TMT Newsletter | October 2026
Outlook
03.11.2026
Opinion
CJEU-AG Szpunar: Does displaying copyright-protected press articles in the output of an AI chatbot constitute a communication to the public (Article 15(1) DSM Directive, Article 3(2) InfoSoc Directive)? Does the provider reproduce protected content in the event of such an output where the user prompts already reproduce or refer to the protected text (Article 15(1) DSM Directive, Article 2 InfoSoc Directive)? Does the provider reproduce the press articles when it uses them to train the chatbot and, if so, does the text and data mining exception apply (Article 15(1), 4 DSM Directive, Article 2 InfoSoc Directive; C-250/25)?
Hearing
CJEU: Do the transparency obligations for providers of media intermediary services under Sec. 93 MStV, which aim to safeguard diversity of opinion, fall within the coordinated field of the E-Commerce Directive (Article 1(6), Article 3(1), (2) E-Commerce Directive)? Does Article 27 DSA preclude such national transparency obligations (C-474/25)?
05.11.2026
Decision
CJEU: Is a national data protection supervisory authority a "controller" within the meaning of Article 4(7) GDPR when it handles a complaint under Article 77 GDPR? Is a blanket exclusion of the right of access under Article 15 GDPR to the supervisory authority's files and records compatible with Article 23 GDPR (C-205/25)?
Opinion
CJEU-AG Szpunar: Under what conditions does a dynamic IP address constitute personal data (Article 4(1) GDPR)? Can a GDPR infringement which the data subject knowingly causes for the sole purpose of asserting a claim give rise to non-material damage within the meaning of Article 82(1) GDPR? Or can a court deny such a right to compensation for abuse of rights (C-654/25)?
12.11.2026
Decision
CJEU: When an online content-sharing service provider stores copyright-protected works that its users upload, does it perform an act of reproduction that requires a separate authorisation in addition to communication to the public? If so, does that authorisation also cover acts of reproduction by users who are not acting on a commercial basis (Article 2 InfoSoc Directive, Article 17(1), (2), Article 1(2), Article 2(6) DSM Directive; C‑579/24)?
Opinion
CJEU-AG Kokott: Did the Commission fail to demonstrate sufficiently that a service provider’s exclusivity, placement and prior authorisation clauses with website publishers were capable of restricting competition in the online search advertising intermediation market (Article 102 TFEU, Article 54 EEA Agreement; C-826/24 P)?
Opinion
CJEU-AG Spielmann: Under what conditions can a collective management organisation (CMO) demand information on the unlawful use of copyright or related rights without any pending infringement proceedings (Article 17 CRM Directive, Article 8(1), in conjunction with Article 3(2) Enforcement Directive; C‑601/25)?
Hearing
CJEU: Do the Commission’s explanations in a decision on supervisory fees under the DSA as to how it calculates the average monthly number of active recipients of a service amount to a methodology that must therefore be laid down in a delegated act (Article 43(3) to (5), Article 87 DSA; C-744/25 P and C-745/25 P)?
19.11.2026
Opinion
CJEU-AG Szpunar: Does the Notification Directive (Directive (EU) 2015/1535) apply to a service provided via television broadcasting (Article 1(1)(b), (2) Notification Directive)? Is a general national ban on gambling advertising a "rule on services" within the meaning of Article 1(1)(e) Notification Directive and compatible with EU law? Can private individuals also rely on a failure to notify (Article 5 Notification Directive; C‑194/25)?
Opinion
CJEU-AG Szpunar: Are the Belgian rules on press publishers’ rights (in particular, unilateral negotiation and information obligations for service providers and a binding price-setting procedure) and the obligations imposed on OCSSPs beyond those required by the DSM Directive (in particular, a mandatory direct remuneration claim) contrary to EU law (Article 15, 17 DSM Directive; C‑663/24)?
News
CJEU – Formal validity of copyright assignment contract not governed by the lex loci protectionis
It is the law applicable to the contract under Articles 4 and 11 Rome I Regulation, and not the lex loci protectionis under Article 8(1) Rome II Regulation, that determines whether a copyright assignment contract is formally valid. Formal validity concerns only the contractual relationship between the author and the assignee, not the liability of the alleged infringer. Otherwise, courts could assess the formal validity of the same contract differently in each country, which would undermine legal certainty (C176/25).
