Europe: Privacy

Michael Egan and Michael Scorer explore how organisations are transitioning from AI experimentation to practical implementation in legal workflows. They examine why generative AI adoption has doubled while confidence remains low, and discuss the critical role of defensibility, governance, and human oversight in successful AI deployment.

As artificial intelligence becomes embedded in everyday service delivery across consulting, development, outsourcing, and professional services, suppliers are routinely using AI tools to process client data and generate work product—often without any contractual framework governing how.

Under the Law, the Board has the authority to impose administrative sanctions. It is stipulated that the Board may impose administrative fines for failure to comply with the duty to provide information...

Le Comité européen de la protection des données a adopté un projet de nouvelles lignes directrices relatives à l'anonymisation, visant à moderniser l'avis 05/2014 du Groupe de travail Article 29. Ces lignes directrices proposent un cadre d'évaluation reposant sur trois critères cumulatifs et font l'objet d'une consultation publique jusqu'au 30 octobre 2026.

The DPA published a public announcement regarding the Board’s Principle Decision dated 29 April 2026 and numbered 2026/921, concerning the processing of biometric data for tracking employee working hours.

The Italian Data Protection Authority (“Garante”) imposed a €180,000 fine on Emirates following its investigation into the airline’s processing of passengers’ health data through its Medical Information for Fitness to Travel (“MEDIF”) process. While the authority confirmed that processing health data for the purpose of providing safe travel and special assistance was lawful and did not require consent, it found that Emirates failed to provide passengers with clear and comprehensive privacy information regarding the processing activities.