Legal monitoring.

How far can a company delegate to a machine the power to recruit, evaluate, pay, discipline, or dismiss a worker? The recent penalty imposed by the Dutch data protection authority on the ride-hailing company Uber provides a starting point for an answer. On August 21, the authority levied a fine of 824 […]

While the European regulation on artificial intelligence (AI) entered into force on August 1, 2024, we are now at a pivotal stage in its implementation. A useful reminder of the timeline for applying the Regulation's provisions, which takes into account recent developments, can be found on the European Commission's website.

On June 30, the NGO Noyb, a thorn in the side of tech giants and regulators, sent a letter to the European Commission asking it to schedule the withdrawal from the transatlantic data protection framework (the Data Privacy Framework or DPF). According to the NGO, the United States no longer guarantees any independent oversight of data protection matters.

As we mentioned in a recent article, the data processor is both a central and indispensable player for many data controllers, and a weak link in the data security chain. Recent case law, as well as decisions by data protection authorities, have reiterated that the data controller remains […]

Legal Watch No. 94 – April 2026. Tracking pixels in emails: the CNIL clarifies the legal framework. On April 14, the CNIL published its recommendations on tracking pixels in emails. The recommendation is addressed to all private and public organizations that use tracking pixels, as well as to […]

Legal Watch No. 57 – March 2023. Smart Cameras and Biometrics – What Will Be the Impact of the Law Relating to the Olympic Games? On March 23, the National Assembly adopted Article 7 of the law on the Olympic Games. The bill, passed in a sparsely attended assembly (73 out of 577 members were present), […]

Legal Watch No. 93 – March 2026. Access to personal data: recognition of abuse of rights? A recent decision by the Court of Justice of the European Union (CJEU) clarifies the conditions for individuals' right of access to their personal data, and in particular the circumstances under which […]

Legal Watch No. 92 – February 2026. The subcontractor: between weak link and strategic player. On February 9, the CNIL (French Data Protection Authority) presented its 2025 report on its sanctions and corrective measures: cookies, employee monitoring, and data security are the main subjects of the sanctions imposed in 2025, including the cumulative amount of fines […]

Legal Watch No. 91 – January 2026. Data security in light of the “France Travail” sanction. The sanction adopted on January 29th by the CNIL against France Travail is exemplary in that it reminds us of the essential elements of an effective security policy. In a context of […]

Legal Watch No. 90 – December 2025. Data, AI, cybersecurity: a who's who of the directives and regulations to follow in 2026. Many regulations adopted in recent years will now fully enter into force or reach decisive stages of their implementation. At the same time, new initiatives from the European Commission, particularly the Digital […]