[{"source":"FTC USA Business Blog Posts","description":"First Consumer Review Fairness case takes on promoter’s “big bucks on Amazon” claim lfair August 6, 2018 | 11:11AM First Consumer Review Fairness case takes on promoter’s “big bucks on Amazon” claim By Lesley Fair T he marketers behind a purported money-making promotion called Sellers Playbook appear to have skipped the chapter about complying with federal and state consumer protection laws. That’s the allegation in a complaint filed by the FTC and the Minnesota Attorney General . In addition, it’s the FTC’s first case charg ing violations of the Consumer Review Fairness Act. The roots of the allegations go back to another venture sued by the FTC earlier this year: FBA Stores, also known as Amazing Wealth System and Amazon Wealth Systems. The defendants in that case ran online ads and in-person workshops that claimed to reveal the secret s of making major money on Amazon. But few, if any, of the consumers who forked over thousands of dollars and implemented their “plug-and-play systems” earn ed the kind of cash the defendants claimed. Which brings us to Sellers Playbook, Exposure Marketing, Jessie Conners Tieva, and Matthew Tieva – Minnesota-based defendants charged with pitching the same kind of “secrets” to making big bucks on Amazon . According to the just-filed lawsuit , the striking similarities should come as no surprise. That ’s because defendant Jessie Tieva was a regular speaker at Amazing Wealth Systems’ workshops. How successful was she in getting consumers to sign up? The complaint charges that Ms. Tieva and her team generated more than $3.4 million in sales for Amazing Wealth Systems. And let’s be clear: We’re not talking about $3.4 million in sales by consumers who successfully implemented the system. We mean $3.4 million that consumers shelled out to the operators of Amazing Wealth Systems for which Tieva was paid a handsome commission. The complaint alleges that the new Sellers Playbook venture is, in effect, a copycat of the now-defunct Amazing Wealth Systems operation. The earning claims certainly have a familiar ring to them. Here’s how Sellers Playbook touted their “opportunity”: “Holy cow, guys. That’s when you start seeing the returns of what we want you to have, $20,000 a month,” “Potential Net Profit: $1,287,463.38,” “Starting with $1000...1 year later over $210,000,” and “How many of you would like to learn how to turn a $5- to $10,000 investment into a $25- to a $1.2 million return with your investment? Yeah. And you’re going to learn those strategies before you leave here today. There are a few other things Amazon Wealth Systems and Sellers Playbook have in common: 1) Neither company has any affiliation with Amazon; and 2) Both companies charged consumers hundreds of dollars – or even hefty five-figure fees – to sign up. Of course, few consumers make the kind of earnings the defendants claimed. According to the complaint, many of the webpages promoting Sellers Playbook contained an inconspicuous earnings disclaimer in grey near the bottom of the page. What’s more, at a live event, the defendants briefly displayed this slide, which one of the presenters downplayed with this statement: “That’s why they have us do this again. It makes the lawyers happy, disclaimers. But you got to do your part. Money’s not going to fall from the sky. But as long as you do a part, it’s going to happen.” T he complaint challenges the defendants’ earning claims as false or unsubstantiated under FTC law and the Minnesota Prevention of Consumer Fraud Act. What’s more, the lawsuit alleges multiple violations of the FTC’s Business Opportunity Rule . The FTC and the AG also charge that provisions in the defendants’ form contracts try to restrict consumers’ ability to post reviews of their products, services, or conduct , in violation of the Consumer Review Fairness","id":3199075,"titre":"First Consumer Review Fairness case takes on promoter’s “big bucks on Amazon” claim","url":"https://www.ftc.gov/business-guidance/blog/2018/08/first-consumer-review-fairness-case-takes-promoters-big-bucks-amazon-claim","pubDate":"Tue, 06 Oct 2026 08:06:23 +0200"},{"url":"https://www.ftc.gov/business-guidance/blog/2020/04/new-ftc-warning-letters-cite-unsupported-coronavirus-related-health-earnings-claims","titre":"New FTC warning letters cite unsupported Coronavirus-related health and earnings claims","pubDate":"Mon, 05 Oct 2026 08:07:08 +0200","description":"New FTC warning letters cite unsupported Coronavirus-related health and earnings claims sgressin April 24, 2020 | 12:44PM New FTC warning letters cite unsupported Coronavirus-related health and earnings claims By Seena Gressin The FTC is not the pen pal you want if you operate a multi-level marketing company but aren’t closely monitoring your distributors. In its latest round of warning letters, the FTC warns ten MLM companies that they are responsible for the claims made by their participants. The letters direct the companies to report within 48 hours what actions they’ve taken to stop their distributors from claiming their products can treat or prevent Coronavirus disease, that MLM business opportunity participants are likely to earn substantial income, or both. The FTC says that the health and earnings claims are unsubstantiated and therefore violate truth-in-advertising laws. The products at issue are not scientifically proven to treat or prevent COVID-19, the disease that Coronavirus causes. The FTC previously has sent warning letters to companies about their Coronavirus-related health claims, but the new letters are the first to also