Resources

First Draft General-Purpose AI Code of Practice by EU Commission

The Consumer Financial Protection Bureau (CFPB) by Consumer Financial Protection Bureau WASHINGTON, D.C

Financial matters

Musk Adds Microsoft to OpenAI Lawsuit, Expanding Antitrust Allegations

AI tools in recruitment by UK ICO

Discussion Paper: Large Language Models and Personal Data by The Hamburg Commissioner for Data protection and freedom of information

AI Management Essentials by Department for Science, Innovation and Technology

UK to Regulate AI Frontier Models with New Legislation in 2025

Slovenian SA Decision 0603-42/2023/12 against Dodo Pizza

CCTV, Lawfulness of Processing, Legitimate Interest

AI and the audiovisual sector: navigating the current legal landscape by IRIS European Audiovisual Observatory

Harmonised Standards for the European AI Act by EU Commission

AI Principles and Best Practices for Developers and Employers by U.S. DEPARTMENT OF LABOR

Perplexity AI Faces Lawsuit Over Alleged Copyright Violations by Dow Jones and NY Post

AI Toolkit Tracker

Artificial Intelligence (AI) Toolkit Tracker – more information about the Toolkit by UK ICO

Dutch Supervisory Authority for Data Protection (AP)-Uber Technologies Inc., Uber B.V. (7/22/2024)

Data Transfers

Hellenic Data Protection Authority (HDPA)-Greek Ministry of Immigration and Asylum (4/2/2024)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Privacy by Design

Spanish Data Protection Authority (aepd)-CTC EXTERNALIZACIÓN, S.L (2/12/2024)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights

Dutch Supervisory Authority for Data Protection (AP)-International Card Services B.V. (1/15/2024)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Data Protection Authority of Sweden-Östersund Municipality’s Department for Children and Education (11/28/2023)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Hellenic Data Protection Authority (HDPA)-Athens Urban Transport Organization (9/25/2023)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Storage limitation

Data Protection Authority of Sweden-Tele2 Sverige Aktiebolag (6/30/2023)

Data Transfers

Data Protection Authority of Sweden-CDON AB (6/30/2023)

Data Transfers

Data Protection Authority of Ireland-Meta Platforms Ireland Limited (5/12/2023)

Data Transfers

Spanish Data Protection Authority (aepd)-GSMA LTD. (5/3/2023)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Austrian Data Protection Authority (dsb)-Operator of a public toilet (8/23/2022)

Lawfulness of Processing, Legitimate Interest, Sensitive Data

Spanish Data Protection Authority (aepd)-ALBERO FORTE COMPOSITE, S.L. (4/28/2023)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Italian Data Protection Authority (Garante)-Azienda Universitaria Friuli Occidentale (12/15/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Principles, Sensitive Data

Italian Data Protection Authority (Garante)-Azienda Universitaria Friuli Centrale (12/15/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Principles, Sensitive Data

Italian Data Protection Authority (Garante)-Azienda Universitaria Giuliano Isontina (12/15/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Principles, Sensitive Data

Spanish Data Protection Authority (aepd)-ADSL HOUSE, S.L. (10/24/2022)

Data Subjects Rights, Data Transfers

Data Protection Authority of Niedersachsen-Volkswagen (7/26/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Workshop (3/29/2022)

Legitimate Interest, Principles, Purpose limitation, Sensitive Data

Spanish Data Protection Authority (aepd)-TIGERS MARKET, S.L. (5/17/2022)

Data Subjects Rights, Data Transfers

Danish Data Protection Authority (Datatilsynet)-Danish National Genome Center (3/25/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Italian Data Protection Authority (Garante)-Azienda sanitaria unica regionale Marche (1/13/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Integrity and confidentiality, Principles

Data Protection Authority of Hamburg-Company (7/12/1905)

Definitions, Joint Controllers

Norwegian Supervisory Authority (Datatilsynet)-Elektro & Automasjon Systemer AS (12/13/2021)

Lawfulness of Processing, Legitimate Interest

Spanish Data Protection Authority (aepd)-TIGERS MARKET, S.L. (11/29/2021)

Data Subjects Rights, Data Transfers

Spanish Data Protection Authority (aepd)-INTRODUCTION BUSINESS CAPITAL MEDIA, S.L. (12/1/2021)

Data Subjects Rights, Data Transfers

Spanish Data Protection Authority (aepd)-SERVICIOS LOGÍSTICOS MARTORELL SIGLO XXI, S.L. (10/26/2021)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Spanish Data Protection Authority (aepd)-Caixabank S.A. (7/8/2021)

