October Data Protection Newsletter

We are here to share clear and practical insights on the latest developments in data protection, AI, and tech regulation, helping you stay informed and compliant in this ever-changing digital landscape.

Whether you manage compliance or simply want to stay safer and better informed online, this newsletter is for you.

As always, our Data Protection Team is here to help. If you would like tailored advice or to discuss a specific issue, please contact us using the details at the end of this page.

CNIL closes its injunction against Google

On 23 September 2026, the restricted committee of the French data protection authority (CNIL) closed the injunction it had issued against Google LLC and Google Ireland Limited on 1 September 2025, finding that both companies had complied within the required deadline.

🧩Key takeaway

In September 2025, alongside a €325 million fine, the CNIL ordered Google to fix two issues within six months, under a penalty of €100,000 per day of delay. Google has now done so:

• Cookies when creating a Google account: users in France had to be clearly told that creating a Google account necessarily involves advertising cookies. Google added information to the sign-up path explaining that the account depends on accepting advertising cookies, in exchange for the service being free.
• Ads in Gmail: Google had to obtain users' consent before showing ads that look like emails among users' private messages. Instead, Google changed the ad format so that ads are now clearly different from real emails. As a result, consent is no longer required under the French rules on electronic marketing.

In the decision, the CNIL said a cookie wall is not unlawful in itself, but only if several conditions are met:

1. Justification: it must preserve the economic balance between offering the service and its cost. Here, Gmail is free and funded by advertising.
2. Free consent: refusing must not harm the user, and there should be a real alternative. Here, the generic-ads option played that role, and refusing personalised ads had to be as easy as accepting them.
3. Informed consent: users must clearly understand that the free service depends on accepting advertising cookies. This was the point of the injunction, and Google has now fixed it.

The CNIL stresses that the closure only covers the points in its 2025 order. It does not confirm that Google's whole account creation path complies with the French cookie rules (Article 82 of the French Data Protection Act), in particular the clarity of the information and screens shown to users. The CNIL may investigate again in the future.

❔Why is it important?

The decision shows that injunctions backed by daily penalty payments are an effective tool for regulators to force concrete changes, beyond the fine itself.

It also gives organisations two practical lessons. First, if access to a free service depends on advertising cookies, users must be told this clearly before signing up. Second, ads shown inside an inbox either need users' consent or must be designed so they cannot be mistaken for real emails. Organisations should check their sign-up flows and advertising formats against both points.

Italian “Garante” fines company for failing to respond to an employee’s data access requests during dismissal proceedings

On 6 August 2026, the Italian data protection authority (Garante) fined security company La Patria S.p.A. (the Company) €39,000 for failing to properly respond to a former employee’s requests to access personal data relating to disciplinary proceedings that led to his dismissal, and for providing inadequate and inaccurate employee privacy information.

🧩Key takeaway

The case concerned a former employee who requested access to documents relating to disciplinary proceedings against him, including GPS location data collected through a company vehicle assigned to him. The proceedings ultimately led to his dismissal.

The Garante identified three main issues regarding the company:

• Failure to respond to data access requests: the employee asked twice for copies of the documents used against him during his disciplinary proceedings. He did not mention the GDPR, so the company treated these as employment law requests and never replied. The Garante clarified that a request does not need to refer to the GDPR to count as an exercise of the right of access, even when it is made under employment law procedures. Where a request is refused, the controller must explain its reasons and inform the individual of the right to lodge a complaint or seek a judicial remedy.
• Insufficient information about GPS tracking: The company did not provide adequate information about location data collected through GPS devices installed in company vehicles. Such data qualify as personal data where the vehicle’s location can be linked, directly or indirectly, to the employee driving it.
• Inaccurate employee privacy notice: The company’s notice referred to special categories of personal data, including information about philosophical beliefs and sex life, despite the company not processing such data. The Garante found that a privacy notice must describe only the processing that actually happens, and that processing must itself be lawful. Listing data “just in case” makes a notice inaccurate, not more transparent.

❔Why is it important?