target claims about potential business opportunity earnings. The letters come at a time when millions of people are out of work and facing financial challenges as a result of the pandemic. MLM companies rely on a network of independent distributors, sometimes called business opportunity participants, to buy and resell their products, often through direct person-to-person sales or online. MLMs typically offer participants a cut of the sales made by people the participant recruits to invest in the business opportunity. The new recruits then try to sell the products, and try to recruit more people to do the same. Most people who join MLMs make little or no money. According to the FTC, distributors of the MLM companies receiving the letters have posted promotional messages on Facebook, Instagram, and other social media sites. Health claims the FTC letters cite include: “STAY SAFE!! MAKE YOUR IMMUNE SYSTEM STRONG!!!” Standard coronavirus protection kit . #antiseptics and #immunity_support.” “HOW WILL YOU FIGHT OFF CORONA? USE NUTRABURST-CHAGA- .... #coronacure #coronaprevention ... #immunesupport #immunebooster ... #immunesystembooster” “Got the coronavirus heebeegeebees? Boost your immunity with this amazing deal!!!!” “... If interested to learn more or obtain oils or rollers Let me know A little extra protection can help #doterra #NursesCOVID19 #Dialysis #ImmunityBoosters #ImproveRespiratoryFunction” Earnings claims the FTC letters cite include: “...Living in quarantine and where 14 million people applied for unemployment just last week ... I’ll stick with the opportunity to change people’s lives ... turn a small investment into six figures .... #arbonne ... #quarantine #2020” “Need to make extra money? Find it difficult to pay your bills? Were you laid off/ #fired? Be your own Boss w/doTERRA essential oils. Msg me to achieve financial independence #laidoff #unemployed #cantpaymybills #cantpaymyrent #student #sales #sidehustle #makemoney #stayathomemom.” “[E]veryone’s getting stimulus checks right now... There is no better investment you could do... Take that money that you’re about to get back... figure out a way to make this happen tonight.” In the letters alleging unsubstantiated health claims, FTC staff reminds the companies that, under the FTC Act, claims that a product can prevent, treat, or cure a serious disease require the support of well-controlled human clinical studies. Because “no such study is currently known to exist” for the advertised products, the FTC says the companies “must immediately cease making all such claims.” In the letters alleging deceptive earnings claims, FTC staff reminds the companies that under the FTC Act, “claims about the potential to achieve a wealthy lifestyle, career-level income, or significant","id":3197413,"source":"FTC USA Business Blog Posts"},{"id":3194910,"description":"Practice Fusion case suggests 6 health privacy pointers lfair June 8, 2016 | 9:01AM Practice Fusion case suggests 6 health privacy pointers By Lesley Fair Combine two of the most talked-about consumer protection topics – health privacy and consumer-generated online content – and what do you get? A proposed FTC settlement with Practice Fusion, the largest cloud-based electronic health records company in the country, and six compliance tips for others in the industry. One of San Francisco-based Practice Fusion’s primary products is an electronic records system for outpatient providers. In 2009, the company launched “Patient Fusion,” an online portal where patients whose providers were already using Practice Fusion could view or download their health information or transmit it to another provider. Patient Fusion also let patients send and receive secure messages from their providers. Fast forward several years and the company decided to expand Patient Fusion to include a public directory where current and prospective enrollees could search for doctors geographically or by specialty, read patient reviews of providers, and request appointments. But Practice Fusion had to ask itself a question familiar to many online companies: How do we get the content – in this case, patient reviews? That’s the focus of the FTC’s lawsuit. According to the complaint , Practice Fusion solicited data in a misleading way that led some patients to believe they were sending follow-up messages directly to their doctors about their diagnosis, medical treatment, prescriptions, etc. – and not contributing content to a public website. Practice Fusion, however, populated its new site with the information those people provided, some of which was highly sensitive. Here’s what happened. After appointments with their doctors, patients received emails titled “How was your visit?” The message continued, “To help improve your service in the future, please let us know how your visit went” and included a link with rating stars. The message ended this way: Thank you, Dr. [Name] In a footer, the message said “This email was sent to you by Patient Fusion®, a tool Doctor [Name] uses to deliver the highest quality of care to patients.” Below that in smaller print it said “Sent on behalf of Doctor [Name]’s office by: Practice Fusion.” If patients clicked the link, they were taken to a page that asked for feedback about things like how long they had to wait for their appointment, the doctor’s bedside manner, and whether their medical concern was addressed. There also was a text box where patients were invited to “leave a review for your provider.” Below that was a pre-checked box with the phrase “Keep this review anonymous.” What did some people put in that box? Highly