what i read this week - week 46 2026
Haven't done these posts since August! I've also generated quite the backlog since end of September probably, now I'm working that off :)
papers and other pdfs
[EN] EDPB Statement on Smart Glasses - 8 page statement of the European Data Protection Board on smart glasses. Among the usual known issues around them like consent, data minimization and transparency obligations, they also point out the difficulties around identifying the controllers (in the sense of Article 4 Nr. 7 GDPR) of the data processing - depending on the process and context, it couldn't just be the owner or wearer of the glasses, it could also be the producer of the device (like Meta), or the provider of a linked application or service (like OpenAI, if ChatGPT was used), which means joint controllership is possible. The document also discusses the GDPR's household exemption and when it stops applying to the recording via smart glasses.
[EN] EDPB Guidelines 03/2026 on web scraping in the context of generative AI - 23 page guidelines from the European Data Protection Board on web scraping done by bots to train AI, first version from July this year. As far as personal data is concerned, the GDPR also applies here, yet its requirements are easily circumvented, with almost no way to catch it or hold scrapers accountable. It's clear that scraping has the goal of maximizing data acquisition (quite the opposite of the data minimization principle) and it's usually not feasible to notify affected all parties of the processing of their data, so they don't have to.
Scrapers tend to not discriminate very strongly what kinds of data they scrape (unless it is for a very specific project and on limited websites only), so within it all, there could be data that falls under special categories like Article 9 GDPR, so scraping it is a clear violation. Incidental and accidental collection of this data might be permissible if enough technical- and organizational measures have been taken to avoid this as much as possible, but this directly clashes with the interest to get as much data as possible for AI, so this is sadly an unrealistic standard to expect. It's also questionable whether the purposes can be defined in a way that satisfies legal requirements and doesn't cause a purpose change later on. The guidelines suggest considering using synthetic data instead of personal data, defining precise collection criteria, applying filters to exclude the collection of certain categories of data, and excluding websites which structurally contain these data and websites which clearly oppose the scraping of their content.[EN] From a Right-Based Approach to Competitiveness? The EU Digital Omnibus Reform - 18 pages published in the Journal of Risk Regulation by Giovanni De Gregorio and Hannah Ruschemeier, the latter who used to be my professor and who motivated me to make the jump into data protection law. The paper discusses the standard criticisms of the digital omnibus, mainly the increasing risks for fundamental rights and legal certainty in favor of competitiveness, and the lack of enforcement. It also mentions an underdiscussed point in the current reworks: The changes and relaxing of certain requirements, definitions and standards actively rewards companies who either operate in bad faith or have simply never invested in complying while flying under the radar, while it's penalising those that have invested in rigorous legal compliance who now have to change processes, documents and internal rules all over again.
[EN] Growing Up With Generative AI - 44 slides about a YouGov online survey on behalf of interface in France from June 2026 about the youth experience of growing up with AI. 1,138 parents of children aged 11 to 17 and 970 teenagers aged 11 to 17 were asked. Key takeaways are that AI is widely used among children in those ages, and parents tend to underestimate the use of their children quite significantly unless it is AI companions. Regular use of generative AI increases with the child’s age, even though confiding in AI is more common among prepubescent children aged 11-12 (concerning).
[EN] Working Paper on Extended Reality 28 pages from the International Working Group on Data Protection in Technology exploring what Extended Reality is (umbrella term for Augmented Reality, Virtual Reality, and Mixed Reality (“MR”)) and what privacy risks apply. This sort of tech usually needs a lot of cameras and sensors to function and may collect biometric data, and infers a lot of things via AI and other means. Nothing really new or mind-boggling here, the standard risks apply, more or less, especially when it comes to wearable tech (VR headsets), third parties being captured during use, and sharing location to use (like Pokemon GO).
[DE] KI-Taskforce Bericht: Deutschland als KI-Nation 2039 - 39 page PDF about Germany's AI future that was written exclusively by ministries, no citizens, no NGOs or companies. Much of it reads more like vague advertising than concrete steps and plans. What's especially disappointing is that while they can't stop talking about sovereignty and acknowledging that if you don't start early, you're always gonna be reliant on others who are far ahead, they're still planning on being almost completely reliant on foreign tech, especially US giants. EU models shall only serve as fallback options, except for their pipe dream of some highly specialized AI tools that are exclusive to German knowledge/commercial niches that is supposed to catapult us forward.
