European Union: Data Protection

The Court of Justice of the European Union has ruled that national competition authorities may seize business emails during dawn raids without prior court authorization, provided the seizures are legally grounded and strictly limited to the inspection's subject matter. While the decision grants authorities significant power, it establishes important safeguards, particularly for mixed-use devices containing both professional and private data, which may require prior judicial review before access is permitted

On 30 June 2026, the Irish Data Protection Commission (“DPC”) released its 2025 annual report (“Report”).1 The Report covers the eighth year of the DPC’s enforcement of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

A recent US Supreme Court decision has cast doubt on the independence of the Federal Trade Commission, potentially undermining the legal foundation of the EU-US Data Privacy Framework. The ruling allows the President to remove FTC commissioners without cause, raising questions about whether the framework still provides EU data subjects with adequate protection. Privacy advocacy groups are already preparing legal challenges that could invalidate this third iteration of transatlantic data transfer arrangement