitimate interest can be used as a legal basis for developing or using AI models, and 3) what happens if an AI model is developed using personal data that was processed unlawfully. It also considers the use of first and third party data. The opinion was requested by the Irish Data Protection Authority (DPA) with a view to seeking Europe-wide regulatory harmonisation. To gather input for this opinion, which deals with fast-moving technologies that have an important impact on society, the EDPB organised a stakeholders’ event and had an exchange with the EU AI Office. EDPB Chair Talus said: “AI technologies may bring many opportunities and benefits to different industries and areas of life. We need to ensure these innovations are done ethically, safely, and in a way that benefits everyone. The EDPB wants to support responsible AI innovation by ensuring personal data are protected and in full respect of the General Data Protection Regulation (GDPR).” Regarding anonymity , the opinion says that whether an AI model is anonymous should be assessed  on a case by case basis by the DPAs. For a model to be anonymous, it should be very unlikely (1) to directly or indirectly identify individuals whose data was used to create the model, and (2) to extract such personal data from the model through queries. The opinion provides a non-prescriptive and non-exhaustive list of methods to demonstrate anonymity. With respect to legitimate interest , the opinion provides general considerations that DPAs should take into account when they assess if legitimate interest is an appropriate legal basis for processing personal data for the development and the deployment of AI models. A three-step test helps assess the use of legitimate interest as a legal basis. The EDPB gives the examples of a conversational agent to assist users, and the use of AI to improve cybersecurity. These services can be beneficial for individuals and can rely on legitimate interest as a legal basis, but only if the processing is shown to be strictly necessary and the balancing of rights is respected. The opinion also includes a number of criteria to help DPAs assess if individuals may reasonably expect certain uses of their personal data. These criteria include: whether or not the personal data was publicly available, the nature of the relationship between the individual and the controller, the nature of the service, the context in which the personal data was collected, the source from which the data was collected, the potential further uses of the model, and whether individuals are actually aware that their personal data is online. If the balancing test shows that the processing should not take place because of the negative impact on individuals, mitigating measures may limit this negative impact. The opinion includes a non-exhaustive list of examples of such mitigating measures, which can be technical in nature, or make it easier for individuals to exercise their rights or increase transparency. Finally, when an AI model was developed with unlawfully processed personal data, this could have an impact on the lawfulness of its deployment, unless the model has been duly anonymised. Considering the scope of the request from the Irish DPA, the vast diversity of AI models and their rapid evolution, the opinion aims to give guidance on various elements that can be used for conducting a case by case analysis. In addition, the EDPB is currently developing guidelines covering more specific questions, such as web scraping. Note to editors: *An Article 64(2) opinion addresses a matter of general application or produces effects in more than one Member","url":"https://www.edpb.europa.eu/news/news/2024/edpb-opinion-ai-models-gdpr-principles-support-responsible-ai_en","source":"EDPB News"},{"titre":"Shocking Revelations: The Green Revolution That Could Cost You Money!","pubDate":"Tue, 23 Apr 2024 10:40:55 +0200","id":1270379,"description":"Key Takeaways: The Green Job Craze: Sacrifices for Sustainability Recent data from Indeed, a global job matching platform, has unveiled surprising insights into the growing allure of sustainability-focused careers. With a staggering 1 in 4 individuals willing to accept a pay cut for a role that positively impacts society and the environment, the dynamics of the job market are undergoing a profound transformation. The Rising Demand for Green Talent The statistics speak volumes about the shifting priorities among job seekers and employees. A 116% surge in ESG/sustainability-related job postings between 2019 and 2024 reflects an increasing demand for professionals who The post Shocking Revelations: The Green Revolution That Could Cost You Money! appeared first on Business Today","source":"Business Today","url":"https://businesstoday.news/shocking-revelations-the-green-revolution-that-could-cost-you-money/?utm_source=rss&utm_medium=rss&utm_campaign=shocking-revelations-the-green-revolution-that-could-cost-you-money"}]