Insights

On February 27, 2025, the Court of Justice of the European Union (“CJEU”) issued a ruling about the requirements on data controllers to respond to data access requests regarding an automated decision-making system. In particular, the CJEU interpreted the meaning (under Article 15(1)(h) GDPR) of the phrase “meaningful information about the logic involved” in automated decision-making. Importantly, the ruling also separately addressed how to balance data access rights with the protection of the controller’s trade secrets, when the protection of trade secrets is invoked under Article 15(4) as a reason not to disclose a copy of personal data in an access request.

The U.S. Copyright Office has released Part 2 of its Report on the legal and policy issues related to copyright and artificial intelligence (AI). This part of the Report, issued on January 29, 2025, focuses on the copyrightability of outputs created using generative AI. Overall, the Copyright Office concludes that existing law is sufficient to resolve questions of AI usage in copyrighted works, and sufficient human contributions to AI-generated outputs that would constitute authorship will be analyzed on a case-by-case basis. The Office declined to support a separate copyright registration analysis for AI works, but provided new examples of how using AI as a tool could support sufficient authorship for copyrightability.

On October 24, 2024, the Court of Justice of the European Union (CJEU) handed down its highly anticipated ruling in the Kwantum v. Vitra case (C-227/23). In short, the CJEU held that EU Member States must afford copyright protection for works of applied art (i.e., furniture, lighting, home appliances, etc.) that meet the originality-requirement, regardless of the country of origin of these works or the nationality of the author.

AI is currently attracting a lot of attention, and not only for the stunning pace at which we have embraced AI for writing office speeches, shopping lists or mathematical formulas, or for creating illustrations or improving the visuals of slide shows. Lawyers have also started paying attention to AI, with analyses of copyright infringements in input and output, anti-competitive concerted behavior (such as price fixing) or violations of personality and privacy rights with deep fakes imitating celebrities’ images or voices.

At the beginning of the year, we brought to your attention that a number of important Belgian and EU legislative changes are likely to have an impact in 2024: there are new laws that have been adopted and proposals that are expected to firm up into law.

In an era where regulatory landscapes are rapidly evolving, companies with a footprint in the European Union must stay vigilant and adaptable. The EU has recently unveiled a comprehensive set of guidelines that impose fresh obligations on both EU and non-EU based companies operating within its borders. This client alert is the first in a series designed to decode the complexities of the new EU regulations and provide actionable insights for businesses to ensure full compliance[1]. Stay tuned as we unravel the details of these pivotal changes and guide you through the steps your business needs to take to align with the EU's heightened regulatory standards.

On February 17, 2024, The Digital Services Act (DSA) will become applicable, introducing a new regulatory framework for providers of intermediary services. The DSA will apply to those offering their services to users located in the EU, regardless of the providers' place of establishment. We have discussed the new obligations in our previous client alert, when the DSA was adopted. In this alert, we will focus on the notice and action mechanisms, the positions of the users, intermediaries and the general public.

A number of important Belgian and EU legislative changes are likely to have an impact in 2024. On the one hand, there are new laws that have been adopted and will start to bite, and, on the other, there are proposals that are expected to firm up into law.

On Friday 8 December 2023, after a period of lengthy and intense negotiations, European legislators have reached a political agreement on the AI Act. Proposed by the European Commission in April 2021, the Act positions the EU as a trailblazer in regulating the groundbreaking technology of Artificial Intelligence. Although the final text is not yet available, a final political agreement on the content of the regulation has been achieved.

On November 9, 2023, the European Parliament has adopted the final version of the Data Act, marking a significant milestone in the evolving landscape of digital regulation. The Data Act is part of the European Commission’s broader strategy to shape Europe’s digital future (see our earlier posts here and here).

On October 24, 2023, the European Data Protection Supervisor (EDPS), which is the supervisory authority for the EU institutions, bodies, offices and agencies (EUIs), published a new opinion on the widely discussed proposal for an EU Regulation laying down harmonized rules on artificial intelligence (commonly known as the AI Act Proposal). Although the EDPS does not supervise the private sector, it plays an influential role in both the European and global regulatory community and this new opinion is, thus, a valuable addition to the current legislative debate.

In a judgment of August 1, 2022, the Court of Justice of the European Union (CJEU) provided further guidance on two important aspects of the General Data Protection Regulation (GDPR) (CJEU C-184/20). In summary, the CJEU held that, first, for a national law that imposes a legal obligation to process personal data to be able to constitute a legal basis for processing, it needs to be lawful, meaning that it must meet an objective of public interest and be proportionate to the legitimate aim pursued, and second, that non-sensitive data that are liable to reveal sensitive personal data need to be protected by the strengthened protection regime for processing of special categories of personal data.

On Tuesday, July 5th, the European Parliament adopted the Digital Services Act (DSA) with a resounding 539 votes in favor, 54 votes against and 30 abstentions. The DSA is but one part of the multifaceted European digital strategy and, together with the Digital Markets Act (DMA), makes up the Digital Services Package, initially proposed by the European Commission in December 2020 (see our previous alert of January 12, 2021). The DSA takes the form of a Regulation, directly applicable in all EU Member States, and will amend (but not fully replace) the 2000 e-Commerce Directive (Directive 2000/31/EC).

On May 3, 2022, the European Commission published a proposed regulation (the “EHDS Proposal”) for the establishment of a European Health Data Space (or “EHDS”). This is the first proposal for establishing domain-specific common European data spaces following the European strategy for data and an important step in building a European “Health Union”.