[{"titre":"Stick with Security: Require secure passwords and authentication","url":"https://www.ftc.gov/business-guidance/blog/2017/08/stick-security-require-secure-passwords-authentication","pubDate":"Mon, 05 Oct 2026 08:07:08 +0200","source":"FTC USA Business Blog Posts","description":"Stick with Security: Require secure passwords and authentication lfair August 11, 2017 | 10:47AM Stick with Security: Require secure passwords and authentication By Thomas B. Pahl, Acting Director, FTC Bureau of Consumer Protection To make it harder for hackers to bluff their way onto a computer network, careful companies follow the advice of Start with Security and require strong authentication practices . We’ve considered FTC settlements, closed investigations, and the questions we get from businesses about implementing good authentication “hygiene.” Here are some tips on using effective authentication procedures to help safeguard your network. Insist on long, complex, and unique passwords. A password’s very reason for being is to be easy for a user to remember, but hard for a fraudster to figure out. Obvious choices like ABCABC, 121212, or qwerty are the digital equivalent of a “hack me” sign. Furthermore, experts have determined that passphrases or longer passwords are generally harder to crack. The smarter strategy is for companies to think through their standards, implement minimum requirements, and educate users about how to create stronger passwords. Also, when you install software, applications, or hardware on your network, computers, or devices, change the default password immediately. And if you design products that require consumers to use a password, configure the initial set-up so they have to change the default password. Example: A staff member attempts to select payroll as the password for the database that includes employee payroll information. The company sets up its system to reject an obvious choice like that. Example: To access the corporate network, a business allows employees to type in their username and a shared password common to everyone who works there. Employees are also allowed to use that shared password to access other services on the system, some of which contain sensitive personal information. The more prudent policy would be to require strong, unique passwords for each employee and to insist that they use different passwords to access different applications. Example: At a staff meeting, a company’s IT manager offers tips for employees about good password hygiene. She explains that passphrases or longer passwords are better than short passwords based on standard dictionary words or well-known information (for example, a child’s name, a pet, a birthday, or a favorite sports team). By establishing a more secure corporate password standard and educating employees about implementing it, the IT manager is taking a step to help her company reduce the risk of unauthorized access. Store passwords securely. A company’s first line of defense against data thieves is a workforce trained to keep passwords secret. But even the strongest password is ineffective if an employee writes it on a sticky note on her desk or shares it with someone else. Train your staff not to disclose passwords in response to phone calls or emails, including ones that may appear to be coming from a colleague. Con artists have been known to impersonate corporate officials by spoofing phone numbers or email addresses. A compromised password poses a particular risk if it can be used to open the door to even more sensitive information – for example, a database of other user credentials maintained on the network in plain, readable text. Make it difficult for data thieves to turn a lucky password guess into a catastrophic breach of your company’s most sensitive data by implementing policies and procedures to store credentials securely. Example: A new employee gets a call from someone who claims to be the company’s system administrator. The caller asks him to verify his network password. Because the new staffer learned about impersonation scams at an in-house security orientation, he refuses to disclose his password and instead reports the incident to the appropriate person in the company. Example: A company keeps user credentials and other passwords in plain","id":3197409},{"pubDate":"Sat, 03 Oct 2026 08:09:37 +0200","titre":"Practice Fusion case suggests 6 health privacy pointers","url":"https://www.ftc.gov/business-guidance/blog/2016/06/practice-fusion-case-suggests-6-health-privacy-pointers","id":3194910,"description":"Practice Fusion case suggests 6 health privacy pointers lfair June 8, 2016 | 9:01AM Practice Fusion case suggests 6 health privacy pointers By Lesley Fair Combine two of the most talked-about consumer protection topics – health privacy and consumer-generated online content – and what do you get? A proposed FTC settlement with Practice Fusion, the largest cloud-based electronic health records company in the country, and six compliance tips for others in the industry. One of San Francisco-based Practice Fusion’s primary products is an electronic