Submarine cables carry almost all intercontinental Internet traffic, yet many routes converge in a small number of corridors and straits — where fragility becomes systemic. From the Red Sea and other global chokepoints to the EU response: NIS2, CER, Regional Cable Hubs and the €40M repair-capacity call, with Italy leading the Mediterranean hub.

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Submarine Cables: Global Vulnerability and the European Response

Global vulnerability of submarine cables and the European response: chokepoints, the Red Sea case, NIS2, CER, Regional Cable Hubs and repair capacity.

#Cybersecurity #NIS2 #SubmarineCables

The EDPB has adopted a common template for personal data breach notifications under Article 33 GDPR. I have analysed the model in a new article. The point is that this is not simply a form. The template includes 7 sections and 126 fields, with predefined values, tooltips, mandatory-field indicators and business logic for conditional visibility and validation. It translates several GDPR requirements into a structured digital workflow: the lifecycle of the notification, the 72-hour rule, the taxonomy of confidentiality, integrity and availability breaches, the link between Articles 33 and 34 GDPR, the assessment of risk, communication to data subjects, cross-border cases and multi-notification scenarios. The real test will be implementation. If national supervisory authorities integrate the template into their digital platforms in a coherent way, it may reduce operational fragmentation and support more consistent breach notification practices across the EU. Article:

NicFab Blog — Privacy, GDPR & Artificial Intelligence

The EDPB Common Template for Data Breach Notification: Towards Harmonising Article 33 GDPR

The EDPB adopts a common template for data breach notifications under Article 33 GDPR: analysis of the model

#GDPR #DataBreach #EDPB #Privacy #DataProtection #Cybersecurity

Italy moves on AI Act implementation: the Council of Ministers gave preliminary approval to two draft legislative decrees implementing Law 132/2025 — governance and authorities, AI and policing, civil liability, training and AI literacy. My analysis of the parameters to watch: Articles 70 and 74(8) AI Act on the governance architecture and the DPA's role, the boundary between policing and national security, and training as the condition for the effectiveness of the entire framework.

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Implementing decrees of Law 132/2025: the Council of Ministers

On 10 June 2026, the Italian Council of Ministers gave preliminary approval to two draft legislative decrees implementing Law no. 132/2025 on artif...

#AIAct #AIGovernance #AILiteracy @npub1l2j7...el4g

NicFab Newsletter #21 is out. The protection of minors is becoming the lever with which Brussels is rewriting the architecture of the web. Age verification, Ofcom's first Online Safety Act sanction, the push against fragmented national social media bans — a paradigm is consolidating where the protection of the minor legitimizes structural user identification. This week: CJEU C-797/23 on publishers' fair remuneration, AI Act simplification proposal at the Parliament, EU concludes the CoE Framework Convention on AI, Pope Leo XIV launches a Vatican commission on AI. →

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Newsletter #21 - 19 May 2026

NicFab Newsletter #21 — 19 May 2026. Weekly review on privacy, data protection, AI regulation, cybersecurity and digital rights.

#Privacy #AIAct #GDPR #Cybersecurity

Digital Omnibus on AI: in the early hours of 7 May 2026, the European Parliament and Council reached a provisional political agreement. Nine days after the failed 28 April trilogue. Three takeaways: — Application dates confirmed (2 Dec 2027 Annex III / 2 Aug 2028 Annex I / 2 Dec 2026 watermarking) — Machinery products move to sectoral safety discipline with equivalence clause — New Article 5 ban on nudifiers and AI-generated CSAM (compliance by 2 Dec 2026) Until formal adoption by both co-legislators, the original AI Act regime stands. Lex lata vs de lege ferenda matters. Full analysis:

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Digital Omnibus on AI: the Provisional Agreement of 7 May 2026

Legal analysis of the provisional agreement of 7 May 2026 on the Digital Omnibus on AI. Application dates, conformity assessment for Annex I, narro...

Newsletter:

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Newsletter Archive

Privacy, Data Protection, AI, Cybersecurity & Tech Law - Weekly Review

#AIAct #DigitalOmnibus #EUlaw #AIgovernance #DigitalRegulation #DataProtection #FundamentalRights #Trilogue #GPAI #Privacy

NicFab Newsletter #18 is out 📬 This week: → Italian DPA: Poste/Postepay fined €12.5M, tracking pixel guidelines, media reminder → AI Digital Omnibus trilogue: possible AI Act postponement → Civil society letter signed by 34 organizations against weakening → EDPB/EDPS joint opinions on Biotech Act and cybersecurity rules → CNIL updates electronic voting recommendation → Breaches: ANTS, ADT, Rituals, UK Biobank Read:

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Newsletter #18 - 28 April 2026

NicFab Newsletter #18 — 28 April 2026. Weekly review on privacy, data protection, AI regulation, cybersecurity and digital rights.

