European digital regulation is becoming increasingly important for businesses – while its practical implementation remains challenging.

This is also reflected in a survey we conducted among businesses of different sizes and across a range of industries:
Respondents rated the strategic relevance of the regulatory requirements at an average of 8.2 out of 10. Their own level of knowledge stood at 5.9, while satisfaction with the regulatory framework was significantly lower at just 4.7.

A key priority is therefore to translate regulatory requirements into clear responsibilities, robust processes and appropriate contractual arrangements.

To provide practical guidance in this area, we have developed our “EU Digital Regulation: A Practical Guide”.

The guide provides a structured and practical overview of the key European regulatory frameworks, distinguishing in particular between requirements that apply to the business as a whole and those relating to specific products and services. For each regulatory framework, it provides a concise overview of:

• who is affected;

• the key compliance requirements; and

• the implications for contractual arrangements and internal processes.

Covering NIS2, DORA and the AI Act, as well as the Data Act, Cyber Resilience Act, Digital Services Act and MiCAR, the guide provides a practical introduction to an increasingly complex and interconnected European digital regulatory landscape.

Should you wish to explore individual topics in greater detail or assess the specific actions required for your business, we would be pleased to support you through workshops, roundtables, readiness assessments and compliance reviews.

For the Cyber Resilience Act in particular, we have developed a modular advisory offering that combines clearly defined scopes. The individual modules can be selected to suit each business’s specific needs, providing targeted support across the different stages of CRA implementation.

Please find the Tech Law Briefing by following this link.

Kind regards,

Your IP, Digital & Data Team of
ADVANT Beiten

The summer of AI in 2026 has brought a wide range of legal developments:

The courts have begun to cut a clear path through the legal thicket. The judgment of the Munich I Regional Court against Google offers a ray of hope to anyone who finds themselves misrepresented in an “AI Overview”. The same court also ruled in favour of the rights holders in the second action brought by GEMA against an AI provider. It applied not only German copyright law but also US copyright law. The Munich I Regional Court is thus likely to attract the attention of AI providers even beyond Germany’s borders.

The AI Act is also attracting international attention. The impact of the transparency obligations taking effect under the AI Act are already visible and noticeable across all media. Critics' early warnings now seem to be materialising: the sheer volume of labeling disclosures risks diluting their original warning function.

At least this foreword was written without the assistance of AI. Details of the latest developments can be found below. They may contain traces of AI but have been lovingly curated and checked by hand.

Kind regards,

Dr Andreas Lober
Head of the IP, IT & Data Practice Group

You can find the AI Briefing here.

Topics in this issue are:

Case law

• Federal Labour Court: No GDPR Right to a Complete Compliance Report
• Düsseldorf Administrative Court: Company Bears Burden of Proving Consent to Marketing Emails

Regulatory investigations and enforcement actions

• Netherlands: Fine of Approx. EUR 825 Million Against Uber for Automated Decision-Making
• Italy: EUR 1.7 Million Fine Following Social Engineering Attacks
• Italy: EUR 460,000 Fine for Excessive Retention of Employee Emails and Log Data

Opinions

• CNIL: Agentic AI Heightens Risks to Personal Data
• BFDI: Central Cookie Managers Instead of Cookie Banners

The Privacy Ticker is available in the download area below or under this link.

Topics in this issue are:

Case law

• Federal Court of Justice: GDPR Damages for Misdirected Xing Massage
• Saxon Higher Administrative Court: Video Hearing from an Unsafe Third Country may be Refused
• Siegburg Labour Court: EUR 1,000 Damages fpr Disclosing a Diagnosis in a WhatsApp Group
• Arnberg Local Court: Initial Access Request may be Abusive
•  

Regulatory investigations and enforcement actions

• Italy: Fines Totalling EUR 7.72 Million for Intransparent Credit Scoring
• Italy: EUR 2 Million Fine Against Data Broker Lusha

Opinions

• EDPB: Guidelines on Anonymisation
• EDPB: Guidelines on Web Scraping for Generative AI

The Privacy Ticker is available in the download area below or under this link.