The social and ecological questions don't really get addressed aside from making sure everyone can have access to AI freely and equally. Not much to be found on how the disruption of the job market and possible mass unemployment will be dealt with specifically, as well as deepfakes and misinformation and its effects on society and elections; just that they are problems and shouldn't be. The document also has very arbitrary, hype-based goals whose numbers seem very random and not grounded in any actual need or progress. All in all, a document and plan that's kinda like the bad and late kid in class who saw the other groups present first, reworked parts of their presentation on a whim after seeing those, and now pretends they had this stuff all along, but doesn't know what they're talking about, pretending to be one of the top students in class.[DE] Stellungnahme der DVD e. V.und des Netzwerks Datenschutzexpertise zum Gesetzentwurf zum Einsatz von KI in der Migrationsverwaltung (KIMVG) - 21 page statement of two privacy groups in Germany regarding the planned use of AI in migration management and edits of AsylG and AufenthG to facilitate this data processing. The statement endorses the plan (yikes!) based on the amount of work in that area making it difficult to decide the applications within the required time frames, but thankfully nonetheless corrects some false understandings and points out some risks and necessary standards as well (especially around the automation and the classification of high risk AI). I really don't want to entrust AI with making automated decisions on something so serious, life or death in many cases, and it's not good enough for me if there is a human in the loop somewhere just nodding about the AI assessment.
I also consider it disrespectful if one party creates a convoluted process to apply for asylum or other forms of immigration which demands a ton of documents, just to whine about being overwhelmed by the documents and deciding they no longer really want to see them personally. There are different ways German administrations could thin out and quicken the process without making someone jump through hoops and then avoid looking at what was asked for. I don't want extremely vulnerable groups to have to agree to this sort of invasive processing of their personal data just for a chance at safety and a new life.[DE] Digitale Grundrechte sichern – Datenschutz einfach, wirksam und föderal stärken - 5 page motion from several politicians and Grüne at the Bundestag, calling for more data protection. They're calling out the open assault on our digital human rights and the practice of blaming data protection and privacy concerns for anything from IT failures to commercial flops. They call, among other things, for a modernization of our federal DPA system instead of centralization and the continued support and further development of the GDPR, and are against sweeping data privileges for AI.
other links
[DE] Nein, Europa ist keine Kolonie von Big Tech - Arguments on why the EU is not victim of digital colonialism by the US. We voluntarily bought into it out of convenience, we were not forced into it, and we still profit from colonialism today.
[EN] Who is reducing your privacy? - informative site from noyb about who votes against your privacy interests in the EU.
[EN] We can’t just change the definition of ‘recording’ - Article by The Verge about the newest attempt of tech companies to make you comfortable with always-on recording if it isn't saved and highlights are immediately processed by AI during use, as if just saving recordings was the issue and not everything else around it (like chilling effects, or the fact that devices now do the recording that seemingly shouldn't be capable of it).
[EN] You’ve Changed. Shouldn’t Your Algorithm? - Tech Policy Press article on interesting considerations and problems behind your interests and needs changing while your algorithm keeps you boxed in, plus conflicting behavior between what you say you want (let's say, cat videos) and then engaging with what you don't want (because it is shocking, enraging, etc.) even though you know you shouldn't, training your algorithm to show you more of the things you say you don't want. Fitting quote from the article: "A crisis can command our attention without defining what we want to understand next month. A reader may want to keep following a local newspaper while receiving fewer unsolicited disaster videos." More granular controls around what you want to see and don't wanna see, with agreed upon endpoints, are required.
[EN] Humans Have Rights. Machines Do Not. - Tech Policy Press article covering the attempts of the AI industry to argue that their chat bots' outputs are their "own opinions", therefore protected speech, and that their models deserve human rights such as the freedom of speech, all to avoid liability for its outputs and consequences on the users. The result is "agency without accountability".
[EN] Tech Companies Are Trying to Shift the Entire Concept of Privacy (Again) - Electronic Frontier Foundation post on a topic I have also touched on: Privacy is a team effort that should extend to everyone, yet tech companies are trying to offload responsibility onto users and seem to only keep the person using the device a bit more private (if at all), and see everyone else the user is surrounded by as fair game. It requires you to become an expert and dodge an assault of things while being at the mercy of everyone around you. That's by design!
Published