[{"source":"Faculté de droit Travaux récents","description":"dc.contributor.author: Polo-Bergeron, Pierre dc.date.issued: 2026-10 dc.description.abstract: Ce mémoire propose une analyse critique du droit international de l’eau et de son application concrète, en particulier dans le bassin du Nil. La première partie examine l’architecture juridique internationale relative aux eaux transfrontalières, en détaillant ses fondements coutumiers et conventionnels ainsi que ses obligations procédurales et substantielles, et en évaluant son intégration des droits humains. La seconde partie analyse l’exemple égyptien comme vitrine des défis contemporains : elle met en lumière la tension entre la souveraineté étatique, la coopération régionale, la sécurité hydrique, le changement climatique et les crises humanitaires. L’étude conclut que si le droit international de l’eau constitue une base normative solide, sa mise en oeuvre reste tributaire de la volonté politique des États et de la création de mécanismes conjoints, qui seuls permettent une coopération effective et durable dans la gestion des ressources partagées.; This thesis offers a critical analysis of international water law and its practical application, with a focus on the Nile Basin. The first part examines the international legal framework governing transboundary freshwater resources, detailing its customary and conventional foundations as well as its procedural and substantive obligations, including its integration with human rights law. The second part explores Egypt as a case study illustrating the contemporary challenges of inter- State cooperation under the constraints of sovereignty, climate change impacts, and humanitarian crises. The study concludes that while international water law provides a strong normative basis, its implementation depends on political willingness and the establishment of joint management mechanisms, which are essential for effective and sustainable cooperation in managing shared water resources. dc.type: Thèse ou mémoire / Thesis or Dissertation etd.degree.discipline: Droit","id":3252075,"titre":"Le droit international de l’eau et sa difficile réconciliation avec la souveraineté des États, une étude de cas portant sur l’Égypte et le Nil","url":"https://hdl.handle.net/1866/46727","pubDate":"Fri, 30 Oct 2026 08:03:48 +0100"},{"pubDate":"Thu, 29 Oct 2026 07:58:22 +0100","url":"https://theconversation.com/france-three-overlapping-woes-are-fuelling-a-generation-of-discontent-295102","titre":"France: three overlapping woes are fuelling a generation of discontent","id":3248553,"description":"KEY TAKEAWAYS The French high schooler-led uprising is not a sign of a generational struggle pitting the young against baby boomers. The uprisings indicate a state of discontentment reflecting three grievances: failings within the education system, eco-anxiety and concerns over employment in the age of AI. Far from demanding a break with the established order, young protesters are simply asking for the right to live a good and fair life... like their predecessors before them. Rarely has Freud’s Civilization and Its Discontents seemed so relevant to the times in which we are living. Although the discontents we are currently witnessing do not necessarily affect society as a whole, they are certainly impacting an entire generation born in the 21st century, as well as their parents and their social environment. Admittedly, we know that generations are not homogeneous and that any attempt to generalise is an oversimplification. Nevertheless, the high schoolers that are taking to the streets to protest in this day and age belong to a relatively homogeneous age cohort. You would be forgiven for thinking that the current unrest is the result of a clash of generations. From the outside, it is often viewed as a generational tug of war between a struggling young population and the rest: an aging but relatively prosperous Europe . Criticism is, without doubt, being directed at “baby-boomers” or those born during the thirty years following World War II (which were marked by economic prosperity and low unemployment, conditions that now seem a world away today). The problem lies elsewhere Nevertheless, this is not a generational conflict, and the fact that a substantial proportion of parents , as well as the majority of the population , share the students’ demands shows that the problem lies elsewhere. These demands are nothing new, and they help explain why many parents joined their children during the first demonstrations, along with teachers, to show their support over deteriorating conditions in high schools. The students and their initial demands were hijacked by more politically radical movements, some even revolutionary or anarchist, as well as opportunistic groups that took advantage of the disorder to loot shops and businesses, without any tangible political agenda. According to an official report dated October 14, 2026, “937 law enforcement officers, 248 students and 149 members of educational staff have been injured since the beginning of the high school student movement.” The demonstrations on October 18 resulted in more than 1,800 arrests . The proliferation of various groups with overlapping demands muddles the student movements’ original message, leaving us with little more than the smouldering remnants of a battlefield. Nevertheless, it is the central concerns of these students that I wish to explore here. Ultimately, this movement appears to lie at the intersection of several anxiety-inducing issues. Rather than speaking of a convergence of struggles, we should speak of a convergence of anxieties. Three sources of anxiety The movement appears to reflect the convergence of three factors that are also sources of concern: the perceived deterioration of public education ecological anxiety the new difficulties young people face in the labour market, particularly those associated with the development of artificial intelligence (AI). These three factors provide fertile ground for psychosocial anxiety. The high school students’ main demands appear legitimate and concern improving working conditions: replacing absent teachers, shortening excessively long school days, reducing the number of students per class, repairing and maintaining infrastructure, and improving or abolishing Parcoursup , the widely criticised higher education admissions platform that is often difficult to understand. These demands echo the broader perception that conditions in the French school system have deteriorated and that the system is relatively inefficient compared with those of neighbouring countries.","source":"The Conversation – Articles (FR)"},{"url":"https://theconversation.com/brazil-lulas-presidential-win-puts-the-brakes-on-the-rise-of-the-far-right-in-latin-america-295219","titre":"Brazil: Lula’s presidential win puts the brakes on the rise of the far right in Latin America","pubDate":"Tue, 27 Oct 2026 13:57:26 +0100","description":"KEY TAKEAWAYS Social policies, such as support for small businesses, and a shorter working week without a loss of pay helped president Lula to turn around Brazil’s election. Street protests and social media strengthened Lula’s campaign amid allegations of election interference by Meta favouring Flávio Bolsonaro. Major challenges lie ahead as Lula faces a right-leaning Congress, opposition from the Bolsonaro movement and pressure from the Trump administration. Luiz Inácio Lula da Silva won Brazil’s presidential election with 51.79% of valid votes, unexpectedly reversing the first-round result won by Flávio Bolsonaro, a first in Brazilian presidential elections. Between the two rounds, he gained about 10.4 million additional votes. Defeated, right-wing challenger Flávio Bolsonaro announced that he would ask for the election to be annulled. The next day, his party, the Liberal Party (PL), acknowledged the result. Brazil’s nonalignment sounds a warning to the global far right Beyond halting the advance of Donald Trump’s and Secretary of State Marco Rubio’s influence in the region, Brazil’s election result points to strategies by which far right success in other countries can be contained. It is also a personal defeat for Trump, who invested energy and influence without openly declaring his support, but with the objective