Lawfulness of Processing, Legitimate Interest

Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)-Storstockholms Lokaltrafik (6/21/2021)

Data Subjects Rights, Lawfulness of Processing, Legitimate Interest, Principles, Sensitive Data

Lithuanian Data Protection Authority (VDAI)-Unknown (7/12/1905)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Technical and Organisational Measures (TOMs)

Czech Data Protection Auhtority (UOOU)-Bank (7/12/1905)

Data Subjects Rights, Data Transfers

Norwegian Supervisory Authority (Datatilsynet)-Ålesund Municipality (3/15/2021)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Spanish Data Protection Authority (aepd)-Equifax Iberica S.L. (3/10/2021)

Lawfulness of Processing, Legitimate Interest

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (3/11/2021)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Data Transfers

Spanish Data Protection Authority (aepd)-Avilon Center 2016 S.L. (2/24/2021)

Data Subjects Rights, Data Transfers

Spanish Data Protection Authority (aepd)-Vamavi Phone S.L. (2/11/2021)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Data Transfers

Spanish Data Protection Authority (aepd)-Iberdrola Clientes, SAU (12/22/2020)

Data Subjects Rights, Data Transfers

Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)-Gnosjö Municipality (11/25/2020)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Representative

Deputy Data Protection Ombudsman-Taksi Helsinki (5/29/2020)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Representative

Deputy Data Protection Ombudsman-Kymen Vesi Oy (5/22/2020)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Data Protection Authority of Sweden-School in Skellefteå (8/20/2019)

Controllers and Processors, Data minimisation, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg discussion paper on “Legal Foundations in Data Protection for the Use of AI”

AI, Lawfulness of Processing, Legitimate Interest, Specific processing situations

Guidelines on Securing AI Systems by The Cyber Security Agency of Singapore (CSA)

AI, Risk Management, Specific processing situations

Japan AI Safety Institute’s “Guide to Red Teaming Methodology on AI Safety”

AI, Specific processing situations

Study Finds ChatGPT Can Perform Biometric Tasks: A Closer Look at Privacy Risks

AI, Sensitive Data

Case C‑621/22 CJEU

Lawfulness of Processing, Legitimate Interest, Marketing and Advertising, Specific processing situations

Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR by EDPB

Lawfulness of Processing, Legitimate Interest

Recommendations for the use of AI coding assistants by ANSSI and BSI

AI, Specific processing situations

AIPact by the European Artificial Intelligence Office

AI, Data Subjects Rights, Specific processing situations

EDPS Model Administrative Arrangement

Data Processing by the Government, Data Transfers, Specific processing situations

Manipulative, Deceptive, and Exploitative AI Systems report by the Dutch DPA

AI, Lawfulness of Processing, Specific processing situations

FTC Targets Deceptive AI Claims with Operation AI Comply

AI, Lawfulness of Processing

OpenAI, Microsoft, and Amazon Join EU’s AI Pact to Shape Future Regulations

California Governor Vetoes AI Safety Bill

“AI & Algorithmic Risks Report” by Dutch Data Protection Authority

AI, Risk Management, Specific processing situations

National Strategy on AI by Sri Lanka

AI, Lawfulness of Processing, Specific processing situations

The Future of European Competitiveness by EU Commission

AI, New technology, Specific processing situations

Belgian DPA General Secretariat Artificial intelligence systems and the RGPD from a data protection perspective

AI, Lawfulness of Processing, Principles, Specific processing situations, Transparency

Tech Giants Sign Open Letter Urging “Regulatory Certainty on AI” in Europe

LinkedIn Used User Data for AI Training Before Updating Its Terms

AI, Data Sharing, Data Subjects Rights, Lawfulness of Processing

The IDTA, Addendum and TRA: practical guidance for cross-border transfers by the UK ICO

Access Requests (DSAR), Data Transfers

Privacy Impact Assessment (PIA) Templates by CNIL

Data Protection Impact Assessment (DPIA)

Case C 203/22 on AI and automated decisions, the right of access under the GDPR, and the protection of trade secrets

AI, Automated Decision-making, Controllers and Processors, Specific processing situations

Artificial Intelligence and Machine Learning in Health Care and Medical Sciences Best Practices by Pitfalls Gyorgy J. Simon Constantin Aliferis Springer

AI, Health Data, Principles, Sensitive Data, Specific processing situations

Report and Guidance on Privacy in Social Network Services – ”Rome Memorandum” by International Working Group on Data Protection in Telecommunications