Topics in this issue are:

Case law

• EJ: No GDPR Prohibition on the Use of Unlawfully Obtained Data
• Federal Court of Justice: Personal Data of Third Parties Does not Need to be Redacted when Inspecting Files in Foreclosure Proceedings
• Federal Administrative Court: Health Insurance Plans Fall Under Art 9(2)(H) GDPR
• Regional Court of Freiburg: Art. 15 GDPR Covers Payment and Gaming History
• Berlin Regional Court I: Deutsche Wohnen Fine Reduced to EUR 900,000

Regulatory investigations and enforcement actions

• France: EUR 5 Million Fine Imposed on IQVIA for Health Data Violations
• Norway: EUR 1.8 Million Fine for Invalid Consent

Opinions

• Data Protection Authority Baden-Württemberg: AI Transcription of Municipal Council Meetings

The Privacy Ticker is available in the download area below.

Topics in this issue are:

Case law

• Administrative Court of Berlin: Video Surveillance and ID Checks in Public Outdoor Pools Permissible
• Regional Court of Dortmund: Art. 15 GDPR not an Investigative Tool for Gambling Games

Regulatory investigations and enforcement actions

• Netherlands: EUR 100 Million Fine Against Taxi App for Data Transfer to Russia
• Italy: EUR 12.5 Million Fine Against Poste Italiane and Postepay for App Monitoring

Opinions

• BFDI, Federal Network Agency and Hesse Publish Roadmap for AI in Medical Devices
• EU Commission: Recommendation for Privacy-Friendly Age Verification

Event highlights

• Webinar: The EU Cyber-Resilience Act - What Businesses Need to Do Now, 2 July from 11:00 - 12:00 CET

The Privacy Ticker is available under this link or in the download area below.

• EU Parliament/Council: Changes to the AI Regulation via the “Digital Omnibus”

Case law

• Higher Regional Court of Düsseldorf: AI-assisted modification of a photo does not automatically infringe copyright
• Regional Court of Frankfurt am Main: Copyright protection for a partially AI-generated song
• Berlin Administrative Court: AI-“invented” case law citations in a lawyer’s brief
• Augsburg Regional Court: AI client acquisition system prohibited
• Hamm Higher Regional Court: Operator liable for false statements made by an AI chatbot

Statement / Miscellaneous

• EU Commission: Draft guidelines on transparency obligations under Art. 50 AI Regulation
• EU Parliament: Copyright and generative AI
• BMDS: “Agentic AI Hub” launches pilot in municipalities
• EU Commission: Draft guidelines on the classification of high-risk AI systems

Event Highlight

• Digital Law Day on June 24 in Frankfurt
• Webinar: “The EU Cyber Resilience Act - What businesses need to do now” on July 2

Download the full newsletter below or under this link.

Topics in this issue are:

Case law

• Federal Court of Justice: Right to Information cannot be Asserted as a Derivative Right by Third Parties
• Administrative Court of Düsseldorf: transport Encryption for E-Mails is Generally Sufficient
• Regional Court of Krefeld: No Compensation for Zero-Day Exploit

Regulatory investigations and enforcement actions

• Italy: Fine of EUR 31.8 Million Against Bank for Unauthorized Access to Customer Data
• Italy: Fine of EUR 17.6 Million Against Bank for Passing on Customer Data
• Spain: Fine of EUR 950,000 for Inadmissible Processing of Biometric Data

Opinions

• EDPB Publishes DPIA Template
• Federal Council: Statement on Data Protection Regulations in the “Digital Omnibus”
• EDPB: Guidelines on the Processing of Personal Data for Scientific Research Purposes

The Privacy Ticker is available under this link or in the download area below.

Topics in this issue are:

Changes in Legislation

• New Rules on AI Usage in Baden-Württemberg

Case law

• ECJ: Abuse of Access Requests Under Article 15 GDPR
• Jena Higher Regional Court: Unlawful Offsite Data Collection by Meta Business Tools
• Berlin II Regional Court: No Data Transfer from WhatsApp to Meta

Regulatory investigations and enforcement actions

• United Kingdom: EUR 16.8 Million Fine Against Reddit
• Italy: EUR 2 Million Fine for Unauthorized Contracts by Sales Partners
• Sweden: EUR 560,000 Fine Due to Lack of IT Security on Sports Platform

Opinions

• 61 Supercisory Authorities Worldwide issue Joint Statement on AI-Generated Content

The Privacy Ticker is available under this link or in the download area below.

