■ AI ACT: legal responsibility for using AI
Many organizations continue to view Regulation (EU) 2024/1689 on artificial intelligence as legislation aimed almost exclusively at major tech players. In reality, the AI Act applies across the entire supply chain: to those who develop AI systems, but also to those who integrate them into their products, distribute them on the market, or use them in business processes, based on a risk-based approach and the protection of fundamental rights.
The most common misconception is that the “ordinary” use of AI tools in a company is legally neutral. This is not the case: every company is required to assess the system it uses, verifying whether it falls under prohibited practices, high-risk systems, or those subject to specific transparency obligations, with direct impacts on internal governance, contracts with suppliers, control procedures, and the allocation of responsibilities.
For companies, the question is not “whether” to use artificial intelligence, but “how” to legally oversee its use. This involves mapping actual uses, understanding the role assumed in the technology chain (supplier, distributor, deployer), verifying disclosure obligations and requirements for human supervision, and coordinating the AI Act with the GDPR, cybersecurity, and internal controls. In the coming years, the degree of organizational maturity will be measured precisely by the ability to integrate these regulatory frameworks into a coherent system of AI governance.
EDPB: Toward Operational Standardization of compliance.
The European Data Protection Board (EDPB) has launched a public consultation aimed at developing standardized “ready-to-use” templates. The initiative, inspired by the principles of the Helsinki Declaration, aims to simplify the application of the GDPR through the creation of official templates—that is, predefined models that provide common parameters for reporting and transparency.
The initiative addresses a structural issue in privacy: the gap between the legal obligation, expressed in general rules, and its concrete translation into documents and operational procedures. Uniform templates for the DPIA (i.e., the data protection impact assessment), notifications of data breaches (personal data breaches), notices to data subjects, processing records, and assessments of legitimate interest, in fact, help reduce inconsistencies in implementation, discrepancies in documentation, and difficulties in defending against inspections.
The standardization proposed by the EDPB makes the establishment of safeguards clearer, unifies the language used by legal, technical, and organizational functions, and promotes integrated governance of processing activities.
The template does not replace compliance, but defines the minimum framework for consistency.
The truly decisive factor remains the ability to adapt standard models to the company’s concrete reality.
It is not enough to adopt predefined documents or forms: they must be translated into the company’s own processes, roles, and operational workflows. Only when procedures on paper become actual practices integrated into daily management can we speak of true compliance.
EDPB: Recommendations for More Privacy-Friendly Online Shopping.
The European Data Protection Board (EDPB), at its plenary session on December 4, 2025, adopted Recommendations for the creation of user accounts on e-commerce websites. The goal is to make online shopping more respectful of users’ privacy by allowing transactions to be carried out without the need to register, favoring a “guest” mode. Registration may be mandatory only in specific cases, such as subscriptions or exclusive offers. These guidelines aim to reduce the collection and processing of personal data, in line with the GDPR’s principles of data protection by design and by default.
The EDPB has also launched a preliminary discussion on the “Digital Omnibus” proposal, expressing concern over the proposed change to the definition of personal data, which could go beyond the case law of the Court of Justice of the EU and undermine the fundamental right to data protection. This change, in fact, risks weakening the protection of data subjects and reducing transparency and accountability of companies in the management of personal data.
United Kingdom: ICO fines British password manager £1.2 million for a data breach.
The UK’s Information Commissioner’s Office (ICO), in a decision dated December 11, 2025, imposed a fine of £1.2 million (approximately €1.375 million) on a British company that provides password management services for a serious data breach that occurred in 2022.
The case involves two separate incidents which, combined, allowed a hacker to access the company’s backup database and steal personal information from up to 1.6 million customers, including names, email addresses, phone numbers, and stored website URLs.
Although the “zero-knowledge” encryption system prevented the decryption of passwords, the failure to implement adequate security measures left personal data exposed. The unauthorized access was made possible by the compromise first of the company’s laptop and then of an employee’s personal device, which contained the decryption key. The breach was deemed severe due to its scope, the categories of data involved, and the failure to adopt sufficiently adequate security controls.
Spain: AEPD fines a Spanish company €1.56 million for a data breach.
The Agencia Española de Protección de Datos (AEPD) imposed, by decision no. EXP202401683 of October 22, 2025, a fine of €1.56 million on a Spanish company that sells sporting goods, for a serious breach of personal data security.
The case involved a data breach of significant scope, affecting approximately 6.4 million people, including customers and employees, residing in Spain, France, Italy, the Netherlands, and Portugal. The cyberattack led to the compromise of identifying data (first name, last name, tax ID), contact information (address, phone number, email), financial data, and health data, with particular relevance to employee data, including that related to health and disability.
The notification of the breach to the data subjects was deemed late and incomplete in relation to the obligations set forth in Article 34 of EU Regulation 2016/679 (GDPR), which requires timely and clear notification in the event of a data breach posing a risk to the rights and freedoms of data subjects. The breach was also considered serious due to the failure to adopt adequate technical and organizational security measures, as well as the cross-border impact and the categories of data involved, which amplified the risk of abuse and harm to the individuals concerned.
Meta Fined €251 Million for Serious GDPR Violations
The Irish Data Protection Commission (DPC) recently imposed a €251 million fine on Meta, Facebook’s parent company, due to a serious security breach. This incident affected approximately 29 million accounts worldwide, including 3 million in Europe. The decision stems from an investigation launched following a security incident that revealed significant vulnerabilities in the handling of user data.
The incident dates back to July 2017, when Facebook introduced a feature allowing users to view their profile as it appeared to others. A design flaw allowed malicious actors to exploit this feature, combining it with another option to generate unauthorized access tokens. This enabled unauthorized access to users’ profiles and their personal information, including name, email address, phone number, and date of birth.
Although Meta implemented corrective measures after identifying the breach, the DPC highlighted the risks associated with inadequate data protection practices during the design of digital platforms. The authority found several violations of the General Data Protection Regulation (GDPR) by Meta, pointing out shortcomings in the breach notification and in the documentation of the corrective measures adopted by the company. The DPC emphasized the importance of integrating strict data protection requirements from the earliest stages of development to safeguard users’ rights.
The vulnerabilities that led to the breach pose a significant risk of misuse of personal information, making the adoption of adequate preventive measures crucial.
The current fine adds to the total of €2.8 billion already imposed on Meta for similar violations, although only €17 million has actually been collected due to ongoing legal disputes.
Meta announced its intention to appeal the DPC’s decision, reiterating its commitment to protecting user data and the measures taken to ensure security on its platforms.