Definitions, Processing of personal data

Report of the work undertaken by the ChatGPT Taskforce by EDPB

AI, Specific processing situations

Recommendation 01/2019 on the draft list of the European Data Protection Supervisor regarding the processing operations subject to the requirement of a data protection impact assessment (Article 39.4 of Regulation (EU) 2018/1725) |EPDB

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Opinion 36/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Booking.com Group |EPDB

Data Transfers

Recommendations 1/2022 on the Application for Approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR) |EPDB

Data Transfers

Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data |Version 2.0 |EPDB

Data Transfers

Recommendations 01/2021 on the adequacy referential under the Law Enforcement Directive |EPDB

Adequacy Decisions, Data Transfers

Opinion 04/2024 on the notion of main establishment of a controller in the Union under Article 4(16)(a) GDPR |EPDB

Definitions, Main Establishment

Case C‑740/22

Definitions, Personal Data

Case C‑604/22

Joint Controllers, Personal Data

Opinion 31/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Thalès Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 32/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Thalès Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 33/2023 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Controller Binding Corporate Rules of the Cerner Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 34/2023 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Processor Binding Corporate Rules of the Cerner Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 35/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Carlsberg Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 01/2024 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Booking.com Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 2/2024 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the TELEFÓNICA Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 3/2024 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Accenture Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 23/2023 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules for customer data of the UPS Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 24/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Nestlé Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 25/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the SHV Holding N.V. Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 26/2023 on the draft decision of the Romanian Supervisory Authority regarding the Processor Binding Corporate Rules of the OSF Global Services Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 27/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Tessi Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 28/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Servier Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 29/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Sodexo Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 30/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Sodexo Group |EPDB

Binding Corporate Rules, Data Transfers

Rethinking Privacy in the AI Era | White Paper by Stanford University

AI, Specific processing situations

Comparison of U.S. State Privacy Laws. Data Protection Assessments by CIPL

Controllers and Processors, Data Protection Impact Assessment (DPIA)

SWISS-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

EU-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

THE NEW STANDARD CONTRACTUAL CLAUSES – QUESTIONS AND ANSWERS

Data Transfers, Standard Contractual Clauses (SCC)

A pro-innovation approach to AI regulation by UK ICO

AI, Specific processing situations

International Data Transfer Agreements – Transitional Provisions

Data Transfers

Transfer Risk Assessment Tool by the UK ICO

Data Transfers

Transfer Impact Assessment (TIA) Template by HSE

Data Transfers

[UK EXTENSION] EU-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

Datenschutzkonforme Künstliche Intelligenz Checkliste mit Prüfkriterien nach DS-GVO

AI, Specific processing situations

Analysis of the final compromise text of the EU AI Act with a view to agreement by the Belgian Presidency

AI, Specific processing situations

Recommendations 02/2020 on the European Essential Guarantees for surveillance measures

CCTV, Lawfulness of Processing, Legitimate Interest, Specific processing situations

Draft Impact Assessment Framework by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA)

[UK] International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

Data Transfers

[UK] Standard Data Protection Clauses to be issued by the Commissioner under S119A(1) Data Protection Act 2018

Data Transfers

Report on the first review of the functioning of the adequacy decisions adopted pursuant to Article 25(6) of Directive 95/46/EC

Adequacy Decisions, Data Transfers

Guide to Binding Corporate Rules by the UK ICO

Data Transfers

[PROPOSAL 2024] EU AI ACT

AI, Specific processing situations

Generative AI framework for HM Government by the UK Central Digital and Data Office

AI, Specific processing situations

Artificial Intelligence Strategy of the CJEU

AI, Specific processing situations

Processing Personal Data on the Basis of Legitimate Interests under the GDPR by FPF

Lawfulness of Processing, Legitimate Interest

Case C 683-2021

Data Controller, Data Processors, Joint Controllers

[Draft] Transfer Impact Assessment by the CNIL

Data Transfers

Interim Report – Governing AI for Humanity by UN AI Advisory Body

AI, Specific processing situations

AI fairness in practice by the Alan Turing Institute

AI, Specific processing situations

Case T-1077/23

AI, Copyright, Specific processing situations

GUIDELINES ON LEGITIMATE INTEREST by the NPC of the Republic of Philippines

Lawfulness of Processing, Legitimate Interest

Annex: A summary of the Transparency in Health and Social Care guidance impact assessment by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

Transparency in health and social care by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