of returning the Bolsonaro family to power. Lula’s victory can be attributed to three equally important factors. The first is a package of social measures: an increase in Bolsa Família, the government’s flagship cash-transfer program; the announcement of measures benefiting individual microentrepreneurs (MEI), who account for nearly 70% of active businesses in Brazil; and, above all, the approval, during the second-round campaign, of the government’s bill reducing the working week from six to five days with no loss of pay . In a poll conducted four days before the vote, this legislation was the news item that mattered most in determining voters’ choice (17%). It was followed by reports of Supreme Federal Court (STF) justices’ involvement in the Banco Master corruption case (14%), politicians’ involvement in the same case (13%), and the Lula government’s lifting of the ban on online betting houses, known as “bets” (11%). Between the two rounds, Lula raised his government’s approval rating, particularly among higher-income voters (+6 p.p) and right-wing voters outside of bolsonarismo (+12 p.p), i.e. groups that make up Flávio’s voter base. Over the same period, fear of the Bolsonaro family’s return to power overtook fear of Lula’s reelection (44% to 42%) . Taking to the streets and digital power Such a turnaround was driven, in large part, by mass mobilisation of Lula’s supporters in the streets and on social media. Large rallies called by students and other mostly young people brought millions of people on the streets, breaking the chill seen in the preceding weeks . The largest rally in support of Lula took place in São Paulo on October 24. Demonstrators sang the Independence Anthem of Brazil, a clear reference to Brazil’s independence from Trump’s interventionist policy . Part of this interventionism was attributed to the actions of Meta, the parent company of Instagram, Facebook and WhatsApp. During the second-round campaign, allegations grew that the company had favoured Flávio Bolsonaro and other far-right candidates by manipulating its algorithms . While Meta denied any favouritism, blaming technical failures, internal messages revealed by Folha de S. Paulo revealed that Lula’s campaign had been unable to boost posts for nearly 24 hours in October. In reaction to the far right’s domination of the digital environment, one of the major landmarks of the second round was the creation of the “Lula’s Army”, a WhatsApp channel set up by a federal deputy that gathered more than 10 million","id":3244497,"source":"The Conversation – Articles (FR)"},{"description":"By: Susannah Tredwell , Manager of Library Services at DLA Piper (Canada) LLP and James Bachmann , Instructional Librarian, Law Library, University of British Columbia Since 1988, when CALL/ACBD’s Copyright Committee was first set up, CALL/ACBD has advocated for its members' interests in the area of copyright. While the primary focus of CALL/ACBD’s copyright advocacy over the last few years has been on Crown copyright and primary law, CALL/ACBD has also made submissions about such areas as fair dealing and licencing. CALL/ACBD sees this work as not only supporting the needs of its members but also as serving the interests of access to justice as a whole. Continuing this work, on January 18, 2022 CALL/ACBD, along with Library Futures Institute, will act as an intervener in the Supreme Court of Canada case Society of Composers, Authors and Music Publishers of Canada, et al. v. Entertainment Software Association, et al.   Kim Nayyer, CALL/ACBD’s President, and Robert Janes of JFK Law   will be representing CALL/ACBD and Library Futures. This case addresses the question of how the concepts of “communication to the public by telecommunication” and “making available on demand” as used in the Copyright Act should be understood. The outcome of this case has the potential to significantly impact various library activities, including controlled digital lending and possibly even the simple use of hyperlinks, particularly in light of the limited scope of current library and education exceptions in the Copyright Act . CALL/ACBD's submitted that the court refrain from broadly construing the terms “making available” and “Communication to the Public by Telecommunication” and that s. 2.4(1.1) of the act (\"Communication to the public by telecommunication\")   does not need to be understood as creating a new right.   You can find CALL/ACBD’s intervener's factum at https://www.scc-csc.ca/WebDocuments-DocumentsWeb/39418/FM050_Intervener_Canadian-Association-Law-Libraries-et-al.pdf . The other factums in this case are available at https://www.scc-csc.ca/case-dossier/info/af-ma-eng.aspx?cas=39418 .  CALL/ACBD has acted as an intervener at the Supreme Court of Canada on two other occasions. In Keatley Surveying Ltd. v. Teranet Inc. , which looked at Crown copyright, CALL/ACBD submitted   that “s. 12 Crown copyright does not extend to primary sources of law”. In York University v. Canadian Copyright Licensing Agency  (\"Access Copyright\"), CALL/ACBD submitted   that the SCC “should resist the temptation to modify or clarify the existing fair dealing test” stating that the existing test “is a flexible multifactorial test that allows libraries (and other institutions) to tailor access and appropriate copying policies that consider all relevant circumstances.” CALL/ACBD also made submissions to the 2018 review of the Copyright Act , R.S.C. 1985, c. C-42: one general submission   and <a","id":3241460,"source":"Canadian Association of Law Libraries / L'Association canadienne des bibliothèques de droit CALL/ACBD Blog","titre":"Canadian Association of Law Libraries Intervention in Upcoming Supreme Court of Canada Copyright Case","url":"https://www.callacbd.ca/CALL-Blog/12242053","pubDate":"Mon, 26 Oct 2026 07:55:47 +0100"},{"pubDate":"Tue, 06 Oct 2026 08:06:24 +0200","titre":"Franchise Fundamentals: Taking a deep dive into the Franchise Disclosure Document","url":"https://www.ftc.gov/business-guidance/blog/2023/05/franchise-fundamentals-taking-deep-dive-franchise-disclosure-document","source":"FTC USA Business Blog Posts","id":3199079,"description":"Franchise Fundamentals: Taking a deep dive into the Franchise Disclosure Document lfair May 23, 2023 | 6:41PM Franchise Fundamentals: Taking a deep dive into the Franchise Disclosure Document By Lesley Fair Love at first sight may (or may not) be a real thing, but when it comes to investing your money, it’s unwise to fall for a franchise without first subjecting it to tough-minded scrutiny. The third in the FTC’s Franchise Fundamentals blog series walks through an essential part of that evaluation: an in-depth review of the Financial Disclosure Document (FDD) required by the FTC’s Franchise Rule . You must receive the Franchise Disclosure Document at least 14 days before you’re asked to sign any contract or pay any money to the franchisor or one of its affiliates. In fact, you have the right to the FDD once the franchisor has received your application and agrees to consider it. So speak up if you don’t receive it and ask questions – lots of them – as you review the FDD and any attached documents.   Image Indeed, the franchisor’s conduct regarding the FDD may raise some red flags about how they do business. Providing the FDD doesn’t establish that a franchisor is reputable – it’s required by law, after all – but if a franchisor doesn’t promptly provide this mandatory document, gives you an incomplete FDD, evades your probing questions, or tries to rush you through the process, it doesn’t speak well of their approach to legal compliance.  