Technology and IP Quarterly - Q4 2025

Technology and IP Quarterly Q4 2025

2

Introduction In this Q4 2025 edition of the Technology and IP Quarterly, we offer a comprehensive overview of the latest developments in intellectual property rights, life sciences, and regulatory and data protection. We highlight the most significant advancements in Norway and the EU during the last quarter of 2025, covering regulatory updates, case law and other important news.

Table of Contents Life Sciences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Intellectual property rights. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Regulatory and Data Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Editorial team Eirik Basmo Ellingsen

Jacob A. Møller

PARTNER eiell@bahr.no

PARTNER jam@bahr.no

Anja Stensrud Elverum

Anna Medbøe Tamuly

MANAGING ASSOCIATE anelv@bahr.no

ASSOCIATE antam@bahr.no

Albin Holterman Ødegaard

Morten Smedal Nadheim

ASSOCIATE albho@bahr.no

SENIOR ASSOCIATE monad@bahr.no

Sander Bøe Bertelsen

Fujan Parsa

ASSOCIATE saber@bahr.no

SENIOR ASSOCIATE ylhos@bahr.no

3

Life sciences BAHR provides expert guidance to clients that operate throughout the life sciences sector, including in pharmaceuticals, biotechnology, health services, and medical devices. Our distinguished team is celebrated for representing top pharmaceutical originators in both patent litigation and pioneering regulatory disputes.

We offer expert advice on a wide range of matters, such as pricing, reimbursement, market access, parallel import, marketing and public procurement. We also advice on commercial contracts, such as licensing and agreements related to clinical drug development. With our support, clients are equipped to excel in the competitive life sciences arena.

4

Norway Regulatory updates Delays in transitioning to the new case processing platform for marketing authorisations On 17 September, NoMA implemented a new case processing platform for applications for marketing authorisations. The new platform will make case processing more efficient and enable NoMA to better utilise European systems and processes.1 During the transitioning phase, NoMA has experienced delays due to required manual work for certain case types. The delays are expected to continue into 2026. The developments are being monitored by NoMA, and updated information will be published as needed.2 For marketing authorisations holders, it is worth noting that the issuance of

marketing authorisations in MRP/DCP and for parallel-imported medicinal products are affected by the delays, that cases in the centralised procedure are primarily processed within the applicable deadlines, and that safety updates are being prioritised and processed continuously.3

Simplified language requirements on Nordic packages For about a year, a joint Nordic pilot has enabled marketing authorisations holders of low-volume hospital medicines to use common Nordic packages with English language only on both packaging and the printed package leaflet. The pilot is now being extended to allow English in combination with other European languages. The aim is to simplify production and increase the accessibility to critically important medicines.4 Whilst the pilot is being extended, NoMA reiterates that the legislation is clear on the importance of using national languages on medicinal product packaging and confirms that the extension of the pilot constitutes the broadest exemption permitted and that no additional exemptions will be granted under the pilot. This new scheme only applies to products that have been approved trough the EMA’s central procedure and are included in the Nordic pilot project. The arrangement requires that the marketing authorisation holders themselves apply to have their relevant medicines included.

Guidelines on how to apply are available here.

1

https://www.dmp.no/en/news/noma-adopts-a-new-case-management-platform

2 https://www.dmp.no/en/news/status-of-the-transition-to-the-new-case-processing-platform-formarketing-authorisations 3 https://www.dmp.no/en/news/status-of-the-transition-to-the-new-case-processing-platform-formarketing-authorisations 4

https://www.dmp.no/en/news/pilot-simplifies-language-requirementson-nordic-packages

5

The Ministry of Health and Care Services has asked Directorate of Health to start working with public “health advice AI”

On 27 November 2025, the Directorate of Health informed that it has been asked by the Ministry of Health and Care Services to start working on a public AI service that offers personalised and reliable health advice.5 The purpose is to reduce misinformation and workload on the health service by integrating the AI service as a part of a potential digital frontline.

The initiative will begin with small, safe services, aiming for multiple stakeholders to contribute to different components and sub-services. Currently envisaged sub-services include tools for providing explanations of test results and discharge summaries in plain language, providing advice on vaccines and nutrition, helping assess whether to contact healthcare professionals, targeted preventions, and targeted follow-up for specific patient groups.