CJEU – CMOs may not fund third parties through collected revenues
Collective management organisations (CMOs) may use deductions from their rights revenue for social, cultural or educational services (Article 12(1) and (4) CRM Directive). However, rightholders have to benefit from these services at least indirectly (Article 11(4), Article 12(2) and (4) CRM Directive). Rightholders are actors whose rights management falls within the scope of the CMO's activity (Article 3(c) CRM Directive). CMOs may thus support third parties only with "non-distributable amounts" and thus with revenue due to rightholders they cannot locate (Article 13(4) CRM Directive; C‑840/24).
CJEU-AG – Lawful designation of service provider as a gatekeeper
If a company manifestly calls the gatekeeper presumptions into question, the Commission must in principle open a market investigation. It has no discretion here (Article 3(5) DMA). However, according to AG Biondi, this requires factors that seriously call the presumption into question. If the Commission designates without a market investigation, it does not have to hear the undertaking again (Article 34(1), (3) DMA, Article 41(2)(a) CFR; Opinion C-627/24 P).
CJEU-AG – Right to erasure under GDPR also covers personal data in baptismal registers
According to AG Medina, a non-digital baptismal register is a filing system within the meaning of Article 4(6) GDPR. Former members of the Church may therefore request the erasure of their baptismal data (Article 17(1)(c) GDPR). The archiving exception applies only under strict conditions (Article 17(3)(d) GDPR). If a right to erasure exists, the controller must make the data illegible. Nobody should then be able to identify the data subject easily (Opinion C-12/25).
CJEU-AG – No carte blanche for financial intelligence units completely restricting data subjects’ right of access
A financial intelligence unit (FIU) has a "pre-criminal" function. When it carries out its core missions, it acts as a competent authority. Hence, according to AG Medina, the Law Enforcement Directive applies and not the GDPR (Article 2(1) in conjunction with Article 1(1) Law Enforcement Directive). National law may restrict the right of access completely. But it must lay down clear and precise rules on the scope and conditions of the restriction. It must also give sufficient guarantees against the risk of abuse (Article 15 LED). The FIU may refuse to give reasons in an individual case. It must then point to indirect access through the supervisory authority (Articles 15(3) and 17 LED; Opinion in C‑222/25).
CJEU-AG – On refusal of payment methods based on automated credit checks
Where a refusal of payment in instalments or purchase on account after an automated credit check can prevent the conclusion of the purchase contract, it produces "legal effects" for the customer or at least similarly "significantly" affects them (Article 22(1) GDPR). AG Medina argues that the contractual exception applies only where the automated decision-making itself is essential to perform the main subject matter of the contract (Article 22(2)(a) GDPR). The controller bears the burden of proof (Article 5(2) GDPR; Opinion C-568/25).
CJEU-AG – Company cannot recover competition fine from members of its management body
Article 101 TFEU precludes a company from seeking to recover a cartel fine it has paid from its managing directors or board members (Sec. 43(2) Act on Limited Liability Companies, Sec. 93(2) first sentence Stock Corporation Act). AG Szpunar concludes that under EU law, a company that has infringed competition law is an offender, not the injured party. Allowing such a claim would also undermine the effectiveness and deterrent effect of cartel fines (Opinion C-347/25).
EGC – Commission entitled to deny a very large online platform access to documents concerning calculation of DSA supervisory fee
The documents contained, among other things, commercially sensitive information concerning third-party data providers. The ability to scrutinise the calculation of its own fee does not, in itself, constitute a public interest (Article 2, 4(2), first indent Regulation (EC) No 1049/2001). Moreover, the documents revealed details of the methodology the Commission uses to calculate the user numbers of other services (Article 4(2), second indent Regulation (EC) No 1049/2001). An appeal to the CJEU is possible (T-203/24, not yet final and binding).
