Trained AI models and data subject rights

IMY, the Swedish data protection authority, has issued decisions against four online services that let anyone search for information about private individuals: Lexbase, Krimfup, MrKoll and Upplysning. All four hold a voluntary publication certificate, which gives a database the constitutional protection of the Swedish Fundamental Law on Freedom of Expression. Under Chapter 1, Section 7, first paragraph, of the Swedish Data Protection Act, the GDPR does not apply where it would conflict with that law or with the Freedom of the Press Act.

IMY relied on the Court of Justice's judgment of 9 July 2026 in C-199/24 Legal Newsdesk Sweden, a reference from a Swedish district court involving the company behind Lexbase. According to the Court's press release, the Court held that Member States may not provide exemptions under Article 85 for processing carried out for purposes other than those the article lists. On the Court's test, processing is journalistic where it aims to disseminate information, opinions or ideas to the public, in line with press ethics, with editorial work or at least an editorial line, and with the facts checked. The Court added that a paid online database of criminal convictions does not appear to meet those conditions, subject to the national court's assessment.

Applying that test, IMY found that the Swedish exemption is not necessary to reconcile data protection with freedom of expression for services of this kind, and so is not compatible with Article 85(2) GDPR. It found that the Swedish rules cannot be read in conformity with EU law, and that EU law therefore takes precedence over the constitutional rules and Section 7. It also found that none of the four services processes data for journalistic purposes, and that the use of a database by journalists does not make the service journalistic.

The findings differ by service:

1. Lexbase, run by Legal Newsdesk Sweden AB, and Krimfup, run by Fuplex AB: processing of data on criminal convictions and offences in breach of Article 10 GDPR. IMY reprimanded each and ordered it, within two months of the decision becoming final, to change the service so that a search by name, personal identity number or address no longer shows such data about the person searched.
2. MrKoll, run by Nusvar AB, and Upplysning, run by Upplysning Checknode AB: failure to comply with erasure requests under Article 17(1) GDPR. In the case of MrKoll, requests were dealt with only after IMY intervened, and the company showed no ground for refusing them. IMY reprimanded each.

IMY, which had received about 3 800 complaints against the companies, imposed no fines. It said the scale of the processing would normally justify one, but took into account the constitutional protection the companies held and the absence of case law until recently. The decisions can be appealed to the Administrative Court in Stockholm, through IMY, within three weeks.

By a decision of 22 October 2026, the CNIL's restricted committee fined FNAC DARTY PARTICIPATIONS ET SERVICES 6 million euro and FNAC DIRECT 1 million euro for breach of Article 82 of the French Data Protection Act, the provision on cookies and other trackers, which transposes Article 5(3) of the ePrivacy Directive.

The decision concerns the Fnac mobile app only. The app sent requests to a third-party domain, and those requests contained an identifier assigned to the user by Fnac and information on their activity, such as the products viewed. The data were used to show personalised recommendations of complementary and similar products, and to train the recommendation algorithm. The requests were sent even after the user had chosen to continue without accepting. The CNIL held that neither exemption in Article 82 applied: the tracker's sole purpose was not to enable or facilitate a communication by electronic means, and it was not strictly necessary for an online communication service the user had expressly requested. Prior consent was therefore required.

In setting the amount, the CNIL took into account the tracker's disregard of users' refusal, the large number of the app's users, and the CNIL's settled position on trackers used for personalisation and commercial targeting. The companies must show, within one month of notification of the decision, that the app now obtains consent where required, under a penalty of 10 000 euro per day of delay. The case began with a complaint by noyb, a campaigning organisation, in 2023; the CNIL inspected the app in March 2024.

The ING Bank Śląski fine

On 23 October 2026 the Voivodeship Administrative Court in Warsaw dismissed ING Bank Śląski's complaint against a UODO decision fining it 18 416 400 zloty for breach of Article 5(1)(a), (b) and (c) and Article 6(1) GDPR. According to UODO, after amendments to the Polish anti-money laundering act took effect on 13 July 2018, the bank's procedures required the identity documents of customers and prospective customers to be scanned, without an individual risk assessment, in every case the procedures listed. Scanning was often a condition of carrying out an operation for the customer. According to UODO, scanning also took place in situations unrelated to anti-money laundering duties, such as a complaint about an ATM. In UODO's view, which the court upheld, scanning is lawful under the anti-money laundering act only where it is necessary to apply the required security measures on the basis of an individual risk assessment. The judgment is not final and can be appealed to the Supreme Administrative Court.

Explicit consent to health data

On 6 October 2026 the Supreme Administrative Court, in case III OSK 1943/24, dismissed the appeal of a firm that helps people claim compensation, mainly after road accidents. UODO had fined its partners 45 697 zloty and ordered them to stop processing prospective clients' personal data, including health data, without a legal basis, after the firm collected such data from public sources and through follow-up calls, before any contract was concluded. As reported by UODO, the court held that explicit consent to the processing of health data may be given orally, but that under Article 7(1) GDPR the controller bears the burden of proving it and cannot shift that burden to the authority or to the data subject. According to UODO's account, the court also held that silence, the absence of an objection, starting a conversation or sending medical documents does not by itself show explicit consent.

Italy: Barbuti

By a decision of 23 September 2026, reported in its newsletter of 29 October 2026, the Garante fined Barbuti S.p.A. 5 000 euro. A customer who could not unsubscribe from promotional text messages asked for erasure by writing to the general mailbox linked to the company's website contact form, which the company admitted no one was assigned to monitor. He received an automatic acknowledgement but no reply, and the messages continued. Relying on the EDPB's Guidelines 01/2022 on the right of access, the Garante noted that a request sent through a channel other than the preferred one is in general valid, and that a controller need not answer a request sent to a random address where it has provided an appropriate channel. It found that this request was clear and could easily have been redirected, and that the messages gave no contact point for exercising rights. It found breaches of Articles 5(2), 12 and 17 GDPR and of Article 130 of the Italian Data Protection Code. The company must take measures so that its promotional messages comply with Article 130(5) of the Code, which requires a contact point for exercising rights, and report to the Garante within 30 days.

Romania: Auchan

In a press release of 30 October 2026, ANSPDCP, the Romanian supervisory authority, reported that it had fined Auchan România S.A. 41 908 lei, about 8 000 euro, for breach of Article 32(1)(b) and (2) GDPR. An attacker compromised an administrator account on one of the company's security systems and accessed the usernames, names, email addresses and passwords of a significant number of internal users. The investigation, which followed the company's own breach notification, found that the company had not set specific requirements for secure access to its network storage equipment. ANSPDCP ordered it to ensure that its IT equipment is accessed only from the internal network and that any external access uses, at least, a VPN and multi-factor authentication together.