Digital Fairness Checked, Council on cloud certification schemes

Welcome to Euractiv’s Tech Brief, your weekly update on all things digital in the EU. You can subscribe to the newsletter here.  

"We know that there can be power imbalance or confusion about one’s responsibilities."

- Commissioner for Justice Didier Reynders on the Digital Fairness Check, speaking of how the evolution of digital technologies has changed the relationship of consumers to traders.

Story of the week: The European Commission's Digital Fairness Fitness Check, published on Thursday, reveals that while EU consumer protection laws remain vital, new digital challenges like dark patterns and targeted ads demand urgent reform to safeguard consumers online. Harmful online practices cost EU consumers an estimated €7.9 billion each year, while businesses face much lower costs to comply with EU laws, not exceeding €737 million per year, the report said. Read more. 

Don’t miss: The Council of the European Union is calling for increased transparency around EU cybersecurity certification schemes developed by the EU Agency for Cybersecurity (ENISA), according to draft conclusions seen by Euractiv. The draft, dated 26 September, urges the Commission to "find ways" to have a "more transparent" approach to the development of EU cybersecurity certification schemes, stressing the role of member states in the process. Read more. 

Also this week: 

- European authorities press on with digital wallets for social media age verification 

- Commission ponders what makes a ‘significant’ cybersecurity incident under NIS2 

-  EU’s top court sets time-limits on using personal data for targeted ads

-  Commission questions YouTube, TikTok, and Snapchat over recommender algorithms 

- Commission discloses disagreements between general-purpose AI providers and other stakeholders 

-  Academics to chair drafting the Code of Practice for general-purpose AI 

Artificial Intelligence

Code of Practice drafting. A range of academics have been named chairs and vice-chairs of working groups that will draft a Code of Practice on general-purpose artificial intelligence (GPAI), according to a Commission press release on Monday.Read more. 

An inside look to the GPAI CoP. The Commission also disclosed disagreements between general-purpose model providers and other stakeholders at the first Code of Practice plenary for GPAI on Monday. Read more. 

Controversial California bill vetoed. The hotly debated AI safety bill SB 1047 that could inspire and enhance European AI regulation was vetoed by Governor Gavin Newsom on Sunday, because it “only focuses on the most expensive and large-scale models”. He has signed 18 other AI bills covering watermarking, sexual deepfakes, political advertising, and more. 

AI is sharing your secrets. AI workplace tools like Otter.ai, designed to handle tasks such as transcription, can sometimes overstep boundaries by sharing information that was not intended for wider distribution, the Washington Post reported on Wednesday.

Google’s new AI. Google is developing AI software with reasoning capabilities, similar to OpenAI’s advancements, intensifying competition between the two tech giants, Bloomberg reported on Wednesday.  

Dragos is out. AI Act rapporteur Dragos Tudorache will not be part of the AI Office, because he didn’t want to settle for anything less than a director position, a source told Euractiv, and MLex’s Luca Bertuzzi reported.  

OpenAI closes mega round. The company closed its funding round of $6.6 billion in a $157 billion valuation, becoming one of the most valuable private companies in the world. Investors include Microsoft, Thrive Capital and Abu Dhabi's state-backed investment firm MGX, Reuters reported. The firm also got a $4 billion revolving line of credit, CNBC reported. OpenAI asked investors to avoid backing rival start-ups such as Anthropic and Elon Musk’s xAI, the Financial Times reported.  

Competition 

Amazon-Anthropic deal in the clear in UK. After formally opening a merger investigation in August, the UK's Competition and Markets Authority decided last Friday that the partnership “does not qualify for investigation under the merger provisions of the Enterprise Act 2002.” Amazon also won partial dismissal of a US Federal Trade Commission lawsuit accusing it of maintaining illegal monopolies through anti-competitive tactics pushing sellers to use its advertising and fulfilment services, Reuters reported. 

Vestager is not giving up. "We need to examine these mergers,” said outgoing Commissioner for Competition Margrethe Vestager in a speech on Monday, speaking on killer acquisitions.   

Cybersecurity 

What does significant mean? A Commission committee is considering how to define "significant" cybersecurity incidents that, under the EU-wide cybersecurity legislation NIS2, must be quickly reported to authorities. Member states are far behind schedule in transposing NIS2 into national law, with the deadline on 17 October. Read more. 

Iranian hackers vs. Trump. The US Department of Justice (DoJ) charged three members of Iran’s military with hacking into Donald Trump’s 2020 campaign to leak information to his opponent and media organisations, according to an indictment unsealed last Friday.

Meta’s lapses. The social media giant has been responsible for over 62% of scams reported globally to online bank Revolut in the year since June 2023, the bank said on Thursday.  

Microsoft vs. hackers. Microsoft’s Digital Crimes Unit (DCU), in coordination with the DoJ and a NGO managed to get an order to seize 66 unique domains used by hacking group Star Blizzard, also known as Callisto Group, through a civil action, according to a Thursday press release.  

Data & Privacy 

Automated credit scoring. Germany’s proposed revision of its Federal Data Protection Act (BDSG) would allow automatic credit scoring, a widespread practice in the EU but one which is currently in legal limbo. The revision could be finalised in the next couple of weeks and looks likely to pass, an expert told Euractiv. Read more. 