This case highlights the importance of transparency towards employees for EU organisations. On the one hand, organisations should not overlook employees’ right to access their personal data, including in the context of disciplinary or dismissal proceedings. On the other hand, routine employee privacy notices must provide complete and accurate information about how employees’ personal data are processed and remain consistent with the organisation’s actual processing activities.

Digital Omnibus: EU Council Agrees Its Position

On 21 October 2026, the Council of the European Union (EU) agreed its position on the proposed changes to the General Data Protection Regulation (GDPR), ePrivacy Directive, and other EU digital legislations put forward by the European Commission (Digital Omnibus).

🧩Key takeaway

The Council's position is its negotiating mandate under the ordinary legislative procedure. It is not the final law: the European Parliament must first adopt its own position, after which the two institutions negotiate and formally adopt the final text. 

The main changes agreed by the Council are:

• Clarification of personal data and pseudonymisation: the current definition of personal data is kept, with a new provision clarifying when pseudonymised data allows a person to be identified.
• Simplified GDPR compliance obligations: easier handling of unfounded or excessive data subject requests, exemptions from information obligations in specific low-risk cases, a longer deadline for notifying personal data breaches, and a single EU-level list of high-risk processing with common templates.
• AI and sensitive data: the lawful basis for using personal data to develop and operate AI systems is clarified, and safeguards are added to the new exception allowing sensitive data to be processed for biometric verification and AI.
• Fewer cookie consent requirements: cookie rules stay in the ePrivacy Directive, but consent will no longer be required for some purposes, such as providing the requested service, audience measurement or device security. This should lead to simpler cookie banners and a smoother online experience for customers.

❔Why is it important?

Negotiations with the European Parliament will start once Parliament adopts its position. The EU aims to conclude all simplification packages by the end of 2027.

Until the final text is adopted by both the European Parliament and the Council and published in the Official Journal of the EU, the current GDPR and ePrivacy rules continue to apply in full, including the 72-hour breach notification deadline.

However, the Council's position gives an early signal of where the reform is heading: less paperwork, simplified cookie banners and more legal certainty for AI projects, without narrowing the scope of personal data. Organisations can use this time to identify the procedures that would be affected, while planning AI Act compliance around the new deadlines.

Digital Omnibus:  NOYB calls the Council's AI provision a “digital expropriation”

On 22 October 2026, the privacy organisation NOYB, led by Max Schrems, has published an article raising strong concerns about the Council's position on the Digital Omnibus, focusing on a new GDPR rule on the use of personal data for artificial intelligence (AI).

🧩Key takeaway

NOYB's criticism centres on new Article 88bis GDPR (Article 88c in the Commission proposal). It provides that using personal data to develop and operate AI systems or models can rely on the company's legitimate interest, instead of people's consent.

NOYB has raised the main following issues: 

• Very broad scope: NOYB argues that the rule covers a whole technology rather than a specific purpose. In its view, almost any processing “in the context of AI” could become lawful, including data collected years ago and data of people who were never customers of the AI company.
• Weak safeguards: the Council added references to the right to object and to companies' accountability duties. NOYB says these already apply to all processing and therefore add no real protection.
• Who benefits: NOYB argues that large AI providers holding vast amounts of data would gain the most, while smaller EU companies could lose out.
• Apart from the Al related concern, NOYB also warns that the new rules on the pseudonymised data could in practice narrow the GDPR's scope, for example for user IDs, tracking IDs or IP addresses. 
• NOYB sees the European Parliament, whose position is still being prepared, as the next battleground, and suggests the final law could be challenged before the Court of Justice of the EU.

❔Why is it important?

Article 88bis is one of the most debated parts of the reform and may still change in negotiations with the European Parliament.

For organisations, nothing changes yet: using personal data for AI training still requires a valid legal basis, a documented legitimate interest assessment where that basis is relied on, and respect for rights of individuals such as the right to object. Even if the provision is adopted, possible court challenges could create legal uncertainty, so organisations should keep documenting their AI-related processing carefully.

Contact

Need advice on Data Protection, AI, or Whistleblowing compliance?

Our Data Protection team is here to support you. Contact us today to discuss your needs and explore how we can assist you: Dara Kelly, Head of Advisory, or Pasquale Esposito, Data Protection Officer.