NoMA announces Norway’s participation in fast-track clinical trial assessment initiative On 5 December 2025, NoMA announced that Norway will be participating in a European Pilot Initiative called Facilitating and Accelerating Strategic Trials (“FAST-EU”), which is expected to start in January 2026.6 The initiative will be a part of the wider efforts to create a foundation for increased collaboration and reliance between national medicines authorities, with the support of the EU. The purpose of the pilot is to accelerate the assessment of multinational clinical trials and increase the number of clinical trials conducted within the EU/EEA. Multiple stakeholders, including the Association of the Pharmaceutical Industry in Norway, have expressed support for Norway’s participation in this initiative.7 Further information about the pilot initiative can be found in the press release from the Heads of Medicines Agencies here.

Case law Patient injury compensation after Covid-19 vaccine vaccine – 25-064437TVI-TTRO/TTRD On 2 December 2025, Trøndelag District Court found the Norwegian State liable for damages after an individual developed chronic fatigue syndrome (CFS/ME) following vaccination with a Covid-19 vaccine. The Patients’ Injury Compensation Board had rejected the individual’s claim finding that they had not suffered any patient injury, but the District Court came to the opposite conclusion.

5 https://www.helsedirektoratet.no/nyheter/helsedirektoratet-satser-pa-trygge-helserad-medkunstig-intelligens 6 https://www.dmp.no/en/news/european-pilot-initiative-a-fast-track-approach-to-processing-ofclinical-trial-applications 7 https://www.lmi.no/2025/12/05/lanserer-en-pilot-for-hurtiglop-for-godkjenning-av-kliniskestudier-i-eu-eos/

6

The basis for liability was a specific provision in Section 3 of the Norwegian Patient Injury Act for damages that occur as a result of taking a recommended or required vaccine. The District Court noted that Section 3 of the Patient Injury Act requires a two-step assessment. First, the injured party must prove that there is a practical possibility that the vaccine could have caused the disease. The standard of proof here is modest. Second, if a practical possibility is established, the burden of proof is reversed, and the State will become liable for damages unless it proves that the disease was more likely caused by other factors. When the requirements of this provision are met, it is the State that is liable for damages, not the manufacturer of the vaccine.

The State argued that the Boards’s decision should be upheld, on the basis that there was no sufficient connection between the vaccination and the injury, and that it was more likely that the disease had developed due to other factors.

Therefore, they argued that the requirement of legal causation was not fulfilled.

In any case, the State argued that the vaccine must be considered such an insignificant factor in the overall picture that it would not be reasonable to attribute tortious liability to it.

After an overall assessment, the District Court concluded that there was a practical possibility that the Covid-19 vaccine caused the long-term effects that led to the CFS/ME. Among other things, the District Court emphasised the temporal proximity between the vaccine and the development of the disease, as the patient developed symptoms on the same day as the second dose of the vaccine.

The District Court also found that the State had failed to prove other probable causes of injury which, either individually or collectively, had acted independently of the vaccine. As a result, the State was found liable for damages under Section 3 of the Patient Injury Act. The State has appealed the District Court’s decision.

Violations of advertising regulations for prescription-based medicinal products Violations of advertising regulations may result in fees and compulsory fines.

Decisions resulting from such violations are published on NoMA’s website after the appeal deadline has expired. The website can be accessed here.

On 1 December 2025, NoMA published three new decisions against three pharmaceutical companies8, all of which illustrate that the requirements for advertising of prescription-based medicinal products are strict and inter alia require that all information published is up-to-date per the publication data, sufficient and accurately reflecting the information in the Summary of Product Characteristics (SmpC). Further, the decisions illustrate that the requirements 8 https://www.dmp.no/tilvirkning-import-og-salg/reklame-for-legemidler/tilsyn-ogsanksjonsmuligheter/vedtak-om-brudd-pa-reklameregelverket

7

for information to be considered “advertising”, are not very high. In all three decisions, the manufacturers were ordered to cease all further use of the relevant advertisements, cf. the Medicines Regulation Section 13-14 (2), as the sole sanction imposed.

