The AEPD publishes the second issue of its journal on privacy and technology

The Spanish Data Protection Agency (AEPD) has published the second issue of Privacy, Innovation and Technology (PIT Journal). The institutional announcement is dated 8 October 2026: this is the date the Agency gives for the announcement and publication, not the date on which this article was consulted. The AEPD homepage also links to the issue as an available resource.

The new issue is a special issue marking the tenth anniversary of the General Data Protection Regulation (GDPR). According to the Agency, its articles examine some of the challenges the regulation faces as technology evolves. This description identifies the editorial theme; it does not mean that the issue amends the GDPR or that the AEPD has announced new obligations through the journal.

The publication notice highlights three central articles: one on proactive accountability, another on the right to an explanation in automated decisions, and an analysis of data protection by design when public administrations use generative artificial intelligence. These subjects are presented for discussion and analysis, not as new regulatory decisions.

The section titled Privacy Studies brings together nine studies, according to the same notice. The AEPD lists neurodata, anonymisation, personal data breaches, smart cities, algorithmic political advertising and synthetic identity among the topics. The list shows the issue’s interdisciplinary scope, although the notice does not summarise the methods or conclusions of each study.

To understand the arguments precisely, readers should consult the journal articles rather than rely only on the notice’s selection of topics. The announcement serves as an index, but it is not enough to attribute a shared position on artificial intelligence, legal interpretation or measures organisations should take to every article.

The AEPD presents the PIT Journal as a scientific publication launched within the framework of its Privacy Laboratory. It describes it as a space for researchers, professionals, public officials, technology specialists and others who work or conduct research in these fields. Its stated aim is to contribute to debate and to disseminate specialist knowledge about privacy, data protection, technology and fundamental rights.

The first issue, referenced on the Agency’s own website, is described as a space for reflection, analysis and dissemination on privacy, data protection and disruptive technologies, with particular attention to artificial intelligence. The existence of two issues establishes editorial continuity, but does not in itself demonstrate the journal’s future publication schedule, academic impact or level of acceptance.

The institutional origin is useful context: the AEPD is Spain’s data protection authority, and the journal is linked to its work. At the same time, institutional backing does not replace critical reading of each article. To assess a specific claim, readers need to consider its authorship, sources, method and scope, and distinguish academic analysis from an instruction or formal position issued by the Agency.

The PIT Journal can be a starting point for readers who want to follow legal and technical debates related to data use. In this issue, the announced selection connects GDPR principles with topics such as automated systems, generative AI in public administrations and new categories of personal information. Its value is documentary and analytical: it helps readers locate topics and arguments for closer study.

A practical way to consult it is to separate three levels: what the GDPR and applicable rules say; what interpretation or proposal an article develops; and what official guidance the AEPD has published about a case or technology. These are not equivalent. A research article may raise problems or debate solutions without creating an obligation for companies, public administrations or providers.

The Agency also maintains an Innovation and Technology area with resources on managing risks to rights and freedoms, as well as tools and materials to support GDPR compliance. Combining the journal with these official resources helps readers move from general debate to practical documents, without confusing the purpose of each publication or assuming that one article resolves every situation an organisation may face.

Publishing a journal issue is not the same as enacting a legislative reform, issuing binding guidance or adopting an enforcement decision. In the information consulted, the AEPD presents the issue as a scientific publication focused on analysis and studies; the notice does not announce any change to GDPR rules or to the obligations of controllers and processors.

The news should therefore be read as making an institutional editorial resource available. If a company or public administration needs to decide how to process personal data, the journal may provide context, but it does not replace an assessment of the specific case, consultation of applicable rules or review of relevant official guidance. Nor can readers conclude that systems mentioned in the articles comply or fail to comply with the law without examining the content and the particular circumstances.

This distinction also matters to readers: the fact that a study addresses the right to an explanation or generative AI does not demonstrate that there is a new official interpretation of those issues. The verifiable scope of the news is narrower and clear: the Agency published the second issue, explained its theme and listed several of its contents.

This information is based on the notice announcing the second issue and the AEPD’s official pages describing the journal and its Innovation and Technology area. The notice, dated 8 October 2026, confirms the issue, its special focus and the topics highlighted by the Agency; the institutional homepage links both to this issue and to the reference to the first one.

The call for submissions for the second issue is an editorial antecedent: in May 2026 it announced that articles were being accepted and anticipated a special issue marking the GDPR’s tenth anniversary. A call for submissions does not by itself prove publication, so the fact that the second issue is available is based on the subsequent notice from October.

This verification is limited to the cited institutional materials and their description of the publication. It does not assess the methodological quality of each study, independently verify all its conclusions or constitute legal advice. To answer a specific question, the next step is to consult the relevant article and compare its claims with the applicable legislation and official guidance.