Privacy Law and Privacy Regulations

German employers face complex data protection requirements when conducting internal investigations. This briefing examines the legal framework governing personal data processing under GDPR and German law, exploring when evidence remains admissible in court and how to balance employee rights against investigative needs.

The Supreme Court of Denmark ruled on a GDPR compensation case where a municipality mistakenly disclosed sensitive health information and financial data to a resident's former spouse during a routine file access request. The case examines whether the unauthorized disclosure of highly sensitive mental health data and income information constitutes non-material damage under Article 82 of the GDPR, and whether the municipality can be exempted from liability.

The European Union's Data Act introduces a groundbreaking "access by design" requirement that fundamentally changes how manufacturers must approach product development for connected devices and IoT products. From September 2026, businesses placing connected products on the EU market must ensure users can directly access their generated data by default, shifting data accessibility from a reactive request-based model to a proactive design imperative.

Artificial intelligence is transforming workforce management across Asia-Pacific, yet most jurisdictions rely on existing employment and data protection laws rather than AI-specific legislation. Governments supplement these frameworks with ethical principles and voluntary guidance, though recent developments in Australia and Malaysia suggest a shift toward more targeted oversight of AI systems that significantly impact workers.

The Court of Justice's Jautiva ruling has clarified that EU company law does not require unrestricted online access to shareholder personal information, even when corporate transparency and anti-money laundering objectives are invoked. Cyprus businesses must now reconsider how they balance statutory filing obligations with data protection principles, particularly when shareholder records can be downloaded in bulk without safeguards. This analysis examines what the judgment means for corporate disclosure pra

How is the Irish Data Protection Commission responding to unprecedented complaint volumes driven by AI-generated submissions? What are the most common mistakes controllers make when handling subject access requests, and why is transparency becoming a critical enforcement focus?