EU Regulatory updates The last implementing regulations on the joint clinical assessment of medical devices and in-vitro diagnostic medical devices has been issued On 17 October 2025, the European Commission issued the last of six implementing regulations on the joint clinical assessment of medical devices and in-vitro diagnostic medical devices. The implementing regulation forms part of the implementation of the so-called HTA Regulation, which became applicable on 12 January 2025.9 The HTA Regulation aims to strengthen cooperation within the EU/EEA on joint health technology assessments of relative clinical efficacy and safety, as well as joint scientific consultations for health technology developers.10 It sets the foundation for collaboration and communication, and rules for use of methods for joint clinical assessments of health technologies. According to the preamble of the HTA Regulation, a health technology assessment is a scientific, evidencebased process that allows competent authorities to determine the relative effectiveness of new or existing health technologies.

The implementing regulation will apply in the EU from 9 November 2025. The act is considered EEA-relevant and acceptable, and NoMA will submit a proposal for the implementation of the regulation in Norwegian law for consultation.11

Position paper on digital label for importer and authorised representative published The mandatory requirements for additional product information for medical devices and in-vitro diagnostic medical devices have recently increased significantly in the EU, both information needed for safe use of the device (essential information) as well as additional information must be included on the product’s printed label.12 9 https://health.ec.europa.eu/publications/implementing-act-joint-clinical-assessment-medicaldevices-and-vitro-diagnostic-medical-devices_en 10 https://www.dmp.no/en/public-funding-and-pricing/health-technology-assessments/ international-cooperation/eu-regulation-on-health-technology-assessment-htar 11 https://www.regjeringen.no/no/sub/eos-notatbasen/notatene/2025/okt/metodevurderingergjennomforingsforordning-om-felles-kliniske-vurderinger-for-medisinsk-utstyr/id3141412/ 12 https://www.medtecheurope.org/2025/11/06/joint-industry-paper-calling-for-digital-label-forimporter-and-authorised-representative-information/

8

Since the additional information is unrelated to identification of the device, warnings, precautions, handling and use information, MedTech Europe, AESGP, COCIR and Euromcontact state that this information is not essential to the safe and effective use of the medical and in-vitro diagnostic medical devices.

Therefore, on 4 November 2025, they published a joint paper proposing that socalled non-essential information may be provided in digital format. As a first step it is suggested that importer and authorised representative information may be provided digitally.

The full paper can be accessed here.

The European Commission has announced that EUDAMED will become mandatory from May 2026 EUDAMED is a centralised European database used to register and collect information about medical devices and their manufactures. The database aims to strengthen surveillance and transparency regarding medicinal devices in the

internal market. It shall contribute to enhance the cooperation between the authorities and the market players, and secure better information for healthcare professionals and the general public.13 On 27 November 2025, the European Commission announced that four of the six modules in EUDAMED, including actor registration, device registration, notified bodies and certificates, and market surveillance, will be mandatory to use from May 2026.14 The requirement to use these modules in EUDAMED will apply to manufactures, importers, authorized representatives, certification bodies and people who put together a system or a set of procedures.15

The Council of the European Union agreed on its positions on the Critical Medicine Act On 2 December 2025, the Council of the European Union agreed on its positions on the Critical Medicines Act, marking “a significant step towards improving Europe’s preparedness for health crises”.16 The Critical Medicines Act is a proposal for a new EU regulation that aims to improve the availability, security and resilience of supply of essential medicines within the EU. The new Critical Medicines Act would complement the proposed draft of the EU pharmaceutical reform package.

The Critical Medicines Act aims to strengthen the availability and security of the supply of critical medicines by diversifying the supply chain, which will reduce 13 https://health.ec.europa.eu/medical-devices-eudamed/overview_en 14 https://health.ec.europa.eu/latest-updates/eudamed-four-first-modules-will-be-mandatory-use28-may-2026-2025-11-27_en 15 https://www.dmp.no/nyheter/eudamed-blir-obligatorisk-fra-mai-2026 16 https://www.consilium.europa.eu/en/policies/critical-medicines-act/

9

dependence on a limited number of suppliers, and boosting EU pharmaceutical manufacturing to reduce reliance on third countries.17 Furthermore, the act aims to provide incentives for collaborative procurement initiatives to reduce cost and help member states purchase medicines more effectively.