records system for outpatient providers. In 2009, the company launched “Patient Fusion,” an online portal where patients whose providers were already using Practice Fusion could view or download their health information or transmit it to another provider. Patient Fusion also let patients send and receive secure messages from their providers. Fast forward several years and the company decided to expand Patient Fusion to include a public directory where current and prospective enrollees could search for doctors geographically or by specialty, read patient reviews of providers, and request appointments. But Practice Fusion had to ask itself a question familiar to many online companies: How do we get the content – in this case, patient reviews? That’s the focus of the FTC’s lawsuit. According to the complaint , Practice Fusion solicited data in a misleading way that led some patients to believe they were sending follow-up messages directly to their doctors about their diagnosis, medical treatment, prescriptions, etc. – and not contributing content to a public website. Practice Fusion, however, populated its new site with the information those people provided, some of which was highly sensitive. Here’s what happened. After appointments with their doctors, patients received emails titled “How was your visit?” The message continued, “To help improve your service in the future, please let us know how your visit went” and included a link with rating stars. The message ended this way: Thank you, Dr. [Name] In a footer, the message said “This email was sent to you by Patient Fusion®, a tool Doctor [Name] uses to deliver the highest quality of care to patients.” Below that in smaller print it said “Sent on behalf of Doctor [Name]’s office by: Practice Fusion.” If patients clicked the link, they were taken to a page that asked for feedback about things like how long they had to wait for their appointment, the doctor’s bedside manner, and whether their medical concern was addressed. There also was a text box where patients were invited to “leave a review for your provider.” Below that was a pre-checked box with the phrase “Keep this review anonymous.” What did some people put in that box? Highly sensitive information directly addressed to their doctors, not evaluations meant to be shared publicly. Here are just a few examples: “Dr [name], My Xanax prescription that I received on Monday was for 1 tablet a day but usually it’s for 2 tablets a day. I have not taken it to the pharmacy yet. Can I pick up a new one, or can I get a prescription called into a pharmacy? Thanks, [patient’s full name] “I called today and left a message regarding my daughter and no one has returned my call. I think she is depressed and has stated several times this week that she wishes she was dead. Could someone please call me [phone number]?” “The cefuroxime axetil does not seem to be doing anything for me. I did a little research and I think I have a yeast infection called candida. Not sure what to do about it yet. I guess I will first try to change my diet. Medication? [patient’s full name] “I would like to make an appointment for my back pain and possible shingles. Can you please call me @ [phone number]? Thank you! [patient's full name]” “I HAVE NO INFECTION [healthcare provider name].  EVERYTHING WENT","source":"FTC USA Business Blog Posts"},{"source":"Federal Trade Commission - Protecting America's Consumers","id":3127461,"description":"Today, 22 states joined the Federal Trade Commission in filing suit against Amazon, alleging that the company engaged in deceptive and unfair practices that secretly inflated prices in its online search advertising auctions. The complaint   alleges that, for over seven years, Amazon has covertly and substantially increased the prices that more than one million brands and sellers were required to pay to advertise on its platform. As a result, the complaint alleges that Amazon’s scheme has likely extracted tens of billions of dollars from its unwitting advertising customers. “When one of the world’s largest online retailers engages in unfair and deceptive conduct, the impact can be staggering,” said Chairman Andrew N. Ferguson. “Amazon has millions of advertising customers who were misled into paying significantly higher prices. These higher costs were largely passed on to American consumers. The FTC under President Trump won’t allow this deception to continue.” The FTC, along with the attorneys general of Alaska, Arizona, California, Colorado, Florida, Idaho, Illinois, Indiana, Iowa, Kentucky, Louisiana, Maryland, Nebraska, New Jersey, New York, North Carolina, Oklahoma, Pennsylvania, Rhode Island, South Carolina, Vermont and Washington, allege Amazon has imposed undisclosed surcharges on its advertising customers, which include over 500,000 small- and medium-sized businesses that participated in auctions for advertising placements on Amazon.com and its mobile app. In these auctions, prospective advertisers bid to place Sponsored Product ads, Sponsored Brands ads and Display Ads alongside the results that appear when a consumer