International data transfer agreement and guidance by the UK ICO

Data Transfers

[DRAFT] FRAMEWORK CONVENTION ON ARTIFICIAL INTELLIGENCE, HUMAN RIGHTS, DEMOCRACY AND THE RULE OF LAW

AI, Specific processing situations

The NYT vs OpenAI and Microsoft

AI, Copyright, Specific processing situations

[Draft] Guidelines on the processing of personal data in regard to recruitment by the UK ICO

Automated Decision-making, Controllers and Processors, Data Protection Impact Assessment (DPIA), Employment, Specific processing situations

European Commision press release on AI Act Agreement

AI, Specific processing situations

New rules for Artificial Intelligence – Questions and Answers by the European Commision

AI, Specific processing situations

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL LAYING DOWN HARMONISED RULES ON ARTIFICIAL INTELLIGENCE (ARTIFICIAL INTELLIGENCE ACT)

AI, Specific processing situations

Privacy Impact Assessment Tool by the Australian Government

Controllers and Processors, Data Protection Impact Assessment (DPIA)

AI Act Provisional Agreement Press Release

AI, Specific processing situations

Press Release No 184-23 by the CJEU

Controllers and Processors, Joint Controllers, Liability and Remedies, Supervisory Authorities

GDPR guidance: Legitimate Inerersts Assessments (LIA) for Digital Advertising

Lawfulness of Processing, Legitimate Interest, Marketing and Advertising, Specific processing situations

PRACTICAL GUIDANCE FOR THE USE OF GENERATIVE ARTIFICIAL INTELLIGENCE IN THE PRACTICE OF LAW by State Bar of California

AI, Specific processing situations

Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence (PROPOSED MEMORANDUM )

AI, Specific processing situations

The impact of the General Data Protection Regulation (GDPR) on artificial intelligence by the EU Parliamnet

AI, Specific processing situations

Guidelines for secure AI system development by UK NCSC and US CISA

AI, Specific processing situations

Benefits and Risks of Generative Artificial Intelligence Report by the State of California

AI, Specific processing situations

DPIA for AI template

Controllers and Processors, Data Protection Impact Assessment (DPIA)

TOWARDS A SUSTAINABLE, MULTILATERAL, AND UNIVERSAL SOLUTION FOR INTERNATIONAL DATA TRANSFER by the UK Government

Data Transfers

COMMON GUIDEPOSTS TO PROMOTE INTEROPERABILITY IN AI RISK MANAGEMENT | German Ministry of labor and social Affairs

AI, Specific processing situations

Generative AI: The Data Protection Implications by CEDPO

AI, Specific processing situations

Global Toolkit on AI and the Rule of Law for the Judiciary by UNESCO

AI, Specific processing situations

AI Privacy Policy template

AI, Specific processing situations

AI and Data Protection Risk Toolkit by UK ICO

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

Audit Requirements for Personal Data Processing Activities involving AI by AEPD

Controllers and Processors, Data Protection Impact Assessment (DPIA), Technical and Organisational Measures (TOMs)

Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence by the US President

AI, Specific processing situations

Automated Decision-Making Under the GDPR by the FPF

AI, Automated Decision-making, Controllers and Processors, Specific processing situations

Human rights Impact Assessments for AI

Controllers and Processors, Data Protection Impact Assessment (DPIA)

T‑553-23 R

Data Transfers

AI How-to Sheets by CNIL

AI, Specific processing situations

Description of the dataset template by CNIL

AI, Specific processing situations

Opinion 44/2023 on the Proposal for Artificial Intelligence Act in the light of legislative developments

AI, Specific processing situations

Artificial intelligence and the Information Privacy Principles by the Privacy Commisioner (New Zealand)

AI, Specific processing situations

How to use AI and personal data

AI, Specific processing situations

Case C-101/01

Data Transfers, Definitions, Principles, Processing of personal data, Sensitive Data

OPINION 1/15 OF 26. 7. 2017

Data Transfers

Guidelines 01/2023 on Article 37 Law Enforcement Directive

Data Transfers

C-597/19

Lawfulness of Processing, Legitimate Interest

C-708/18

CCTV, Lawfulness of Processing, Legitimate Interest, Specific processing situations

C-272/19

Access Requests (DSAR), Data Controller, Data Subjects Rights, Definitions

Case C-60/22

Accountability, Controllers and Processors, Joint Controllers, Principles

Voluntary AI Safety Standard by the Australian Government

AI, Specific processing situations

Safe and responsible AI in Australia Proposals paper for introducing mandatory guardrails for AI in high-risk settings by Australian Government