Once the European Parliament has established its position, the next step is negotiations between the Parliament and the Council regarding the final text of the regulation. The proposal is marked as EEA-relevant and is therefore expected to be implemented in Norway in due course.18

The Council and the European Parliament have reached an agreement on the ‘pharma package’ On 11 December 2025, the Council of the European Union and the European Parliament reached a provisional agreement on the EU pharmaceutical reform package, often referred to as the ‘pharma package’.19 The reform aims to create a more competitive pharmaceutical sector whilst ensuring timely access to medicines for patients across the EU. The agreement introduces a revised system of regulatory data protection, with eight years of data protection and one year of

market exclusivity for new medicines, and an additional year of market exclusivity for certain innovative medicines. The reform also strengthens obligations on earlier authorisation holders to ensure adequate supply of medicines, refines the Bolar exemption to allow earlier preparation of generic and biosimilars, and introduces transferable exclusivity vouchers to incentivise the development of priority antibiotics, subject to strict safeguards to protect healthcare budgets.

The provisional agreement remains to be endorsed by both the Council of the European Union and the European Parliament, before being formally adopted and entering into force. The legislation is marked EEA-relevant, and Norway will be required to implement corresponding amendments to its current legislation in due course.

Proposed EU Biotech Act On 16 December 2025, the European Commission presented its proposal for the EU Biotech Act, which seeks to enhance the European Union’s competitiveness in biotechnology.20 The proposed EU Biotech Act introduces significant changes, inter alia by streamlining clinical trial authorisation and by granting a 12-month SPC extension for qualifying medicinal products developed using biotechnology.

17 https://www.ema.europa.eu/en/human-regulatory-overview/post-authorisation/medicineshortages-availability-issues/availability-medicines-during-crises/union-list-critical-medicines 18 https://www.stortinget.no/no/Hva-skjer-pa-Stortinget/EU-EOS-informasjon/EU-EOS-nytt/2025/ eueos-nytt---18.-mars-2025/lovforslag-om-kritiske-legemidler-critical-medicines-act/ 19 https://www.consilium.europa.eu/en/press/press-releases/2025/12/11/pharma-package-counciland-parliament-reach-a-deal-on-new-rules-for-a-fairer-and-more-competitive-eu-pharmaceuticalsector/ 20 https://health.ec.europa.eu/publications/proposal-regulation-establish-measures-strengthenunions-biotechnology-and-biomanufacturing-sectors_en

10

The proposal focuses on accelerating clinical trial authorisations, reducing timelines significantly, and establishing regulatory sandboxes and AI-enabled tools to support innovation. The proposal contains amendments to Regulation (EU) No 536/2014 (Clinical Trials Regulation), which aim to cut approval timelines, foster greater collaboration across borders, and improve regulatory efficiency. In the proposal, authorisation timelines for multinational clinical trials are shortened from 106 days to 75 days, including validation and ethical review. When there is no request for information to the sponsor, timelines for initial clinical trial authorisations are reduced from 75 days to 47 days, and the currently applicable 50-day extension for Advanced Therapy Medicinal Products is eliminated.

Simplification of procedures for low-intervention clinical trials is supported by the introduction of a new category of “minimal-intervention” clinical trials. The proposal further includes an integrated approach to clinical trials combining the investigation of a medicine together with a medical device or an in-vitro diagnostic, by introducing a single assessment process. The proposal also clarifies that GDPR Articles 6(1)(c) and 9(2)(a) constitute the appropriate legal

bases for the processing of personal data in clinical trials and states that Member States should not be able to impose further restrictions and limitations under GDPR Article 9(4). The proposal also provides that personal data may be further processed by the same controller for the purposes of other clinical trials or scientific research.

To incentivise investments, the proposal includes measures to extend Supplementary Protection Certificates for medicines developed using biotechnology, including ATMPs and veterinary medicinal products, cf. Articles 27 and 40a of the draft. To qualify for this extended protection, the product must contain a new active substance distinctly different from that of any authorized medicinal product in the Union, contain a mechanism of action distinctly different from previously authorized medicinal products for the same disease, be supported by a multi-country clinical trial data conducted in more than two Member States, and include at least one manufacturing step within the EU. The next step is for the proposal to be examined by the European Parliament and the Council under the ordinary legislative procedures. Once, adopted, the EU Biotech Act will be EEA-relevant and may be expected to be implemented in Norway in due course.

