October 26, 2026 · 27 min read · Data protection

GDPR reform under the Digital Omnibus: what the Council's mandate means for access requests and for lawyers

GDPRAccess RequestsDigital OmnibusLitigationData Protection

On 21 October 2026 the ambassadors of the EU member states agreed the Council's negotiating position on the Digital Omnibus, the package that would make the most extensive changes to the GDPR since it began to apply in 2018 (1). For litigators one change matters more than the rest. The Commission had proposed that a controller could refuse an access request where the data subject "abuses the rights conferred by this regulation for purposes other than the protection of their data" (2). Read literally, that clause would have closed a route familiar to employment, insurance, banking and medical-liability lawyers: using Article 15 of the GDPR to obtain the other side's records before a claim is filed. The Council struck it out (3).

In its place the Council would let a controller refuse a request where it can demonstrate an "abusive intention", the test the Court of Justice applied in March 2026 when it held, in Brillen Rottler, that even a first access request can be refused as excessive (4). The European Parliament's rapporteurs want to go further and write into the regulation's recitals that using data protection rights "as an enabler of other rights" is not abusive (5). Parliament's committees have not voted yet (6).

This guide explains where the reform stands, what the three texts say about access requests and what the Court has already decided, how Dutch, German and French courts deal with access requests in disputes, which other GDPR changes the Council wants, and what lawyers should do now, whether they send access requests, answer them for clients or receive them at their own firm.

The short answer: Nothing has changed yet. The GDPR applies as adopted in 2016 and as interpreted by the Court of Justice. Under that case law an access request needs no reason and may be used to prepare a claim, but a controller may refuse even a first request if it demonstrates, unequivocally, that the request was made with an abusive intention, such as manufacturing a damages claim. The Council's mandate would write an abusive-intention test into Article 12(5) and drop the Commission's plan to exclude requests made for other purposes. Parliament has no position yet, and negotiations between the institutions can only start once it has one.

Where the GDPR reform stands

The Commission published the Digital Omnibus on 19 November 2025 as part of its simplification agenda (2). It is a single regulation that amends the GDPR, the data protection rules for the EU institutions, the ePrivacy Directive, the Data Act and the incident-reporting rules of the NIS2 Directive, and repeals the Data Governance Act and three other instruments. A companion proposal on the AI Act, presented the same day as a separate regulation, moved faster: the Council reports that the AI legislative act was adopted on 29 June 2026 (1). The data part, which contains the GDPR amendments, is still in the legislative procedure:

The next step is a vote in the joint ITRE and LIBE committee, followed by Parliament's mandate and then negotiations with the Council. On 26 October 2026 Parliament's procedure file still read "Awaiting committee decision" (6). The Council's release refers to the aim, set in the "One Europe, One Market" roadmap signed in April 2026, of concluding all simplification packages by the end of 2027 (1).

Two points of timing matter for advice. First, nothing in the mandate or in Parliament's draft binds anyone until a regulation is adopted and published. Second, under the Council's text the GDPR amendments, including the access-request rules, would apply from the day the regulation enters into force, the third day after publication, with no transition period. Only the new breach-notification rules would wait 18 months, and reporting breaches through the new national entry points 30 months (3). If that approach survives the negotiations, the change will take effect almost as soon as the text is published.

Subject access requests as a litigation tool

Article 15 gives a person the right to know whether a controller processes data about them and, if so, to receive a copy of those data with information about purposes, recipients, sources and retention (8). The first copy is free. The controller must answer within one month, extendable by two further months for complex or numerous requests, and if it refuses it must say why and point to the right to complain and to go to court (Article 12(3) and (4)). The only general ground for refusal is in Article 12(5): requests that are "manifestly unfounded or excessive, in particular because of their repetitive character", which the controller has to demonstrate (8).

