TMT Newsletter | September 2026

Outlook

01.10.2026
Opinion

CJEU-AG Medina: May an adult who was baptized as a minor request the erasure of his or her personal data from the analogue baptismal register, or does the freedom of religion or the archiving exception preclude such erasure  (Article 17(1), (3)(d) GDPR, Article 10 CFR, Article 9 ECHR; C-12/25)?

Opinion

CJEU-AG Szpunar: Are German provisions which enable a corporation on which a national authority has imposed a fine for an infringement of competition law to claim compensation from its management body compatible with Article 101 TFEU? (Section 43(2) Act on Limited Liability Companies and Section 93(2) s. 1 Stock Corporation Act; C-347/25)?

07.10.2026
Hearing 

CJEU: Does making a phonogram available to the public require the possibility of accessing it, or can it also be done by setting a hyperlink (Article 3(2)(b) InfoSoc Directive)? Can the CJEU's criteria for an act of communication to the public by video-sharing and share-hosting services be applied to determine whether a content delivery network carries out an act of making available to the public (Article 13(1) E-Commerce Directive, Article 5(1) DSA, Article 3(2)(a), (b) InfoSoc Directive; C-534/25)?

Decision

EGC: Action against a decision refusing a service provider access to documents on the calculation of the supervisory fee under Article 43 DSA (Article 2 and 4(2), (3) Regulation (EC) No 1049/2001; T-203/24).

08.10.2026
Opinion

CJEU: Can a financial intelligence unit fully and permanently restrict a person's right of access under the GDPR or Directive (EU) 2016/680 to protect ongoing investigations (Article 2(2)(d) and 23 GDPR, Article 2(1) in conjunction with Article 1 and Article 15 of Directive 2016/680; C-222/25)?

14.10.2026
Decision

EGC: Action against a decision designating a pornographic online platform as a VLOP (Article 33(4) DSA; T-134/24).

15.10.2026
Opinion

CJEU-AG Biondi: Action against a decision designating a company as a gatekeeper for its video-sharing service and online advertising service (Article 3(1), (5) DMA; C-627/24 P).

Opinion

CJEU-AG Szpunar: On the scope of the Notification Directive (Directive (EU) 2015/1535), the legal consequences of a failure to notify under Article 5 of the Notification Directive, and the compatibility of a general national ban on gambling advertising with EU law (C-194/25).

Opinion

CJEU-AG Medina: Does the practice of a distance seller of refusing certain payment methods to customers on the basis of an automated credit check infringe Article 22(1) GDPR – and, if so, what are the necessity requirements under Article 22(2)(a) GDPR (C-568/25)?

 

CJEU – On the copyright protection of postings on social networks and the scope of the exception for reporting of current events

Social media posts can be copyright-protected where the author made free and creative choices in selecting, arranging and combining the words (Article 2(a) InfoSoc Directive). Length, genre and online format are generally irrelevant. The exception for current events reporting (Article 5(3)(c) InfoSoc Directive), in principle, allows for national provisions limiting use to extracts. However, a national prohibition on deriving a commercial or financial benefit from the use is violates EU law (C-598/24).

CJEU – EECC does not provide a legal basis for unilateral contract changes 

Providers of publicly available electronic communications services may not simply change existing contracts. Article 105(4) EECC-Directive does not grant providers the right to unilaterally change contractual terms. Rather, it presupposes that such a right already exists. Whether general terms and conditions may provide for unilateral contract changes is therefore governed by general consumer protection law (C-669/24).

CJEU – Political party not free to use trademarks for parodic advertising without further justification

A Belgian political party used third-party trademarks to promote its asylum agenda. Freedom of expression can justify such use only where it outweighs the trademark owner's property rights (Article 9(2)(c) EUTMR, Article 10(2)(c) and (6) Directive (EU) 2015/2436, Article 11 CFR). When balancing these interests, national courts must consider the user's intention (good faith), any harm to the trademark owner, and whether the use contributes to a debate of general interest (C-298/23).

CJEU-AG – Belgian data retention rules for electronic communications incompatible with EU law

The rules provide for broad retention of traffic and location data by electronic communications providers, including for fraud prevention. According to AG Szpunar, such retention is compatible with Article 15(1) ePrivacy Directive and Article 7, 8 CFR only under strict conditions: the data categories must be kept separate from a technical point of view, combined use must be prevented, and retention must be limited to what is strictly necessary. The Belgian rules fail to meet these requirements and give operators too much discretion on what data to retain and for how long (C-661/24).

CJEU-AG – Consent to direct marketing by "partners" of an internet service provider valid only where the identity of those partners is known

According to AG Spielmann, consent to use personal data by an unidentified "partner" of an internet provider does not meet the requirements of Article 6(1)(a) GDPR: consent can only be "informed" if the data subject knows who will process its data. If the recipient's identity was unknown when consent was given, new consent must be obtained at the latest with the first communication. The option to unsubscribe after the first contact does not cure the lack of prior consent (C-317/25).