searches for a product using a keyword on Amazon’s store. Placements are auctioned to the highest-ranked bidder for each keyword. As described in the complaint, Amazon has represented to prospective advertisers for years that Amazon runs “second price” auctions where the winner of the auction would only pay “one cent more than the next highest bidder” for each successful bid for an advertising keyword. However, in practice, the complaint alleges that Amazon has charged its Sponsored Products advertisers their own winning bid close to 80% of the time and has effectively converted its nominally “second price” auction into a first price auction. According to the complaint, Amazon’s “second price” auctions have been described by Amazon, and understood by advertisers, to be run as generalized second-price, or GSP auctions, which have been the accepted industry standard for digital advertising placements. The complaint states that Amazon has made these or similar representations on its website, in training videos and in other public-facing materials, as well as in presentations made to advertisers by its hundreds of sales personnel.  The type of auction matters to advertisers because it impacts how they bid. In a sealed first-price auction—the type of auction where winners pay the amount of their winning bid—bidders run the risk that they might overbid. So, in repetitive auctions for the same goods, they will often reduce their bid to determine what the minimum amount needed to win future auctions might be. This is called bid shading. In second-price auctions, bidders are more likely to bid higher, closer to their true value for the product, because they will only be liable to pay the least bid amount needed to win under the auction’s rules.  As alleged in the complaint, Amazon told advertisers it ran a GSP, but for years its auction pricing had “a surcharge hidden in it,” in the words of one internal Amazon document. The complaint alleges that, beginning in 2019, Amazon changed its auction rules without notice by adding an undisclosed surcharge that Amazon referred to internally as a “soft reserve price.” This resulted in advertisers paying substantially more than the price determined by the GSP auction.  According to the complaint, Amazon","pubDate":"Tue, 01 Sep 2026 08:10:10 +0200","titre":"FTC, States Sue Amazon Over Secret Ad Surcharge Scheme","url":"https://www.ftc.gov/news-events/news/press-releases/2026/08/ftc-states-sue-amazon-over-secret-ad-surcharge-scheme"},{"source":"Federal Trade Commission - Protecting America's Consumers","description":"StubHub, the nation’s largest ticket exchange and resale ticket provider, will pay $10 million to settle Federal Trade Commission charges that the company violated the FTC Act and the agency’s Rule on Unfair or Deceptive Fees by deceptively advertising ticket prices on its website without clearly and conspicuously disclosing up-front how much consumers actually would pay, including all mandatory fees. “The Commission’s Fees Rule makes it very clear that the total price of live-event tickets must be disclosed up-front to enable consumers to make fully informed purchasing decisions,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “Price transparency is essential to a free and competitive marketplace. Today’s settlement underscores the Commission’s commitment to ensuring that consumers pay the price they are promised.” The FTC’s action against StubHub Holdings, Inc., follows a  warning letter the agency sent the online ticket platform in May 2025 stating that multiple prices displayed on its website appeared to be in violation of the Fees Rule. Under the Rule, which took effect on May 12, 2025 , it is an unfair and deceptive practice for any business to offer, display, or advertise the price of a live-event ticket without clearly, conspicuously, and most prominently disclosing the total price, which the Rule defines as “the maximum total of all fees or charges a consumer must pay for any good(s) or service(s) and any mandatory ancillary good or service.” Misrepresenting prices also violates the FTC Act. Today’s action also follows the Administration’s recent Executive Order on Ticketing , which includes a directive for the FTC to “take appropriate action . . . to ensure price transparency at all stages of the ticket-purchase process, including the secondary ticketing market.” According to the Commission’s complaint , in mid-May 2025—after the Rule went into effect—StubHub advertised its ticket prices without disclosing the full price consumers would actually pay by failing to include mandatory fees and to disclose the total price everywhere it displayed prices. Specifically, the FTC alleges StubHub failed to provide the total price for tickets—including high-demand National Football League tickets in the lead-up to when the NFL schedule was announced on May 14, 2025—in the first three pricing displays on its website. On the initial two pricing displays, in numerous instances, the advertised price did not include all mandatory fees, and StubHub did not disclose the total price. On the third