EuroCloud
EuroCloud Europe is a European non-profit and vendor-neutral organisation delivering know-how, legal orientation, quality guidance and best-practice policies for the global usage of cloud services.
Past events
EuroCloud Swiss Event Cloud security - How to gain trust EuroCloud Swiss Zurich, Switzerland
Zurich, Switzerland
Cloud security - How to gain trust
Gaia-X Summit 2022 The Gaia-X Summit 2022 Paris has started and the official Gaia-X Hub Austria is well represented. Gaia-X Paris, France
Paris, France
The Gaia-X Summit 2022 Paris has started and the official Gaia-X Hub Austria is well represented.
7th INPLP conference The yearly INPLP conference has reached its 7th year. Sourcing International Vienna, Austria
Vienna, Austria
The yearly INPLP conference has reached its 7th year.
The European Forum Alpbach EFA is a platform that drives ideas for an empowered and democratic Europe. European Forum Alpbach Alpbach, Austria
Alpbach, Austria
EFA is a platform that drives ideas for an empowered and democratic Europe.
FIC International Cybersecurity Forum 2022 Europe's leading event on digital security and trust FIC Lille, France
Lille, France
Europe's leading event on digital security and trust
6th INPLP Conference The yearly INPLP conference has reached its 6th year. Sourcing International Vienna, Austria
Vienna, Austria
The yearly INPLP conference has reached its 6th year.
Latest News
Read, shred and forget? New Swedish case law and the manual-processing gap in the GDPR
Swedish employers routinely ask applicants and employees to show an extract from the criminal records register (belastningsregistret). Article 10 GDPR allows criminal conviction data to be processed only under official authority or where law authorises it, which most private employers lack. In AD 2026 nr 27 (case A 156/24), the Labour Court held that an employer who merely receives, reads and destroys such an extract falls outside the GDPR altogether.
A Review of the EDPB’s Anonymization Guidelines in Light of EDPS v SRB
When, and for whom, does information constitute personal data? The Court of Justice of the European Union (CJEU) addressed this question in EDPS v SRB (C-413/23 P). Its judgment clarified the treatment of pseudonymized data but prompted further debate over implementation. The Digital Omnibus proposal sought to amend the GDPR’s definition of personal data; the June 2026 compromise text removed that amendment and reassigned the proposed pseudonymization powers to the European Data Protection Board (EDPB). Against this background, the EDPB opened its draft Guidelines 02/2026 on Anonymization for consultation on 8 July 2026. The draft reflects much of the CJEU’s reasoning but, in our view, also extends beyond it. This article follows the dispute from the initial complaints through the judgment and the EDPB’s subsequent guidance.
Where Space Data Lands. Ground Stations and the Reach of Data Protection Law
During 2026 the conversation about privacy in outer space has turned toward orbit itself, as proposals for orbital data centres have led scholars, practitioners and the European Parliament’s foresight service to ask whether Article VIII of the Outer Space Treaty, which keeps a space object under the jurisdiction and control of its State of registry, could make that State a digital flag state for the data processed on board. That debate deserves attention, although it overshadows a more immediate fact, which is that almost all personal data collected or relayed by satellites still comes down to Earth through an antenna located in a specific country and subject to a specific data protection law. Under the Ground Station as a Service model, in which operators book antenna passes on demand and receive the data directly in the cloud, a single satellite may land data in several jurisdictions in one day, so the question of which law applies, and to whom, is increasingly answered at the antenna, and Ecuador, whose equatorial position makes it an attractive site for ground infrastructure, offers a useful case study because its law and the GDPR reach different results for the same downlink.
The US Regulatory Landscape of “Surveillance Pricing”
Ever wonder if you’re paying more for the exact same item as another consumer? You may be. Pricing that is set for an individual consumer using that consumer’s personal data — often called “surveillance pricing” or “personalized algorithmic pricing” — has quickly moved from an interesting academic discussion and policy debate to an active compliance problem.
The Price of a Face
When a public hospital in Madeira introduced facial recognition to monitor staff attendance, it reignited a fundamental question in European data protection law: can biometric processing be justified when simpler alternatives exist? This article examines the legal framework governing biometric attendance systems under the GDPR, Portuguese law, and the EU AI Act, and argues that the principle of necessity (not technological capability) must remain the decisive test.
The CNIL's new approach to AI models Memorisation, extractability and anonymisation under the GDPR
As generative AI becomes increasingly powerful, the CNIL’s 2026 guidance shifts the GDPR debate from how personal data is used in training to whether AI models themselves can retain and reveal information about individuals. By focusing on memorisation, extractability, and anonymisation, the framework offers a practical roadmap for assessing when AI models may still pose privacy risks and therefore remain subject to European data protection law.