For a lawyer preparing a dispute, the subject access request (DSAR) is a remarkable instrument. It reaches all personal data the opponent holds about the client: emails that mention them, interview notes from an internal investigation, a claims handler's file notes, a bank's assessment, medical records. It requires no showing of relevance, costs nothing and runs on a statutory clock. In legal systems without pre-trial discovery, which means most of continental Europe, it can produce in a month what a court order for the production of documents takes far longer to obtain, where one is available at all. Employees use it after a dismissal, policyholders in disputes over premium increases, patients before a medical-negligence claim, customers against banks and lenders.

Controllers object that this turns a data protection right into a disclosure weapon. The Commission agreed: its explanatory memorandum describes the amendment as clarifying the situation "where the right of access is abused by data subjects for purposes other than the protection of their personal data" (2). Supervisory authorities and Parliament's rapporteurs disagree, and the Court of Justice has so far declined to treat the requester's purpose as decisive.

What the Court of Justice has already decided

FT, October 2023. A patient who suspected errors in his dental treatment asked his dentist for a free copy of his medical records; the referring court noted that he wanted it "with a view to triggering the liability" of the dentist (paragraph 23). The Court held that neither Article 12(5) nor Article 15 makes a first copy conditional on reasons and that the controller may not demand them (paragraph 38). Recital 63, which says access serves to "be aware of, and verify, the lawfulness of the processing", cannot be read as meaning that a request "must be rejected if it concerns an objective other than that" (paragraph 43). The answer: the first copy is free "even where the reason for that request is not related to those referred to" in recital 63 (paragraph 52) (9).

Addiko Bank, May 2024. In a reasoned order on a Croatian reference, which it could answer from existing case law, the Court confirmed that the obligation to provide a copy applies even where the request is motivated by a purpose other than those mentioned in recital 63 (10).

Österreichische Datenschutzbehörde, January 2025. The Austrian supervisory authority had refused to deal with a person who had filed 77 similar complaints against different controllers in about 20 months. The Court held that the number of complaints alone does not make them excessive: the authority must establish "an abusive intention" in the light of all the circumstances (paragraph 50), for example that the number of complaints is explained by "some other purpose, unconnected with the protection of those rights" (paragraph 56). The Court rooted the exception in the general principle that EU law cannot be relied on for abusive or fraudulent ends (paragraph 49) (11).

Brillen Rottler, March 2026. A man living in Austria subscribed to the newsletter of a family-run optician in Arnsberg, Germany, and, on the Court's account of the facts, sent an access request thirteen days later. The optician refused it as abusive, relying on reports, blog posts and law-firm newsletters that described the same pattern with other companies: subscribe, request access, claim damages. He claimed at least €1,000 (4). The Court held:

One sentence in the judgment will be quoted against every litigation-driven request. Paragraph 40 says an abusive intention "may be" found where the request was made "for a purpose other than that of being aware of the processing of those data and verifying the lawfulness of that processing, in order to be able, subsequently, to obtain protection of his or her rights under the GDPR" (4). Read alone, that could cover a dismissed employee who wants their personnel file for an unfair-dismissal claim. In our view, read with the rest of the judgment, it does not. The formula is borrowed from Österreichische Datenschutzbehörde (paragraphs 50 and 56), a case about a serial complainant. The Court requires both elements of abuse, describes the advantage sought as one "from the EU rules", insists on restrictive interpretation and strict criteria, and cites FT without any suggestion of departing from it. The operative part puts it plainly: the request must have been made not for the purpose of awareness and verification "but with an abusive intention, such as that of artificially creating the conditions laid down for obtaining an advantage from that regulation". The employee did not set up the processing in order to complain about it; the data exist because of the employment relationship. Brillen Rottler is about the manufactured claim: a relationship entered into voluntarily, a request within days, a pattern repeated across many controllers. That is our reading, and controllers will test it in court.

The three texts on access requests compared

The Digital Omnibus would amend Article 12(5) and its recital. The three institutions now have three different texts.