pricing display, StubHub listed multiple fees and charges but did not disclose the total price. The proposed order settling StubHub’s alleged violations of the FTC Act and the Fees Rule requires the company to pay $10 million, which the company will use to provide monetary relief to eligible consumers through a settlement and consumer redress distribution program. The order also prohibits StubHub from misrepresenting the total price of any good or service; any fee or charge, including its nature, purpose, amount, or refundability, as well as why the fee or charge is being imposed; the final payment amount for any transaction; and any other material fact including those related to refunds or cancellations. The proposed order also prohibits StubHub from: Offering, displaying, or advertising any price of a good or service without clearly and conspicuously disclosing the total price; Failing to disclose the total price more prominently than any other pricing information; Failing to clearly and conspicuously disclose the amount of any fees or charges that have been excluded from the total price and what they are for, as well as the final payment amount—before the consumer agrees to pay for a product or service; and Violating the Commission’s Fees Rule. Within 90 days of the date of the order StubHub must provide redress to two groups of eligible","id":2818173,"url":"https://www.ftc.gov/news-events/news/press-releases/2026/04/stubhub-refunding-10-million-fees-consumers-after-deceptive-ticket-pricing","titre":"StubHub Refunding $10 Million in Fees to Consumers After Deceptive Ticket Pricing","pubDate":"Fri, 10 Apr 2026 08:08:44 +0200"},{"url":"https://www.ftc.gov/news-events/news/press-releases/2025/12/instacart-pay-60-million-consumer-refunds-settle-ftc-lawsuit-over-allegations-it-engaged-deceptive","titre":"Instacart to Pay $60 Million in Consumer Refunds to Settle FTC Lawsuit Over Allegations it Engaged in Deceptive Tactics","pubDate":"Fri, 19 Dec 2025 09:48:21 +0100","source":"Federal Trade Commission - Protecting America's Consumers","description":"Today, the Federal Trade Commission announced that grocery delivery provider Instacart will pay $60 million in refunds to consumers to settle allegations that the company engaged in numerous unlawful tactics that harmed shoppers and raised the cost of grocery shopping for Americans. Instacart will be required to cease its deceptive practices under a proposed FTC order, and consumers who were charged for Instacart+ without their express informed consent will receive refunds as a result of the settlement. “Instacart misled consumers by advertising free delivery services—and then charging consumers to have groceries delivered—and failing to disclose to consumers that signed up for a free trial that they would be automatically enrolled into its subscription program,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “The FTC is focused on monitoring online delivery services to ensure that competitors are transparently competing on price and delivery terms.” The FTC has alleged that Instacart engaged in a variety of deceptive tactics that misled consumers and caused them to pay more in fees, while depriving consumers of refunds. Specifically, the FTC alleges that Instacart: Falsely advertised “free delivery” to consumers on their first order Instacart’s claims of “free delivery” are false because consumers still must pay a mandatory “service fee” to get their groceries delivered. These mandatory service fees add as much as 15% to the order cost and were not clearly disclosed to consumers. Falsely advertised a “100% satisfaction guarantee,” implying that it will provide full refunds when consumers are not fully satisfied Consumers who experience late deliveries or unprofessional service typically are not offered full refunds and instead are given only a small credit that can be used toward a future order. Instacart hid the refund option from the “self-service” menu that consumers use to report problems with their orders, leading many consumers to erroneously believe they could receive only a credit toward a future order rather than a refund. Failed to clearly disclose terms relating to Instacart+ membership enrollment Instacart’s free-trial enrollment process for Instacart+ did not adequately disclose that consumers would be charged for memberships at the end of their trials, nor did it disclose Instacart’s restrictive refund policy. As a result, Instacart has charged many consumers for paid memberships without their express informed consent. Hundreds of thousands of consumers have been charged membership fees without receiving benefits from the membership or getting refunds. Under the terms of the FTC’s proposed settlement order , Instacart will be prohibited from making misrepresentations concerning the costs of delivery services and satisfaction guarantees. Instacart must also clearly and conspicuously disclose the terms and obtain express informed consent for transactions involving subscription models where consumers are automatically charged unless they actively opt out. The Commission vote