Assuming you have the FDD in hand, let’s consider some of the 23 required items line by line. Here are things to look for as you review the FDD. Franchisor’s Background (FDD Item 1) Item 1 provides background information about the franchisor and any parent companies, predecessors, and affiliates, including how long the franchise has been in business. It also lets you know if there are any legal requirements unique to the franchised business, like the need to get a special license or permit. This can help you understand the costs and risks you would be taking on. Business Background (FDD Item 2) Remember the old adage “People are known by the company they keep”? Well, companies are known by the people they keep, which is why Item 2 identifies directors, principal officers, and other key executives. Pay attention to their business backgrounds, their experience in managing a franchise system, and how long they’ve been with the franchisor. Litigation History (FDD Item 3) Item 3 lists information about prior litigation, including whether the franchisor or any of its executive officers have been convicted of certain crimes or have been found liable – or settled lawsuits – related to the franchise relationship. Lawsuits against the franchisor could mean it hasn’t honored its agreements or that franchisees are dissatisfied with its performance. Item 3 also says whether the franchisor has sued any of its franchisees in the past year. That information could suggest problems in the franchise system. For example, if a franchisor sued franchisees for failing to pay royalties, was it because franchisees weren’t successful and couldn’t make their royalty payments? Bankruptcy (FDD Item 4) Have the franchisor, its affiliates, or any of its executives filed for bankruptcy? Item 4 discloses that information and could give you insights into the financial condition of the business.  Initial and Other Fees (FDD Items 5-7) Items 5-7 go over some of the costs involved in starting and operating a franchise. That could include things like deposits or franchise fees (some of which may be non-refundable); what you’ll have to pay for initial inventory, signs, equipment, leases, or rentals; and ongoing costs, like royalties and advertising fees. A Consumer’s Guide to Buying a Franchise suggests more than a dozen other areas of financial inquiry, which should give you an indication about the importance of both getting in touch with your inner bean"},{"titre":"Keep FCRA in the foreground when the subject is background screening","url":"https://www.ftc.gov/business-guidance/blog/2014/04/keep-fcra-foreground-when-subject-background-screening","pubDate":"Mon, 05 Oct 2026 14:07:46 +0200","source":"FTC USA Business Blog Posts","description":"Keep FCRA in the foreground when the subject is background screening chundycz April 9, 2014 | 12:13AM Keep FCRA in the foreground when the subject is background screening By Lesley Fair When the talk turns to Big Data, part of the conversation is about all the public information available about people's lives – and how companies market it to prospective employers, landlords, etc.  Two cases just announced by the FTC  serve as a cautionary reminder to members of the industry that what they do may be subject to the long-standing consumer protections of the  Fair Credit Reporting Act (FCRA) .  InfoTrack, an Illinois company, and San Diego-based Instant Checkmate will be paying civil penalties to settle FTC lawsuits that they violated the FCRA.  Is it time for an FCRA refresher at your business? Instant Checkmate marketed its reports as a way for prospective employers and landlords to investigate applicants.  For example, the company advertised that one of the “GOOD REASONS to get instant criminal checks on anyone right now” was to “check out tenants before they rent.”  It also used a Google Ad Words campaign to make sure its site appeared when people searched for background checks on nannies, babysitters, maids, and housekeepers.  What kind of information would buyers get?  Current and previous addresses, birth certificates, arrest histories, and marriage and divorce records, to name just a few examples. InfoTrack offered similar services to employers nationwide, including background screening reports with people’s driving records, education and employment information, criminal histories, and even records from sex offender registries. How does the FCRA come in?  The law defines a “consumer report” as a “communication of any information” by a consumer reporting agency (CRA) that bears on a person’s “credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living” which is used (or expected to be used) as a factor in establishing their eligibility for credit, insurance, employment, or other reasons outlined in the law. According to the FTC, what Instant Checkmate and InfoTrack were doing triggered the FCRA.  For example, companies covered by the law must follow procedures to assure their reports are as accurate as possible, must take steps to see that those using their reports have permissible purposes for accessing them, and must provide required User Notices explaining key protections for consumers.  The law imposes special requirements when CRAs provide reports containing public record information that could have an adverse effect on a person’s ability to get a job.  In that case, the CRA must either: 1) notify the consumer that it’s reporting the information in the public record; or 2) maintain “strict procedures” – that’s the language in the law – designed to ensure the reported public information is complete and up to date. You’ll want to read the complaints for specifics of where the FTC says the companies fell short, but one example cited in the lawsuit against InfoTrack offers an object lesson on why FCRA protections are so important to consumers – and how the consequences can be devastating when companies don’t live up to the law.  According to the FTC, the reports InfoTrack provided to prospective employers included information about whether a job applicant was on the National Sex Offender Registry.  The employer would provide the first and last name and the date of birth to help InfoTrack with its search.  The problem was that before the fall of 2011, no date of birth was available for many names on the Registry.  If InfoTrack’s search found more than one person with the same first and last name, it reported a “possible match” to employers and gave them reports that included several different people with the","id":3198181},{"pubDate":"Thu, 01 Oct 2026 08:21:30 +0200","url":"https://hal.science/hal-05733006v1","titre":"[hal-05733006] The Council of Europe Framework Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law: a unique tool for cross-border regulatory interoperability","id":3189681,"description":"The Framework Convention on AI builds on international human rights law to establish a legal instrument aimed at ensuring respect for fundamental rights and principles recognised by States in the context of the development and use of AI. It is therefore in line with international and European ethical frameworks on AI. At the same time, it is a unique text, the first multilateral treaty applicable to activities within the AI lifecycle. This raises questions about its contribution to the contemporary co-construction of global AI governance. To this end, this contribution offers a systematic and contextual legal analysis of the main provisions of the text, examining first the holistic scope of the Framework Convention on AI and secondly its high-level normative substance. The analysis shows that the Convention is the result of a global political compromise, which makes it a text with modest and uncertain legal scope, especially with regard to persons affected by AI. At the same time, the legal methodology it adopts, which is based on transnational normative interoperability rather than legal harmonisation, offers an interesting prospect for ‘soft’ global legal coherence in the protection of human rights, democracy and the rule of law in AI context. In particular, it could help to standardise at the international level the principle of risk and impact management of AI on fundamental rights and","source":"Annuaire français de droit international"},{"description":"Fighting Coronavirus scams: Taking stock chundycz May 8, 2020 | 9:01AM Fighting Coronavirus scams: Taking stock By Andrew Smith, Director, FTC Bureau of Consumer Protection Since the beginning of the COVID-19 crisis, the FTC has released dozens of warning letters against people trying to make an illegal buck off the Coronavirus. More than a month in, it seems like a good time to look back at what’s happened. If you follow this blog, you’ll know these have been busy weeks – with advice about spotting the many scams we’re all facing, news of the warning letters sent on a wide range of scams, and some enforcement actions filed. You might wonder: Why send letters? Why not just sue the !