Proposed simplification of rules on medical devices and in vitro diagnostic devices On 16 December 2025, the Commission also proposed amendments to the Medical Device Regulation and the In Vitro Diagnostic Medical Devices Regulation to simplify and reduce regulatory burden, whilst maintaining high standards of patient safety.21 21 https://health.ec.europa.eu/publications/proposal-regulation-simplify-rules-medical-and-vitrodiagnostic-devices_en

11

The proposed amendments streamline certification and conformity assessment procedures inter alia by replacing the fixed 5-year certificate validity with riskbased periodic reviews, reduced notified body involvement for lower-risk devices and reduced surveillance frequency where justified. The proposal also sets forth regulatory sandboxes at national and EU level for emerging technologies and introduces fast-track for breakthrough and orphan devices. The proposal reduces administrative obligations such as reporting and promotes digitalisation of compliance tools. The Commission estimates that these measures could save more than €3 billion annually and improve predictability for manufacturers, particularly SMEs. The next step is for the proposal to be examined by the European Parliament and the Council under the ordinary legislative procedures. Once adopted, the amendments will be EEA-relevant and may be expected to be implemented in Norway in due course.

12

13

Intellectual property rights BAHR’s intellectual property practice covers all areas of contentious and noncontentious intellectual property law. The team has litigated numerous cases and has extensive experience providing legal advice to both domestic and international clients within the fields of patents, trademarks, copyright, design and trade secrets. For more information regarding patent litigation in Norway, BAHR has authored the Norwegian chapter in Lexology In-Depth: Patent Litigation, accessible here.

This section will present recent regulatory developments and case law in the field of intellectual property from Norway, the European Union, and other European jurisdictions, offering insights into the latest legal trends and decisions during the last quarter of 2025.

14

Norway Case law Patents – Claim for invalidity not abandoned in appeal proceedings – 25-097181ASD-BORG/02 – 3 December 2025 In proceedings before the Oslo District Court, InflowControl AS initiated patent infringement litigation against Tendeka AS and Swellfix UK ltd. (collectively Tendeka), seeking injunctive relief to prevent the offering for sale, commercialisation, and use of Tendeka’s Autonomous Inflow Control Device (AICD) technology. InflowControl alleged that Tendeka’s solution infringed two of its patents. Tendeka requested dismissal on non-infringement grounds whilst simultaneously filing a counterclaim seeking a declaration of invalidity, recognising that invalidity cannot serve as a basis for dismissal unless formally pleaded as a separate claim. The Oslo District Court ruled in favour of Tendeka, finding no patent infringement had occurred, and did not address the validity question, citing that courts may leave invalidity counterclaims unaddressed when they function purely as defensive grounds and the court first concludes that there is no patent infringement.

InflowControl appealed the decision in part to the Borgarting Court of Appeal, where it sought to overturn the finding of non-infringement for one of its patents and argued that Tendeka had effectively abandoned its invalidity claim at first instance since the invalidity claim had not been determined by the District Court. In a decision of 3 December 2025, the Court of Appeal rejected this argument, holding that Tendeka had not abandoned the invalidity claim through its written pleadings and noting that there had not been any withdrawal of the invalidity claim orally during the hearing.

This decision provides valuable guidance on the procedural treatment of invalidity counterclaims in Norwegian patent litigation, clarifying that an invalidity claim may be included in appeal proceedings even where the first instance court did not address such claim. The hearing on the merits of the appeal proceedings is scheduled for June 2026.

BAHR represents Tendeka and Swellfix in these proceedings.

Trade secrets - Disclosure of evidence in patent litigation - Borgarting Court of Appeal – LB-2025-154980 – 19 November 2025 Borgarting Court of Appeal considered an appeal of a decision on certain requests for disclosure of evidence, proposed by both the plaintiff, Welltec AS and Welltec Oilfield Services (Norway) AS (the patent holder) and the defendant, Schlumberger Norge AS (the alleged infringer). The case concerns alleged infringement of a patent relating to well drilling. The defendant claimed that the patent should be invalidated. During the proceedings, both parties filed motions to disclose several types of evidence.

15

The plaintiff requested documentation of invoices, sales prices, sales offers, contracts, technical information, drawings and information on the manufacturers of the alleged infringing product, while the defendant requested documentation of what the patent holder claimed was “inventive” in the patents. The plaintiff also wanted to inspect physical copies of the products which were claimed to infringe the patent.

Borgarting Court of Appeal found that information of invoices, agreements and offers for sale would be relevant for ascertaining possible claims for economic loss, licence fees, or unjust enrichment, which the patent holder may claim should infringement be established. While the Court of Appeal considered invoices, agreements and offers for sale to be trade secrets, it found that the necessity to illuminate the case between the parties did not outweigh the need for the alleged infringer to keep its trade secrets confidential, with the exception of the claim for production of the invoices. The need to maintain confidentiality of trade secrets was heightened since the defendant was a direct competitor to the plaintiff. The defendant was therefore only obligated to produce evidence of invoices for its sales.

