Digital Omnibus proposal, FTC EdTech order, Data Privacy Framework appeal

Commission proposes Digital Omnibus to simplify EU digital rules

What's New?

The European Commission has proposed a Digital Omnibus, part of a wider Digital Package, to simplify EU rules on data, cybersecurity and AI. The Commission's own summary says the GDPR's definition of personal data would follow a recent Court of Justice judgment, and cookie rules would move into the GDPR with one-click refusal and a list of low-risk purposes that need no consent. Incident reports required under several laws, including NIS2 and the GDPR, could go through one submission channel run by ENISA. The AI Act would also be amended. This is a proposal, not law.

Why It Matters

A proposal can change before it is adopted. The direction is clear, with the GDPR, cookie rules and AI Act timelines all on the table, but compliance programs should not be rebuilt around text that may still be amended.

FTC proposes order against EdTech provider Illuminate Education

What's New?

On 1 December 2025 the US Federal Trade Commission announced a proposed settlement with Illuminate Education. The FTC alleges the company left its cloud databases unsecured, and that a hacker using a former employee's credentials reached data on 10.1 million students. It also alleges the data was stored in plain text until at least January 2022, and that some school districts were told of the breach nearly two years later. The proposed order would require deletion of data no longer needed, a public retention schedule and a security program. It is open to public comment for 30 days, after which the FTC decides whether to finalize it.

Why It Matters

These are allegations in a proposed order, and the case concerns security and retention rather than advertising. For vendors serving schools, it shows that security statements in contracts and breach notification promises can be tested against practice.

Recommended Action

EdTech providers should check retention and deletion practice, encryption, and breach notification commitments against what their school contracts say.

Appeal on the EU-US Data Privacy Framework is before the Court of Justice

What's New?

On 31 October 2025 Philippe Latombe lodged an appeal (Case C-703/25 P) against the General Court's judgment of 3 September 2025 in Case T-553/23. He asks the Court of Justice to set that judgment aside and to annul the Commission's adequacy decision on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023). The Commission, Ireland and the United States are the other parties. The Official Journal notice records the appeal only; no ruling has been reported.

Why It Matters

Many US transfers, including those of vendors on US cloud infrastructure, rely on this adequacy decision. Whether it stands is for the Court to decide, so organizations should know that the question is open.

Recommended Action

Map which transfers rely on the Data Privacy Framework and check that a fallback transfer mechanism is documented for them.