GDPR Compliance Update October 2026: Fines & Key Rulings

The October 2026 GDPR compliance update covers several major European enforcement decisions and legal developments. France’s CNIL fined EXTIA €300,000 over failures to handle erasure requests, Italy’s Garante fined IQVIA €7 million over health-data processing, and Ireland’s Data Protection Commission imposed €403 million in fines on Google for infringements involving historical location-data practices.

In Case C-317/25, an Advocate General proposed that consent to marketing by unidentified “partners” may not cover a downstream marketer, although the CJEU has not yet ruled.

Other developments include draft EDPB guidelines on administrative fines, Lithuanian court decisions concerning surveillance and legal obligations, and the CJEU’s Jautiva judgment rejecting Latvia’s unrestricted online disclosure of shareholders’ personal data.

For organisations, the key implications concern responding to erasure requests, assessing re-identification risks, verifying marketing consent, ensuring that actual data collection matches privacy settings, and limiting unnecessary disclosure of personal data.

EXTIA: Erasure requests need a complete response

France’s CNIL fined recruitment and engineering company EXTIA €300,000 for failures involving individuals’ rights, particularly erasure. Of 265 requests received in 2024, more than three quarters were not handled or were not handled satisfactorily: 12 were not processed, 166 people were not told what action had been taken, and 27 received information late. Automatic deletion did not remove the duty to inform the person.

Article 12 generally requires a response without undue delay and within one month. An extension of up to two further months is possible for complex or numerous requests, but the person must be told within the first month and given the reasons.

Erasure under Article 17 is not absolute: some data may be retained under an exception, such as to comply with a legal obligation or establish, exercise or defend legal claims. If no action is taken, the GDPR requires an explanation, including information about the person’s right to complain and seek a judicial remedy.

Operational checks

Assign a responsible owner. Make sure each request reaches someone who can assess it, coordinate action and send the response.
Track the deadline. Record when each request arrives and flag the response and extension-notification deadlines.
Search relevant systems. Check where the person’s data are held, including relevant operational systems and copies—not just the main account or CRM.
Document retention decisions. Record which data were retained and the Article 17 exception relied upon.
Close the loop. Record the outcome of each request and when the response was sent.

IQVIA: Anonymisation and pseudonymisation are not interchangeable

Italy’s Garante fined IQVIA Solutions Italy €7 million in a decision dated 23 September and announced on 2 October. The case concerned a database holding health information on about one million patients of roughly 800 general practitioners.

A persistent patient code, combined with detailed medical and location-related information, could allow people to be singled out and re-identified using means reasonably likely to be employed.

The Garante said the data dated back to 2001. It also found that identifying information—including names, tax codes, addresses and contact details—relating to more than 3,300 patients had entered the database; more than 3,000 of those patients had health data included.

IQVIA was ordered to bring the processing into compliance within 120 days of notification if it intended to continue. Alternatively, anonymisation would have to be carried out independently by the doctors under the authority’s safeguards.

Legal distinction: Pseudonymisation reduces direct attribution but does not, by itself, make data anonymous. Whether data are anonymous depends on whether a person can still be identified by means reasonably likely to be used.

For teams working with identifiers and datasets

Test for singling out. Ask whether a record can be distinguished from others even without a name or direct identifier.
Map persistent identifiers. Check whether codes or tokens let you follow the same person’s records over time.
Assess linkage. Determine whether the data can be combined across records or with other datasets to reveal identity.
Model realistic re-identification risk. Consider the information and means available in the actual processing context, not only what your team holds.
Classify the data accurately. Keep pseudonymised personal data within GDPR controls unless a reasoned assessment supports treating the data as anonymous.

Groupe Canal+: Does consent cover the downstream marketer?

In 2021, Groupe Canal+ commissioned electronic marketing campaigns targeting about 3.9 million people. Two internet service providers had originally collected the contact details, and subscribers had consented to marketing by the providers’ “partners”—without the partners being individually identified.

The CNIL fined Groupe Canal+ €600,000 in October 2023. In his 17 September Opinion in Case C-317/25, Advocate General Spielmann proposed that a downstream marketer whose identity was unknown when consent was obtained needs fresh consent before marketing.

He considered “partners” too vague to identify the marketer; an option to unsubscribe after receiving a marketing message would not remedy the absence of prior consent.

Case status — 8 November 2026: This is an Advocate General Opinion, not a binding CJEU judgment. Case C-317/25 remains pending.

Before using partner-supplied contacts

Trace the data’s origin. Record which organisation collected each contact and how it was transferred to you.
Review the wording people actually saw. Keep the consent text and any explanation of the purpose and recipients shown at collection.
Check who was covered. Establish whether your organisation was identified or validly included in the original consent. If not, the Advocate General’s proposed approach requires fresh consent before sending marketing communications.

Google: Location settings must match real processing

On 21 September, Ireland’s Data Protection Commission announced a final decision imposing €403 million in fines on Google Ireland Limited and ordering it to bring the processing into compliance within six months.

The inquiry concerned Web & App Activity, Location History and Location Accuracy from 25 May 2018 to 4 February 2020; it was not a finding about every current Google location-data practice.

