A special issue on the relevance of the GDPR
The Spanish Data Protection Agency (AEPD) published the second issue of its scientific journal Privacy, Innovation and Technology (PIT) on October 8, 2026. The special issue takes the ten years of the General Data Protection Regulation (GDPR) as its axis and examines how its guarantees are applied in the face of technological and organizational changes. The focus is not on celebrating a date, but on discussing whether the Regulation's principles remain operational in new scenarios.
The issue is aimed at researchers, professionals, public officials, and technology specialists, as well as those working on privacy and digital governance. The journal is integrated into the AEPD's Privacy Laboratory, which seeks to connect academic analysis, professional practice, and institutional perspective. Its value lies in offering specialized debate, not in replacing a norm, a binding guide, or a legal criterion applicable to a specific case.
Three practical questions in the central block
The special issue brings together three works. The first reviews proactive accountability: compliance is not reduced to producing documents, but requires managing risks, being able to track decisions, and demonstrating that controls work. For organizations, the distinction is useful: having written policies does not by itself certify that a processing is controlled in practice.
The second article studies the right to explanation in individual automated decisions based on recent case law from the Court of Justice of the European Union. It also examines how the GDPR's guarantees relate to the transparency obligations of the Artificial Intelligence Act. The topic matters when a decision based on automated processing affects a person, but the issue's summary does not allow treating the right to explanation as a uniform obligation to reveal any technical detail of the system.
The third work addresses the use of generative artificial intelligence in local public administrations and the role of technological architecture and data protection by design. The question shifts to the design phase: what technical and organizational decisions can prevent problems before a tool is incorporated into a public service. The article does not by itself turn a specific configuration into the only valid solution; its interest lies in analyzing preventive safeguards.
Nine studies expand the risk map
The Privacy Studies section incorporates nine investigations on diverse matters. Among them are the protection of neurodata and the limits of its commercialization; the possibilities and restrictions of automatic anonymization of texts, images, audio, and video; and the comprehensive assessment of the risk associated with security breaches. The thematic breadth connects technical problems with legal consequences, without reducing privacy to a matter of consent or computer security.
Other works deal with the relationship between data, artificial intelligence, and fundamental rights in smart cities; algorithmic transparency in political advertising; civil liability for security violations and loss of control over personal data; and hybrid threats. The list is completed by the preparation of local entities to incorporate AI and the legal risks of synthetic identity. These topics point to different decisions: from how to design urban services to how to analyze political content or respond to incidents.
The issue adds two reviews of works on international data transfers and on rights and non-discrimination against algorithms in platforms and social networks. Taken together, the contents offer a map of issues to guide readings and debates, not an exhaustive list of all current problems or a uniform recommendation for each organization.
Inside the second PIT issue
The issue pairs a three-article GDPR monograph with nine studies spanning additional privacy and technology topics.
| GDPR monograph | 3 articles |
|---|---|
| Privacy Studies | 9 studies |
The topic labels summarize the AEPD’s description and do not represent the authors’ full arguments.
Sources and references1
What it offers compared to Agency guides and criteria
A scientific journal fulfills a different function than a practical guide. The AEPD already publishes documents aimed at immediate decisions; for example, in October 2026 it pointed out guarantees that must be considered before incorporating AI into video surveillance systems, such as justifying the purpose, assessing necessity and proportionality, and integrating data protection by design. PIT, on the other hand, brings together academic analyses that help explore debates and interpretation frameworks. It is not advisable to confuse analytical depth with operational instructions.
The issue brings together academic contributions on the GDPR, artificial intelligence, and data protection. Its articles analyze these topics from different perspectives, within the format of a scientific publication.
The issue brings together academic contributions on the GDPR, artificial intelligence, and data protection. Its articles analyze these topics from different perspectives, within the format of a scientific publication.
How to use the issue in daily work
For companies and administrations, the topics of the issue can become review questions. In the face of an automated decision, it is advisable to identify what data is involved, what effect the decision has, and what information the person must receive. In the face of a generative AI system, the analysis can start with the purpose, architecture, data processed, and safeguards incorporated by design. The articles offer context on these issues.
The second issue includes studies on proactive accountability, security breaches, generative AI in local administrations, smart cities, algorithmic political advertising, synthetic identity, neurodata, and automatic anonymization. These are among the topics covered in its monograph and Privacy Studies section.
The issue brings together research on the GDPR, artificial intelligence, and data protection, including work on automated decisions, public administrations, neurodata, and security breaches. Its contents span several areas of privacy and technology.
Open access and limits of interpretation
The AEPD identifies the journal as published under a CC BY-NC-ND license. The journal is part of the Agency's Privacy Laboratory and is presented as a publication intended to support the dissemination of specialized knowledge.
The institutional announcement summarizes the matters of each work, but that summary does not replace the reading of the articles nor does it allow attributing a common conclusion to all its authors. Furthermore, a scientific journal and a regulatory authority have different functions: the former publishes analyses; the latter exercises public competences in accordance with the legal framework. Distinguishing those planes avoids turning academic debate into a rule that the issue does not establish.
The second issue of PIT includes work on proactive accountability and security breaches, as well as studies concerning neurodata and synthetic identity. The AEPD describes the journal as a scientific publication addressing privacy, data protection, technology, and the impact of emerging technologies on fundamental rights. Its contents cover a range of topics in these fields.
