Personal data / Justice: TikTok has been fined €530 million by the Irish Data Protection Commission for two reasons: firstly, a failure to comply with the equivalent protection requirements for international data transfers (art. 46 par. 1 of the RGPD), and secondly, a failure to comply with the transparency obligations of article 13 par. 1 of the RGPD. Moreover, TikTok admitted during the inquiry that user data had been stored on servers in China even though TikTok had declared the opposite earlier in the process (Press release of 2 May 2025).
Personal data / Decision: The European Data Protection Board (EDPB) has adopted a favourable opinion on the adequacy decision in favour of the European Patent Organisation. Once adopted by the Commission, the adequacy decision will allow the exchange of personal data from Europe to the EPO. This is the first adequacy decision in favour of an international organisation and not a State. The aim of this decision is to facilitate the granting and enforcement of patents granted by the EPO (Press release of 6 May 2025).
Sports piracy / Justice: On May 15th, 2025, the Paris Court of First Instance issued two rulings ordering VPN services to block 200 sites illegally broadcasting football and rugby competitions, paving the way for VPN services to block these sites (Press release 15 May 2025).
DNS blocking / Report: ICANN’s Security and Stability Advisory Committee (SSAC) published a report on 16 May 2025 on ‘DNS blocking revisited’. The SSAC notes the widespread use by authorities of DNS blocking to combat illegal content, but deplores the lack of effectiveness of this method, which does not tackle content that remains available online, and even the harmful effects on legitimate services. The Committee recommends that entities wishing to use DNS blocking should take a more considered and supervised approach (Press release 16 May 2025).
Revenge-porn and Deepfakes / Legislation: The United States passed the “Take it down Act” on 19 May 2025. This bipartisan text prohibits the non-consensual publication of real or artificially generated intimate representations of individuals, in other words pornographic Deepfakes and revenge porn are banned. This ban is accompanied by an obligation for the platforms concerned to remove the content within 48 hours of notification by the victim (Public Law No: 119-12, 19 May 2025).
Audiovisual piracy / Justice: The Paris Court of First Instance, questioned by film industry trade associations has acted against applications that hide the illegal distribution of pirated content behind the appearance of note-taking applications, weather forecasts, etc. It has ordered Orange, Bouygues, Free and SFR to use all effective means to prevent access to the applications in question, as well as to the sites distributing the APKs for these applications. (Press release of 15 May 2025).
Personal Data and Google My Business / Justice: The Chambéry Court of Appeal confirms that the information published in Google My Business profiles is personal data for which the legitimate interest is not sufficient to justify processing in the absence of consent from the professional concerned (Court of Appeal of Chambéry, 22 May 2025, no. 22/01814).
Finance: In March 2025, the International Organisation of Securities Commissions (IOSCO) created I-SCAN, a single portal bringing together the blacklists of 150 regulators around the world. This portal exposes services or sites operating fraudulently. The regularly updated portal has more than 31,900 entries and is set to expand further (Press release, 20 March 2025).
Cybercrime / Government: The Ministry of the Interior through COMCYBER-MI has published its National Strategy to fight cybercrime. It is based on 4 pillars: Anticipation and resilience; Operational; Partnerships, cooperation and management; Skills and attractiveness. (Press release of 30 May 2025).
Generative AI / Copyright: EUIPO has published a report on the development of generative AI from the point of view of copyright, in which it announces the creation of the Copyright Knowledge Centre by the end of 2025, which would help authors and right holders to grasp the challenges of AI. The report also stresses the importance of the traceability of protected works and the use of new methods of partnership and mediation to secure the long-term use of works by suppliers of generative AI (Press release of May 2025).
Intellectual Property / Report : The European Commission has published its biennial report on the protection and enforcement of intellectual property rights in third countries and 2025 Counterfeiting and Piracy Watch List (European Commission report published on 22 May 2025).
Cybercrime : Coordinated action by Microsoft’s Digital Crimes Unit and Interpol has resulted in the removal, suspension and blocking of 2,300 domains linked to the Lumma Stealer malware (Press release of May 21st 2025).