*$@&#? Fair question. But the letters are working. And, given the scope of the scams out there right now, we want to get the best and fastest results we can with the most efficient tool we have. Right now, for these Coronavirus-related issues, that’s warning letters. In general, here’s how it goes: We spot someone advertising something with no proof that it works – and, in many cases, telling outright lies about its wonders. We send a letter pointing out the illegal things they’re doing. They then have 48 hours to tell us what they’ve done to resolve the problems we’ve raised. In nearly all cases so far, those who get the letters have stopped making the false claims or selling the scammy thing – whether cures from a product or earnings from a work-at-home scheme. Within 48 hours: no more lying to people, no more stealing people’s money. During a crisis like this, we’ve prioritized stopping as many bad actors as we can, as quickly as we can. And when a warning letter will do that, we’ll take that win. Most of the letters sent so far relate to the first scams out of the box: the treatments and cures – many of which we heard about from you. These treatments and cures were, of course, not at all what they claimed to be. The sellers peddled everything from teas and essential oils to IV or ozone “therapies,” stem cell treatments, and high doses of Vitamin C. All of these products have had one thing in common: There was no evidence – none – that they work against the Coronavirus. The warning letters are working in other areas, too. We’ve sent 13 letters to VoIP service providers and other companies, telling them we see how they’re helping illegal telemarketers or robocallers make calls related to COVID-19, and telling them to cut it out. And, just two weeks ago, we sent 10 letters to multi-level marketing (MLM) companies for making exaggerated earnings claims for their business opportunity selling fake Coronavirus treatments or cures from home. These companies hit the daily double: false income claims for their work-at-home program and unsubstantiated health claims for their products. But sometimes you need more firepower to get the desired result. It took a lawsuit to stop a company that, allegedly, pretended to be affiliated with the Small Business Administration’s Paycheck Protection Program, fooling hundreds – if not thousands – of small businesses. And, last week, we filed suit against Whole Leaf Organics for allegedly claiming to treat not only the Coronavirus, but also cancer with CBD. Both cases are now pending. What we know about COVID-19 changes every week. And right now, the scammers are shifting their focus to the economic impact payments, among other things, to find new ways to get your money or information. But here are some things that remain true: Scammers are peddling cures and treatments with no proof they work. Remember: Right now, there is nothing that has been proven to prevent COVID-19. Anyone who tells you to pay them by gift card, money transfer, cash, or Bitcoin is a scammer. Period. And, if they say they’re from the government, they’re not. Never give your Social Security, bank account, or credit card number to anyone who contacts you. Again, not even if they say","id":3189429,"source":"FTC USA Business Blog Posts","titre":"Fighting Coronavirus scams: Taking stock","url":"https://www.ftc.gov/business-guidance/blog/2020/05/fighting-coronavirus-scams-taking-stock","pubDate":"Thu, 01 Oct 2026 08:11:56 +0200"},{"pubDate":"Thu, 03 Sep 2026 16:29:20 +0200","titre":"EU-OSHA moves to new headquarters in Bilbao’s BAT Tower in the presence of European Commission Executive Vice-President Roxana Mînzatu","url":"https://osha.europa.eu/en/about-eu-osha/press-room/eu-osha-moves-new-headquarters-bilbaos-bat-tower-presence-european-commission-executive-vice-president-roxana-minzatu","source":"OSHA","id":3132682,"description":"The European Agency for Safety and Health at Work (EU-OSHA) today inaugurated its new offices in the BAT (B Accelerator Tower), in a ceremony presided over by the European Commission Executive Vice-President for Social Rights and Skills, Quality Jobs and Preparedness, Roxana Mînzatu . Also taking part in the event were William Cockburn , Executive Director of EU-OSHA; Mikel Torres , Deputy First Minister and Minister of Economy, Labour and Employment of the Basque Government; Ainara Basurko , Provincial Councillor for Economic Promotion and First Deputy General; and Amaia Arregi , First Deputy Mayor and Counsellor for Security at the Bilbao City Council. During the inauguration, European Commission Executive Vice-President Roxana Mînzatu highlighted that EU-OSHA’s new headquarters in the BAT marks the beginning of a new chapter for the Agency, which has been based in Bilbao since 1996 and has become Europe’s reference point for occupational safety and health. She noted that the building symbolises values such as innovation, sustainability and openness to the future, which define both EU-OSHA and the European project. Mînzatu underlined that the rapid changes taking place in the world of work create opportunities but also new risks, and stressed the importance of prevention, evidence-based policies and cooperation among institutions, businesses, researchers and workers. She also highlighted EU-OSHA’s role in identifying emerging risks and promoting good practices, recalling that occupational safety and health should be viewed as an investment in people and in Europe’s competitiveness. The Executive Vice-President further stated that the Agency’s new headquarters reflect a competitive and socially responsible Europe, capable of combining innovation, economic growth and the protection of people. Finally, she thanked the European, Spanish, Basque and local authorities for their support and acknowledged the contribution of EU-OSHA staff to creating safer and healthier workplaces across Europe. View the photo"},{"titre":"Marking 10 years of the GDPR: the evolution of the European data protection landscape","url":"https://www.edpb.europa.eu/news/news/2026/marking-10-years-gdpr-evolution-european-data-protection-landscape_en","pubDate":"Mon, 27 Apr 2026 14:14:32 +0200","source":"EDPB News","description":"Brussels, 27 April – Today marks the 10th anniversary of the GDPR’s adoption, the first comprehensive data protection framework spanning an entire continent, establishing clear rights for individuals and obligations for organisations across Europe. The moment that led to the creation of the EDPB The GDPR led to the establishment of the European Data Protection Board (EDPB) on 25 May 2018, replacing the Article 29 Working Party that was previously in charge of dealing with issues relating to the protection of personal data. The GDPR gave the Data Protection Authorities (DPAs) stronger enforcement powers and expanded the scope of their work from focusing mainly on national compliance complaints to routinely dealing with cross-border cases. In the past 10 years, the 31 European DPAs comprising the EDPB have worked together to ensure the consistent enforcement of the GDPR and a harmonised data protection approach across Europe.   A key role in an evolving digital landscape Today, the GDPR is part of a broader and evolving European digital framework, alongside other digital laws such as the Digital Services Act, the Digital Markets Act, and the AI Act . In a world shaped by artificial intelligence, platform economies, and increasing data-driven innovation, the GDPR ensures that technological progress goes hand in hand with the protection of individuals’ fundamental rights . An inspiration for the rest of the world The impact of the GDPR has extended far beyond Europe’s borders, inspiring similar frameworks across the globe and contributing to a growing international recognition of privacy as a fundamental right .   How the GDPR has shaped the data protection landscape: insights from Data Protection Authorities Have you ever wondered what the data protection landscape looked like before the GDPR and how DPAs prepared for its entry into force? How has life for Europeans changed since its adoption? Watch the video for insights and testimonies from Data Protection Authorities which contributed to the shaping of the data protection landscape in Europe.   