sensitive information directly addressed to their doctors, not evaluations meant to be shared publicly. Here are just a few examples: “Dr [name], My Xanax prescription that I received on Monday was for 1 tablet a day but usually it’s for 2 tablets a day. I have not taken it to the pharmacy yet. Can I pick up a new one, or can I get a prescription called into a pharmacy? Thanks, [patient’s full name] “I called today and left a message regarding my daughter and no one has returned my call. I think she is depressed and has stated several times this week that she wishes she was dead. Could someone please call me [phone number]?” “The cefuroxime axetil does not seem to be doing anything for me. I did a little research and I think I have a yeast infection called candida. Not sure what to do about it yet. I guess I will first try to change my diet. Medication? [patient’s full name] “I would like to make an appointment for my back pain and possible shingles. Can you please call me @ [phone number]? Thank you! [patient's full name]” “I HAVE NO INFECTION [healthcare provider name].  EVERYTHING WENT","source":"FTC USA Business Blog Posts","pubDate":"Sat, 03 Oct 2026 08:09:37 +0200","titre":"Practice Fusion case suggests 6 health privacy pointers","url":"https://www.ftc.gov/business-guidance/blog/2016/06/practice-fusion-case-suggests-6-health-privacy-pointers"},{"description":"A perpetual question from clients is whether a new development should be protected by filing a patent application or kept as a trade secret? Patents are granted by national patent offices for new, useful and not obvious inventions. Patents require a full and public description of the idea and the details needed by a skilled person to put that idea into practice. For example, Section 27(3)(c) of the Patent Act requires that for machines, the patent “explain the principle of the machine and the best mode in which the inventor has contemplated the application of that principle”. This quid pro . . . [more] The post Trade Secrets as an Alternative to Patent Protection appeared first on Slaw","id":3178670,"source":"Slaw","url":"https://www.slaw.ca/2026/09/25/trade-secrets-as-an-alternative-to-patent-protection/","titre":"Trade Secrets as an Alternative to Patent Protection","pubDate":"Sat, 26 Sep 2026 08:01:53 +0200"},{"url":"https://www.arcom.fr/en/find-out-more/legal-area/legal-resources/arcoms-notice-may-6-2026-accompanying-publication-model-agreements-provided-article-l333-10-french-sports-code","titre":"Arcom's notice of May 6, 2026 accompanying the publication of model agreements provided for in article L333-10 of the French Sports Code.","pubDate":"Fri, 22 May 2026 14:08:22 +0200","source":"Arcom Textes juridiques","description":"The French regulatory authority for audiovisual and digital communication, Having regard to the French intellectual property code , in particular article L. 331-12 ; Having regard to the French Sports Code , in particular article L.333-10 ; After due deliberation, Adopts the following notice: The year 2025 marked a turning point in the fight against sports broadcasting piracy, with increased involvement of various types of intermediaries, under the impetus of sports rights holders, as part of the dynamic injunctions issued under article L. 333-10 of the French Sports Code . In addition to the legal actions involving Internet Service Providers (ISPs), which have been fully integrated into the scheme since 2022, and in order to strengthen the effectiveness of the blocking measures implemented, rights holders have extended their legal actions, from 2023, to search engine operators, who play a key role as central players in the diffusion of information on the internet and in directing users to sports-related contdnt. Search engine operators are now almost systematically involved in actions taken by rights holders to protect sports competitions. Between 2024 and 2025, the number of delisting measures ordered by the courts and the number of measures notified by Arcom in application of the orders issued has dubbed. In response to the misuse by some Internet users of domain name resolution services or virtual private networks (VPNs), rights holders then extended the scope of players taken to court to prevent access to services dedicated to the unlawful broadcasting of sports competitions. More than 5,000 blocking demands were notified to alternative DNS in 2025. As for virtual private network service providers, they were the subject of the first court verdicts, handed down on the basis of article L. 333-10 of the French Sports Code , in May 2025, and as such are receiving a growing number of blocking demands to update the measures ordered by the judge. Against this backdrop, strengthening cooperation between rights holders of sports-related content and the various intermediaries mentioned in the court orders would therefore appear to be desirable in order to give an even greater impact to the fight agains sports piracy. The parties are also invited to continue their exchanges with Arcom with a view to optimizing the provision of identification data and ensuring the simultaneous application of delisting and blocking measures by all technical intermediaries involved in preventing access to unlawful services. Article L. 331-12 of the French intellectual property code makes provision for the adoption of notices by the Authority for the protection and promotion of creation, with the aim of encouraging the signing of voluntary agreements likely to help remedy infringements of copyright and neighbor rights, or of the audiovisual exploitation rights mentioned