#Privacy #GDPR #AIAct #Cybersecurity @npub1l2j7...el4g

For anyone following EU digital regulation, data protection, AI governance, cybersecurity, and digital policy: a daily curated digest of institutional sources — Garante Privacy, EDPB, EUR-Lex, European Commission, ENISA, and more. Short format, direct links, updated every day. Free, no registration. 👉

NicFab Blog

Daily Digest | NicFab Blog

Daily curated news on Privacy, Data Protection, AI, Cybersecurity and Tech Law

Newsletter (weekly analysis):

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Newsletter - Data Protection, Privacy, AI & Tech Law

Subscribe to receive expert legal analysis on Data Protection, GDPR compliance, and AI regulation. Professional insights delivered to your inbox.

#DataProtection #AIAct #GDPR #AIgovernance #Cybersecurity @npub1l2j7...el4g

NicFab Newsletter #16 is out. This week: EDPB 2025 Annual Report and CEF 2026 launch on transparency obligations, EU Implementing Regulation for the Health Data Space Board, new eIDAS 2.0 rules for digital wallet onboarding, Adobe Reader zero-day active since December 2025, AI Act Art. 20 on corrective actions, and Legal Prompting on structured analysis of DPA decisions. Read the full issue:

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Newsletter #16 - 14 April 2026

NicFab Newsletter #16 — 14 April 2026. Weekly review on privacy, data protection, AI regulation, cybersecurity and digital rights.

Subscribe for free:

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Newsletter - Data Protection, Privacy, AI & Tech Law

Subscribe to receive expert legal analysis on Data Protection, GDPR compliance, and AI regulation. Professional insights delivered to your inbox.

#Privacy #GDPR #AIAct #Cybersecurity #DataProtection #eIDAS #AI @npub1l2j7...el4g

Video conferencing is not just a technical choice — it's a GDPR compliance decision. My new analysis examines Zoom, Teams, Google Meet, Jitsi, and Proton Meet through the lens of the CLOUD Act, end-to-end encryption, and Art. 48 GDPR. E2EE as a default — not an option — is both a technical and a legal safeguard. Regulatory precision is not an academic luxury. It is a professional responsibility.

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Video Conferencing and GDPR: Choosing a Platform in Light of the CLOUD Act and End-to-End Encryption

Which video conferencing platform is GDPR-compliant? A legal analysis of Zoom, Teams, Google Meet, Jitsi, and Proton Meet in light of the CLOUD Act

#GDPR #Privacy #E2EE #CLOUDAct #VideoConferencing #DataProtection #DigitalSovereignty #AIAct @npub1l2j7...el4g

AI Act: Who is actually a deployer, and what must they do today? I keep seeing alarmist posts about the AI Act that cite fabricated deadlines, nonexistent penalties, and overstated obligations. That isn't helpful for businesses, professionals, or compliance teams. In my latest analysis, I clarify: What “deployer” actually means under Article 3(4), and why that qualification does not automatically trigger broad or burdensome obligations. The actual timeline: Article 50 transparency obligations apply from 2 August 2026, and the same date currently applies to obligations concerning high-risk AI systems listed in Annex III — while the Digital Omnibus proposal would postpone that framework to December 2027. The real penalties under Article 99: there is no general “2% of turnover” penalty for deployers. AI agents: the European Commission has clarified that “AI agent” is not a legal category under the AI Act; however, any system that meets the definition in Article 3(1) may still fall fully within the scope. A practical compliance framework with 6 concrete steps for businesses and professionals. Regulatory precision is not an academic luxury. It is a professional responsibility. Read the full analysis:

NicFab Blog — Privacy, GDPR & Intelligenza Artificiale

AI Act: Deployer, AI Agents e obblighi di trasparenza — Il punto della situazione nella primavera 2026

Post operativo sugli obblighi reali dei deployer ai sensi dell

#AIAct #EUAIAct #AIGovernance #AICompliance #TechLaw #DigitalLaw #RegulatoryCompliance #ArtificialIntelligence #EULaw #Compliance @npub1l2j7...el4g

