23 octobre 2026 — Journée RGPD à Poitiers : cybersécurité, IA et conformité au cœur des enjeux de protection des données

AISIA

Rédaction AISIA · édition du 23 octobre 2026

🤖 AI Act Art. 50(4). Analyse de la rédaction AISIA, produite avec le système d'IA AISIA à partir des flux publics cités. Les faits sont ceux des sources. La lecture est une interprétation, pas un fait supplémentaire. Règlement (UE) 2024/1689.

23 octobre 2026 — Journée RGPD à Poitiers : cybersécurité, IA et conformité au cœur des enjeux de protection des données

CNIL publie « Journée RGPD à Poitiers : cybersécurité, IA et conformité au cœur des enjeux de protection des données ». Le fil écrit : « La CNIL organise une nouvelle Journée RGPD à Poitiers le 1er décembre 2026. Cet évènement sera l’occasion d’échanger avec les acteurs du territoire sur les actualités en matière de protection des données personnelles et les enjeux concrets auxquels sont confrontés les professionnels. ». 4 autres textes suivent dans l'édition.

Par la rédaction AISIA, 23 octobre 2026.

EDPB publie « EDPB publishes statement on the data protection challenges of smart glasses ». Le fil écrit : « Brussels, 13 October – During its latest plenary, the EDPB has adopted statement 1/2026 on smart glasses and published the report “The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses” , developed in the context of the Support Pool of Expert (SPE) programme . As smart glasses become widely available and more frequently used, they raise significant questions for the protection of individuals’ personal data and rights and freedoms even if they create new opportunities for communication, assistance, and innovation. “These devices look like ordinary glasses, but they include cameras and microphones and are connected to the internet. This raises serious privacy concerns, as individuals may be recorded without their knowledge. The risks are even greater in sensitive environments—such as hospitals, schools, or workplaces—and when recordings are shared on social networks. And of course, children are especially at risk when using these glasses or when they are filmed.“ EDPB Chair, Anu Talus The EDPB’s text is an initial statement which provides preliminary guidance to users, manufacturers and service providers while increasing awareness about the risks these devices pose. Shared responsibility The user’s responsibility for processing personal data under the GDPR depends on the way they use their smart glasses. For example, if this involves sharing a photo or video on a public social media account, or if smart glasses are used as part of official, professional, or political activities, the user would be considered a data controller . However, if the user shares a photo or records a video of family members or friends, or if they use the device for personal translation purposes in a private context, this would be considered a purely personal activity for which the GDPR would not apply (household exemption). In any case, even when the GDPR does not apply, the use of smart glasses may still be subject to criminal, civil, or labour law - as well as other sector-specific rules. As data controllers, neither the producer nor the provider of a linked application or service can transfer their obligations to users . They must comply with data protection law and ensure any new data processing remains compatible with the original purpose of collection. The importance of transparency The EDPB highlights transparency as one of the main data protection challenges posed by smart glasses. Due to their discreet appearance and use, bystanders may be unaware that personal data relating to them is being processed, by whom, and for what purposes. “Smart glasses should make their recording obvious – for instance with bright LED lights, audio signals or voice activation cues, privacy-friendly smartphone notifications, or unique designs. These warnings need to be reliable, hard to ignore, and always up to date. Even in public spaces, bystanders should clearly understand that someone is filming or photographing them. Because when it comes to privacy, individuals deserve clear warnings, not hidden surprises.” EDPB Chair, Anu Talus Lastly, the statement encourages industry standards and awareness-raising measures to help individuals understand when smart glasses are being used and how their personal data is used. Expert insights The report “The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses” was commissioned by the Board, through its SPE programme and following a proposal from the French DPA, to better understand smart glasses usage, their privacy implications, and assess their societal acceptability. The report, developed by a digital sociologist, examines both user experiences with smart glasses and non-users' perceptions of associated risks, supported by real-life examples from interviewees. The research shows that smart glasses are sometimes becoming instruments of interpersonal surveillance and handling of evidence. Furthermore, individuals’ ability to use these devices effectively varies widely, creating power imbalances between those who use them and those being recorded. Note to editors: This document was not produced by the EDPB. It was prepared by an external contractor as part of the SPE programme. The views expressed are those of the authors and do not necessarily reflect the official position of the EDPB. **The Support Pool of Experts (SPE) is a key initiative of the EDPB, which is part of the  EDPB 2024-2027 Strategy . The main objective of this programme is to help European Data Protection Authorities (DPAs) increase their capacity to supervise and enforce data protection rules by developing common tools and giving them access to a wide pool of experts. » Le flux date cette publication : Tue, 13 Oct 2026 12:00:00 +0000.