in article L. 333-10 of the French Sports Code, on electronic communications networks used for the provision of online public communication services. In addition, under the terms of IV of article L. 333-10 of the French Sports Code, Arcom is responsible for adopting model agreements which the rights holders mentioned in I of the same article are invited to sign. The agreement concluded between the parties specifies, in particular, the measures that the parties undertake to take to put an end to any infringement of the exclusive audiovisual exploitation rights of the sports event or competition. The Autorité recommends that the rights holders mentioned in I of article L. 333-10 of the French Sports Code, on the one hand, and any intermediaries implementing measures ordered on the basis of II of article L. 333-10 of the same code, on the other (notably search engine operators, domain name resolution services and virtual private network providers), enter into discussions with a view to concluding agreements that would reflect their joint commitment to fight agains the unlawful diffusion of sports-related events and competitions as effectively as possible. To this end, Arcom is","id":2900811},{"id":2850552,"description":"Brussels, 27 April – Today marks the 10th anniversary of the GDPR’s adoption, the first comprehensive data protection framework spanning an entire continent, establishing clear rights for individuals and obligations for organisations across Europe. The moment that led to the creation of the EDPB The GDPR led to the establishment of the European Data Protection Board (EDPB) on 25 May 2018, replacing the Article 29 Working Party that was previously in charge of dealing with issues relating to the protection of personal data. The GDPR gave the Data Protection Authorities (DPAs) stronger enforcement powers and expanded the scope of their work from focusing mainly on national compliance complaints to routinely dealing with cross-border cases. In the past 10 years, the 31 European DPAs comprising the EDPB have worked together to ensure the consistent enforcement of the GDPR and a harmonised data protection approach across Europe.   A key role in an evolving digital landscape Today, the GDPR is part of a broader and evolving European digital framework, alongside other digital laws such as the Digital Services Act, the Digital Markets Act, and the AI Act . In a world shaped by artificial intelligence, platform economies, and increasing data-driven innovation, the GDPR ensures that technological progress goes hand in hand with the protection of individuals’ fundamental rights . An inspiration for the rest of the world The impact of the GDPR has extended far beyond Europe’s borders, inspiring similar frameworks across the globe and contributing to a growing international recognition of privacy as a fundamental right .   How the GDPR has shaped the data protection landscape: insights from Data Protection Authorities Have you ever wondered what the data protection landscape looked like before the GDPR and how DPAs prepared for its entry into force? How has life for Europeans changed since its adoption? Watch the video for insights and testimonies from Data Protection Authorities which contributed to the shaping of the data protection landscape in Europe.   Sorry, your browser doesn't support embedded","source":"EDPB News","pubDate":"Mon, 27 Apr 2026 14:14:32 +0200","url":"https://www.edpb.europa.eu/news/news/2026/marking-10-years-gdpr-evolution-european-data-protection-landscape_en","titre":"Marking 10 years of the GDPR: the evolution of the European data protection landscape"},{"source":"EDPB News","id":2769535,"description":"Brussels, 19 March - The EDPB has launched its Coordinated Enforcement Framework (CEF) action for 2026*. Following a year-long coordinated action on the right to erasure in 2025 , the CEF's focus this year will shift to compliance with the obligations of transparency and information under the GDPR . The GDPR ensures that individuals are informed when their data is being processed (under Art. 12, 13 and 14). This right to be informed is a core element of transparency and ensures that individuals have more control over their data. Next steps During 2026, 25 Data Protection Authorities (DPAs) across Europe will take part in this initiative. They will look closely to assess the compliance of controllers with their transparency obligations under the GDPR. Participating DPAs will soon contact controllers from different sectors across Europe, either through enforcement actions or fact-finding exercises. In the latter case, they might also decide to undertake additional follow-up actions if needed. During the second half of the year, participating DPAs will share and discuss their findings together, with a view to aggregate the results of their national actions and generate deeper insight into the topic. A consolidated report will then be drafted and submitted for adoption by the EDPB, allowing for targeted follow-ups on both national and EU levels. Background The CEF is a key action of the EDPB under its 2024-2027 Strategy , aimed at streamlining enforcement and cooperation among DPAs. In 2023, the EDPB published the report on its first coordinated action on the use of cloud-based services by the public sector . In 2024, the EDPB also published the report on the outcome of the second coordinated action on the designation and position of Data Protection Officers . In 2025, the EDPB issued the report on its third coordination action on the implementation of the right of access . In 2026, the EDPB has adopted a report on its Coordinated Enforcement Framework (CEF) action on the right to be forgotten (Art.17 GDPR) .   