This roundtable was convened around the core idea that a more coherent digital rulebook need not come at the expense of strong protections. Instead, simplification can be understood as an effort to address areas where the EU digital acquis has grown increasingly complex in practice, including at the intersection of data protection, AI, online safety, […]

This report is based on our first technical workshop for CIPL’s Simplification Project. The workshop was focused on the proposed AI Act Omnibus and explored targeted amendments that could simplify implementation while preserving the AI Act’s objectives: enabling trustworthy, human-centric AI and innovation, while protecting health, safety, fundamental rights, and the environment. The report highlights […]

CIPL welcomes the opportunity to comment on the joint draft Guidelines of the European Commission and the European Data Protection Board (EDPB) on the Interplay between the Digital Markets Act (DMA) and the General Data Protection Regulation (GDPR). CIPL appreciates the cooperative nature of these draft Guidelines and the collaboration of the European Commission and […]

Clear, concise, and practical regulatory guidance is essential for organisations, as it provides the legal certainty needed to navigate an increasingly complex and overlapping regulatory landscape. This is particularly important in cases of legislative overlap, where the jurisdictions and competencies of multiple regulators may intersect. CIPL supports the clarification the draft guidelines make, that the […]

In this submission, CIPL supports the Commission’s commitment to strengthening the high level of consumer protection in the digital environment. As the Fitness Check of EU Consumer Law on Digital Fairness concluded, it is imperative that: “existing consumer protection rules remain relevant and necessary to ensure a high level of consumer protection and effective functioning […]

This paper examines sandbox initiatives across multiple jurisdictions, including in AI, data protection and financial services, to identify the core success factors that make these models effective. It distils these insights into practical recommendations for regulators designing and operating sandboxes and for participating organisations. Building on this analysis, the paper considers the specific context of […]

The European Union’s Digital Markets Act (DMA) represents one of the most ambitious regulatory interventions in the digital economy to date. It was intended to empower consumers and to level the market playing field to foster innovation, growth, and competitiveness in the EU. To achieve this, the DMA introduced a number of strict obligations on […]

The paper, written in partnership with Richard Thomas CBE, raises two fundamental questions for data protection authorities: What should DPAs be doing and prioritizing? How should they be doing it? While these questions are not easy to answer, they are essential to explore. Building on our previous work, including the Regulating for Results Paper (2017) […]

This CIPL Response is not publicly available.

Promoting organizational accountability among all organizations that process personal data has been one of CIPL’s main areas of focus. An important component of our work on that front has been to identify ways in which data protection laws, public policy, and approaches to enforcement can encourage and incentivize organizational accountability. This paper elaborates specifically on […]

This is the second paper of the special Joint-Project “Effective Implementation and Regulation Under the New Brazilian Data Protection Law (LGPD)”, by CIPL and CEDIS/IDP. This project aims to: Facilitate information-sharing about the LGPD Inform and advance constructive, forward-thinking and consistent LGPD implementation Enable the sharing of industry experience and best practices Promote effective regulatory […]

This is the second paper of the special Joint-Project “Effective Implementation and Regulation Under the New Brazilian Data Protection Law (LGPD)”, by CIPL and CEDIS/IDP. This project aims to: Facilitate information-sharing about the LGPD Inform and advance constructive, forward-thinking and consistent LGPD implementation Enable the sharing of industry experience and best practices Promote effective regulatory […]

The COVID-19 crisis imposed a wide range of immediate and likely long-term impacts on organizations, governments, regulators, people and society at large. Many of them could to stay with us beyond the immediate crisis and change the way we all live, work and interact. These impacts likely will also be felt in data privacy – […]

This is the second paper of the special Joint-Project “Effective Implementation and Regulation Under the New Brazilian Data Protection Law (LGPD)”, by CIPL and CEDIS/IDP. This project aims to: Facilitate information-sharing about the LGPD Inform and advance constructive, forward-thinking and consistent LGPD implementation Enable the sharing of industry experience and best practices Promote effective regulatory […]

What is a “Regulatory Sandbox”? How could it contribute to high standards of data protection and privacy and promote innovation? What are the challenges and problems? What safeguards are needed? Why would regulators and organizations want to participate in a Sandbox? In this white paper, we set out the key features of the concept. Essentially, […]

The ecosystem for regulating data protection and privacy is changing rapidly, and not just within the EU. For many years CIPL has championed the role of accountable organizations and the merits of a risk-based approach. We now turn to the “plumbing” of the system as a whole and consider how its component parts can best […]

This was a closed consultation.