Sorry, your browser doesn't support embedded","id":2850552},{"pubDate":"Thu, 16 Apr 2026 14:15:11 +0200","url":"https://www.edpb.europa.eu/news/news/2026/edpb-brings-clarity-data-processing-scientific-research-speeds-finalisation_en","titre":"EDPB brings clarity to data processing for scientific research, speeds up the finalisation of the anonymisation guidelines and approves first European data protection seal as a tool for transfers","id":2829942,"description":"Brussels, 16 April – During its latest plenary, the EDPB has adopted Guidelines on processing of personal data for scientific research purposes . In addition, the Board has created a team to speed up the finalisation of the guidelines on anonymisation. The EDPB has also adopted two opinions on the two sets of the Europrivacy certification criteria for approval as European Data Protection Seals, one of which to be used as a tool for transfers. Many areas of scientific research rely on the processing of individuals’ personal data, and this has driven significant scientific breakthroughs that benefit society. The rise of new technologies, such as artificial intelligence, also contributes to scientific progress by enabling researchers to use and analyse data in innovative ways. The main objective of the EDPB guidelines on scientific research is to provide more clarity for researchers and make GDPR compliance easier , while ensuring the protection of individuals’ fundamental rights . “Scientific research can drive societal progress and improve our daily lives.  Our guidelines facilitate innovative research by helping researchers to navigate the GDPR. The EDPB is committed to supporting the scientific community and unlocking the full potential of scientific research in the EU while upholding data protection rights.\" EDPB Chair, Anu Talus In its guidelines, the Board provides clarifications on the concept of ‘scientific research’ . To determine if the processing takes place for scientific research purposes in the meaning of the GDPR, the Board provides six key-indicative factors that should be considered, in addition to the nature, scope, context and purposes of processing. These are: 1) methodical and systematic approach, 2) adherence to ethical standard, 3) verifiability and transparency, 4) autonomy and independence, 5) objectives of the research, and 6) potential to contribute to existing scientific knowledge or apply existing knowledge in novel ways. If the research activities meet these six factors, they can be presumed to constitute scientific research. Otherwise, the controller should justify and be able to demonstrate why the activities should be considered scientific research, within the meaning of the GDPR. Further processing for scientific research purposes is presumed to be compatible with the initial purpose for collecting individuals’ personal data. Therefore, controllers are not obliged to do the purpose compatibility test under the GDPR to determine if the new processing is compatible with the original purpose of collection. However, controllers must still make sure that the legal basis of the initial processing is also suitable for the further processing of personal data for scientific research purposes. Controllers can rely on “broad consent” where the purposes of research are not fully known at the time of collecting the personal data. In this case, researchers should respect ethical standards for scientific research and put additional safeguards in place to compensate for the lack of purpose specification. Controllers can also ask individuals to consent to different individual research projects separately, as soon as the purposes of those projects become known (dynamic consent). A combination of both broad and dynamic consent is also possible. In addition, the EDPB clarifies rights of individuals when their personal data are processed for scientific purposes. This includes the rights to erasure and object for which limitations may apply when personal data are processed for scientific research purposes. The Board provides examples to explain when the right to erasure can be considered likely to render impossible or seriously impair the objective of conducting scientific research. The EDPB also explains when controllers may reject an individuals’ objection to the processing of their personal data for scientific research purposes. This can be the case when processing is necessary for the performance of a task carried out for reasons of","source":"EDPB News"},{"pubDate":"Thu, 09 Apr 2026 14:14:02 +0200","url":"https://www.edpb.europa.eu/news/news/2026/edpb-annual-report-2025-supporting-stakeholders-through-guidance-and-dialogue_en","titre":"EDPB annual report 2025: supporting stakeholders through guidance and dialogue","id":2816021,"description":"Brussels, 09 April - The European Data Protection Board (EDPB) has published its  2025 Annual Report . The report provides an overview of the EDPB work carried out in 2025 and reflects on important milestones, such as the adoption of the  Helsinki Statement on Enhanced Clarity, Support, and Engagement . “In 2025, we saw the data protection landscape change significantly. The rapid expansion of the EU’s digital regulatory framework has added complexity to the data protection ecosystem. To help organisations navigate this complexity and support compliance, the EDPB focused on enhancing legal certainty, making compliance more achievable in practice, and strengthening cooperation, both among Data Protection Authorities and with other regulators.  We also prioritised meaningful dialogue with stakeholders to ensure our work reflected real-world needs. Our achievements support economic growth while continuing to protect individuals’ fundamental rights to privacy and data protection.” EDPB Chair, Anu Talus   The Helsinki’s statement initiatives leading the way In 2025, the EDPB worked actively to address the demand for regulatory simplification to support innovation and economic growth, while ensuring the protection of individuals’ personal data.  With this in mind, the Board adopted the  Helsinki Statement on Enhanced Clarity, Support, and Engagement , which outlines new initiatives to  make GDPR compliance easier, strengthen consistency, enhance the dialogue and improve transparency with stakeholders and boost cross-regulatory cooperation .   For example, the Board launched a public consultation to ask organisations which templates would be most useful, organised several stakeholder events to consult organisations on upcoming guidelines and systematically published reports on stakeholder input.    Easing compliance for organisations and providing legal advice In the context of ongoing discussions on regulatory simplification at EU level, the EDPB actively contributed to legislative initiatives aimed at reducing administrative burden and streamlining requirements. The Board adopted a  joint opinion with the European Data Protection Supervisor (EDPS) on the Commission’s Proposal for a Regulation amending certain regulations, including the GDPR.  In addition, the Board held important discussions on this matter during plenary meetings, which subsequently informed the  EPDB/EDPS joint opinions on the Commission’s proposals on the  Digital Omnibus and on the  Digital Omnibus on AI adopted at the beginning of 2026. The Board also delivered five adequacy-related opinions concerning United Kingdom, Brazil and the European Patent Organisation (EPO).  In addition, the Board adopted  Recommendations on the legal basis for requiring the creation of user accounts on e-commerce websites , and  Recommendations on the 2027 WADA World Anti-Doping Code  upon request from the Commission.   Strengthening cross-regulatory cooperation Cross-regulatory cooperation was a key focus for the EDPB last year. The EDPB worked together with the European Commission to clarify how data protection and digital laws interact and to address legal and practical challenges in cross-sectoral cases. In 2025, the EDPB adopted its first set of  joint guidelines with the Commission on the interplay between the Digital Markets Act (DMA) and the GDPR . The Board also worked with the Commission on joint guidelines on the interplay between the AI act and EU data protection laws for adoption in 2026.  