AI, Specific processing situations

Global Approaches to Auditing Artificial Intelligence by IPIE

AI, Specific processing situations

Artificial Intelligence Security Governance Framework 1.0 by China Cybersecurity Standardization Technical Committee

AI, Specific processing situations

Multidisciplinary Perspectives on Artificial Intelligence and the Law by Springer

AI, Specific processing situations

UNESCO: Consultation paper on AI Regulation

AI, Lawfulness of Processing, Public Interests, Specific processing situations

Saudi Data & Artificial Intelligence Authority: Rules governing the appointment of Personal DPOs under the Kingdom of Saudi Arabia’s (KSA) Personal Data Protection Law (PDPL)

AI, Specific processing situations

NSW report: Artificial intelligence in New South Wales

AI, Specific processing situations

Briefing EU Legislation in Progress by EPRS on AI Act

AI, Specific processing situations

Noyb Complaint Case: C-082-01 to EU Data protection Supervisor against EU Parliament

Controllers and Processors, Data Breaches, Public Administrative Body

ON THE ANTITRUST IMPLICATIONS OF EMBEDDING GENERATIVE AI IN CORE PLATFORM SERVICES BY SSRN

AI, Specific processing situations

South Africa National Artificial Intelligence Policy Framework

AI, Specific processing situations

Policy for the responsible use of AI in government by Australian Government

AI, Data Processing by the Government, Specific processing situations

Consumer Protection in respect of Use of Generative Artificial Intelligence by Hong Kong Monetary Authority

AI, Specific processing situations

The State of Artificial Intelligence in the Pacific Islands

AI, Specific processing situations

Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on adapting non-contractual civil liability rules to artificial intelligence (AI Liability Directive)

AI, Liability and Remedies, Specific processing situations, Supervisory Authorities

Noyb Complaint Case: C-082-02 to EU Data protection Supervisor against EU Parliament

Controllers and Processors, Data Breaches, Public Administrative Body

Relying on the legal basis of legitimate interests to develop an AI system by CNIL

Lawfulness of Processing, Legitimate Interest

CNIL open source PIA software – data protection impact assessment

Data Protection Impact Assessment (DPIA)

Securing Artificial Intelligence: Mitigation Strategy Report by ETSI

AI, Specific processing situations

Data protection compliant AI by Bavarian State Office for Data protection Supervision

AI, Specific processing situations

Case C‑461/22 CURIA

Data Controller, Definitions

EU-U.S. DATA PRIVACY FRAMEWORK F.A.Q. FOR EUROPEAN BUSINESSES BY EDPB

Data Transfers

Responsible AI Governance in Africa: Prospects for Outcomes Based Regulation by African Observatory on Responsible AI

AI, Specific processing situations

Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework by EDPB

AI, Specific processing situations

Confidential Computing and Privacy: Policy Implications of Trusted Execution Environments by Future of Privacy Forum

AI, Specific processing situations

Formal Opinion 512 on Generative Artificial Intelligence Tools by AMERICAN BAR ASSOCIATION

AI, Specific processing situations

Case C-394/23, Mousse: Request for a preliminary ruling from the Conseil d’État (France) lodged on 28 June 2023 — Association Mousse v Commission nationale de l’informatique et des libertés (CNIL), SNCF Connect

Definitions, Processing of personal data

Data protection impact assessment for AI Solutions by Danish DPA

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

National framework for the assurance of artificial intelligence in government by the Australian, state and territory governments

AI, Specific processing situations

Relying on the legal basis of legitimate interest to develop an AI system by CNIL

AI, Specific processing situations

Generative AI Controls Framework Safe, Secure, and Compliant AI Adoption Approach Whitepaper by IBM

AI, Specific processing situations

Patent Landscape Report on Generative AI by WIPO

AI, Specific processing situations

Discussion Paper: Large Language Models and Personal Data by The Hamburg Commissioner for Data protection and freedom of information

AI, Specific processing situations

Mobilizing the legal basis of legitimateinterest to develop an AI system by CNIL

AI, Specific processing situations

Today’s and tomorrow’s means of payment facing the challenge of data protection by CNIL

Definitions, Processing of personal data

EditorsTrends in Data Protection and Encryption Technologies by SpringerProfessional

Definitions, New technology, Processing of personal data

Guidelines 01/2023 on Article 37 Law Enforcement Directive by EDPB

Data Transfers

Orientations for ensuring data protection compliance when using Generative AI systems by EDPS

AI, Specific processing situations

GDPR & Generative AI A Guide for Customers by Microsoft

AI, Specific processing situations

Risk and control for artificial intelligence and machine learning systems by Cybernetica