The Commission's proposal (November 2025)

The Council's mandate (October 2026)

The Parliament rapporteurs' draft (June 2026)

The Council gave the European Data Protection Board and the EDPS much of what they had asked for: abuse linked to "an abusive intention (e.g., evident intention to cause harm to the controller)" rather than to purposes, and no rule against broad requests. It did not follow their call to drop "reasonable grounds to believe" and keep the current burden of proof (7). On that point the Council and the Parliament draft part company.

Our reading of where this leaves the law. The Council, Parliament's rapporteurs and the Court now converge on one idea: the purpose for which access is sought is not, in itself, a ground for refusal. Only the Commission's text still ties refusal to purpose, and the Council has struck that clause out. What remains disputed is how much a controller has to prove and how the test is phrased. Brillen Rottler requires the controller to demonstrate abusive intent "unequivocally". The Council's "reasonable grounds to believe" is a lower formula, and if it is enacted controllers will argue that the legislature deliberately relaxed the standard. Litigators should watch that phrase in the negotiations more closely than any other.

How courts in the Netherlands, Germany and France handle access requests in disputes

National courts were applying the Court's line before the Council moved, and their decisions show what the abusive-intention test looks like in practice.

The Netherlands

The Dutch starting point predates the GDPR. In 2007 the Hoge Raad held in Dexia that a person asking for access under the former Data Protection Act need give no reasons, and that the procedural rule on the production of documents, then Article 843a of the Code of Civil Procedure, does not limit that right (12). The reform of Dutch evidence law in force since 1 January 2025 kept that division: the new disclosure duty in Article 194 of the Code expressly does not apply to a party's own personal data, which the legislative history sends to the GDPR (13).

On 29 September 2026 the Gerechtshof Den Haag applied Brillen Rottler on appeal in summary proceedings (kort geding) brought by a player who wanted his data from an online casino operator to support a claim for his gambling losses. The court held that under current law a request is excessive only if both the objective and the subjective element of abuse are present, and that the operator had not put forward enough to establish deliberate abuse. It also dealt with the Digital Omnibus head-on: the Commission's proposed wording is not law in force, and even that wording would not make a request abusive merely because it is also made for reasons other than data protection (14). The Gerechtshof Arnhem-Leeuwarden had already held in 2024, in a dispute over the interview reports of an investigation that KPMG had carried out into a former municipal official for his employer, that wanting to use documents in other proceedings does not make a request an abuse of the right of access; abuse may arise where the right is used solely to harm the controller (15). In July 2026 the Rechtbank Noord-Holland reached the opposite result for a man who had sent about 90 access requests in eighteen months, sued some twenty companies with near-identical petitions and, through an intermediary, demanded a settlement: the court found abuse of rights and held his applications inadmissible (16). That is the Brillen Rottler pattern; the ruling is a first-instance decision.

Two Dutch decisions matter when the request is aimed at a lawyer or at legal advice. In 2021 the Gerechtshof Den Haag rejected a request that a dismissed adviser of a public body had sent to the law firm acting for his former employer: the advocaat's statutory duty of confidentiality is a restriction under Article 23 GDPR, implemented in Article 41 of the Dutch GDPR Implementation Act (UAVG), and also bars access through Article 15(4) (17). In 2024 the Hoge Raad upheld a refusal to give a former court employee access to the assessments contained in her employer's request for advice on their employment dispute and in the advice itself. Article 41 requires a concrete weighing of interests, and the rights and freedoms of others that it protects include the right under Article 47 of the Charter to take advice on one's position in a dispute (18).

Germany

German civil procedure has no pre-trial discovery, which helps explain why Article 15 is used so heavily, from disputes over private health insurance premium increases to dismissal cases. On 18 December 2025 the Bundesgerichtshof held that a request is not barred because the policyholder wants the information to prepare a claim for repayment of premiums. Relying on FT, it held that access may not be made subject to conditions the EU legislature did not expressly lay down, and it left open whether abuse can justify refusal beyond the cases in Article 12(5). The appeal judgment was nonetheless set aside and remanded on a different point: whether the premium history was personal data at all (19). On damages, the Bundesarbeitsgericht held in February 2025 that a merely late answer does not in itself amount to a loss of control over the data (20). In our view it is open whether that line survives the Court's acceptance in Brillen Rottler that loss of control or uncertainty can be non-material damage if actually suffered.