Topics in this issue are:

Changes in Legislation

• Act for Critical Infrastructure Protection Passed

Case law

• Federal Court of Justice on the Performance of a Contract as a Legal Basis
• Regional Court Frankenthal: Tesla Video Admitted ad Evidence Despite Possible Data Protection Violation
• Administrative Court of Düsseldorf: Redaction of Third-Party Data Permitted in the Case of Right to Information

Regulatory investigations and enforcement actions

• Adequacy Decision for Brazil
• France: EUR 5 Million Fine Agsinst State Employment Agency
• France: EUR 3.5 Million Fine for Data Transfer to Social Network

Opinions

• EDPB and EDPS: Joint Opinion on the Digital Omnibus
• EDPB: Results of the Audit Action on the Right to Erasure Published
• Google Recaptcha Moves to Order Processing

The Privacy Ticker is available under this link or in the download area below.

In this AI Briefing, we will inform you about: 

Case Law:

• Higher Regional Court Hamburg: Text and Data Mining for AI Training Permissible in Case of Insufficient Opt-Out
• Regional Court Frankfurt: Liability of Google for “AI Overview” is not per se Excluded
• Local Court Munich on Copyright Protection for AI-Generated Graphics
• Administrative Court Hamburg: Use of ChatGPT Classified as Attempted Cheating Even Without Explicit Ban

Regulatory Actions

• EU Commission: Investigtation Launched into X Regarding Systemic Risks Posed by Grok

Opinions / Other:

• Joint Opinion of the EDPB and EDPS on the Digital Omnibus on AI
• EU Commission: First Draft of AI Transparency Code Published
• EU Commission: “Agentic AI” Report and Strategy for Autonomous AI Systems
• Stanford Study: Leading Models Reproduce Copyright Books Almost Entirely

You can find our briefing by downloading the associated files.

The January issue of our Privacy Ticker deals with the changes in  the current case law, regulatory investigations and enforcement actions and opinions.

Topics in this issue are:

Case law

• Federal Court of Justice: Premium History Data in Private Health Insurance only Subject to Information in Case of Personal Reference
• Frankfurt Higher Regional Court: Third-Party Providers are Liable for Cookies without Consent
• Administrative Court of Wiesbaden: Data Protection Authority Must Take Action Against Schufa
• Munich Higher Regional Court: Meta Liable for Damages in Conneciton with Business Tools

Regulatory investigations and enforcement actions

• France: EUR 42 Million Fine Imposed on Mobile Telecommunications Provider for Inadequate Security Measures
• France: Further Fine of EUR 1.7 Million for Inadequate Security Measures
• LDI NRW: EUR 300,000 Fine for Misleading Advertising and Disregard of Data Subject Rights

Opinions

• GDPR Reform Suggestions by the DSK
• Joint Opinion of the EDPB and EDPS on the Digital Omnibus on AI
• BaFin: Guidanec for the Use of AI in Financial Companies

The Privacy Ticker is available under this link or in the download area below.

If you would like to discuss what these developments mean for your company, please do not hesitate to get in touch. We look forward to continuing the conversation – and wish you an engaging read.

In this AI Briefing, we will inform you about:

Changes in Legislation: 

• Draft Bill of the AI Act Implementation Law
• Italy: First EU Country with National AI Law

Case Law: 

• Munich Regional Court I: Inadmissible Use of Song Lyrics for AI Training and Output
• Hamburg Regional Court: AI Chatbot Grok not Spread Inaccurate Factual Assumptions
• Berlin Regional Court II: AI-Generated Voice Violates Personal Rights and Data Protection
• Cologne Local Court: Lawyer Uses AI to Invent Legal Rulings and Findings
• Great Britain: Barrister Uses AI and Cites Fictitious Judgements
• Great Britain: High Court London Dismisses Getty Images' Claim Against Stability AI
• Canada: AI Hallucinations Lead to Fine for Party

Opinions:

• DSK: Orientation Guidance Assesses RAG Method as Mitigating Action
• WhatsApp Changes General Terms and Conditions: Ban on General-Purpose AI Chatbots as of 2026

You can find the Briefing by downloading the associated files.