AI, Specific processing situations

Governance of artificial intelligence (AI) by House of Commons UK

AI, Specific processing situations

DECISION OF THE INFORMATION COMMISSIONER Snap Inc. and Snap Group Limited

AI, Specific processing situations

Artificial intelligence (AI) and human rights: Using AI as a weapon of repression and its impact on human rights by EU Parliament

AI, Specific processing situations

Neurodata risks report by EDPS and Spanish DPA

AI, Specific processing situations

Data protection impact assessment on the processing of personal data on government Facebook Pages

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Information note by EDPB on data transfers under the GDPR to the United States after the adoption of the adequacy decision on 10 July 2023

Adequacy Decisions, Data Transfers

Orientation guide of the Conference of Independent Federal and State Data Protection Supervisory Authorities by the German Data Protection Conference (DSK)

AI, Specific processing situations

GDPR & GENERATIVE AI – A GUIDE FOR THE PUBLIC SECTOR BY MICROSOFT

AI, Specific processing situations

Convention on AI, Human Rights, Democracy and the Rule of Law – by the Council of Europe (draft)

AI, Specific processing situations

Report of the work undertaken by the ChatGPT Taskforce bg EDPB

A Guide to ICO Audit Artificial Intelligence (AI) Audits by UK ICO

AI, Specific processing situations

Guideline on the massive collection of personal data from the web for the training of generative artificial intelligence (GenAI) models by the Italian Data Protection Authority (Garante)

AI, Data scraping, Specific processing situations

Opinion 18/2021 on the draft Standard Contractual Clauses submitted by the LT SA (Article 28(8) GDPR) |EDPB

Controllers and Processors, Data Transfers, Standard Contractual Clauses (SCC)

Opinion 26/2021 on the draft decision of the Supervisory Authority of North Rhine-Westphalia (Germany) regarding the Controller Binding Corporate Rules of the Internet Initiative Japan Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 27/2021 on the draft decision of the Supervisory Authority of North Rhine-Westphalia (Germany) regarding the Processor Binding Corporate Rules of the Internet Initiative Japan Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 28/2021 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules of Oregon Tool, Inc (formerly “Blount”) |EDPB

Binding Corporate Rules, Data Transfers

Opinion 29/2021 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of Oregon Tool, Inc (Formerly “Blount”) |EDPB

Binding Corporate Rules, Data Transfers

Opinion 30/2021 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the COLT Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 31/2021 on the draft decision of the Spanish Supervisory Authority regarding the Processor Binding Corporate Rules of the COLT Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 21/2021 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the CGI Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 22/2021 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the CGI Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 14/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the United Kingdom |EPDB

Adequacy Decisions, Data Transfers

Opinion 15/2021 regarding the European Commission Draft Implementing Decision pursuant to Directive (EU) 2016/680 on the adequate protection of personal data in the United Kingdom |EDPB

Adequacy Decisions, Data Transfers

Opinion 32/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the Republic of Korea |EDPB

Adequacy Decisions, Data Transfers

Information Note by EDPB on the redress mechanism for EU/EEA individuals in relation to alleged violations of U.S. law with respect to their data collected by U.S authorities competent for national security

Adequacy Decisions, Data Transfers

EU-US Data Privacy Framework Template Complaint Form for Submitting Commercial Related Complaints to EU DPAs by EDPB

Adequacy Decisions, Data Transfers

EDPB-EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)

AI, Specific processing situations

Generative Artificial Intelligence Risk Assessment by State of California Department of Technology

AI, Risk Management, Specific processing situations

Report and Recommendations of the New York State Bar Association Task Force on Artificial Intelligence

AI, Specific processing situations

Perspectives on Issues in AI Governance by Google

AI, Specific processing situations

Deploying AI Systems Securely by NSA

AI, Specific processing situations

PRACTICE GUIDE SECURITY OF PERSONAL DATA Version 2024 by CNIL

Definitions, Personal Data

Opinion 39/2021 on whether Article 58(2)(g) GDPR could serve as a legal basis for a supervisory authority to order ex officio the erasure of personal data, in a situation where such request was not submitted by the data subject |EPDB

Data Controller, Data Subjects Rights, Definitions

Opinion 03/2022 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the WEBHELP Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 30/2021 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the COLT Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 31/2021 on the draft decision of the Spanish Supervisory Authority regarding the Processor Binding Corporate Rules of the COLT Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 33/2021 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules of Carrier |EPDB

Binding Corporate Rules, Data Transfers

Opinion 34/2021 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules of Otis |EPDB

