Kritia Law Watch
A housing co-op, and the breach it decided not to report
Tuesday 2026-09-01
Poland's supreme administrative court has restored a fine against a small housing cooperative that logged a breach internally and told nobody. Quiet elsewhere: three practical things worth the time, and a German credit bureau facing a formal warning.
01 — ENFORCEMENT
Decisions authorities and courts actually published.
Supreme Administrative Court upholds the President of UODO's decision on a 52,000 PLN fine for a housing cooperative (4 minute read)
UODO (Polish data protection authority)· EU
The cooperative disclosed a copy of a criminal complaint carrying a member's name, address and national ID number, then recorded it only in its internal breach register. On 26 August the court overturned the lower court and reinstated the fine of nearly 52,000 PLN — about EUR 12,000. Two findings travel: the risk analysis must weigh risk to the person, not the controller's interest, and this controller could produce none.
02 — RULES & GUIDANCE
New or changed official text, guidance and proposals.
Public consultation on the Law Enforcement Directive (2016/680) (3 minute read)
UODO, on the European Commission's consultation· EUNot law yet
The Commission's second evaluation of how the police directive works in practice is open for comment until 14 September 2026. Narrow relevance — it governs processing by law-enforcement authorities, not ordinary business — but if your firm supplies them, this is the window in which practical experience gets heard. In Polish, linking the Commission's own consultation.
03 — PRACTICAL
Worth doing, or worth the time to read.
AI: the CNIL updates its traceability tool for open-weights AI models (4 minute read)
CNIL (France)· EU
Published 26 August, and now in English. The Genmod demonstrator traces an open-weights model's ancestors and descendants, so a model known to have memorised personal data can be followed through everything fine-tuned from it. Useful the moment someone in your firm downloads a model rather than calling an API.
AP advises Twitch users: opt out from sharing data with Amazon AI (3 minute read)
Autoriteit Persoonsgegevens (Netherlands)· EU
The Dutch authority's note of 20 August on Amazon training AI models on Twitch users' streams, faces, voices and chats. The transferable fact is the default: the 'Training for Generative AI' setting is on unless a user turns it off. Worth an hour this week checking which of your own vendors ship the same default.
Refused credit: your questions answered (5 minute read)
CNIL (France)· EU
Written for the person refused, on 19 August, but it restates what the firm doing the refusing owes: in defined cases, the reasons for the decision, and access to the personal data behind the assessment. It sits on top of the CNIL's May 2026 recommendation for professionals on creditworthiness assessment. In French.
04 — THE WIDER VIEW
Written about the rules, not by the people who make them.
'Shadow database' scandal: noyb sends SCHUFA cease-and-desist letter; interest list for class action opened (6 minute read)
noyb· EUAnalysisNot law yet
noyb says the German credit bureau retains records that should have been deleted, uses them for customers' testing, and withholds them from Article 15 access requests; it has issued a formal warning and opened an interest list for damages claims. An advocacy group's account of its own action, and SCHUFA disputes it. Nothing here has been decided.
05 — QUICK LINKS
- Mayor of Wejherowo reprimanded for disclosing personal data (2 minute read)
UODO — Two requests handled as one file, and a resident's details went to the firm he was asking about. Poland, 24 August. - Dialogue on the AI Act (3 minute read)
Autoriteit Persoonsgegevens — A supervisor offering informal, confidential meetings to organisations working out how the AI Act lands on them — open since 8 July, and still open. - The President of UODO backs the energy sector's code of conduct work (2 minute read)
UODO — A regulator pointing an industry at codes of conduct as the way to evidence its GDPR position. Poland, 27 August.
06 — COUNTDOWN
92days · 2026-12-02
Machine-readable marking for generative systems placed on the market before 2 Aug 2026.
What this isn’t
News about the law, not legal advice, and not an assessment of your business. Items marked Analysis are someone’s view of the rules, not the rules. Whether a duty applies to you depends on what you actually do — the scope checker is free.
Get this each publishing day
Free with a Kritia account — no card, no payment. About a minute to read, every claim linked to its source.