Topics in this issue are:

CHANGES IN LEGISLATION

• EU Commission Withdraws Plans for E-Privacy Regulation and AI Liability

CASE LAW

• ECJ: Discretion of the Authority in the Case of Excessive Complaints
• ECJ: Finde Amount Depends on Worldwide Group Turnover
• Higher Regional Court of Schleswig: Transport Encryption Insufficient when Sending Invoices by E-Mail
• Federal Court of Justice: Compensation of EUR 500 Due to Unauthorized Schufa Entry

REGULATORY INVESTIGATIONS AND ENFORCEMENT ACTIONS

• Italy: Data Protection Authority Bans DeepSeek
• German Data Protection Authorities Initiate Investigation Proceedings Against DeepSeek
• Spain: Fine of EUR 4 Million Against Generali Due to Data Breach

OPINIONS

• EU Commission Guidelines on Prohibited AI Practices
• EDPB Adopts Statement on Age Assurance

The Privacy Ticker is available under this link or in the download area below.

Topics in this issue are:

CHANGES IN LEGISLATION

• DORA in Force

CASE LAW

• ECJ: Gender Information Unnecessary when Purchasing Tickets
• ECJ: Collective Agreements do not Create a Legal Basis

REGULATORY INVESTIGATIONS AND ENFORCEMENT ACTIONS

• Ireland: Fine of EUR 251 Million Against Meta Due to Data Breach
• Italy: Fine of EUR 15 Million Against OpenAI for Lack of Legal Basis and Intransparency
• Netherlands: Fine of 4.75 Million Against Netflix for Lack of Information

OPINIONS

• EDPB Adopts Guidelines on Pseudonymisation
• EDPB: Opinion on the Processing of Personal Data in AI Models
• Lowe Saxony Data Protection Authority: Criticism of the Consent Managament Regulation

The Privacy Ticker is available under this link or in the download area below.

However, the speed of developments in recent months has surprised us. There is hardly a medium that has not reported in one form or another – and the current possibilities are being tested in schools just as much as in companies. Meanwhile, the third edition of the German broschure is available and we decided to publish it in English language as well.

The aim of this brochure is to provide a brief overview of the current legal situation and the state of the discussion. A brief presentation such as this cannot claim to be complete in terms of breadth and depth.

In addition, we venture an outlook on future developments and possible adaptations of the legal framework with regard to the advancing automation of AI and robotic systems. We are particularly interested in questions concerning the protectability of works created by AI on the one hand and questions of liability on the other – up to and including the not only provocative question of whether artificial intelligences should be holders of rights, perhaps even be given a legal personality. Here, too, we can and will only provide food for thought and discussion in a work of limited scope.

The German version has been published in summer 2024. This is an English translation for which some of the chapters have been updated.

Dr. Andreas Lober
Susanne Klein

Topics in this issue are:

Changes in Legislation

• Cyber Resilience Act and Amendment ofProduct Liability Directive in Force

CASE LAW

• ECJ: Exemptions from Information Obligations also for Self-Generated Personal Data
• Federal Social Court: Delayed Information Does not Lead to Loss of control Over Data
• Austrian Federal Administrative Court: Consent for Google Recaptcha
• Labour court of Duisburg: Compensation of EUR 10,000 for Disclosure of Health Data

REGULATORY INVESTIGATIONS AND ENFORCEMENT ACTIONS

• France: Fine of EUR 50 Million Against Telecommunications Service Provider for Unlawful Advertising
• Italy: Fine of EUR 5 Million Against Delivery Service for Unauthorized Tracking
• Spain: Fine of EUR 1.3 Million Against Telecommunication Service Provider After Cyber Attack

OPINIONS

• EDPB Guidelines on Art. 48 GDPR

The Privacy Ticker is available under this link or in the download area below.