Note to editors: *The Board selected this topic during its October 2025 plenary","pubDate":"Thu, 19 Mar 2026 14:12:59 +0100","titre":"CEF 2026: EDPB launches coordinated enforcement action on transparency and information obligations under the GDPR","url":"https://www.edpb.europa.eu/news/news/2026/cef-2026-edpb-launches-coordinated-enforcement-action-transparency-and-information_en"},{"source":"Federal Trade Commission - Protecting America's Consumers","id":2582987,"description":"Today, the Federal Trade Commission announced that grocery delivery provider Instacart will pay $60 million in refunds to consumers to settle allegations that the company engaged in numerous unlawful tactics that harmed shoppers and raised the cost of grocery shopping for Americans. Instacart will be required to cease its deceptive practices under a proposed FTC order, and consumers who were charged for Instacart+ without their express informed consent will receive refunds as a result of the settlement. “Instacart misled consumers by advertising free delivery services—and then charging consumers to have groceries delivered—and failing to disclose to consumers that signed up for a free trial that they would be automatically enrolled into its subscription program,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “The FTC is focused on monitoring online delivery services to ensure that competitors are transparently competing on price and delivery terms.” The FTC has alleged that Instacart engaged in a variety of deceptive tactics that misled consumers and caused them to pay more in fees, while depriving consumers of refunds. Specifically, the FTC alleges that Instacart: Falsely advertised “free delivery” to consumers on their first order Instacart’s claims of “free delivery” are false because consumers still must pay a mandatory “service fee” to get their groceries delivered. These mandatory service fees add as much as 15% to the order cost and were not clearly disclosed to consumers. Falsely advertised a “100% satisfaction guarantee,” implying that it will provide full refunds when consumers are not fully satisfied Consumers who experience late deliveries or unprofessional service typically are not offered full refunds and instead are given only a small credit that can be used toward a future order. Instacart hid the refund option from the “self-service” menu that consumers use to report problems with their orders, leading many consumers to erroneously believe they could receive only a credit toward a future order rather than a refund. Failed to clearly disclose terms relating to Instacart+ membership enrollment Instacart’s free-trial enrollment process for Instacart+ did not adequately disclose that consumers would be charged for memberships at the end of their trials, nor did it disclose Instacart’s restrictive refund policy. As a result, Instacart has charged many consumers for paid memberships without their express informed consent. Hundreds of thousands of consumers have been charged membership fees without receiving benefits from the membership or getting refunds. Under the terms of the FTC’s proposed settlement order , Instacart will be prohibited from making misrepresentations concerning the costs of delivery services and satisfaction guarantees. Instacart must also clearly and conspicuously disclose the terms and obtain express informed consent for transactions involving subscription models where consumers are automatically charged unless they actively opt out. The Commission vote approving the stipulated final order was 2-0. The FTC filed the proposed order in the U.S. District Court for the Northern District of California. NOTE:  Stipulated final orders have the force of law when approved and signed by the District Court","pubDate":"Fri, 19 Dec 2025 09:48:21 +0100","url":"https://www.ftc.gov/news-events/news/press-releases/2025/12/instacart-pay-60-million-consumer-refunds-settle-ftc-lawsuit-over-allegations-it-engaged-deceptive","titre":"Instacart to Pay $60 Million in Consumer Refunds to Settle FTC Lawsuit Over Allegations it Engaged in Deceptive Tactics"},{"source":"EDPB News","id":2170441,"description":"Background information Date of final decision: 15 May 2025 National case Controller:  SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months Key words: administrative fine, consent,  unsolicited communication   Summary of the Decision Origin of the case   As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the chain, the primary collectors, who are responsible for collecting prospect data). SOLOCAL MARKETING SERVICES used this data to operate commercial prospecting by SMS or e-mail to individuals concerned, on behalf of its advertiser customer. It may also pass on some of this data to its customers, so that they can carry out their own commercial prospecting by telephone or post. Key Findings  Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code): The restricted committee considered that the misleading appearance of the forms used by data brokers made it impossible to obtain free and unambiguous consent, in compliance with the requirements of the GDPR, which would have formed the basis for the prospecting operations carried out by the company. Failure to demonstrate that the data subject has consented to processing of his or her personal data (Article 7 of the GDPR): The company failed to provide the French SA with proof of consent from individuals whose data has been transferred to it by one of its main suppliers. As a result, the French SA was unable to examine the collection forms used by this supplier and, therefore, the validity of the consent of the data subjects.   