Commission européenne — stratégie numérique publie « First harmonised standard supporting the AI Act published in the Official Journal ». Le fil écrit : « First harmonised standard supporting the AI Act published in the Official Journal Anonymous (not verified) Mon, 10/19/2026 - 09:37 The European Commission has published the reference to the first harmonised standard supporting the implementation of the AI Act in the Official Journal of the European Union. The standard, EN 18286:2026 - Artificial intelligence - Quality management system for EU AI Act regulatory purposes , developed by CEN and CENELEC, provides a clear legal pathway for providers of high-risk AI systems to comply with the quality management system requirements under article 17 of the AI Act . Its publication through Commission Implementing Decision (EU) 2026/2274 means that providers implementing this standard will benefit from a presumption of conformity with the Article 17 requirements covered by the standard. EN 18286 translates these requirements into an operational quality management system (QMS). It is the only AI QMS standard with a presumption of conformity. It is mapped to Article 17 of the AI Act, built around the AI system lifecycle – rather than the organisation – and designed to be layered on top of the existing international standards – such as ISO/IEC 42001, ISO 9001 or a sectoral QMS (e.g. ISO 13485) – rather than replace them.  EN 18286 explicitly allows providers in regulated sectors to integrate management systems, rather than run separate ones. Organisations without ISO/IEC 42001 that plan to place or put into service high-risk AI systems in the EU market can use EN 18286 to expand an existing QMS or build one that fulfills the requirements of article 17 requirements. The publication of this standard marks an important milestone in implementing the AI Act, ahead of the application of requirements for high-risk AI systems , with further harmonised standards expected to follow. Find further information about the Standardisation of the AI Act . Related topics Artificial intelligence. » Le flux date cette publication : Mon, 19 Oct 2026 07:37:54 +0000.

Commission européenne — stratégie numérique publie « Digital Services Act study on financial scams on online platforms and ways to counter them ». Le fil écrit : « Digital Services Act study on financial scams on online platforms and ways to counter them Anonymous (not verified) Tue, 10/20/2026 - 08:47 A new study maps the main types of online financial scams, platform features scammers exploit, their impact on users and society and measures platforms can take to stop them. Online financial scams – fraudulent schemes whose primary aim is to extract money from victims – have grown into a pervasive crime in the digital age. They are present across all types of online intermediary services, including Very Large Online Platforms (VLOPs) and Very Large Search Engines (VLOSEs) . The European Commission has procured this study in 2025 to support its supervisory and enforcement tasks under the Digital Services Act (DSA) . It provides a typological mapping of financial scam formats across online platforms and assesses existing and emerging mitigation strategies to curb financial scams online. The study was carried out by Open Evidence and Spark Legal and Policy Consulting. It does not evaluate compliance by providers of VLOPs and VLOSEs. Read the study and the executive summary in (French and English) . Key insights A diverse typology of scams The study maps different types of online financial scams and categorises them in six broad categories: investment scams romance scams e-commerce scams employment and collaboration scams unexpected gain scams disaster relief scams The study finds that investment scams and romance scams are the most common and fastest-growing forms of scams in Europe. It also finds that the scam landscape is increasingly being redefined by overlapping methods across different categories. Online platforms features and financial scams The study presents information on relevant features related to scams on online platforms including: advertising systems recommender systems content moderation of organic content monetisation systems app store content and private messaging functions inauthentic identities and account manipulation deceptive commercial content generative AI The study also shows how financial scams operate across different platforms and are facilitated by organised criminal networks that sell tools and services, effectively lowering the barrier to entry. Identifying effective countermeasures The study identifies relevant countermeasures across 4 categories: Access and gatekeeping measures, such as know your business customer and identity requirements are the first line of defence against online financial scams; Detection and removal measures, including automated and human-review based measures, can neutralise scam content; User facing measures – such as reporting tools and information on redress – can equip end users with tools and information to identify and report online scams; Platform-level policies and cooperation with third parties can help platforms identify, prevent and address online scams. Related topics Online platforms and e-commerce DSA - Digital Services Act. » Le flux date cette publication : Tue, 20 Oct 2026 06:47:54 +0000.