Topics in this issue are:

CASE LAW

• Federal Court of Justice: Loss of Control from Facebook Scraping can be Damage
• Higher Regional Court of Frankfurt: Self-Service Tool in X Fulfils Right to Information Under Art. 15 GDPR
• Regional Labour Court of Düsseldorf: Employer Must Inform Applicants that it Googles them

REGULATORY INVESTIGATIONS AND ENFORCEMENT ACTIONS

• Spain: Fine of EUR 3.5 Million Against Telecommunications Provider due to Ransomware Attack
• Hamburg Data Protection Authority: Fine of EUR 900,00 for Breach of Deletion Obligations
• Finland: Fine of 2.4 Million for Setting up an E-Mail Inbox

OPINIONS

• EDPB: First Report on the EU-US Data Privacy Framework
• German Data Protection Conference: Updates Guidelines for Providers of Digital Services
• German Data Protection Conference: Guidelines on Selected Issues of the New Online Access Act

The Privacy Ticker is available under this link or in the download area below.

Topics in this issue are:

CHANGES IN LEGISLATION

• Draft of an Employee Data Protection Act
• Cyber Resilience Act Adopted

CASE LAW

• ECJ: Order Information can Represent Health Data
• ECJ: No Obligations of the Supervisory Authorities to Take Remidial Action
• ECJ: Apology can be Sufficient Compensation for Damage
• ECJ: Sensitive Data may not be Used for Personalised Adverstising

REGULATORY INVESTIGATIONS AND ENFORCEMENT ACTIONS

• Fine of EUR 310 Million against LinkedIn for Unlawful Processing for Advertising Purposes
• Fine of EUR 91 Million against Meta for Storing Passwords

OPINIONS

• EDPB: Responsibilities of the Controller in the Assignment of Data Processors
• EDPB: Guidelines on the Balancing of Interests

The Privacy Ticker is available under this link or in the download area below.

Topics in this issue are:

CHANGES IN LEGISLATION

• Federal Government Adopts Cookie Regulation

CASE LAW

• Higher Regional Court of Munich: Data Breach Justifies Termination of Employment without Notice
• Regional Court of Traunstein: No Claim against Social Network for Data Processing Solely in Europe
• Administrative Court of Schleswig: Dashcam Videos on YouTube must be Pixelated

REGULATORY INVESTIGATIONS AND ENFORCEMENT ACTIONS

• Fine of EUR 30.5 Million against Clearview
• Fine of EUR 3.2 Million due to Meta-Pixel on Website

OPINIONS

• Data Protection Conference: Transfer of Personal Data in Asset Deals
• Data Protection Conference: Resolution on the Use of Facial Recognition Systems by Security Authorities
• Data Protection Conference: Guidelines on Data Processing in Connection with Radio-Based Meters

The Privacy Ticker is available under this link or in the download area below.

Topics in this issue are:

CHANGES IN LEGISLATION

• Data Transfer to the USA: New Agreement Between Switzerland and the USA Adopted

CASE LAW

• Federal Court of Justice: Explicit Naming of Data Protection Officer not Mandatory
• Administrative Court of Stuttgart: City Ordered to Pay EUR 2,500 Compensation for Unauthorized Publication of Health Data
• Administrative Court of Ansbach: Data Subject has Right to Demand Intervention from Data Protection Authority

REGULATORY INVESTIGATIONS AND ENFORCEMENT ACTIONS

• Fine of EUR 290 Million Against Uber Because of Data Transfer to the US
• USD 60 Million Fine Against T-Mobile Due to Unauthorized Data Access

OPINIONS

• Guidelines for Local Authorities and Administrations on the Right to Information Under Article 15 GDPR
• EU Commission: Second Report on the Evaluation of the General Data Protection Regulation

The Privacy Ticker is available under this link or in the download area below.

Topics in this issue are:

CHANGES IN LEGISLATION

• Digitalisation in the Healthcare Sector: Innovations for Cloud Computing in Force

CASE LAW

• ECJ: Claim by Consumer Associations in Case of GDPR Infringements Confirmed
• Federal Labor Court: Processing if Health Data in an Employment Relationship

REGULATORY INVESTIGATIONS AND ENFORCEMENT ACTIONS

• Online-Platform Vinted Fined Almost EUR 2.4 Million
• Fine of EUR 6.4 Million Against Italian Energy Company
• Fine of Some EUR 1.3 Million Against Swedish Bank

OPINIONS

• Agreement Between the EU and Japan on Data Flows in Force
• Hamburg Data Protection Authority: Large Language Models do not Store Personal Data
• BaFin: Implementation Information on DORA

The Privacy Ticker is available under this link or in the download area below.