Decision  Based on the findings of the inspection, the restricted committee – the French SA body responsible for issuing sanctions – considered that the company had failed to comply with obligations under the French Post and Electronic Communications Code (CPCE) and the General Data Protection Regulation (GDPR) regarding the collection and proof of consent.  It imposed on SOLOCAL MARKETING SERVICES:  a €900 000 fine which was made public; and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months.  The amount of this fine takes into account the very large number of people concerned (several million), the company's historical position on the market, the financial benefit derived from the breaches, and the measures taken by the company to comply with some of its obligations since the checks were carried out. For further information:  •  Courtiers en données : sanction de 900 000 euros à l’encontre de la société SOLOCAL MARKETING SERVICES (French) •  Data brokers: SOLOCAL MARKETING SERVICES fined €900,000  (English)","pubDate":"Tue, 10 Jun 2025 09:51:20 +0200","url":"https://www.edpb.europa.eu/news/news/2025/french-sa-fines-solocal-eu900-000_en","titre":"The French SA fines SOLOCAL €900 000"},{"pubDate":"Wed, 21 May 2025 15:52:14 +0200","titre":"The French SA fines SOLOCAL 900 000 €","url":"https://www.edpb.europa.eu/news/news/2025/french-sa-fines-solocal-900-000-eu_en","source":"EDPB News","id":2130472,"description":"Background information Date of final decision: 15 May 2025 National case Controller:  SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of 10 000 € per day overdue after a period of 9 months Key words: administrative fine, consent,  unsolicited communication   Summary of the Decision Origin of the case   As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the chain, the primary collectors, who are responsible for collecting prospect data). SOLOCAL MARKETING SERVICES used this data to operate commercial prospecting by SMS or e-mail to individuals concerned, on behalf of its advertiser customer. It may also pass on some of this data to its customers, so that they can carry out their own commercial prospecting by telephone or post. Key Findings  Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code): The restricted committee considered that the misleading appearance of the forms used by data brokers made it impossible to obtain free and unambiguous consent, in compliance with the requirements of the GDPR, which would have formed the basis for the prospecting operations carried out by the company. Failure to demonstrate that the data subject has consented to processing of his or her personal data (Article 7 of the GDPR): The company failed to provide the French SA with proof of consent from individuals whose data has been transferred to it by one of its main suppliers. As a result, the French SA was unable to examine the collection forms used by this supplier and, therefore, the validity of the consent of the data subjects.   Decision  Based on the findings of the inspection, the restricted committee – the French SA body responsible for issuing sanctions – considered that the company had failed to comply with obligations under the French Post and Electronic Communications Code (CPCE) and the General Data Protection Regulation (GDPR) regarding the collection and proof of consent.  It imposed on SOLOCAL MARKETING SERVICES:  a 900 000 € fine which was made public; and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of 10 000 € per day overdue after a period of 9 months.  The amount of this fine takes into account the very large number of people concerned (several million), the company's historical position on the market, the financial benefit derived from the breaches, and the measures taken by the company to comply with some of its obligations since the checks were carried out. For further information:  •   Courtiers en données : sanction de 900 000 euros à l’encontre de la société SOLOCAL MARKETING SERVICES (French) •   Data brokers: SOLOCAL MARKETING SERVICES fined €900,000  (English)"},{"titre":"European Patent Organisation and extension of adequacy decisions for the UK: EDPB adopts opinions","url":"https://www.edpb.europa.eu/news/news/2025/european-patent-organisation-and-extension-adequacy-decisions-uk-edpb-adopts_en","pubDate":"Tue, 06 May 2025 15:51:59 +0200","description":"Brussels, 06 May - During its latest plenary, the European Data Protection Board (EDPB) adopted an opinion on the European Commission’s draft adequacy decision under the GDPR concerning the European Patent Organisation (EPO) . In addition, the Board adopted an opinion on the European Commission’s proposal to extend the validity of the UK adequacy decisions under the GDPR and the Law Enforcement Directive (LED) . Finally, the EDPB agreed to grant the status of observer to the Personal Data Protection Agency of Bosnia and Herzegovina.   