In addition, the EDPB adopted  guidelines on the interplay between the Digital Services Act (DSA) and the GDPR .   Placing stakeholders at the heart of the EDPB work In 2025, a public consultation was launched on the  joint guidelines with the Commission on the DMA and the GDPR . The Board has also organised public consultations on the EDPB guidelines on  DSA and GDPR","source":"EDPB News"},{"description":"BEREC Provides Early Assessment of the Digital Networks Act, Welcoming Ambition While Highlighting Areas for Improvement yannick.stephan Mon, 30/03/2026 - 12:57 Press Releases The Body of European Regulators for Electronic Communications (BEREC) today published its early assessment of the European Commission’s proposal for a Digital Networks Act (DNA). BEREC welcomes the overarching ambition to modernise the regulatory framework for Europe’s connectivity sector and to support resilient, sustainable and high quality digital networks. At the same time, BEREC identifies important areas where further refinement is needed to ensure that the DNA strengthens, rather than complicates, Europe’s internal market for electronic communications. BEREC stands ready to provide its regulatory expertise in order to avoid undue complexity or uncertainty and to ensure that the final framework delivers a competitive, connected and resilient digital Europe. BEREC welcomes the updated objectives introduced by the DNA , including resilience, sustainability, in addition to the existing objectives addressed by the European Electronic Communications Code. While BEREC supports the ambition to strengthen the competitiveness of the EU digital sector, it highlights that this can only be achieved through an effective and robust competition framework. It further notes that the proposal introduces elements of greater centralisation that require further clarification to ensure they contribute effectively to a well functioning internal market. While BEREC recognises the Commission’s intention to streamline the General Authorisation procedures, the proposed Single Passport mechanism raises concerns from several perspectives. In particular, by concentrating significant enforcement responsibilities in the Member State of first notification, the system risks forum shopping, uneven supervisory burdens and slower enforcement. Overall, BEREC considers that the proposal could introduce greater operational complexity, administrative burden and legal uncertainty, without offering clear benefits over the current straightforward authorisation regime. BEREC also notes that the DNA proposes major changes to spectrum management , including treating spectrum as an EU‑level resource and introducing common rules for fees, long‑duration rights and satellite authorisation. While these measures aim at harmonisation, BEREC warns that the proposed single market procedure, which includes a Commission veto, signifies a notable trend towards centralisation and raises certain concerns. BEREC also cautions that some proposals in particular the introduction of unlimited license duration and automatic renewals, risk favouring existing rights holders and reducing market contestability. On the other hand, it welcomes it proposed role in the market shaping aspects of spectrum assignment. On satellite authorisation, BEREC supports EU coordination but stresses the need for alignment with ITU‑R rules. The DNA’s move to treat numbering resources as a common Union asset introduces a more centralised approach, and while BEREC sees potential benefits in greater harmonisation, it notes that key concepts—such as an EU wide numbering plan and pan European numbering ranges—require further clarification. BEREC also considers that additional analysis of demand, use cases and operational impacts would help ensure that any new framework is aligned with the needs of end users, operators and regulators. BEREC welcomes the preservation of the Significant Market Power regime, a cornerstone of the EU regulatory model, alongside the continued availability of symmetric access tools . Nonetheless, several DNA proposals, including new sequencing rules for remedies, the potential removal of the Recommendation on Relevant Markets, and expanded Commission veto powers could reduce the ability of NRAs to address national market needs. BEREC supports the goal of enabling a smooth transition from copper to fibre networks and recognises improvements made to","id":2793006,"source":"BEREC Office","url":"https://www.berec.europa.eu/en/news/press-releases/berec-provides-early-assessment-of-the-digital-networks-act-welcoming-ambition-while-highlighting-areas-for-improvement","titre":"BEREC Provides Early Assessment of the Digital Networks Act, Welcoming Ambition While Highlighting Areas for Improvement","pubDate":"Mon, 30 Mar 2026 19:33:01 +0200"},{"pubDate":"Wed, 18 Feb 2026 15:27:14 +0100","titre":"EDPB identifies challenges hindering the full implementation of the right to erasure","url":"https://www.edpb.europa.eu/news/news/2026/edpb-identifies-challenges-hindering-full-implementation-right-erasure_en","id":2703238,"description":"Brussels, 18 February - The European Data Protection Board (EDPB) has adopted a  report on its Coordinated Enforcement Framework (CEF) action on the right to be forgotten (Art.17 GDPR) .  The  Board selected this topic  as it is one of the most frequently exercised GDPR rights and one about which DPAs frequently receive complaints from individuals. The main objectives of this coordinated action are to ensure that the right to erasure is effectively exercised by individuals in Europe and understand how controllers comply with this right in practice. In addition, the EDPB identified good practices and the most important related challenges, with the aim of providing further guidance on this topic.  Throughout 2025, 32 DPAs across Europe took part in this initiative. More specifically, 9 DPAs have initiated new formal investigations or have continued ongoing ones, and 23 DPAs carried out a fact-finding exercise. A total of 764 controllers across Europe responded to the action, ranging from small and medium-sized enterprises (SMEs) to big companies active in many different industries and fields, as well as various types of public entities. The results of these national actions have been aggregated and analysed together allowing for targeted follow-up on both national and EU level.   Areas of improvement and main challenges The report lists the issues that were identified, along with a series of recommendations addressed to controllers, to help them implement the right to erasure. Seven recurring main challenges were identified by DPAs. The results confirmed some of the findings of the 2024 coordinated action on the right of access , for example when it comes to the lack of appropriate internal procedures to handle requests, or the lack of sufficient information provided to individuals. In addition, participating DPAs reported specific findings related to the reliance by some controllers on inefficient anonymisation techniques to handle erasure requests as an alternative to deletion. DPAs also noted inconsistent practices, and the difficulties faced by controllers regarding the determination of retention periods and the deletion of personal data in the context of back-ups. In addition, as the right to erasure is not an absolute right, some controllers face difficulties in assessing and applying the conditions for the exercise of this right, including in carrying out the different balancing tests between the right to erasure and other rights and freedoms.   Follow-up to help organisations comply  Extensive guidance, documents and templates exist at national level to help controllers comply with the right of erasure and help individuals exercise this right. In line with the Helsinki Statement’s objectives of making GDPR compliance easier and ensuring consistent interpretation and enforcement across Europe, the extensive guidance and templates already available at national level will be leveraged at EDPB level where appropriate.   Background and next steps The CEF is a key action of the EDPB under its 2024-2027 Strategy , aimed at streamlining enforcement and cooperation among DPAs.  