As the IAPP reports, “After three days of intense negotiations, the European Union reached a political agreement 8 Dec. on the Artificial Intelligence Act, which would be the world’s first comprehensive regulation of AI. The trilogue process between the European Commission, Council of the European Union and European Parliament stretched on for more than 32 hours over the course of a three-day period last week, with negotiators announcing the deal late Friday night.  European Commission President Ursula von der Leyen welcomed the agreement, calling it historic, and noting it will have a global impact: “Our AI Act will make a substantial contribution to the development of global rules and principles for human-centric AI.” The latest text of the legislation has yet to be published. Co-legislators still have work to finalize the text”.

Full details can be found here.

***

Two judgements have been issued by the European Court of Justice against a German credit reference agency named SCHUFA.

As regards ‘scoring’, the Court holds that it must be regarded as an ‘automated individual decision’ prohibited in principle by the GDPR, in so far as SCHUFA’s clients, such as banks, attribute to it a determining role in the granting of credit.

As regards information relating to the granting of a discharge from remaining debts, the Court considers that it is contrary to the GDPR for private agencies to keep such data for longer than the public insolvency register. The discharge from remaining debts is intended to allow the data subject to re-enter economic life and is therefore of existential importance to that person. That information is still used as a negative factor when assessing the solvency of the data subject. In this case, the German legislature has provided for data to be stored for six months. It therefore considers that, at the end of the six months, the rights and interests of the data subject take precedence over those of the public to have access to that information.

Full details of the judgements can be found here.

***

The Committee for Industry, Research and Energy of the European Parliament has adopted a draft report on the Cyber Solidarity Act. This aims to add strength to EU cyber resilience in responding to large-scale cyber incidents. Further negotiations among EU institutions are expected to take place next year.

Full details can be found here

***

The Higher Regional Court of Cologne has decided on some important data protection matters. In particular, in the context of Google Ads, website operators and Google are considered joint controllers, while Google’s Standard Contractual Clauses (SCCs) do not provide adequate additional safeguards for the data transfers to the U.S. (data transfers occurred before the EU-U.S. Data Privacy Framework came into force were under consideration).

Full details can be found here.