EDPB publie « Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data ». Le fil écrit : « Background information Date of final decision: 2 October 2026 National case  Controller: Xandr Inc. Legal References: Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data) Decision: Administrative fine Key words: Fines, Basic principles, Marketing, Online platforms Summary of the Decision Origin of the case   The case started in 2020 when the Norwegian Consumer Council lodged a complaint against the advertising technology company Xandr (at the time AppNexus, now a part of Microsoft) with the Norwegian DPA (Data Protection Authority). The case concerns real-time bidding in Grindr, a location-based dating app aimed at gay, bi, trans and queer people. Key Findings  The Norwegian DPA has found it proven by clear preponderance of probability that Xandr processed Grindr users’ personal data, at least the fact that individuals were using Grindr, their advertising ID and IP addresses, during real-time bidding. These are personal data under Article 4(1) GDPR and data concerning sexual orientation under Article 9(1) GDPR. Xandr is considered a joint controller for the processing, both as supply-side and demand-side platform. Since the data were special category personal data, explicit consent under Article 9(2)(a) was the relevant legal basis for the processing. Xandr did not obtain consent itself, but relied on Grindr’s consent, which were invalid under Articles 4(11) and 7 GDPR. The DPA holds that accountability cannot be outsourced; each joint controller must independently verify that consent is valid and covers its own processing. The infringements were at least negligent. In light of the fact that the infringements concern some of the most central provisions in the GDPR, including sensitive data, the Norwegian DPA regards the infringements of high seriousness. Decision The Norwegian DPA imposed an administrative fine of EUR 8 600 000 on Xandr Inc. for processing personal data of Grindr users in Norway without a legal basis in violation of Article 6(1) GDPR, and for processing special category personal data concerning sexual orientation without a valid exemption, in violation of Article 9(1) GDPR. For further information:   Norwegian Press Release: Datatilsynet gir Microsoft-selskap 92 millioner i gebyr | Datatilsynet English Press Release: Microsoft company fined NOK 92 million | Datatilsynet. » Le flux date cette publication : Fri, 16 Oct 2026 12:00:00 +0000.

Lecture de la rédaction

Notre lecture : CNIL et EDPB et Commission européenne — stratégie numérique éclairent des sujets distincts. Leur rapprochement relève du travail éditorial ; il ne constitue pas une preuve de lien entre les sujets. Les faits restent attribués à leurs sources. Les phrases des fils sont citées telles quelles, sans traduction ajoutée.

Repère visuel

📊 Repère visuel — publications par source : Commission européenne — stratégie numérique (2), EDPB (2), CNIL (1).

Répartition des publications par source

Sources

CNIL — Journée RGPD à Poitiers : cybersécurité, IA et conformité au cœur des enjeux de protection des données

https://www.cnil.fr/fr/journee-rgpd-2026-poitiers

EDPB — EDPB publishes statement on the data protection challenges of smart glasses

https://www.edpb.europa.eu/news/edpb-publishes-statement-on-the-data-protection-challenges-of-smart-glasses_en

Commission européenne — stratégie numérique — First harmonised standard supporting the AI Act published in the Official Journal

https://digital-strategy.ec.europa.eu/en/library/first-harmonised-standard-supporting-ai-act-published-official-journal

Commission européenne — stratégie numérique — Digital Services Act study on financial scams on online platforms and ways to counter them

https://digital-strategy.ec.europa.eu/en/library/digital-services-act-study-financial-scams-online-platforms-and-ways-counter-them

EDPB — Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data

https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en

AISIA — orchestration IA · aisia.fr