AEPD publishes second issue of its scientific journal on privacy and AI

On October 8, 2026, the Spanish Data Protection Agency (AEPD) announced the release of the second issue of Privacy, Innovation and Technology (PIT). The journal is driven by the Agency's Privacy Lab and targets researchers, professionals, public officials, and technology specialists interested in these topics.

The specific novelty is the release of a new edition, not the creation of a new regulatory obligation or criterion. PIT functions as a scientific publication and analysis space: its articles provide discussion and specialized knowledge, but the publication itself is not a norm nor does it replace consulting the GDPR or official guidelines applicable to a case. The AEPD had opened a call for contributions in May for this issue, with publication scheduled for October.

The special issue is dedicated to the tenth anniversary of the General Data Protection Regulation (GDPR) and examines its challenges in the face of technological evolution. The selection poses a useful question for those working with data: how to interpret and apply protection principles in changing technological scenarios, without confusing academic debate with a modification of the legal framework.

The date requires precision: Regulation (EU) 2016/679 was adopted in 2016, but its general application began on May 25, 2018. Therefore, the reference to the tenth anniversary made by the special issue is the editorial framing communicated by the AEPD; it should not be read as a statement that the GDPR started applying in October 2016. The anniversary does not by itself alter the obligations of organizations and administrations.

Among the central issues highlighted by the AEPD are proactive responsibility, the right to explanation in automated decisions, and data protection by design when using generative AI in public administrations. Together, these topics connect system governance with practical questions about responsibility, information to individuals, and privacy consideration from planning.

For a public team or a technology provider, the practical value lies in using these topics as review points, not as a list of answers already resolved by the journal. Before deploying a tool, it is advisable to identify what data is processed, who decides the purposes and means, what human intervention exists, and what information can be given to affected individuals. The press release informs about the topics covered, but does not allow attributing a specific solution to each article or concluding that all generative AI use has the same risk profile.

The Privacy Studies section gathers nine research papers. According to the AEPD's description, they cover neurodata, anonymization, personal data breaches, smart cities, algorithmic political advertising, and synthetic identity, among other matters. It is a repertoire that shows the breadth of the field: from particularly sensitive data to urban systems or forms of digital representation.

The variety can serve professionals to locate relevant questions for their sector and guide subsequent readings. It does not, by itself, demonstrate that all works have identical scope, method, or conclusion; nor does it allow evaluating their solidity without consulting the texts. The official note offers a thematic summary, not an independent review of each research paper.

The AEPD presents PIT as a scientific publication for academic and professional communities. For those who must make compliance decisions, the key distinction is between an analysis source and a binding legal source: the journal can help identify debates and technical issues, but it does not replace the normative text nor advice tailored to an organization's circumstances.

A useful reading can follow this order: identify which article addresses a problem close to one's own case; check what facts, method, and scope it exposes; and contrast its proposals with current legislation and official sources. In particular, it is not advisable to turn expressions like “right to explanation” or “protection by design” into automatic guarantees without reviewing the legal and technical context to which they refer.

The second issue gathers a special issue on the GDPR and works on contemporary privacy challenges, including generative AI uses in the public sector. This allows understanding the editorial approach of the issue, but is not enough to assert that the AEPD has set new technical or ethical standards with normative force through the journal.

The practical decision for professionals is to consult the issue as context and training material, and clearly separate its analyses from applicable obligations. The launch note summarizes general topics; to evaluate arguments, methodological limits, or specific recommendations, one must turn to the full articles. This limitation does not invalidate the announcement, but it does restrict what can be concluded from the institutional summary.