EGC – Edge web browser not a gatekeeper based on a qualitative assessment

Despite exceeding the quantitative threshold for end users (Article 3(2)(b) DMA), the Commission could, based on a qualitative assessment, refrain from designating the web browser as a gatekeeper (Article 3(5) DMA). The Commission based its decision on the limited cross-device usage of the web browser, its reliance on a third-party browser engine, and the fact that its integration into the provider's digital ecosystem does not give the browser decisive advantages (T-357/24, not yet final and binding).

EUCOM – Designation of three very large online services under the DSA

The Commission designated ChatGPT as a Very Large Online Search Engine (VLOSE) and Reddit as well as Roblox as Very Large Online Platforms (VLOPs) (Article 33(1), (4) DSA). The service providers must now comply with additional obligations within six months, including assessing and mitigating the systemic risks stemming from their services (Article 34, 35 DSA). The service providers may challenge the designations by way of an action for annulment (Article 263 TFEU; press release of 31.08.26, not yet final and binding).

EUCOM – Draft for EU KIDS Act proposed

The proposal sets age limits for social media use: children under 13 are banned; 13- to 15-year-olds may only have accounts under parental control (Article 6 draft EU KIDS Act). Independent accounts are only permitted from age 15. Age verification must be privacy-friendly and take place at account creation (Article 27 et seq. draft EU KIDS Act). Services must be designed to be age-appropriate ("safety by design", Chapter III draft EU KIDS Act). The Commission proposes a reversal of the burden of proof: VLOPs must demonstrate their services are safely designed (Article 5 draft EU KIDS Act); violations may result in fines of up to 6% of global annual turnover (Article 34 draft EU KIDS Act) (proposal of 17.09.26).

German Federal Court of Justice – Use of a rhythm fragment from a sound recording permissible as a pastiche (Metall auf Metall VI)

Following the CJEU's recent delineation of the concept of "pastiche" (Article 5(3)(k) InfoSoc Directive, Section 51a s. 1 German Copyright Act), the FCJ has now affirmed that the use of the "Metall auf Metall" sequence in the track "Nur mir" constitutes such a pastiche. A pastiche is a creation that evokes an existing work and uses its protected elements to create an "artistic or creative dialogue" recognizable to those familiar with the original work. Here, the rhythm fragment was a "nucleus" of the original work and remained recognizable despite the independent character of "Nur mir". The dialogue lies in transposing the fragment into a different musical genre (I ZR 74/22; following the CJEU' preliminary ruling C-590/23 ("Pelham II"); see also Newsletter of April 2026).

German Federal Court of Justice – No communication to the public where broadcast signals are retransmitted via an internal cable network in retirement homes

Following the CJEU, the FCJ now holds that the internal retransmission of signals in a retirement home does not involve "specific technical means" different from those of the original broadcast, nor does it reach a "new public", an therefore does not constitute a communication to the public (Article 3 InfoSoc Directive, Section 15(2) German Copyright Act). The same applies to the non-harmonised right of communication to the public of broadcasting organisations (I ZR 34/23 and I ZR 35/23; following CJEU preliminary ruling C-127/24; see also Newsletter of May 2026).

German Federal Court of Justice – Referral for a preliminary ruling on the "household exception" under the GDPR

The GDPR does not apply where individuals process personal data for purely personal or household activities ("household exception", Article 2(2)(c) GDPR). The German Federal Court of Justice has referred several questions to the CJEU, in particular whether forwarding private chat messages to an employer falls within this exception, and whether the purpose of the processing must be taken into account (press release of 17.09.26, I ZR 256/25 and I ZR 289/25, not yet published).

Regional Court of Frankfurt a.M. – Hosting provider liable for unlawful advertising

Third parties used a company's trademark and the image of its founder for unlawful advertising on a social network. Following the company's report through a dedicated tool, new identical or substantively equivalent advertisements were uploaded. In the court's view, the hosting provider influenced advertisements in users' feeds. It therefore was not "neutral" within the meaning of the CJEU's case law in Webgroup and Coyote (C-188/24 and C-190/24), as a result of which the liability provisions of the DSA would not apply (Article 6 DSA, press release of 17.09.26, 2-06 O 234/25, not yet final and binding).

Irish Data Protection Commission – Fine imposed on service provider for alleged GDPR infringements

According to the Irish Data Protection Commission, the service provider's handling of location data violated the GDPR's transparency and fairness principles. Users did not know their location data was being used for personalized ads. The Irish authority claims that the alleged violations were aggravated by the retention period of users' data (press release of 21.09.26).