digital economy regulation

The strategy aims to scale up access to data for AI by rolling out data labs and streamlining data rules under existing legislation outlined in the accompanying Digital Omnibus proposals. The strategy further foresees embedding fair conditions for data access and cross-border data flows into “international digital trade”.

This report gathers policy and regulatory developments at EU level covered by Cullen International’s Digital Economy and Media services over the past week. It also lists events taking place this week.

The list includes major US cloud providers Amazon, Google, and Microsoft, whereas among telecoms operators only Deutsche Telekom and Orange Group have been designated. These providers will now be subject to a dedicated EU-level oversight regime led by one of the European Supervisory Authorities. DORA establishes security requirements for ICT risk management in the financial sector and oversight of certain ICT third-party service providers deemed critical.

Industry associations largely argue that new horizontal rules to protect consumers under the future Digital Fairness Act (DFA) are unnecessary, calling instead for better enforcement and simplification of existing EU laws. While surveyed public authorities agree that the DFA should strengthen fairness and trust in the digital marketplace, they differ on whether this should be achieved mainly through better enforcement of existing laws or by requiring companies to embed fairness, transparency, and consumer protection principles into the design and functioning of digital products and interfaces.

The transposition law is mostly aligned with the obligations of the NIS2 Directive on scope and security requirements. However, it includes changes that would enable the Federal ministry of the interior (BMI) to define critical components for NIS2 sectors. Such a change would extend the possibility to potentially restrict the use of products from certain vendors beyond 5G networks.

These would include removing pseudonymised data from the scope of personal data, recognising legitimate interest as a legal basis for AI training involving personal data, and introducing new exemptions to the general prohibition on processing special category (i.e. sensitive) data. The Digital Omnibus would also address the processing of personal data by cookies and consent fatigue. Additionally, the proposal would streamline incident reporting obligations under several digital laws by introducing an EU single-entry point.