Kritia Law Watch
A one-person practice, fined for being its own DPO
Reviewed. This briefing was reviewed by Kritia’s editor before publication.
Two regulators published decisions worth your time, one of them this morning and at a scale that actually resembles a small firm. Plus the Commission's own answers on what Article 4 now asks of you.
01 — ENFORCEMENT
Decisions authorities and courts actually published.
Fine for failing to ensure the independence of the data protection officer (3 minute read)
UODO (Polish data protection authority)· EU
A court bailiff was fined 15,500 PLN — about EUR 3,600 — in two parts: 12,000 for appointing themselves as their own data protection officer for five years, and 3,500 for not notifying the authority. The regulator's reasoning is blunt: a person who runs the organisation cannot be its DPO, because they would be monitoring themselves. Published today, in Polish.
Why it matters to you
Small firms appoint the owner as data protection officer because there is nobody else. This is a regulator refusing that arithmetic: whoever runs the operation cannot be the one overseeing it.
Uber fined nearly 825 million euros for automated driver blocking (4 minute read)
Autoriteit Persoonsgegevens (Netherlands)· EU
The Dutch authority fined Uber 824,990,000 euros for deactivating drivers' accounts by software alone between 2018 and 2022, on fraud suspicion or low ratings, with no human assessment and inadequate notice to drivers. The size belongs to the company, not to the rule. The deputy chair's line is the transferable part: a computer should not make decisions on its own that have major consequences for someone.
Why it matters to you
Ignore the number, keep the rule: software that ends someone's livelihood on its own needs a person in the loop and a real explanation. That test applies at any size, including yours.
02 — RULES & GUIDANCE
New or changed official text, guidance and proposals.
Commission designates ChatGPT, Reddit and Roblox under the Digital Services Act (3 minute read)
European Commission· EU
Announced this morning, on the services' own declarations of at least 45 million average monthly users in the EU: ChatGPT as a very large online search engine, Reddit and Roblox as very large online platforms. They have four months, to 1 January 2027, to meet the extra obligations. Those duties land on the designated services, not on the businesses that use them.
Why it matters to you
Read it to know what did NOT land on you. The extra duties fall on the designated services themselves, not on the firms that use them — useful next time a vendor implies otherwise.
AI literacy — questions and answers (8 minute read)
European Commission / AI Office· EU
The Commission's own answers on what Article 4 asks, last updated 27 July 2026 — which is to say, after the amendment that changed it. If someone has told you the AI Act obliges you to buy a course, this is the page to check them against.
Why it matters to you
The page to check anyone who tells you the AI Act makes you buy a course. The Commission's own answer, updated after the amendment that changed Article 4: measures and evidence, not a purchase.
Guidelines on transparency obligations for providers and deployers of certain AI systems (5 minute read)
European Commission· EU
Published 20 July 2026, and the closest thing yet to an official answer on which Article 50 duties fall on the firm that buys a tool rather than the one that builds it. Deployer duties covered include informing people exposed to deepfakes, to AI-generated content on matters of public interest published without human review, and to emotion-recognition systems.
Why it matters to you
The closest thing to an official answer on which Article 50 duties follow the buyer of a tool rather than its builder. If you publish AI-generated content, this is the part that names you.
03 — PRACTICAL
Worth doing, or worth the time to read.
Before you deploy an AI tool, check how it stands up under the GDPR (4 minute read)
UODO (Polish data protection authority)· EU
A regulator writing directly to organisations about to adopt an AI tool, on 6 August 2026 — what to establish before it goes live rather than after a complaint. Short, and unusually plain for a supervisory authority. In Polish.
Why it matters to you
A list for the week before a tool goes live rather than the week after a complaint. Short enough to actually walk through with whoever is championing the tool.
Identifying and managing a DPO's conflicts of interest (6 minute read)
CNIL (France)· EU
Published 10 August, three weeks before the Polish fine above landed on exactly this failure. If one person in your firm both runs an operation and oversees its data protection, this sets out how French regulators read that. In French.
Why it matters to you
If one person in your firm both runs an operation and oversees its data protection, this is how a regulator reads that arrangement — written three weeks before Poland fined exactly it.
04 — THE WIDER VIEW
Written about the rules, not by the people who make them.
Deployer obligations under the AI Act: implications for employers from 2 August 2026 (7 minute read)
DLA Piper· EUAnalysis
A law firm's read of what an employer that uses AI — rather than builds it — actually took on when the duties became enforceable. Useful if you are running AI anywhere near hiring or performance. Their view, not the regulator's.
Why it matters to you
Worth the time if AI touches hiring or performance review in your firm — a law firm's map of what buying a tool took on. Their reading, so take it as questions to check, not answers.
The EDPB's draft anonymisation guidelines: what they mean for your data strategy (9 minute read)
IAPP· EUAnalysisNot law yet
The European Data Protection Board has put anonymisation guidelines out in draft. Relevant to anyone who has been told that stripping names from a dataset puts it outside the GDPR. Draft means draft: nothing here binds you yet.
Why it matters to you
Relevant if anyone has told you that stripping names puts a dataset outside the GDPR. Draft guidelines, and one publication's reading of them — a thing to watch before it moves what your data team assumes.
05 — QUICK LINKS
- A controller must report a breach that happened at its processor (3 minute read)
UODO — Your vendor had the incident; the 72-hour clock is still yours. Poland, 12 August. - Italian authority fines Lusha 2 million euros (5 minute read)
Garante — A contact-data business, monitored at scale. Italy, 27 July. - The enforcement framework of the AI Act (4 minute read)
European Commission — Who enforces what: the AI Office, the EDPS, and national authorities. Updated 24 August.
06 — COUNTDOWN
93days · 2026-12-02
Machine-readable marking for generative systems placed on the market before 2 Aug 2026.
What this isn’t
News about the law, not legal advice, and not an assessment of your business. Items marked Analysis are someone’s view of the rules, not the rules. Whether a duty applies to you depends on what you actually do. The public guides explain the general rules and link their primary sources.
Get this each publishing day
Free by email, with no account and no card. About a minute to read, every reported item linked to its source.