Binding Corporate Rules, Data Transfers

Opinion 08/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of Bioclinica Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 06/2022 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of Groupon International Limited |EPDB

Binding Corporate Rules, Data Transfers

Opinion 05/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Lundbeck Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 07/2022 on the draft decision of the Hungarian Supervisory Authority regarding the Controller Binding Corporate Rules of MOL Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 04/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of Norican Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 32/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the Republic of Korea |EPDB

Adequacy Decisions, Data Transfers

EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act)

Data Transfers

Opinion 17/2022 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the ANTOLIN Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 18/2022 on the draft decision of the Baden-Württemberg (Germany) Supervisory Authority regarding the Controller Binding Corporate Rules of the Daimler Truck Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 19/2022 on the draft decision of the Baden-Württemberg (Germany) Supervisory Authority regarding the Controller Binding Corporate Rules of the MercedesBenz Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 20/2022 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the Ellucian Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 21/2022 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Ellucian Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 22/2022 on the draft decision of the Liechtenstein Supervisory Authority regarding the Controller Binding Corporate Rules of Hilti Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 23/2022 on the draft decision of the Swedish Supervisory Authority regarding the Controller Binding Corporate Rules of the Samres Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 24/2022 on the draft decision of the Swedish Supervisory Authority regarding the Processor Binding Corporate Rules of the Samres Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 26/2022 on the draft decision of the Data Protection Authority of Bavaria for the Private Sector regarding the Controller Binding Corporate Rules of the Munich Re Reinsurance Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 09/2022 on the draft decision of the Danish Supervisory Authority regarding the Processor Binding Corporate Rules of Bioclinica Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 10/2022 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Controller Binding Corporate Rules of Fresenius Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 02/2022 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the WEBHELP Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 31/2022 on the draft decision of the Slovak Supervisory Authority regarding the Processor Binding Corporate Rules of Piano Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 32/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Ramboll Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 14/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Vestas Wind Systems Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 18/2023 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of the Collibra Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 19/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the American Express Global Business Travel Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 20/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Comcast Corporation Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 21/2023 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of the UPS Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 22/2023 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules for employee data of the UPS Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 7/2023 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of Autodesk Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 8/2023 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of Autodesk Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU-US Data Privacy Framework |EPDB

Adequacy Decisions, Data Transfers

Opinion 9/2023 on the draft decision of the Italian Supervisory Authority regarding the Controller Binding Corporate Rules of Vertiv |EPDB

Binding Corporate Rules, Data Transfers

Opinion 10/2023 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the PROSEGUR Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 16/2023 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the Informatica Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 17/2023 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Informatica Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 6/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of Royal Greenland Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 27/2022 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of LEYTON Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 29/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the DSV Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 30/2022 on the draft decision of the Slovak Supervisory Authority regarding the Controller Binding Corporate Rules of Piano Group |EPDB

Binding Corporate Rules, Data Transfers

Zapier’s Transfer Impact Assessment

Data Transfers

Transfer Impact Assessment (TIA)

Data Transfers

Human rights Impact Assessments for AI by Access Now

AI, Data Protection Impact Assessment (DPIA)

GenAI and data protection: how organisations and their employees can use it appropriately and lawfully

AI, Employment

Opinion on legitimate interests of the data controller (Opinion 06/2014)

Legitimate Interest

Maximillian Schrems v. Data Protection Commissioner [2015] Case C-362/14, 6 October 2015.

Data Transfers

Fashion ID, 29 July 2019, C-40/17, ECLI:EU:C:2019:629

Data Controller, Data Processors

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH, in the presence of Facebook Ireland Ltd (Case C-210/16).

Data Controller

EU-Canada PNR Agreement of 26 July 2017 (Grand Chamber) (EU:C:2017:592)

Data Transfers

Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Case C-311/18), 16 July 2020.

Data Transfers

Nowak (C-434/16, EU:C:2017:994)

Personal Data

Patrick Breyer v. Germany Case C-582/14, 12 May 2016

Consent, Personal Data

Weltimmo s.r.o. v. Nemzeti Adatvédelmi és Információszabadság Hatóság [2015] Case C-230/14, 1 October 2015

Main Establishment

Information note on data transfers under the GDPR to the US | EDPB

Data Transfers

What is Personal Data | UK ICO

Personal Data

Guide to Data Protection Impact Assessments by PDPC Singapore

Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessments (DPIA) Template by UK ICO

Data Protection Impact Assessment (DPIA)

How to manage DPIAs by Data Protection Network (DPN)

Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessment (DPIAs) by APDCAT

Data Protection Impact Assessment (DPIA)

