Gabriela Zanfir-Fortuna

New (temporary) role in my team, with a focus on Latin America 🌎 fpf.org/policy-analy... #privacyishiring

Cleaning old office stuff and I stumbled upon these, from the time I was working on the 1st edition of the OUP GDPR Commentary back in 2019 (?). So much work, effort and stress… It was eventually done. I had forgotten about how difficult it was. And, why, in the end, all that effort 🤷‍♀️

The plot thickens. Perhaps it’s a good time to double check and toggle those opt-outs. Even the memory function “on” looks a bit unnecessary at this time 🫢 www.axios.com/2026/09/25/o...

I understand the "pacing" plea in AI development as technically meaning "festina lente", the first Latin expression I learned in secondary school, and, frankly, the only one that stayed with me for so long because it had such a curious meaning. The Romans were sage, indeed! #pacing

Gently launching into the world my personal Substack, Ai Carte - I explain here why “Ai Carte” aicarte.substack.com/p/why-ai-car... and here you can find a first post about a book, “The Bookshop Woman”, by Nanako Hanada aicarte.substack.com/p/the-booksh... I missed writing for the pleasure of it.

Maybe this is how Canada will finally get GDPR-grade data protection law 👀 😅 www.npr.org/2026/09/16/n...

The new EU Cloud and AI Development Act (CADA) proposal marks a genuine shift in the way the bloc regulates AI, as it codifies the “AI first” principle & it is as much an “AI promotion and enabling”-type of legislation as it is a cloud sovereignty one. My in depth analysis: fpf.org/blog/cada-an...

Thanks! Paras 110-113 are very interesting in that 'knowledge' and 'control' of content are disaggregated, and providers don't merely lose the hosting immunity if they algorithmically choose content - they also lose the benefit of the prohibition on general monitoring.

Liability is a function of the underlying law so it will differ between defamation, hate speech, harassment, data protection, copyright infringement, etc. This is significant in that it takes away an EU-wide shield, and exposes providers to liability under different domestic laws.

I'm curious how this reads together with Russmedia 👀

A European Commission proposal could create one of Europe’s largest privacy and national-security risks in decades. techletters.substack.com/p/the-europe...

Data protection law does not define responsibilities for users’ data, but for individuals’ fundamental rights and how they are impacted through the processing of their data. A fundamental difference that creates a sequence of wrong interpretations of data protection law.

Join FPF CEO @julespolonetsky.bsky.social polonetsky.bsky.social and FPF VP for Global Privacy @gzf.bsky.social for a LinkedIn Live discussion marking 10 years of the adoption of the GDPR. 🗓️ Today, Friday April 17th at 12 noon ET 🔗Sign-up here: linkedin.com/events/74498...

after much deliberation and giving AI the benefit of the doubt, Wikipedia editors have had enough of AI slop. New policy bans LLM generated content, periodt www.404media.co/wikipedia-ba...

This is why tech neutral rules like the GDPR (which, by the way, fully applies to AI agents whenever they touch personal data) are generally a better idea 💡

With everything happening in the world today, these are the top 3 news I got on X when I opened it 👀 And I have almost zero interest in American sport (I guess this is also what happens when the algorithm forgets you due to inactivity 🤖)

2026 is a "perfect storm" for global privacy, says FPF VP of Global Privacy, @gzf.bsky.social. Her latest blog breaks down how three converging forces will shape global data protection and privacy. Read more below. fpf.org/blog/2026-a-...

Here’s a conundrum for you: fit the two red lines Anthropic didn’t want to forgo into the EU AI Act’s red lines under Article 5. 🦗 🦗 🦗 First thing: military use, out of scope. But even as dual use technology: 🦗 🦗 🦗 Should egregious red lines not be spelled out? Or is it an oversight?

Privacy regulators from four continents have aligned around a clear position that AI-generated sexualized deepfakes are a data protection violation. For Grok, already under investigation in multiple jurisdictions, that alignment increases the likelihood of sustained and parallel regulatory action.

My magazines this week 🫠 * But since I’m deep into these conversations at my job, at least they remind me the job is kind of relevant? 🤷‍♀️ 🧐

Amazing resource Cc @gzf.bsky.social

Next week’s India AI Impact Summit is framed around “democratizing AI.” But as India expands AI-driven surveillance, predictive policing, and welfare automation, minorities and marginalized communities are bearing the costs, writes Tavishi.

All events of the #AIImpactSummit in New Delhi will be live-streamed throughout next week and you can watch them here: m.youtube.com/@indiaai India certainly wins at accessibility and inclusiveness. 👀 Is this what a touch of the Global Majority looks like on AI Governance? 🤞

[EN] @gzf.bsky.social joined us last week to discuss proposed changes to the EU legal framework for #AI and digital services open.substack.com/pub/masterso... #GDPR #AIAct

This is how important the Chief Privacy Officer job is. www.nytimes.com/2026/02/13/t...

The most important question about AI isn't determining whether the machine thinks — it's whether interacting with it displaces the conditions under which we think, writes Eryk Salvaggio.

Casey - have you come across Joseph Weizenbaum’s Computer Power and Human Reason? He is the creator of the first chatbot, Eliza, at MIT in the 60s. He pulled the plug in horror after seeing the deep paychological impact of talking to the bot on his team 🙃

The thing about Laura Codruta Kovesi is that she weeds out corruption like no one else I’ve ever seen in my life. Her EPPO is also behind the Le Pen trial, the EEAS/College of Europe muddy case and now this: www.lalibre.be/internationa...

Esta americana quere agradecer a Marimar, Maria la Del Barrio, Corazon Salvaje, Cafe con Aroma de Mujer y todas las telenovelas which ella watched en Rumania cuando era una nena y thanks to which ella ahora comprende so much Espanol 💃 Gracias, gracias, gracias ☺️

There seem to be millions of people who believe that if they ask an AI chatbot to "brainstorm" about a topic and then ask it to write a "first draft," it will still be a human-made work if they edit it. I'm sorry, but it won't.

This feels less like a privacy perfect storm and more like an infrastructure reckoning. Once AI workloads and cross-border data flows collide with GDPR reform, control of compute and models becomes the real pressure point. Data localization isn’t just regulatory anymore—it’s strategic.

Last week @ellamarkianos.bsky.social pitched me on the idea of trying to replace herself with a bot. Ella is irreplaceable, but her piece on building "Claudella" is sharp, funny and moving www.platformer.news/journalism-j...

The U.S. privacy landscape has transitioned from a period of legislative expansion to one of regulatory maturation. Our latest retrospective highlights four key trends in privacy law enforcement in 2025. Read more. fpf.org/blog/fpf-ret...

breathe

... increased data sharing within complex AI agent models / tools and - for a lack of better word - "social medialisation" of chatbots with detailed profiles of users, using this for ads and the related pressure to keep users online for longer.