EGC – Commission rightly designated pornographic online platform as a very large online platform
The Commission's calculation method is reliable (Article 33(4) DSA). The "unique visitors" metric already excludes a large proportion of bounced visits. Deducting bounced visits again was therefore unjustified. The concept of "active recipient" is also sufficiently precise without a delegated act (Article 3(p) DSA). The Commission also gave adequate reasons for its decision. In particular, it explained why the provider's methodology was not reliable (Article 296(2) TFEU). An appeal to the Court of Justice is possible (T‑134/24, not yet final and binding).
EUCOM – Call on Bulgaria to comply with DSA
To comply with the DSA, Bulgaria must also empower the Personal Data Protection Commission and the Electronic Media Council (Article 49 DSA). Bulgaria has also incorrectly transposed the DSA’s rules on sanctioning powers (Article 52 DSA). Its national rules on penalties do not consistently comply with the DSA’s maximum fine limit. Moreover, by treating natural and legal persons differently in ways not provided for in the DSA, they fail to ensure that all penalties are effective, proportionate and dissuasive. Bulgaria has two months to respond (press release of 01.10.26).
EUCOM – Formal proceedings against very large online platform for possible breach of DSA obligations
The Commission will examine whether the provider has properly assessed the systemic risks of fraudulent listings (e.g., non-existent properties, impersonation fraud) and phishing scams (e.g., misuse of shared guest and reservation data) and has put in place effective measures to mitigate them (Article 34 and 35 DSA). It will also investigate whether the provider has clearly labelled paid-for boosted listings as advertisements (Article 26(1) DSA; press release of 21.10.26).
German Federal Court of Justice – Right to information on credit scoring
Credit reference agencies must disclose information about how they calculate a credit score where a third party relies heavily on that score in making a contractual decision. In that case the data subject is "similarly significantly affected" and has a right of access (Article 15(1)(h), Article 22(1) GDPR). Although the burden of proof rests on the data subject, the German Federal Court of Justice (FCJ) presumes that the score played a determining role where a company makes an adverse contractual decision shortly after receiving it (I ZR 227/25 to I ZR 230/25).
German Federal Court of Justice – Price adjustment clauses of a subscription provider violate transparency requirement
According to the FCJ's reading, the price adjustment clauses at issue do not clearly explain customers’ rights when prices increase. They could be read as allowing customers only to terminate the contract, but they could also be understood as allowing customers to reject the increase and continue the contract at the original price. This lack of transparency places customers at an unreasonable disadvantage (Sec. 307(1), first and second sentence, BGB; III ZR 205/25).
German Federal Court of Justice – Reference to CJEU regarding scope of platform immunities
Hosting services are generally not liable for third-party content hosted by them (Article 14(1) E-Commerce Directive, Article 6(1) DSA). The FCJ seeks clarification, in particular, as to whether this also applies where the provider algorithmically selects, organizes and recommends user-generated content. Moreover, the court asks whether, after identifying unlawful content, service providers can be required to manually review similar content themselves (Article 15 E-Commerce Directive, Article 8 DSA). Finally, the FCJ raises the question whether these immunities also apply to damages claims under the GDPR (Art. 82 GDPR; Press release of 27.10.26).
Higher Administrative Court of North Rhine-Westphalia – Blocking orders against internet access providers regarding porn platforms breach EU law
Cypriot porn platforms offered videos without any age verification. A state media authority therefore ordered an internet access provider to block the websites for breach of Sec. 4(2) sentence 1 No. 1 sentence 2 JMStV. However, the platforms did not breach German law. First, the DSA exhaustively governs the systemic obligations of platforms to protect minors. This leaves no room for national rules. Second, applying German rules breaches the country-of-origin principle. Under this principle, online service providers generally need to comply only with the rules of their home Member State. This safeguards the free movement of services (Article 3(1), (2) E-Commerce Directive; 13 B 1351/25, 13 B 1359/25).
Italy – Decree implementing AI Act with far-reaching liability rules
Italy's implementing decree goes beyond the AI Act with rules on civil liability for damage caused by AI systems. For example, where a party breaches obligations under the AI Act, the decree establishes a rebuttable presumption of a causal link between the breach and the damage (Article 18 Decreto legislativo No. 160/2026). Italy thus takes up approaches from the proposed AI Liability Directive that the European Commission had withdrawn (Decreto legislativo No. 160/2026).