In 2023, the EDPB published the report on its first coordinated action on the  use of cloud-based services by the public sector . In 2024, the EDPB also published the report on the outcome of the second coordinated action on the  designation and position of Data Protection Officers . In 2025, the EDPB issued the report on its third coordination action on the  implementation of the right of access . The CEF 2026 action will be on the  obligations of transparency and information under the GDPR .   For further information: DA DPA:   EDPB vedtager rapport om dataansvarliges overholdelse af retten til sletning EL DPA: Ολοκλήρωση της συντονισμένης δράσης του","source":"EDPB News"},{"id":2425502,"description":"Brussels, 09 October - The European Data Protection Board (EDPB) and the European Commission endorsed joint guidelines on the interplay between the Digital Markets Act (DMA) and the General Data Protection Regulation (GDPR) . These are the first joint guidelines by the Board and the European Commission. In line with its 2024-2027 Strategy and the recent Helsinki Statement’s objectives to make GDPR compliance easier and strengthen consistency, the EDPB has cooperated with the European Commission, each within their respective mandates, to facilitate the coherent application of the DMA*and GDPR and to increase legal certainty for gatekeepers, business users, beneficiaries and individuals. EDPB Chair Anu Talus said:   “These joint guidelines are the result of a fruitful cooperation between the EDPB and the European Commission. This is the first time that the EDPB and the European Commission prepare guidelines jointly. This approach maximises usefulness of the guidance by simplifying compliance for businesses and bringing enhanced legal certainty to them.  The guidelines will help gatekeepers, business users and individuals to better understand their obligations and rights under the DMA, and ensure a consistent, effective and complementary application of the DMA and EU data protection law.” How the DMA and the GDPR interact The DMA and the GDPR both protect individuals in the digital landscape , but their goals are complementary as they address interconnected challenges: individual rights and privacy in case of the GDPR and fairness and contestability of digital markets under the DMA.    Several activities regulated by the DMA entail the processing of personal data by gatekeepers and, in several provisions, the DMA explicitly refers to definitions and concepts included in the GDPR. The joint guidelines clarify how gatekeepers can implement these DMA provisions in accordance with EU data protection law . For example, the EDPB and the Commission specify which elements gatekeepers should consider in order to comply with the requirements of specific choice and valid consent under Art. 5(2) DMA and the GDPR, and thus to lawfully combine or cross-use personal data in core platform services. The EDPB and the Commission also address other provisions including those related to the distribution of third party apps and stores, data portability, data access requests and interoperability of messaging services.   Next steps The Board and the Commission have just launched a joint public consultation on the first version of the guidelines which will be open until 4 December 2025 .  This will be an opportunity for stakeholders to comment and provide feedback. All submissions will be published on the DMA website to which a link will be included on the EDPB website, after the consultation period has closed. The final text, incorporating input received during the consultation, will be prepared jointly by the Board and the Commission, and will be adopted by the EDPB and European Commission.   More guidelines on the way Following these first joint guidelines with the Commission, further work is underway to clarify the new cross-regulatory landscape and maintain coherent and consistent safeguards for the protection of personal data. In this regard, the EDPB is working with the Commission, specifically with the AI Office, on joint guidelines on the interplay between the AI Act and EU data protection laws. Note to editors: The Digital Markets Act is one of the first regulatory tools that aims to tackle unfair practices of gatekeepers in digital markets. Gatekeepers are large digital platforms providing core platform services, such as online search engines, app stores, and messenger services. The main objective of the DMA is to make the markets in the digital sector fairer and more contestable. ","source":"EDPB News","pubDate":"Thu, 09 Oct 2025 15:53:21 +0200","titre":"DMA and GDPR: EDPB and European Commission endorse joint guidelines to clarify common touchpoints","url":"https://www.edpb.europa.eu/news/news/2025/dma-and-gdpr-edpb-and-european-commission-endorse-joint-guidelines-clarify-common_en"},{"source":"EDPB News","description":"Brussels, 12 September - During its September plenary meeting, the European Data Protection Board (EDPB) has adopted guidelines on the interplay between the Digital Services Act (DSA) and the General Data Protection Regulation (GDPR) . These are the first set of EDPB guidelines on the interplay between the GDPR and the EU’s recently adopted digital laws. The DSA aims to complement the rules of the GDPR to ensure the highest level of protection of fundamental rights in the digital space. Its main goal is to create a safer online environment in which the fundamental rights of all users, including the right to freedom of expression, are protected. It applies to online intermediary services , such as search engines and platforms. Several provisions included in the DSA entail the processing of personal data by intermediary service providers. The EDPB guidelines contribute to the consistent application of the DSA and of the GDPR, insofar as some provisions of the DSA concern the processing of personal data by intermediary service providers and include references to GDPR concepts and definitions. While it is up to the competent authorities under the DSA - with the support of the European Board for Digital Services and EU courts - to interpret the DSA, there are a number of provisions which relate to the GDPR. These include: notice-and-action systems that help individuals or entities report illegal content recommender systems used by online platforms to automatically present specific content to the users of the platform with a certain relative order or prominence the provisions to ensure a high level of privacy, safety, and security of minors and prohibiting that profile-based advertising using their data is presented to them transparency of advertising by online platforms prohibition of profiling-based advertising using special categories of data  The EDPB guidelines help to understand how the GDPR should be applied in the context of DSA obligations. The EDPB also provides practical guidance relating to the cross-regulatory cooperation between authorities to coordinate enforcement which will provide more legal certainty for intermediary service providers and ultimately to protect the rights and freedoms of individuals. The guidelines will be subject to public consultation, providing stakeholders with the opportunity to comment and provide feedback. EDPB Chair Anu Talus said: “By clarifying the interplay between the DSA and the GDPR, these guidelines mark a significant step towards ensuring a coherent and effective EU digital rulebook, and they will help uphold the fundamental rights and freedoms of individuals. I hope that stakeholders, including the competent authorities under the DSA, will make the most of the opportunity to contribute to the public consultation\". More work in the pipeline Following these first guidelines on the interplay between the GDPR and the DSA, further work is underway with other regulators to clarify the new cross-regulatory landscape and maintain coherent and consistent safeguards for the protection of personal data. In this regard, the EDPB is working on joint guidelines with the European Commission on the interplay between the Digital Markets Act (DMA) and the GDPR, as well as on joint guidelines on the interplay between the AI Act and EU data protection laws.","id":2368407,"url":"https://www.edpb.europa.eu/news/news/2025/interplay-between-dsa-and-gdpr-edpb-adopts-guidelines_en","titre":"Interplay between the DSA and the GDPR: EDPB adopts guidelines","pubDate":"Fri, 12 Sep 2025 15:51:31 +0200"},{"source":"EDPB News","description":"Brussels, 06 May - During its latest plenary, the European Data Protection Board (EDPB) adopted an opinion on the European Commission’s draft adequacy decision under the GDPR concerning the European Patent Organisation (EPO) . In addition, the Board adopted an opinion on the European Commission’s proposal to extend the validity of the UK adequacy decisions under the GDPR and the Law Enforcement Directive (LED) . Finally, the EDPB agreed to grant the status of observer to the Personal Data Protection Agency of Bosnia and Herzegovina.   