Adequate protection of personal data by the EPO At the European Commission’s request, the Board adopted an opinion on the Commission’s draft adequacy decision regarding the European Patent Organisation (EPO). Once formally adopted by the Commission, this will be the first adequacy decision concerning an international organisation and not a country or a region. An adequacy decision is a key-mechanism in EU data protection legislation which allows the European Commission to determine whether a third country or an international organisation offers an adequate level of data protection. The effect of such a decision is that personal data can flow freely from Europe to that third country or international organisation. EDPB Chair, Anu Talus, said: “The EDPB welcomes the Commission’s initiative to work on the first adequacy decision concerning an international organisation. This decision shows how the legal framework of such organisations can be recognised as ensuring an adequate level of protection on the basis of Art.45 GDPR. The EDPB underlines the importance of ongoing dialogue between the Commission and international organisations, with a view to developing this category of adequacy decisions in addition to those relating to third countries.” In its opinion, the Board positively notes that the EPO data protection framework is largely aligned with the European Union data protection framework, including on data protection rights and principles. This shows that the GDPR and, in particular, its transfer provisions, can facilitate safe data flows from Europe to international organisations, while taking into account their status.   Six-month extension of the UK adequacy decisions The EDPB opinion, requested by the European Commission, addresses the proposed extension of the two UK adequacy decisions under the GDPR and the LED, which are set to expire on 27 June 2025. The opinion only concerns the proposed 6-month extension of these adequacy decisions and does not address the level of protection for personal data afforded in the UK, which will be examined by the EDPB following the Commission’s assessment, and if the renewal of the UK adequacy decisions is proposed. Since the UK‘s data protection reform is still pending in the UK parliament, the EDPB recognises the need for a technical and time-limited extension of the adequacy decisions until 27 December 2025.This will give the European Commission sufficient time to evaluate the updated UK legal framework once it has been adopted.   The EDPB stresses that this extension is exceptional and is due to the ongoing legislative developments in the UK. It should not, in principle, be further prolonged. The Board recalls the validity of its opinions 14/2021 and 15/2021 on the two UK adequacy decisions, adopted in April 2021, and invites the European Commission to take them into account in its future assessments.  The Board also recalls the Commission’s obligation to monitor all relevant developments in the UK during the extension period.   New observer to the EDPB’s activities Finally, EDPB members agreed to grant observer status to the EDPB’s activities to the Bosnia and Herzegovina Data Protection Authority, in line with Art. 8 EDPB Rules of Procedure .","id":2099053,"source":"EDPB News"},{"source":"EDPB News","description":"Brussels, 20 January - The European Data Protection Board (EDPB) has adopted a report on the implementation of the right of access by controllers . The report summarises the outcome of a series of coordinated national actions carried out in 2024 under the Coordinated Enforcement Framework (CEF). It lists the issues that were observed for some controllers, along with a series of recommendations to help them implement the right of access. A central element is controllers’ awareness of the EDPB Guidelines 01/2022 on data subjects rights – Right of access and whether these guidelines were followed in practice. EDPB Deputy Chair Zdravko Vukíc said: “The CEF is a valuable initiative that helps strengthen the cooperation among Data Protection Authorities (DPAs): by tackling selected topics in a coordinated fashion, they achieve greater efficiency and more consistency. How controllers implement the right of access lies at the heart of data protection and it is one of the most frequently exercised data subject rights.” Throughout 2024, 30 DPAs across Europe launched coordinated investigations into the compliance of controllers with the right of access, by opening formal investigations, assessing whether a formal investigation was warranted and/or carrying out fact-finding exercises.  A total of 1,185 controllers, consisting of small and medium-sized enterprises (SMEs) and big companies active in different industries and fields, as well as various types of public entities, responded to the action. Areas of improvement and main challenges The results suggest that more awareness raising about Guidelines 01/2022 is necessary , both at national and EU level, as the guidelines help controllers implement the right of access, explain how exercising this right can be made easier, and list the exceptions and limitations of the right to access. As a result of the 2024 CEF action, seven challenges were identified. One of them is the lack of documented internal procedures to handle access requests. In addition, inconsistent and excessive interpretations of the limits to the right of access were also observed, such as overly relying on certain exceptions to automatically refuse access requests. Another example is the barriers that individuals could encounter when exercising their right of access, such as  formal requirements or being requested to provide excessive identification documents. For each challenge identified, the report provides a list of non-binding recommendations to be taken into account by controllers and DPAs. Positive findings Despite the existing challenges, two thirds of participating DPAs evaluated the level of compliance of responding controllers with respect to the right of access from ‘average’ to ‘high’. One important factor identified as having an impact on the level of compliance was the volume of access requests received by controllers, as well as the size of the organisation. More specifically, large-sized controllers or controllers receiving more requests were more likely to reach a higher level of compliance than small organisations with less resources. Positive findings were observed across Europe. These include the implementation of best practices by controllers, such as user-friendly online forms enabling individuals to submit an access request easily as well as self-service systems to allow individuals to autonomously download their personal data in a few clicks and at any time. Background and next steps The CEF is a key action of the EDPB under its 2024-2027 Strategy, aimed at streamlining enforcement and cooperation among DPAs.  