Brillen Rottler itself went back to the Amtsgericht Arnsberg, which on 1 July 2026 dismissed the requester's counterclaims for access and damages. It treated the short interval between subscription and request, and the fact that he sent his request by fax on his full letterhead, volunteering yet more data, as further indications that he meant to create the conditions for a damages claim artificially. The judgment is not final; an appeal is pending before the Landgericht Arnsberg (21). For requests aimed at the opponent's lawyer, the Federal Data Protection Act provides that the right of access does not exist where it would disclose information that must be kept secret under a legal provision or by its nature, in particular because of a third party's overriding legitimate interests (section 29(1), second sentence). A woman who asked the lawyer who had acted against her in a maintenance dispute for access and damages lost at first instance, and in September 2025 the Oberlandesgericht Brandenburg indicated, in a notice under section 522(2) of the Code of Civil Procedure, that it intended to dismiss her appeal: that provision, read with the lawyer's duty of confidentiality under section 43a(2) of the Federal Lawyers' Act, covers everything the lawyer learned in the mandate (22).

France

French employment litigation shows the same tension. In June 2025 the Cour de cassation held that emails an employee sends or receives on the work account are personal data, that the employer must provide both their metadata and their content unless that would harm the rights of others, and upheld damages for an unanswered request (23). The court was not asked about abuse; the employer had given no reason for its silence. In December 2025 the Conseil d'État, citing the Court of Justice's order in Addiko Bank, held that an internal investigation does not in principle bar an employee's access to the data processed in it, unless the employer demonstrates that the request is manifestly unfounded or excessive; the employer's duty is to redact information about others, not to refuse (24). The CNIL's guidance says that a requester need not give reasons and may exercise the right in parallel with litigation, including a case before the conseil de prud'hommes (25).

The contrast with the procedural route is instructive. When a worker asks the court, before trial, to order the production of documents under Article 145 of the Code of Civil Procedure, the judge must check that production is necessary and proportionate, may narrow the request of its own motion and orders, where necessary of its own motion, the redaction of third parties' personal data, as the Cour de cassation held in June 2026 (26). That judgment says nothing about whether an access request is subject to the same test. In our view the contrast explains why employers want the right of access limited: a request under Article 15 reaches the controller with no judge, no showing of necessity and no stated motive. French law contains no Article 23 restriction for lawyers: a request sent to a law firm meets Article 15(4) and the lawyer's professional secrecy under Article 66-5 of the Law of 31 December 1971, and we have found no decision on that situation (27).

The other GDPR changes the Council wants

If enacted, the access-request rules are the change litigators would feel first. The mandate contains others that matter to firms as controllers and to the clients they advise. All of them are the Council's position, not law.

Personal data and pseudonymisation

The Commission wanted to add to the definition in Article 4(1) that information is not personal data for an entity that cannot identify the person by means reasonably likely to be used by that entity. Supervisory authorities "strongly" urged the legislature not to do this (7), and the Council deleted it: its mandate "maintains the current definition of personal data" (1). Instead it proposes a new Article 25a on pseudonymisation, under which pseudonymised data "shall not be considered personal data for third party if that third party is unable to identify the natural person", while they remain personal data for a processor and for anyone to whom they pass who can identify the person (3). That would largely codify the Court's judgment in EDPS v SRB of September 2025, a case under the parallel rules for the EU institutions, which held that pseudonymised data must not be regarded as personal data "in all cases and for every person" (28). For data rooms, expert reports and outsourced review, it would give a clearer basis for sharing pseudonymised sets, but only where the recipient genuinely cannot re-identify.

