EDPB Data Protection
Material regulatory developments from European Data Protection Board are tracked daily by Cresthaven Analytics. Over the last 90 days, 12 material briefs relevant to professionals operating in the technology, ai & competition sector have been published below. Each brief is sourced directly from the primary regulatory feed, summarized for institutional readers, and scored for materiality.
Recent material activity
A selection of recent published briefs; this is not a complete archive.
Norwegian DPA fines Xandr EUR 8.6 million for unlawful real-time bidding data processing under GDPR
The Norwegian Data Protection Authority issued a final administrative fine of EUR 8,600,000 against Xandr Inc. on October 2, 2026, for unlawful processing of Grindr users' personal data during real-time bidding. The deci…
Read the full EDPB Data Protection brief →EDPB adopts preliminary statement on GDPR obligations for smart glasses users, manufacturers, and service providers
The European Data Protection Board (EDPB) adopted a statement on October 13, 2026 addressing data protection obligations for smart glasses under the GDPR. The statement assigns controller status to certain user categorie…
Read the full EDPB Data Protection brief →Italian DPA fines Wind Tre EUR 16.7 million and bans further processing over telemarketing and consent failures
Italy's data protection authority (the Garante) fined Wind Tre S.p.A. EUR 16,700,000 on June 5, 2026, for unlawful telemarketing, invalid consent practices, and systemic failures in overseeing its sales network. The dec…
Read the full EDPB Data Protection brief →Italian DPA fines IQVIA EUR 7 million for unlawful health data processing affecting approximately one million patients
The Italian Data Protection Authority fined IQVIA Solutions Italy S.r.l. EUR 7,000,000 on 23 September 2026. The authority found that patient health data held in a general-practitioner database was not anonymous as claim…
Read the full EDPB Data Protection brief →Dutch DPA fines Uber EUR 824,990,000 for unlawful automated driver deactivation under GDPR
The Autoriteit Persoonsgegevens (AP) imposed a EUR 824,990,000 administrative fine on Uber B.V. on October 8, 2026, covering violations from 2018 to 2022. The AP found that Uber's fully automated account deactivation sys…
Read the full EDPB Data Protection brief →Swedish DPA fines Miljödata SEK 1,800,000 for GDPR security failures exposing 2.2 million individuals
The Swedish Data Protection Authority (IMY) fined IT service provider Miljödata i Karlskrona SEK 1,800,000 (approximately EUR 160,000) on September 22, 2026. The fine follows a cyberattack in August 2025 that exposed per…
Read the full EDPB Data Protection brief →Italian DPA fines BBVA EUR 5,508,000 for seven-month failure to honour a customer's direct marketing objection
The Italian Data Protection Authority fined BBVA's Italian branch EUR 5,508,000 on 3 July 2026 for failing to act on a customer's direct marketing objection for seven months. The decision also orders BBVA to implement co…
Read the full EDPB Data Protection brief →Italian DPA fines Emirates EUR 180,000 for opaque health-data processing and excessive retention under GDPR
The Italian Data Protection Authority fined Emirates EUR 180,000 on 14 May 2026 for transparency and data-minimisation failures in its MEDIF health-data collection process. The authority also issued a 30-day compliance o…
Read the full EDPB Data Protection brief →Irish DPC fines Google 403 million EUR for GDPR location data violations and orders compliance within six months
The Irish Data Protection Commission fined Google Ireland Limited 403 million EUR on 21 September 2026 for GDPR violations across three location data features. The decision also carries a compliance order requiring Googl…
Read the full EDPB Data Protection brief →Spanish DPA fines Securitas Direct 100,000 EUR for directing data subjects to a chargeable rights-exercise channel
The Spanish Data Protection Authority (Agencia Española de Protección de Datos, AEPD) fined Securitas Direct 100,000 EUR on 1 February 2023 for violating the GDPR requirement that data subject rights be exercisable free …
Read the full EDPB Data Protection brief →EDPB adopts draft fining-methodology guidelines and finalizes DSA-GDPR interplay guidance at September plenary
The EDPB adopted two sets of guidelines at its September 21, 2026 plenary. The first, on when DPAs should impose administrative fines under the GDPR, is open for public consultation until November 13, 2026. The second, o…
Read the full EDPB Data Protection brief →CNIL fines EXTIA 300,000 EUR for systemic failure to process and respond to erasure requests
The CNIL imposed a 300,000 EUR administrative fine on EXTIA on 21 July 2026 for breaching GDPR obligations on transparency and the right to erasure. The fine followed an April 2025 audit conducted under the European Data…
Read the full EDPB Data Protection brief →
Get every EDPB Data Protection brief delivered the day it lands
From $149/month
Cresthaven Analytics monitors European Data Protection Board continuously, applying institutional materiality scoring to every release. Subscribers receive structured briefs via email, portal, and (Professional tier and above) real-time alerts.
View all tiers →