The DPC found lawfulness and fairness infringements for Web & App Activity and Location History, and an accountability failure concerning lawfulness, fairness and transparency for Location Accuracy.

It found transparency infringements across all three features and retention infringements for Web & App Activity and Location History. Location data linked to identifiable individuals are personal data, but they are not automatically Article 9 special-category data; location trails can nevertheless reveal highly private details about someone’s life.

What to review in digital services

Define the purpose. Be specific about why location data are collected and how each feature uses them.
Match the legal basis to actual use. Assess the processing that occurs, not just the product description or setting label.
Make disclosures clear. Explain what location information is collected, for what purpose and through which features.
Set retention limits. Keep location information no longer than necessary for the purpose.
Test controls against reality. Verify that actual collection matches the controls and expectations presented to users.

EDPB Guidelines 04/2026: Fine decisions and compliance failures

The European Data Protection Board’s draft Guidelines 04/2026 address how supervisory authorities decide whether to impose an administrative fine alongside or instead of other corrective powers. The draft covers the legal availability of fines, who may be fined, intent or negligence, and whether a fine would be appropriate, effective, proportionate and dissuasive.

Status check — 8 November 2026: Version 1 is a consultation draft. The consultation remains open until 13 November 2026; the guidelines are not final.

The draft does not create a new organisational documentation duty.

Existing accountability practices

Record identified failures. Note what went wrong, when it was discovered and which processing was affected.
Preserve decision-making. Keep the reasoning behind internal decisions and chosen responses.
Evidence remediation and mitigation. Record the steps taken to fix the problem and limit its effects.
Follow up. Check that corrective actions worked and that the issue did not recur.

VDAI: Lithuanian court practice on surveillance and legal duties

A 30 September summary by Lithuania’s State Data Protection Inspectorate (VDAI) covers relevant 2025 decisions of the Regional Administrative Court and Supreme Administrative Court.

In a video-surveillance dispute, the court treated monitoring a neighbour’s residential area as processing personal data despite the camera owner’s claim that the neighbour was not visibly captured. A stated aim of detecting noise did not establish that monitoring the neighbour’s property was necessary.

In a separate case, the Supreme Administrative Court held that obtaining property-register information was necessary to fulfil a statutory duty to maintain a gardening association’s registration book, and overturned the relevant parts of VDAI’s decision concerning the registry data and associated notification findings.

Limit camera coverage. Reposition or mask cameras that capture a neighbour’s private area.
Show necessity. A general concern or noise complaint alone does not justify monitoring someone’s home.
Tie legal-obligation processing to a specific duty. Identify the relevant law and use only the information necessary to meet it.

Jautiva: Public-interest transparency has limits

On 3 September, the Court of Justice delivered its judgment in Case C-798/24, Jautiva. It concerned a Latvian requirement to make information about all shareholders, including minority shareholders, available online.

The data included identity and contact details, share class and number, nominal value and voting rights; the system allowed access by unidentified users and bulk downloading. The CJEU judgment found that EU law precluded this unrestricted disclosure, even where the measure pursued public-interest aims.

The judgment does not prohibit public shareholder registers. The data disclosed and access conditions must be proportionate to the objective. The Court noted that requiring a legitimate interest may, in principle, limit the interference.

Minimise disclosed data. Check whether each field is necessary for the register’s purpose.
Set access conditions. Specify who can access the information, which fields they can view and under what conditions.
Review bulk access. Assess whether downloading a complete dataset creates a greater exposure than individual lookups.

How a CMP Can Help Manage Consent and Tracking Choices

The Google location-data decision concerns whether collection matched user-facing settings and disclosures; the Groupe Canal+ Opinion concerns consent for a marketer not identified when contact details were collected.

Neither is a ruling on cookie banners. For website cookies and scripts, a Consent Management Platform (CMP) can support recording visitor choices and applying those choices to tracking technologies.

In practice, that can include:

User consents recording: records website visitors’ consent choices to support documentation of those choices.
Third-party cookie blocking: helps control selected third-party technologies before the relevant consent is obtained.
Automatic script blocking: controls when selected scripts can run according to consent settings.
Cookie Scanner: identifies website cookies and helps maintain cookie inventories and related disclosures as a website changes.
Consent events: enable websites to respond when a visitor’s consent choices change.

Other available functions and integrations include:

CookieScript is a CMP that Google includes among the CMP partners available for Consent Mode setup. It is also a Google-certified CMP with Gold tier status.

A 14-day free trial of the Plus plan is available without requiring a credit card.

A CMP does not determine whether every individual data flow is lawful or replace the organisation’s wider GDPR compliance assessment.

Conclusion

The cases highlight different aspects of GDPR compliance: erasure requests require timely responses, pseudonymised data may still identify individuals, and location-data processing must be lawful and transparent.

The Groupe Canal+ case raises questions about consent obtained for unidentified marketing partners, while the Lithuanian judgments and Jautiva emphasise necessity and proportionality in data processing and disclosure. The EDPB’s draft guidelines address how authorities determine whether infringements warrant administrative fines.

News

Latest on GDPR: Compliance Update October 2026