approving the stipulated final order was 2-0. The FTC filed the proposed order in the U.S. District Court for the Northern District of California. NOTE:  Stipulated final orders have the force of law when approved and signed by the District Court","id":2582987},{"url":"https://www.edpb.europa.eu/news/news/2025/french-sa-fines-solocal-eu900-000_en","titre":"The French SA fines SOLOCAL €900 000","pubDate":"Tue, 10 Jun 2025 09:51:20 +0200","source":"EDPB News","description":"Background information Date of final decision: 15 May 2025 National case Controller:  SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months Key words: administrative fine, consent,  unsolicited communication   Summary of the Decision Origin of the case   As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the chain, the primary collectors, who are responsible for collecting prospect data). SOLOCAL MARKETING SERVICES used this data to operate commercial prospecting by SMS or e-mail to individuals concerned, on behalf of its advertiser customer. It may also pass on some of this data to its customers, so that they can carry out their own commercial prospecting by telephone or post. Key Findings  Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code): The restricted committee considered that the misleading appearance of the forms used by data brokers made it impossible to obtain free and unambiguous consent, in compliance with the requirements of the GDPR, which would have formed the basis for the prospecting operations carried out by the company. Failure to demonstrate that the data subject has consented to processing of his or her personal data (Article 7 of the GDPR): The company failed to provide the French SA with proof of consent from individuals whose data has been transferred to it by one of its main suppliers. As a result, the French SA was unable to examine the collection forms used by this supplier and, therefore, the validity of the consent of the data subjects.   Decision  Based on the findings of the inspection, the restricted committee – the French SA body responsible for issuing sanctions – considered that the company had failed to comply with obligations under the French Post and Electronic Communications Code (CPCE) and the General Data Protection Regulation (GDPR) regarding the collection and proof of consent.  It imposed on SOLOCAL MARKETING SERVICES:  a €900 000 fine which was made public; and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months.  The amount of this fine takes into account the very large number of people concerned (several million), the company's historical position on the market, the financial benefit derived from the breaches, and the measures taken by the company to comply with some of its obligations since the checks were carried out. For further information:  •  Courtiers en données : sanction de 900 000 euros à l’encontre de la société SOLOCAL MARKETING SERVICES (French) •  Data brokers: SOLOCAL MARKETING SERVICES fined €900,000  (English)","id":2170441},{"url":"https://www.edpb.europa.eu/news/news/2025/french-sa-fines-solocal-900-000-eu_en","titre":"The French SA fines SOLOCAL 900 000 €","pubDate":"Wed, 21 May 2025 15:52:14 +0200","source":"EDPB News","description":"Background information Date of final decision: 15 May 2025 National case Controller:  SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of 10 000 € per day overdue after a period of 9 months Key words: administrative fine, consent,  unsolicited communication   Summary of the Decision Origin of the case   As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the chain, the primary collectors, who are responsible for collecting prospect data). SOLOCAL MARKETING SERVICES used this data to operate commercial prospecting by SMS or e-mail to individuals concerned, on behalf of its advertiser customer. It may also pass on some of this data to its customers, so that they can carry out their own commercial prospecting by telephone or post. Key Findings  Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code): The restricted committee considered that the misleading appearance of the forms used by data brokers made it impossible to obtain free and unambiguous consent, in compliance with the requirements of the GDPR, which would have formed the basis for the prospecting operations carried out by the company. Failure to demonstrate that the data subject has consented to processing of his or her personal data (Article 7 of the GDPR): The company failed to provide the French SA with proof of consent from individuals whose data has been transferred to it by one of its main suppliers. As a result, the French SA was unable to examine the collection forms used by this supplier and, therefore, the validity of the consent of the data subjects.   Decision  Based on the findings of the inspection, the restricted committee – the French SA body responsible for issuing sanctions – considered that the company had failed to comply with obligations under the French Post and Electronic Communications Code (CPCE) and the General Data Protection Regulation (GDPR) regarding the collection and proof of consent.  