Global AI Privacy & Compliance Analyst: 2026-09-22
7 minutes in total
Data Protection Commission (Ireland), 2026-09-21. Read, 4 min.
Ireland’s Data Protection Commission announced its final decision in an own-volition inquiry, opened in February 2020, into Google Ireland’s processing of location data in Web & App Activity, Location History, and Location Accuracy between 25 May 2018 and 4 February 2020, finding GDPR infringements on lawfulness and fairness, accountability, transparency, and retention. It imposed administrative fines totaling €403 million and ordered Google to bring its processing into compliance within six months, with the full decision to follow.
Why it matters for this role: You keep data practices compliant across jurisdictions, and this decision shows how a lead authority applies lawfulness, transparency, and retention duties to a global platform’s location-tracking features.
EDPB adopts guidelines on when to impose a GDPR fine and finalizes its DSA-GDPR interplay guidelines
European Data Protection Board, 2026-09-21. Read, 3 min.
At its 21 September plenary the EDPB adopted guidelines on applying the power to impose administrative fines alongside other corrective powers under the GDPR, setting out a five-step methodology that data protection authorities should follow when deciding whether to fine, with 14 practical examples, and opened them to public consultation until 13 November 2026. It also adopted the final version of its guidelines on the interplay between the Digital Services Act and the GDPR, which will be published after linguistic checks.
Why it matters for this role: Harmonized fining criteria change how you estimate exposure across EU authorities, so the five-step methodology and the non-minor fine presumption belong in how you assess and advise on risk.
Sign in to take it.