AI development and operation

The Council keeps, in a new article numbered 88 bis in its mandate (88c in the Commission's text), the rule that processing in the context of the development and operation of an AI system or model "may be carried out for a legitimate interest" under Article 6(1)(f), but adds that this does not affect the obligation to choose the appropriate legal basis and that safeguards apply whatever the basis, "including the right to object under Article 21" (3). The Commission's version had promised an "unconditional right to object" and specific data minimisation duties (2). A new Article 9(2)(k) would allow the incidental processing of residual special-category data that ends up in training or operating data, with a duty to erase it without undue delay or, if that is technically impossible or would take manifestly disproportionate effort, to protect it from further processing, from use in outputs and from disclosure (3). For firms that build or license AI tools, and for clients who train models on customer or employee data, this would be the first express GDPR text on the question.

Automated decisions

The Commission recast Article 22 as a permission ("may be based solely on automated processing ... only where") and added that a contract could justify an automated decision "regardless of whether the decision could be taken otherwise than by solely automated means" (2). The Council restores the current structure, a right not to be subject to such decisions with three exceptions, deletes that phrase, and spells out the safeguards: human intervention, the right to express a view and to contest the decision (3).

Breach notification, DPIAs and information duties

What lawyers should do now

When you send an access request for a client

When you advise the controller that receives one

When the request arrives at your own firm

Law firms are controllers too, and an opponent, a former client or a former employee may send an access request to the firm itself. The Netherlands and Germany have used Article 23 to protect professional secrecy. A Dutch court of appeal has upheld a law firm's refusal on that basis; in Germany a first-instance court did the same, and the court of appeal signalled agreement in a notice under section 522(2) of the Code of Civil Procedure. France has no such national restriction, so a French firm relies on Article 15(4) and the lawyer's professional secrecy, and silence is not an option: in July 2026 the CNIL reported fines under its simplified procedure against bodies, lawyers among them, that had not responded to it while it investigated complaints about requests to exercise data protection rights, together with injunctions to answer the complainants (29). In every jurisdiction the firm should answer within the deadline, state the restriction it relies on and explain why it applies, rather than ignore the request.

When you advise on the reform

Do not let clients change their access-request procedures on the strength of the Commission's proposal; the Council has dropped its central idea and Parliament's rapporteurs reject it too. Watch three things: the ITRE and LIBE committee vote, the fate of "reasonable grounds to believe" in the negotiations, and the date of entry into force, because under the Council's text the access-request changes would apply from entry into force, on the third day after publication.

How LexVera supports this work

A reform in negotiation is where legal answers most easily go wrong: there is one law in force and three draft texts that look alike, and a memo that quotes the Commission's proposal as if it were Article 12(5) is a mistake that a client may act on. LexVera answers from official sources, the GDPR itself, the judgments of the Court of Justice, Dutch legislation and case law and the case law of the European Court of Human Rights, and keeps each statement tied to the passage it rests on. A lawyer who reads that a first request can be refused opens paragraph 41 of Brillen Rottler and sees the word "unequivocally" before relying on it. Where a matter turns on a date, as a Dutch case begun before the 2025 reform of evidence law does, Dutch legislation can be read in the wording that applied on that date rather than today's.

LexVera covers Dutch law, EU law and the case law of the European Court of Human Rights; German and French national law are outside its scope. A firm's documents stay within its workspace, under the access rules it sets for its matters and teams. LexVera supports the preparation; a qualified lawyer decides what becomes advice, which is the standard set out in our editorial policy.

Frequently asked questions

Has the GDPR changed?

No. The Digital Omnibus is still in the legislative procedure. The Council agreed its negotiating mandate on 21 October 2026, but the European Parliament has not adopted its position and the two institutions have not started negotiating. Until a regulation is adopted and published, the GDPR applies as adopted in 2016, as interpreted by the Court of Justice.