It imposed on SOLOCAL MARKETING SERVICES:  a 900 000 € fine which was made public; and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of 10 000 € per day overdue after a period of 9 months.  The amount of this fine takes into account the very large number of people concerned (several million), the company's historical position on the market, the financial benefit derived from the breaches, and the measures taken by the company to comply with some of its obligations since the checks were carried out. For further information:  •   Courtiers en données : sanction de 900 000 euros à l’encontre de la société SOLOCAL MARKETING SERVICES (French) •   Data brokers: SOLOCAL MARKETING SERVICES fined €900,000  (English)","id":2130472},{"pubDate":"Mon, 20 Jan 2025 15:49:16 +0100","titre":"CEF 2024: EDPB identifies challenges to the full implementation of the right of access","url":"https://www.edpb.europa.eu/news/news/2025/cef-2024-edpb-identifies-challenges-full-implementation-right-access_en","source":"EDPB News","id":1857297,"description":"Brussels, 20 January - The European Data Protection Board (EDPB) has adopted a report on the implementation of the right of access by controllers . The report summarises the outcome of a series of coordinated national actions carried out in 2024 under the Coordinated Enforcement Framework (CEF). It lists the issues that were observed for some controllers, along with a series of recommendations to help them implement the right of access. A central element is controllers’ awareness of the EDPB Guidelines 01/2022 on data subjects rights – Right of access and whether these guidelines were followed in practice. EDPB Deputy Chair Zdravko Vukíc said: “The CEF is a valuable initiative that helps strengthen the cooperation among Data Protection Authorities (DPAs): by tackling selected topics in a coordinated fashion, they achieve greater efficiency and more consistency. How controllers implement the right of access lies at the heart of data protection and it is one of the most frequently exercised data subject rights.” Throughout 2024, 30 DPAs across Europe launched coordinated investigations into the compliance of controllers with the right of access, by opening formal investigations, assessing whether a formal investigation was warranted and/or carrying out fact-finding exercises.  A total of 1,185 controllers, consisting of small and medium-sized enterprises (SMEs) and big companies active in different industries and fields, as well as various types of public entities, responded to the action. Areas of improvement and main challenges The results suggest that more awareness raising about Guidelines 01/2022 is necessary , both at national and EU level, as the guidelines help controllers implement the right of access, explain how exercising this right can be made easier, and list the exceptions and limitations of the right to access. As a result of the 2024 CEF action, seven challenges were identified. One of them is the lack of documented internal procedures to handle access requests. In addition, inconsistent and excessive interpretations of the limits to the right of access were also observed, such as overly relying on certain exceptions to automatically refuse access requests. Another example is the barriers that individuals could encounter when exercising their right of access, such as  formal requirements or being requested to provide excessive identification documents. For each challenge identified, the report provides a list of non-binding recommendations to be taken into account by controllers and DPAs. Positive findings Despite the existing challenges, two thirds of participating DPAs evaluated the level of compliance of responding controllers with respect to the right of access from ‘average’ to ‘high’. One important factor identified as having an impact on the level of compliance was the volume of access requests received by controllers, as well as the size of the organisation. More specifically, large-sized controllers or controllers receiving more requests were more likely to reach a higher level of compliance than small organisations with less resources. Positive findings were observed across Europe. These include the implementation of best practices by controllers, such as user-friendly online forms enabling individuals to submit an access request easily as well as self-service systems to allow individuals to autonomously download their personal data in a few clicks and at any time. Background and next steps The CEF is a key action of the EDPB under its 2024-2027 Strategy, aimed at streamlining enforcement and cooperation among DPAs.  In the past three years, two previous CEF actions were carried out. The results of these national actions are aggregated and analysed together to generate deeper insight into the topic and allowing for targeted follow-up on both national and EU level. In 2023, the EDPB published the report on its first coordinated action on the use of cloud-based services by the public sector . In 2024, the EDPB also published the"}]