IT Security

The new EU action plan sets out how Europe intends to address the opportunities and risks posed by artificial intelligence in the field of cybersecurity.

The planned reform of intelligence service legislation has raised serious concerns within the German Bar Association (DAV). Substantial amendments are required during the legislative process to address the significant constitutional concerns. This is evident from the DAV’s statement of 2 September 2026, to which Niko Härting contributed.

In episode 184 of “Follow the Rechtsstaat”, Prof. Niko Härting and Dr Stefan Brink discuss well-known contentious issues that are once again in the legal and political spotlight. The focus is on the complaint lodged by Reporters Without Borders against the use of spyware by the Federal Intelligence Service, data protection risks associated with the use of cloud solutions by public libraries, and international data transfers. The two also discuss what implications current developments in the US might have for the adequacy decision on the EU-US Data Privacy Framework.

In episode 47 of the Data Navigator podcast, Dr Martin Schirmbacher and Dr Hubertus von Rönne address a topic that, since the Data Act came into force, has repeatedly been cited as a supposed counter-argument against claims for the disclosure of data: the GDPR. One of the reasons for this discussion is the third think tank organised by the Federal Commissioner for Data Protection and Freedom of Information on the Data Act, which took place last week. The starting point is clear: the Data Act expressly applies to personal data as well. In the event of a conflict, the GDPR takes precedence. In practice, however, such conflicts arise far less frequently than is often assumed. The decisive factor here is what is known as ‘relative personal reference’. Whether data is personal is not assessed in the abstract, but from the perspective of the respective data controller. Dr Martin Schirmbacher and Dr Hubertus von Rönne illustrate this principle using the example of a bus driver: for Berlin’s public transport authority, driver data is personally identifiable, as they know who was driving which bus at what time. For the bus manufacturer, which only receives vehicle data without any personal registration details, this link is generally missing. In the case of a wind farm, the situation may be the reverse: the manufacturer knows its maintenance staff, whilst the wind farm operator is usually unable to identify them. It follows that: The same data set may be personal data for one party and not for another. In scenarios governed by the Data Act, it is often precisely the data recipient who cannot establish a link to an individual. If, however, the recipient does establish a link to an individual, they require a legal basis under the GDPR. Legitimate interests are particularly relevant in this context. The manufacturer, in turn, may rely on Article 6(1), first sentence, point (c) of the GDPR for the data transfer, as the disclosure is made on the basis of a legal obligation under the Data Act. Finally, Dr Martin Schirmbacher and Dr Hubertus von Rönne outline the responsibilities of the supervisory authorities. The Federal Network Agency is generally responsible for complaints relating to the Data Act. As soon as personal data is involved, it must involve the Federal Commissioner for Data Protection and Freedom of Information. The state data protection authorities remain responsible for traditional infringements of the GDPR – for example, if a farmer complains that a manufacturer is processing their personal data.

The 4th HÄRTING AI Day will take place in Berlin on 19 November 2026. The event will focus on current issues relating to artificial intelligence, the AI Act, data protection and the practical application of AI in businesses.

Episode 46 of the Data Navigator podcast focuses on data rooms, digital sovereignty and the question of how Europe can create trustworthy data infrastructures. The guest is Ulrich Ahle, CEO of Gaia-X and previously long-standing CEO of the FIWARE Foundation. He has more than thirty years’ experience in the IT sector – including stints at Nixdorf Computer, Siemens and Atos – and was also mayor of Etteln, ‘Germany’s most digital village’. In the interview, Ulrich Ahle explains why Gaia-X does not want to be a European hyperscaler. Rather, the aim is to establish a set of rules and an open-source infrastructure that enables decentralised, trustworthy data spaces based on European values. Key components of Gaia-X are digital identities and a compliance framework with various levels of sovereignty. At the highest level, only European providers are to be able to meet the requirements – in particular to prevent access via extraterritorial regulations such as the US Cloud Act. A practical example is Catena-X, the automotive industry’s data space. Of particular relevance here is the digital battery passport, which will become mandatory from 18 February 2027. It is intended to provide a wide range of information covering the entire life cycle of a battery – from raw materials and the carbon footprint to residual capacity. Data rooms can help to make complex supply chains more transparent and significantly simplify data exchange compared with bilateral solutions. Ulrich Ahle will also discuss Gaia-X’s role in implementing the Data Act. The combination of data room technology and statutory data access rights could help to increase the willingness to share data. This is because, in trusted data rooms, it is technically possible to specify who is permitted to use data, what it may be used for, and for how long. Another key focus is the international development of data rooms. As the Data Act applies only in Europe, but global supply chains require cross-border data flows, Gaia-X is working on a geographical expansion of the Trust Framework – for example, with a view to Japan, Korea, Canada or Brazil. China and various African countries are also exploring similar concepts. Ulrich Ahle’s key message is that the technology for data rooms is now largely in place. What matters now is practical application, operational implementation and viable business models. Only if data rooms are brought to market on a permanent basis can they realise their full potential for digital sovereignty, data usage and European competitiveness.

First (00:38), Dr Stefan Brink and Prof. Niko Härting discuss the coalition agreement of Baden-Württemberg’s new state government, which provides for staff cuts of up to 40 per cent at the State Data Protection Commissioner’s office. One of the reasons given for this is a planned centralisation within the Federal Data Protection Commissioner’s office. Robbing Peter to pay Paul? Subsequently (11:02), Härting and Brink discuss a ruling by the Berlin Administrative Court dated 6 May 2026, ref. VG 42 K 73/25, which confirmed the legality of ID checks and video surveillance at Berlin’s summer swimming pools. Finally (21:21), the topic is freedom of the press and freedom of expression. The Federal Court of Justice (BGH) dismissed a lawsuit brought by the betting provider Tipico against Der Spiegel. Tipico sought to challenge the statement: “Four men from Karlsruhe founded and built up the company; they pushed the boundaries of what is legally permissible and went beyond them.” Brink finds the decision unsettling, whereas Härting considers it well-founded.

The Cologne Data Protection Law Conference, organised by Dr. Otto Schmidt Publishers, will take place on 18 and 19 June 2026. The event will focus on current developments relating to the GDPR, the AI Regulation, the Data Act, the Digital Omnibus Directive, class actions and digital sovereignty.

Cyberattacks are no longer merely a technical issue – they are a communication issue. Anyone who communicates incorrectly or too late during a crisis risks fines, liability and reputational damage. Our event, ‘Cyber Law and Communication’, brings together legal experts, technologists and PR professionals to demonstrate how companies can position themselves in a legally sound and professionally communicative manner – in Germany, the EU and Switzerland.