Today in European Digital
Europe's data protection board makes GDPR sanctions the default
National data protection authorities have less room to choose. New guidelines from the European Data Protection Board, as Agenda Digitale reads them, restrict their discretion over sanctions and set a strong presumption that any GDPR violation that is not minor ends in one. A sanction stops being one option on a menu.
That lands in the middle of a push the other way. German industry and Brussels were both arguing last week for a looser GDPR, and a Commission proposal on Europol and a Council presidency text on AI training data both pull the same law toward weaker protection. The enforcers are not waiting for that fight to end. They are hardening enforcement of the law as it stands, at the point where it bites, which is the only part of the argument they control.
New research from BEUC, the European consumer organisation, puts the cost to European consumers of weaker privacy rules at over 100 euros a year, through Big Tech's exploitation of their data. Its companion report calls strong GDPR enforcement an economic asset, not a burden, and asks for consent-based processing and more consumer control.
Privacy's defenders have started arguing in euros.
On AI, Washington settled for a pledge. Google, Meta, OpenAI and other tech giants signed a voluntary AI security accord with Donald Trump, pledging internal checks and external review. Three of the signatories are already committed to more detailed obligations under the EU AI Act. Detail, then, is not what these firms resist. The accord's weak point is the word voluntary.
Consumers…
In-game currencies are now a case for Europe's consumer watchdogs. They are investigating nine games, Minecraft and Valorant among them, over pricing, refund rights and possible dark patterns, Heise reports. At the centre is whether converting real money into a game's own currency hides what a purchase actually costs. It is an investigation, not a ruling.
Businesses…
A presumption of sanctions changes the arithmetic of every privacy investigation. Agenda Digitale's reading is that businesses must reevaluate how they defend themselves, because arguing that a violation deserves no penalty at all just got harder.
Software makers face a tighter clock. Under the Cyber Resilience Act, Silicon Republic reminds Irish firms, an actively exploited vulnerability must be reported within 24 hours. Any manufacturer marketing software under its own name is in scope, whether the product is paid or free.
Government…
A Dutch non-profit has filed an Aarhus Convention complaint accusing the European Commission of deliberately hiding how much energy and water data centres use, The Next Web reports. The complaint claims officials created that secrecy to protect the tech industry's business interests. These are accusations, not findings. Still, infrastructure whose basic consumption figures the public cannot see is infrastructure the public is being asked to take on trust.
Further today
- UK AI startup Zenithon raises $10M for extreme physics world models · Tech.eu
- Paris-based Inbolt raises €11 million for industrial robot vision · EU-Startups
- European Digital Identity: Why the Wallet Will Be Much More Than an App · Agenda Digitale
- Berlin-based Restate raises $20M for AI agent infrastructure · Tech.eu
- Blackswan Space raises €2.5M for autonomous spacecraft navigation · Tech.eu
- Deutsche Telekom and Cloudflare Announce Direct Data Exchange Partnership · Heise Online
- Everphone secures €15 million to finance new devices for corporate customers · EU-Startups
- Swedish Voi Secures €150M Credit Facility to Scale E-Scooter Fleet · EU-Startups
- European Commission boosts Horizon Europe funding by €500m · Silicon Republic
- Estonian cybersecurity firm Blackwall becomes a unicorn with 368% valuation jump · Tech.eu
- Aspirity Partners Invests Over €100 Million in Danish IoT Firm Onomondo · EU-Startups
Why this matters for European digital sovereignty
Guidelines steer the enforcers; the Digital Omnibus would rewrite what they enforce. A presumption of sanctions is worth only as much as the obligations it attaches to, so if the loosening now under negotiation narrows those obligations, a stricter penalty logic ends up policing a smaller law. For the EDPB's shift to amount to something, it has to show up where penalties are actually set: in national decisions, not in commentary about them. The marker worth watching is the first decision by a national data protection authority that explicitly applies the new presumption to impose a sanction on a violation it classes as not minor. That decision would show whether the Board's guidance has changed practice, or only the vocabulary.
Sources
- EDPB guidelines restrict national authorities' discretion and set a strong presumption of sanctions for non-minor GDPR violations · Agenda Digitale
- Research puts the cost to consumers of weaker privacy rules at over 100 euros a year · BEUC
- Report calls strong GDPR enforcement an economic asset and argues for consent-based processing · BEUC
- Tech giants signed a voluntary AI security accord with Donald Trump; three signatories already have more detailed AI Act obligations · Agenda Digitale
- EU consumer authorities investigate in-game currencies in nine games · Heise Online
- Cyber Resilience Act requires 24-hour reporting of actively exploited vulnerabilities · Silicon Republic
- Dutch non-profit files Aarhus Convention complaint over data centre energy and water data · The Next Web
This daily debrief is published every evening. Source links lead to the original reporting.
European Alternatives You Might Like
Pixelfed
Pixelfed is a decentralized, open-source social media platform for sharing images. Users can upload and share photos, follow other users, and interact through likes, comments, and shares. Utilizing the ActivityPub protocol, Pixelfed allows for federation, enabling users to interact with individuals on other compatible platforms. It is designed for photographers and anyone seeking a privacy-focused, community-driven alternative to centralized image-sharing services.
Element (Matrix)
Element is a secure, decentralized communication platform built on the Matrix protocol. It allows users to send end-to-end encrypted messages, share files, and participate in group chats. Key features include voice and video calls, bridging with other communication platforms like Slack and Discord, and the ability to host your own server for enhanced privacy and control. Element is suitable for individuals, teams, and organizations seeking secure and private communication, and is particularly beneficial for those who value data sovereignty and open-source solutions.
SoundCloud
SoundCloud is a digital audio distribution platform where users can upload, promote, and share their original music and audio. Key features include music streaming, direct messaging, commenting, and the ability to follow artists and playlists. This platform is primarily used by independent musicians, DJs, and podcasters to share their work, connect with listeners, and build an audience. SoundCloud offers a vast library of user-generated content, providing access to a wide range of music and audio not always available on other streaming services.
Ecosia
Ecosia is a search engine that utilizes ad revenue to fund tree-planting initiatives. Users can perform web searches using the same technology as Bing, accessing search results, images, videos, and news. A counter displays the number of trees planted through user searches, and the company reports on its financial activities, including its impact on the environment and carbon neutrality. Ecosia's primary benefit is its commitment to environmental sustainability, appealing to users who want to support reforestation efforts while browsing the internet.