Can a controller refuse an access request because it is being used to prepare litigation?

Not for that reason alone. In FT (C-307/22, 2023) the Court of Justice held that a data subject does not have to give reasons for an access request and that a request cannot be rejected because it pursues an aim other than checking the lawfulness of processing. Under Brillen Rottler (C-526/24, 2026), a controller may refuse such a request as excessive only if it demonstrates unequivocally an abusive intention, such as artificially creating the conditions for a damages claim.

What did the Court of Justice decide in Brillen Rottler?

On 19 March 2026 the Court held in case C-526/24 that even a first access request can be refused as excessive under Article 12(5) GDPR, but only exceptionally and on strict criteria. The controller must demonstrate unequivocally that the request was made not to learn about the processing but to artificially create the conditions for compensation, for example by subscribing to a newsletter in order to request access and then claim damages. Public reports of such a pattern may be used if other evidence supports them.

What does the Council's mandate change for access requests?

It removes the Commission's proposal to let controllers refuse requests made for purposes other than data protection. Instead, a controller could charge a fee or refuse a request under Article 15 where an abusive intention of the data subject can be demonstrated, with reasons given to the data subject. The controller keeps the burden of proof, but the Council retains the Commission's lower standard: it is enough to show reasonable grounds to believe that a request is excessive or that there is an abusive intention. None of this is law yet; Parliament has still to adopt its position.

When would the GDPR changes apply?

Only after the Council and the Parliament agree a text, it is formally adopted and it is published in the Official Journal. Under the Council's mandate, most GDPR amendments, including the access-request rules, would apply from entry into force on the third day after publication, with no transition period. The new breach-notification rules would apply 18 months later, and breach reporting through the national entry points 30 months later. The Council refers to an aim of concluding all simplification packages by the end of 2027.

Does the reform change the definition of personal data?

Not in the Council's version. The Commission proposed a relative definition under which information would not be personal data for an entity that cannot identify the person. The Council deleted that change and instead proposes a new article on pseudonymisation, under which pseudonymised data are not personal data for a third party that cannot identify the person, in line with the Court of Justice's judgment in EDPS v SRB of September 2025.

Sources and methodology

This guide reflects the documents listed below as available on 26 October 2026. The Council's mandate exists only in English and is quoted from Council document 14756/26, in which the Council's changes to the Commission's proposal are marked; the Parliament draft report was read in its English version. The Court of Justice's judgments are quoted from their English texts on EUR-Lex. Dutch, German and French decisions were read in the original language; descriptions of them in English are our summaries. Statements about how the texts should be read are our analysis. This is general professional information, not advice on a specific matter.

