GDPR Under Pressure, Sovereign Silicon and a Smart Glasses Backlash

The fiercest argument of the week was about who may use Europeans' data, and on what terms. Leaked documents published by noyb show a proposal from the Irish Council Presidency, tied to the Digital Omnibus negotiations, under which, noyb says, processing personal data for AI could become automatically lawful. Max Schrems' organisation calls it a "digital expropriation" that would open decades of collected data to AI companies. EDRi described the Council discussions as deregulation disguised as simplification, warning that the line between pseudonymised and genuinely anonymous data risks being blurred. The sharpest point came via netzpolitik.org: a change sold as help for European business would, the data protectionists argue, mainly benefit US corporations.

The Commission opened a second front of its own. Heise reported on a proposed regulation that would ease data protection safeguards for Europol, classifying several of them as administrative burdens, with the stated aim of speeding up mass data collection and the use of AI in policing.

Not all of the pressure comes from Brussels. A Bitkom survey reported by Heise found that 90 percent of German companies want the GDPR reformed, and 71 percent say data protection holds back digitalisation. That is the constituency the simplification agenda draws on, and it is why this debate will not fade quickly.

The rulebook is being rewritten in one room while it is enforced in the next.

Enforcement, meanwhile, carried on. Ireland's Data Protection Commission fined Google 403 million euros for collecting and storing location data after the GDPR took effect: a concluded decision, not an opening move. The European Data Protection Board finalised its guidelines on how authorities should set GDPR fines alongside their other corrective powers, and adopted final guidelines on how the Digital Services Act interacts with data protection rules. On a smaller scale, CNIL closed an injunction against Solocal Marketing Services once the company had put checks in place on consent obtained through data brokers.

The DSA also became a transatlantic matter. According to The Register, the US government is seeking to join Elon Musk's legal challenge against the EU's 120 million euro DSA fine, arguing that the Commission overstepped its jurisdiction over American companies. Whatever the court decides, enforcing EU digital law has become a diplomatic question as much as a legal one.

Closer to everyday life, privacy regulators and prosecutors in three countries turned to smart glasses in the same week that Meta presented its largest lineup yet. The Dutch Autoriteit Persoonsgegevens said that filming recognisable people with camera glasses is nearly always forbidden, and advised organisations to ban their use. German data protection authorities reminded wearers that they themselves must obtain consent or otherwise justify the processing, singling out unseen recording and AI training as risks. In Paris, Heise reported, prosecutors are investigating secret filming with connected glasses. And Bits of Freedom drew attention to Meta's removal of a satirical Dutch video criticising its AI glasses, which had reached half a million views, on the grounds that it broke rules against bullying.

Public space is under similar scrutiny. Berlin began a four-week pilot of automated behaviour scanners at Kottbusser Tor, netzpolitik.org reported, with further tests planned at Alexanderplatz and Warschauer Brücke by 2027. The same outlet described mounting criticism of Germany's EUDI wallet app d-you, due in January 2027, while consumer advocates want pseudonymity and selective disclosure built in from the start. The digital euro was pitched on similar terms: Commissioner Valdis Dombrovskis promised "cash-like privacy" and less reliance on foreign card schemes, according to Silicon Republic, with a target of going live by 2029. The common thread is that public digital infrastructure will be judged on whether it protects the people who use it.

The week's clearest step toward digital sovereignty came in hardware. Jupiter, Europe's fastest supercomputer, is integrating French-designed SiPearl Rhea1 processors, which The Register framed as a move away from reliance on US hardware in exascale computing. Germany's SPRIND and the Netherlands' NADI launched a joint 40 million euro challenge to speed up pan-European AI chip design. And Brussels unveiled a rating scheme and label for data centres covering energy and water use, with labels expected by 2027 and ratings that, as The Next Web explained, will reflect reused heat and grid flexibility. The EU wants to triple data centre capacity; the label is meant to make that growth visible on the grid and in the water supply.

Private capital followed some of the same lines. Finnish-founded Verda raised 189 million dollars for its AI cloud and compute expansion, passing a one billion dollar valuation, Tech.eu reported. Much smaller but telling was Italy's Clastix, which raised 2.9 million euros with backing from Mistral and CDP Venture Capital to build sovereign Kubernetes infrastructure: a European AI company investing in the layer beneath it. Defence technology drew the rest. Swedish startup Terasi secured 11 million euros in seed funding, co-led by the NATO Innovation Fund, for secure communications for European armed forces, while Danish investors Final Frontier and Myriad merged and launched a 100 million euro fund for early-stage defence tech.

Public institutions tried to widen that pipeline. The Commission and the EIB Group launched an Institutional Investors Pact, under which thirteen investors committed to channel money through existing vehicles into European scale-ups. And twenty-one European investors joined NATO's DIANA Capital Network, which aims to help scale defence and dual-use innovation.

Ambition is not delivery, and Xataka was quick to note that Spain's new AI strategy, including an AI chip gigafactory, echoes a 2020 plan that made slow progress. Still, the week showed a Europe building sovereign capacity in silicon and cloud while arguing, with rising intensity, over the data rules that were supposed to make its digital model distinctive.