Adequate protection of personal data by the EPO At the European Commission’s request, the Board adopted an opinion on the Commission’s draft adequacy decision regarding the European Patent Organisation (EPO). Once formally adopted by the Commission, this will be the first adequacy decision concerning an international organisation and not a country or a region. An adequacy decision is a key-mechanism in EU data protection legislation which allows the European Commission to determine whether a third country or an international organisation offers an adequate level of data protection. The effect of such a decision is that personal data can flow freely from Europe to that third country or international organisation. EDPB Chair, Anu Talus, said: “The EDPB welcomes the Commission’s initiative to work on the first adequacy decision concerning an international organisation. This decision shows how the legal framework of such organisations can be recognised as ensuring an adequate level of protection on the basis of Art.45 GDPR. The EDPB underlines the importance of ongoing dialogue between the Commission and international organisations, with a view to developing this category of adequacy decisions in addition to those relating to third countries.” In its opinion, the Board positively notes that the EPO data protection framework is largely aligned with the European Union data protection framework, including on data protection rights and principles. This shows that the GDPR and, in particular, its transfer provisions, can facilitate safe data flows from Europe to international organisations, while taking into account their status.   Six-month extension of the UK adequacy decisions The EDPB opinion, requested by the European Commission, addresses the proposed extension of the two UK adequacy decisions under the GDPR and the LED, which are set to expire on 27 June 2025. The opinion only concerns the proposed 6-month extension of these adequacy decisions and does not address the level of protection for personal data afforded in the UK, which will be examined by the EDPB following the Commission’s assessment, and if the renewal of the UK adequacy decisions is proposed. Since the UK‘s data protection reform is still pending in the UK parliament, the EDPB recognises the need for a technical and time-limited extension of the adequacy decisions until 27 December 2025.This will give the European Commission sufficient time to evaluate the updated UK legal framework once it has been adopted.   The EDPB stresses that this extension is exceptional and is due to the ongoing legislative developments in the UK. It should not, in principle, be further prolonged. The Board recalls the validity of its opinions 14/2021 and 15/2021 on the two UK adequacy decisions, adopted in April 2021, and invites the European Commission to take them into account in its future assessments.  The Board also recalls the Commission’s obligation to monitor all relevant developments in the UK during the extension period.   New observer to the EDPB’s activities Finally, EDPB members agreed to grant observer status to the EDPB’s activities to the Bosnia and Herzegovina Data Protection Authority, in line with Art. 8 EDPB Rules of Procedure .","id":2099053,"titre":"European Patent Organisation and extension of adequacy decisions for the UK: EDPB adopts opinions","url":"https://www.edpb.europa.eu/news/news/2025/european-patent-organisation-and-extension-adequacy-decisions-uk-edpb-adopts_en","pubDate":"Tue, 06 May 2025 15:51:59 +0200"},{"pubDate":"Wed, 18 Dec 2024 15:47:16 +0100","url":"https://www.edpb.europa.eu/news/news/2024/edpb-opinion-ai-models-gdpr-principles-support-responsible-ai_en","titre":"EDPB opinion on AI models: GDPR principles support responsible AI","source":"EDPB News","id":1792119,"description":"Brussels, 18 December - The European Data Protection Board (EDPB) has adopted an opinion* on the use of personal data for the development and deployment of AI models . This opinion looks at 1) when and how AI models can be considered anonymous, 2) whether and how legitimate interest can be used as a legal basis for developing or using AI models, and 3) what happens if an AI model is developed using personal data that was processed unlawfully. It also considers the use of first and third party data. The opinion was requested by the Irish Data Protection Authority (DPA) with a view to seeking Europe-wide regulatory harmonisation. To gather input for this opinion, which deals with fast-moving technologies that have an important impact on society, the EDPB organised a stakeholders’ event and had an exchange with the EU AI Office. EDPB Chair Talus said: “AI technologies may bring many opportunities and benefits to different industries and areas of life. We need to ensure these innovations are done ethically, safely, and in a way that benefits everyone. The EDPB wants to support responsible AI innovation by ensuring personal data are protected and in full respect of the General Data Protection Regulation (GDPR).” Regarding anonymity , the opinion says that whether an AI model is anonymous should be assessed  on a case by case basis by the DPAs. For a model to be anonymous, it should be very unlikely (1) to directly or indirectly identify individuals whose data was used to create the model, and (2) to extract such personal data from the model through queries. The opinion provides a non-prescriptive and non-exhaustive list of methods to demonstrate anonymity. With respect to legitimate interest , the opinion provides general considerations that DPAs should take into account when they assess if legitimate interest is an appropriate legal basis for processing personal data for the development and the deployment of AI models. A three-step test helps assess the use of legitimate interest as a legal basis. The EDPB gives the examples of a conversational agent to assist users, and the use of AI to improve cybersecurity. These services can be beneficial for individuals and can rely on legitimate interest as a legal basis, but only if the processing is shown to be strictly necessary and the balancing of rights is respected. The opinion also includes a number of criteria to help DPAs assess if individuals may reasonably expect certain uses of their personal data. These criteria include: whether or not the personal data was publicly available, the nature of the relationship between the individual and the controller, the nature of the service, the context in which the personal data was collected, the source from which the data was collected, the potential further uses of the model, and whether individuals are actually aware that their personal data is online. If the balancing test shows that the processing should not take place because of the negative impact on individuals, mitigating measures may limit this negative impact. The opinion includes a non-exhaustive list of examples of such mitigating measures, which can be technical in nature, or make it easier for individuals to exercise their rights or increase transparency. Finally, when an AI model was developed with unlawfully processed personal data, this could have an impact on the lawfulness of its deployment, unless the model has been duly anonymised. Considering the scope of the request from the Irish DPA, the vast diversity of AI models and their rapid evolution, the opinion aims to give guidance on various elements that can be used for conducting a case by case analysis. In addition, the EDPB is currently developing guidelines covering more specific questions, such as web scraping. Note to editors: *An Article 64(2) opinion addresses a matter of general application or produces effects in more than one Member"}]