Guide to Data Protection Impact Assessments (DPIAs) by the Irish DPC

Data Protection Impact Assessment (DPIA)

GDPR Risk Assessment by the AEPD

Data Protection Impact Assessment (DPIA)

COMMISSION IMPLEMENTING DECISION of 10.7.2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework

Adequacy Decisions, Data Transfers

Joint Guide to ASEAN MCC and EU SCC

Data Transfers, Standard Contractual Clauses (SCC)

Guidance on ai and data protection 2.0 | UK ICO

Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Knowledge Bases by CNIL

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Methodology by CNIL

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Methodology Mindmap by CNIL

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment – Internet of Things Devices (CNIL)

Data Protection Impact Assessment (DPIA)

Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679

Data Transfers

Artificial Intelligence Risk Management Framework (AI RMF 1.0) by NIST

Guidelines 07/2020 on the concepts of controller and processor in the GDPR

Data Controller, Data Processors, Definitions

Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies

Data Transfers

CIPL Examples of Legitimate Interest Grounds for Processing of Personal Data [PDF] [Official Guidelines]

Lawfulness of Processing, Legitimate Interest

Guidelines 04/2021 on Codes of Conduct as tools for transfers

Data Transfers

AI Meets Media: OpenAI Secures Another Multi-Year Deal with Media Giant

AI models collapse when trained on recursively generated data

AI, Specific processing situations

The NSW AI Assessment Framework

Controllers and Processors, Data Protection Impact Assessment (DPIA)

The government-wide vision on Generative Al of the Netherlands

AI, Data Processing by the Government, Specific processing situations

AI Possible Risks & Mitigations Optical Character Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

AI Possible Risks & Mitigations Named Entity Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

Second Report on the application of the General Data Protection Regulation by EU Commission

Data Subjects Rights, Data Transfers

5310-C Privacy Threshold Assessments and Privacy Impact Assessments by Office of Information Security

Controllers and Processors, Data Protection Impact Assessment (DPIA)

AI system development: CNIL’srecommendations to comply with the GDPR

AI, Specific processing situations

Addictive patterns in the processing of personal data Implications for data protection by AEPD

Definitions, Processing of personal data

AI Auditing Checklist for AI Auditing by EDPB

AI, Specific processing situations

AI, DATA GOVERNANCE AND PRIVACY SYNERGIES AND AREAS OF INTERNATIONAL CO-OPERATION BY OECD

AI, Specific processing situations

Supervision of AI systems in the EU by Dutch DPA and RDI (english)

AI, Specific processing situations

Statement on the interplay between AI Act and GDPR for private sector by the The Austrian DPA

AI, Specific processing situations

AI Development Recommendations to Ensure GDPR Compliance by CNIL

AI, Specific processing situations

The Colorado AI Act “Senate Bill SB24-205”

AI, Specific processing situations

Rules of Procedure by EDPB on the cooperation and respective roles of national SAs and the EDPB Secretariat regarding the submission of complaints in the redress mechanism available to EU individuals in relation to alleged violations of U.S law with respect to their data collected by U.S. authorities competent for national security

Adequacy Decisions, Data Transfers, Risk Management

Artificial Intelligence Risk Management Framework by NIST: Generative Artificial Intelligence Profile

AI, Risk Management, Specific processing situations

Rules of Procedure for the “Informal Panel of EU DPAs”according to the EU-US Data Privacy Framework by EDPB

Adequacy Decisions, Data Transfers

Template Complaint Form to the U.S. Office of the Director of National Intelligence’s Civil Liberties Protection Officer (CLPO) by EDPB

Adequacy Decisions, Data Transfers

[UK] International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

Data Transfers

[UK] International Data Transfer Agreements – Transitional Provisions

Data Transfers

Privacy, seriously by the UK ICO

AI, Privacy by Design, Product Privacy Design

AI and Data Protection risk toolkit by the UK ICO

AI, Data Protection Impact Assessment (DPIA)

Salvatore Manni Case C 398/15

Data Retention, Legitimate Interest, Storage limitation

ANAF Case C‑201/14, 1 October 2015

Automated Decision-making, Data Sharing, Data Transfers, Public Administrative Body

A Guide to Lawful Basis | UK ICO

Consent, Lawfulness of Processing, Legal Obligation, Legitimate Interest, Performance of Contract, Public Interests, Vital Interests

Risk Management and Impact Assessment (DPIA) by AEPD

Data Protection Impact Assessment (DPIA)

The EDPB data protection guide for small business

AI, Risk Management