NicFab Newsletter #15 | 7 April 2026 Privacy, Data Protection, AI and Cybersecurity — weekly review. This week: → Italian Garante imposes record €31.8M fine on Intesa Sanpaolo for 6,600+ unauthorised accesses over two years → CERT-EU attributes Trivy supply chain attack — 340GB of data stolen from 71 EU entities → CNIL sets 2026 enforcement priorities: recruitment, sports federations, HR data retention → AI Act red lines on biometric categorisation; Swiss minister files charges over Grok content → EU bans AI-generated visuals in official communications → FortiClient EMS zero-day exploited; React2Shell hits 766 hosts; $285M DPRK operation → AI Act in a Nutshell: Article 19 on automatic logging → Legal Prompting: privacy notices and AI — why generating from scratch is a mistake → Podcast Episode #3: Drafting privacy notices with AI Read the full issue:

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Newsletter #15 - 7 April 2026

NicFab Newsletter #15 — 7 April 2026. Weekly review on privacy, data protection, AI regulation, cybersecurity and digital rights.

Subscribe for free:

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Newsletter - Data Protection, Privacy, AI & Tech Law

Subscribe to receive expert legal analysis on Data Protection, GDPR compliance, and AI regulation. Professional insights delivered to your inbox.

#Privacy #GDPR #AI #AIAct #Cybersecurity #LegalPrompting

NicFab Newsletter #15 | 7 April 2026 Privacy, Data Protection, AI and Cybersecurity — weekly review. This week: → Italian Garante imposes record €31.8M fine on Intesa Sanpaolo for 6,600+ unauthorised accesses over two years → CERT-EU attributes Trivy supply chain attack — 340GB of data stolen from 71 EU entities → CNIL sets 2026 enforcement priorities: recruitment, sports federations, HR data retention → AI Act red lines on biometric categorisation; Swiss minister files charges over Grok content → EU bans AI-generated visuals in official communications → FortiClient EMS zero-day exploited; React2Shell hits 766 hosts; $285M DPRK operation → AI Act in a Nutshell: Article 19 on automatic logging → Legal Prompting: privacy notices and AI — why generating from scratch is a mistake → Podcast Episode #3: Drafting privacy notices with AI Read the full issue:

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Newsletter #15 - 7 April 2026

NicFab Newsletter #15 — 7 April 2026. Weekly review on privacy, data protection, AI regulation, cybersecurity and digital rights.

Subscribe for free:

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Newsletter - Data Protection, Privacy, AI & Tech Law

Subscribe to receive expert legal analysis on Data Protection, GDPR compliance, and AI regulation. Professional insights delivered to your inbox.

#Privacy #GDPR #AI #AIAct #Cybersecurity #LegalPrompting

Most AI Act rules apply from 2 August 2026. If you work in compliance, data protection or AI governance, you have four months. I built three interactive guidance hubs — bilingual IT/EN, open access, no registration: → AI Hub — timeline, roles, filterable checklist, Annex III high-risk map, harmonised standards, CEN/CENELEC JTC 21, presumption of conformity (Art. 40), common specifications (Art. 41) → Operators Hub — six AI Act operators, practical scenarios, Art. 25 role transformation, obligation cascade, penalties, AI Act / GDPR / contractual position intersection → GDPR & AI Hub — legal bases for training and deployment, Art. 22 and human oversight, DPIA/FRIA coordination, profiling, international transfers and AI supply chains 👉

NicFab Blog

Hub AI Act & GDPR | NicFab

AI Act, GDPR, AI governance — interactive bilingual guidance tools and reference pages for professionals / strumenti interattivi e pagine di rife...

#AI #AIAct #DataProtection #Compliance

📬 Issue #14 of the NicFab Newsletter is out. This week: GDPR enforcement actions, the end of voluntary CSAM detection, the AI Act's new timeline, DSA investigations targeting child safety, and a cybersecurity pattern worth watching — credential compromise at the centre of every major incident. Plus: AI Act in Pills (Art. 18), Legal Prompting techniques for regulatory analysis, and Episode #2 of the NicFab Podcast on Legal Prompting methodology. 🎙️ podcast.nicfab.eu Subscribe to receive it every Tuesday: 👉

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Newsletter - Data Protection, Privacy, AI & Tech Law

Subscribe to receive expert legal analysis on Data Protection, GDPR compliance, and AI regulation. Professional insights delivered to your inbox.

