European Union: Data Protection

Ireland's new High Court rules establish a clear procedural framework for representative consumer actions, while the landmark ICCL v Microsoft case clarifies key questions about admissibility requirements and the burden of proof under GDPR. These developments provide businesses and qualified entities with greater certainty about how collective redress claims will be conducted, though significant cost barriers remain despite the new court fee exemption.

The Council has adopted its position on the EU Pharmaceutical Package at first reading, with legally and linguistically revised texts now available. While the main elements of the political compromise remain intact, several clarifications warrant attention as companies refine their implementation plans and the legislative process continues toward completion.

The Swedish Cybersecurity Act has been in force for eight months, with supervisory authorities beginning enforcement activities focused primarily on notification obligations and incident reporting.

Details of the new EU regime under development are available, as the EU adopts its proposal for a Regulation which would replace the public procurement Directives.

The European Commission has proposed the EU KIDS Act, introducing an EU-wide framework for minors' access to digital services through age-based restrictions and safety-by-design requirements. The proposal establishes tiered access rules for social media and video-sharing platforms, with independent accounts prohibited under age 13, guardian supervision required for ages 13-15, and autonomous access permitted from age 15. Digital service providers will need to navigate complex age assurance requirements whil

European financial supervisors issue a joint declaration on cybersecurity risks from frontier AI models, while the CJEU clarifies limits on intermediary liability exemptions and restricts public access to shareholder data.

The Supreme Court of Denmark ruled on a GDPR compensation case where a municipality mistakenly disclosed sensitive health information and financial data to a resident's former spouse during a routine file access request. The case examines whether the unauthorized disclosure of highly sensitive mental health data and income information constitutes non-material damage under Article 82 of the GDPR, and whether the municipality can be exempted from liability.

The European Union's Data Act introduces a groundbreaking "access by design" requirement that fundamentally changes how manufacturers must approach product development for connected devices and IoT products. From September 2026, businesses placing connected products on the EU market must ensure users can directly access their generated data by default, shifting data accessibility from a reactive request-based model to a proactive design imperative.

The European Commission is poised to introduce sweeping restrictions on children's access to digital platforms, including social media, video sharing services, AI chatbots, and online games. The proposed EU Kids Act would establish age-based limitations and verification requirements across all EU member states, potentially superseding individual national measures currently under consideration in countries like Ireland.