Time-limits on processing personal data. Personal data collected by social networking platforms for targeted advertising, cannot be used indefinitely, the Court of Justice of the EU (CJEU) ruled on Friday, according to a press release seen by Euractiv. Read more.

GDPR violations can be challenged. The Court of Justice of the EU ruled on Friday that competitors can challenge General Data Protection Regulation (GDPR) violations as unfair commercial practices. This stems from a dispute between two German pharmacists over the online sale of pharmacy-only medicines.  

Ryanair under scrutiny. The Irish Data Protection Commission is investigating how Ryanair processes personal data for customer verification of users who use third party websites, the data protection authority said in a Friday press release.  

Web Foundation closes shop. The inventor of the World Wide Web is shutting down the Web Foundation, an organisation aimed to democratise the internet, in order to focus on privacy protection, Tim Berners-Lee and Rosemary Leigh wrote in a Friday letter.  

Digital Services Act 

Commission questions YouTube, TikTok, Snapchat. The European Commission sent a request for information under the Digital Services Act (DSA) on the design and operation of recommender systems to YouTube, Snapchat, and TikTok on Wednesday. Read more. 

Digital wallets and age verification. Digital wallets for age verification are being developed to protect minors on large social media platforms under the DSA, before they are deployed more widely in 2026, a European Commission official said on Wednesday. Read more. 

A game of broken Telegram? The messaging app hasn’t drastically changed its policies, wrote Telegram’s CEO Pavel Durov wrote on Wednesday. The app had a clear contact point for government requests to take down information since early 2024, explaining why more “valid requests” under the DSA were filed in Q3 2024 by European authorities. Presumably these requests were to take down content.

DSA guidelines. 5 Rights Foundation and 38 children's rights organisations welcome the Commission's DSA guidelines, expected by mid-2025 to mandate high privacy, safety, and security standards for minors on digital platforms.  

Industrial Strategy 

Intel’s lifeline. Intel is in talks with the US government to finalise $8.5 billion in funding for its ailing business, the Financial Times reported on Friday. That’s on top of $47.5 billion in financing the company is eligible for receiving through direct funding, tax cuts, and loans. In September, the company announced it is halting government-supported plans in Germany and Poland.  

US chip projects environmental exemption. On Wednesday, President Biden signed the Building Chips in America Act of 2023, which “exempts certain projects relating to the production of semiconductors from environmental reviews under the National Environmental Policy Act of 1969. 

Vision for 2030. According to the Information Technology Industry Council’s (ITI) "Vision 2030", published on Tuesday, the EU should reduce regulatory complexity, streamlining sustainability efforts, and promoting digital technologies like AI to aid decarbonisation. 

Law enforcement 

CSAM stalled again. The Netherlands' government and opposition are both abstaining from supporting the latest version of the controversial EU regulation aimed at detecting online child sexual abuse material (CSAM), according to an official position and an open letter published on Tuesday. Read more. 

On the agenda next week. At next week’s Justice and Home Affairs Council meeting, the Hungarian presidency will aim to achieve a general approach on the CSAM proposal, according to its agenda for next Thursday and Friday. The draft law once again was removed from the agenda of Wednesday’s EU ambassadors meeting, as the presidency did not expect a majority in favour of the proposal. 

Media 

Assange in Strasbourg. Wikileaks founder Julian Assange said on Tuesday he was released after years of incarceration only because he pleaded guilty to doing "journalism", warning that freedom of expression was now at a "dark crossroads, in a meeting with the Council of Europe rights body at its Strasbourg headquarters in his first public comments since his release.  

Platforms 

Hinge’s bias. Some Black women report that dating apps like Hinge appear biased in terms of the matches they are shown, the Washington Post reported on Thursday.  

X’s Brazil saga. Social media platform X still has to pay $5 billion in fines in order to resume its service in Brazil, the Supreme Court said on Friday, Reuters reported.

Telecom 

Friendly discussion? A wide range of telecom stakeholders met in Budapest on Wednesday to discuss EU telecom regulation. The Commission, national regulators, stakeholders, Big Tech companies and consumer organisations mostly repeated their previous takes at the conference organised by the Hungarian presidency, with telecommunications attachés also in attendance. Euractiv understands that Hungary’s next Council conclusions might be fed with comments from stakeholders. 

Another nail in Draghi’s report. The lobby organisation MVNO Europe published on Tuesday another call for EU institutions to be cautious over the Draghi report's recommendations on telecommunications - particularly his focus on consolidation of the industry. MVNO Europe also “opposes spectrum-related proposals”. 

The launchers (non)-issue. ITRE MEPs did not challenge Commission's Deputy Director-General in charge of Satellite Navigation and Earth Observation Christoph Kautz when he said the Commission simply had to launch satellites from Florida, contrary to the fury French liberals and The Left had shown at the previous Strasbourg plenary. 

What else we’re reading this week: 

The Meteoric Rise of Temu and Pinduoduo—and What Might Finally Slow Them Down (Wired) 

Russian Missiles, American Chips (Bloomberg) 

Not Just Fun and Games: Politics Edges Deeper Into Livestreams (The New York Times)