#Privacy #DataProtection #GDPR #AIAct #Cybersecurity #DSA #LegalPrompting #AI

📰 NicFab Newsletter #14 — tomorrow, March 31, 2026 The new issue is coming. Here are some of this week's highlights: ▪ Italian DPA: fines against Enel Energia (telemarketing), Bakeca (ads without consent), and GPEN investigation on children's privacy ▪ EDPB: case digest on legitimate interest and cross-regulatory cooperation ▪ EU Parliament: voluntary CSAM detection extension rejected — expires April 3 ▪ EU Commission: preliminary findings against 4 porn platforms and Snapchat investigation for child safety ▪ Amsterdam court: Grok banned from generating non-consensual nude images ▪ AI Act: comparative timeline before and after the Digital Omnibus ▪ Cybersecurity: EU Commission cloud breach, FBI Director email hack Plus: - AI Act in Pills — Part 14 (Art. 18, documentation keeping) - Legal Prompting — Part 2 (regulatory analysis techniques) - NicFab Podcast — Episode #2: The methodology. Subscribe to receive it tomorrow morning:

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Newsletter - Data Protection, Privacy, AI & Tech Law

Subscribe to receive expert legal analysis on Data Protection, GDPR compliance, and AI regulation. Professional insights delivered to your inbox.

🎯 Stay tuned! #Privacy #GDPR #DataProtection #AIAct #Cybersecurity #DSA #EDPB #EURegulation #Newsletter

The European Parliament published a briefing on AI ethics in classrooms (PE 784.573). Strong on philosophy, but missing the connection to binding EU rules and competence frameworks. My analysis as a data protection lawyer: why we don't need more principles — we need to connect GDPR, AI Act, DigComp 3.0 and eCF 4.0 to protect children in schools.

NicFab Blog — Privacy, GDPR & Artificial Intelligence

AI Ethics in Classrooms: When Principles Meet the Law

The European Parliament publishes a briefing on the ethical dimensions of AI in classrooms. We analyse the document through the lens of a legal

#AIAct #GDPR #AIethics #Education #DigComp #eCF #EuropeanParliament #AI

🇪🇺 The European Parliament has published its Draft Report on the Digital Omnibus on AI (PE782.530). The IMCO and LIBE committees, with rapporteurs Kokalari and McNamara, propose 24 amendments to COM(2025) 836. The most significant shift: fixed deadlines for high-risk AI systems replacing the Commission's discretionary mechanism. But there's more — AI literacy obligations stay with providers and deployers, the standard for sensitive data processing becomes that of strict necessity, and regulatory sandboxes must involve data protection authorities. I analyzed the Draft Report amendment by amendment, comparing it with the Commission's proposal. Full analysis here:

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Digital Omnibus on AI: the European Parliament Rewrites the Commission

Comparative analysis of the IMCO-LIBE Draft Report PE782.530 against the Commission

#AIAct #DigitalOmnibus #EuropeanParliament #ArtificialIntelligence #EURegulation #GDPR #DataProtection #AICompliance #AIGovernance #LegalTech

NicFab Newsletter #06 is out! This week: Garante Privacy, EDPB, EDPS, European Commission, Parliament & Council updates, Digital Markets regulation, AI Standards & Certifications (CEN-CENELEC, ForHumanity), International developments, Cybersecurity, AI Act deep-dive and more. Read:

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Newsletter #06 - February 03, 2026

NicFab Newsletter #06 — February 03, 2026. Weekly review on privacy, data protection, AI regulation, cybersecurity and digital rights.

Subscribe:

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Newsletter - Data Protection, Privacy, AI & Tech Law

Subscribe to receive expert legal analysis on Data Protection, GDPR compliance, and AI regulation. Professional insights delivered to your inbox.

#Privacy #DataProtection #AIAct #Cybersecurity #GDPR #AI #artificialintelligence

🌱 Proud to share: my online services are hosted green! Verified by The Green Web Foundation — powered by renewable energy via netcup GmbH. Small steps matter. 💚 ✅ thegreenwebfoundation.org/green-web-check/?url=www.nicfab.eu ✅ thegreenwebfoundation.org/green-web-check/?url=www.fabiano.law #GreenHosting #Sustainability #GreenWeb #ClimateAction #TechForGood

🚀 NEW: Gemini Protocol - A Human-Centric Alternative to the AI-Driven Web In an era of AI slop, pervasive tracking & algorithmic feeds, Gemini offers a refuge: mandatory encryption, no cookies, no JavaScript, pure content. History, NASA connection, technical overview, privacy benefits & limitations. I also maintain a capsule at gemini://nicfab.eu 🔗

NicFab Blog — Privacy, GDPR & Artificial Intelligence

Gemini Protocol: A Human-Centric Alternative to the AI-Driven Web

Exploring the Gemini protocol: history, NASA connection, privacy benefits, limitations, and my personal capsule at gemini://nicfab.eu

#Gemini #Privacy #SmallWeb #DigitalRights #PrivacyByDesign #FOSS #AI