In the past three years, two previous CEF actions were carried out. The results of these national actions are aggregated and analysed together to generate deeper insight into the topic and allowing for targeted follow-up on both national and EU level. In 2023, the EDPB published the report on its first coordinated action on the use of cloud-based services by the public sector . In 2024, the EDPB also published the","id":1857297,"titre":"CEF 2024: EDPB identifies challenges to the full implementation of the right of access","url":"https://www.edpb.europa.eu/news/news/2025/cef-2024-edpb-identifies-challenges-full-implementation-right-access_en","pubDate":"Mon, 20 Jan 2025 15:49:16 +0100"},{"source":"EDPB News","description":"Brussels, 18 December - The European Data Protection Board (EDPB) has adopted an opinion* on the use of personal data for the development and deployment of AI models . This opinion looks at 1) when and how AI models can be considered anonymous, 2) whether and how legitimate interest can be used as a legal basis for developing or using AI models, and 3) what happens if an AI model is developed using personal data that was processed unlawfully. It also considers the use of first and third party data. The opinion was requested by the Irish Data Protection Authority (DPA) with a view to seeking Europe-wide regulatory harmonisation. To gather input for this opinion, which deals with fast-moving technologies that have an important impact on society, the EDPB organised a stakeholders’ event and had an exchange with the EU AI Office. EDPB Chair Talus said: “AI technologies may bring many opportunities and benefits to different industries and areas of life. We need to ensure these innovations are done ethically, safely, and in a way that benefits everyone. The EDPB wants to support responsible AI innovation by ensuring personal data are protected and in full respect of the General Data Protection Regulation (GDPR).” Regarding anonymity , the opinion says that whether an AI model is anonymous should be assessed  on a case by case basis by the DPAs. For a model to be anonymous, it should be very unlikely (1) to directly or indirectly identify individuals whose data was used to create the model, and (2) to extract such personal data from the model through queries. The opinion provides a non-prescriptive and non-exhaustive list of methods to demonstrate anonymity. With respect to legitimate interest , the opinion provides general considerations that DPAs should take into account when they assess if legitimate interest is an appropriate legal basis for processing personal data for the development and the deployment of AI models. A three-step test helps assess the use of legitimate interest as a legal basis. The EDPB gives the examples of a conversational agent to assist users, and the use of AI to improve cybersecurity. These services can be beneficial for individuals and can rely on legitimate interest as a legal basis, but only if the processing is shown to be strictly necessary and the balancing of rights is respected. The opinion also includes a number of criteria to help DPAs assess if individuals may reasonably expect certain uses of their personal data. These criteria include: whether or not the personal data was publicly available, the nature of the relationship between the individual and the controller, the nature of the service, the context in which the personal data was collected, the source from which the data was collected, the potential further uses of the model, and whether individuals are actually aware that their personal data is online. If the balancing test shows that the processing should not take place because of the negative impact on individuals, mitigating measures may limit this negative impact. The opinion includes a non-exhaustive list of examples of such mitigating measures, which can be technical in nature, or make it easier for individuals to exercise their rights or increase transparency. Finally, when an AI model was developed with unlawfully processed personal data, this could have an impact on the lawfulness of its deployment, unless the model has been duly anonymised. Considering the scope of the request from the Irish DPA, the vast diversity of AI models and their rapid evolution, the opinion aims to give guidance on various elements that can be used for conducting a case by case analysis. In addition, the EDPB is currently developing guidelines covering more specific questions, such as web scraping. Note to editors: *An Article 64(2) opinion addresses a matter of general application or produces effects in more than one Member","id":1792119,"url":"https://www.edpb.europa.eu/news/news/2024/edpb-opinion-ai-models-gdpr-principles-support-responsible-ai_en","titre":"EDPB opinion on AI models: GDPR principles support responsible AI","pubDate":"Wed, 18 Dec 2024 15:47:16 +0100"}]