  1. Council of the EU, "Digital rulebook: Council agrees position to simplify data protection, privacy and cyber reporting rules", press release, 21 October 2026 (updated 22 October 2026)
  2. European Commission, Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus), COM(2025) 837 final, 19 November 2025, explanatory memorandum, recital 35 and Article 3
  3. Council of the EU, Digital Omnibus, mandate for negotiations with the European Parliament, document 14756/26, 22 October 2026, recitals 35 and 35a, Article 3 (amendments to Articles 4, 9, 12, 13, 22, 25, 33, 35 and 57 GDPR and new Articles 25a and 88 bis) and Article 11
  4. Court of Justice, judgment of 19 March 2026, Brillen Rottler, C-526/24, EU:C:2026:216
  5. European Parliament, ITRE and LIBE committees, draft report on the Digital Omnibus (rapporteurs Aura Salla and Marina Kaljurand), PE786.818, 22 June 2026, amendments 5, 48 and 49 and explanatory statement
  6. European Parliament, Legislative Observatory, procedure file 2025/0360(COD), consulted 26 October 2026
  7. EDPB and EDPS, Joint Opinion 2/2026 on the Digital Omnibus proposal, adopted 10 February 2026, sections 3 and 7.1 (paragraphs 53 to 59)
  8. Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 12, 15, 23 and 82 and recital 63
  9. Court of Justice, judgment of 26 October 2023, FT (Copies of medical records), C-307/22, EU:C:2023:811
  10. Court of Justice, order of 27 May 2024, Addiko Bank, C-312/23, EU:C:2024:458, operative part, point 2 (available in French and Croatian only)
  11. Court of Justice, judgment of 9 January 2025, Österreichische Datenschutzbehörde (Excessive requests), C-416/23, EU:C:2025:3
  12. Hoge Raad, 29 June 2007, ECLI:NL:HR:2007:AZ4663 (Dexia), paragraphs 3.4 and 3.6.2
  13. Act of 6 March 2024 simplifying and modernising the law of evidence, Staatsblad 2024, 62 (in force on 1 January 2025), new Article 194(4) of the Dutch Code of Civil Procedure; Kamerstukken II 35 498, no. 3
  14. Gerechtshof Den Haag, 29 September 2026, ECLI:NL:GHDHA:2026:2861, paragraphs 6.16 and 6.19 to 6.20
  15. Gerechtshof Arnhem-Leeuwarden, 19 March 2024, ECLI:NL:GHARL:2024:1924, paragraph 4.4
  16. Rechtbank Noord-Holland, 13 July 2026, ECLI:NL:RBNHO:2026:8285 (see also 21 July 2026, ECLI:NL:RBNHO:2026:9166)
  17. Gerechtshof Den Haag, 14 December 2021, ECLI:NL:GHDHA:2021:2793, paragraph 6.10
  18. Hoge Raad, 4 October 2024, ECLI:NL:HR:2024:1372, paragraphs 3.3.5 to 3.3.7
  19. Bundesgerichtshof, judgment of 18 December 2025, I ZR 115/25, paragraphs 15 to 18
  20. Bundesarbeitsgericht, judgment of 20 February 2025, 8 AZR 61/24, ECLI:DE:BAG:2025:200225.U.8AZR61.24.0, paragraph 17
  21. Amtsgericht Arnsberg, judgment of 1 July 2026, 42 C 434/23, ECLI:DE:AGAR:2026:0701.42C434.23.00 (not final; appeal Landgericht Arnsberg, I-10 S 71/26)
  22. Oberlandesgericht Brandenburg, order of 11 September 2025, 1 U 16/25, ECLI:DE:OLGBB:2025:0911.1U16.25.00 (notice under section 522(2) ZPO; final decision not consulted), with section 29(1) BDSG and section 43a(2) BRAO
  23. Cour de cassation, chambre sociale, 18 June 2025, no. 23-19.022, ECLI:FR:CCASS:2025:SO00668
  24. Conseil d'État, 1 December 2025, TotalEnergies SE, no. 498023, paragraphs 10 and 11
  25. CNIL, "Le droit d'accès des salariés à leurs données et aux courriels professionnels" (consulted 26 October 2026)
  26. Cour de cassation, chambre sociale, 24 June 2026, no. 25-10.397, ECLI:FR:CCASS:2026:SO00570
  27. Law no. 71-1130 of 31 December 1971, Article 66-5 (professional secrecy of the avocat)
  28. Court of Justice, judgment of 4 September 2025, EDPS v SRB, C-413/23 P, EU:C:2025:645, paragraphs 75 to 87
  29. CNIL, "La CNIL a prononcé 23 nouvelles sanctions depuis janvier au titre de la procédure simplifiée", 6 July 2026

GDPR and AI

GDPR and AI for law firms: lessons from EDPB Opinion 28/2024

Legitimate interest, anonymity of AI models and the documentation supervisory authorities expect.

Privilege

Is your AI chat privileged?

When conversations with AI tools can be disclosed in litigation, and how lawyers keep privilege intact.

AI Act

Legal AI in 2026: platform upgrades and EU timelines

The AI half of the Digital Omnibus and what it changed in the AI Act timetable.