As to the request for documentation of what the patent holder claimed was “inventive” in the patents , both the Oslo District Court and Borgarting Court of Appeal ruled that professional evaluations on whether a patent was “inventive”, was considered to be evidence of facts, not law. The court claimed that such opinions were relevant in assessing questions of inventive step and novelty, even if such opinions were subjective. However, the obligation to submit such evidence does not include correspondence with or the opinions of legal advisors and patent attorneys, which is subject to attorney-client privilege. Such information was therefore carved out by the patent holder.

Borgarting Court of Appeal also repealed and remanded two decisions of the District Court: The District Court’s rejection of the plaintiff’s request for documentation on the manufacturers of the tools, and the District Court’s order that the defendant must provide access to physical copies of the tools and technical drawings.

While the Court of Appeal’s reasoning is largely case-specific, the decision also includes practical clarifications of the thresholds for production of evidence in intellectual property proceedings in Norway, especially where the parties are competitors and the evidence includes information that constitutes trade secrets.

In brief, requests to produce trade secrets as evidence in matters between competitors must be strongly reasoned and requires that the court finds such production to be necessary for the consideration of the case at hand.

16

Trade secrets - Evidence in unfair competition case- Borgarting Court of Appeal – LB-2025-137294 – 21 November 2025 In another case on disclosure of evidence heard by Borgarting Court of Appeal, a company in the construction sector filed suit against six former employees and their new employer, claiming that their commencement of a competing undertaking while employed with their former employer, inter alia violated laws on proper business practices and on trade secrets. As part of the proceedings, the plaintiff filed an extensive request to the court for the defendants to produce evidence on, inter alia, their correspondence mentioning the former and new employer, correspondence on the planning of a competing business against the former employer, technical drawings of products offered by the new employer, and order lists of the new employer for 2023 – 2025.

Oslo District Court ruled that all of the requested evidence had to be produced by the defendant, who appealed the decision, claiming that the District Court improperly applied the rules on evidence of trade secrets, which a party may

refuse to provide unless the court after a weighing of relevant interests finds the evidence necessary to produce.

When it came to the requests for correspondence between the defendants and the new employer in the relevant time period, the Court of Appeal ruled that Oslo District Court had not actually ruled on whether the relevant documents constituted trade secrets at all. A proper assessment on the exemption for trade secrets requires that the courts cannot presume that the relevant documentation is part of the exemption for trade secrets. Several rulings on these documents were therefore repealed and remitted to the District Court.

As to lists of orders from customers and completed projects, the Court of Appeal concurred with the District Court that while the evidence constituted trade secrets important to the defendants, a weighing of interests required that the documents should be produced. The damaging effects of producing the evidence would be reduced by having the proceedings held in camera and reducing the number of present representatives from the plaintiff.

The Court of Appeal also ruled that technical information of the relevant products offered by the new employer, though being highly sensitive information, should also be produced due to its centrality as evidence for the plaintiff’s claims. Interestingly, the Court of Appeal gave weight to the fact that the District Court requested the parties to agree on and provide the mandate to a “clean team” consisting of an independent third party, who would receive the requested information. Although the mandate and composition were not yet decided, this would relieve some of the damage caused to the defendant when conducting the proceedings.

17

Trademark – The Oslo District Court - 25-077788TVI-TOSL/03 – 17 October 2025 The company Apple Inc. had applied for the combined mark APP CLIP, with Apple’s apple logo placed before the word element:

The mark was applied for registration for, among other things, the service “Providing online non-downloadable application development software”. The Norwegian Industrial Property Office refused protection for the mark in Norway, because it considered that the mark would infringe the earlier trademark right to the word mark CLIP, which was registered for identical and similar services.

The Oslo District Court agreed that Apple’s mark would infringe the earlier trademark. The Oslo District Court noted that the primarily distinctive element

in Apple’s mark was the word element CLIP. The District Court further concluded that the mark had sufficient visual, phonetic and conceptual similarities for there to be a likelihood of indirect confusion, in that consumers may believe there is a commercial link between the proprietor of the mark CLIP and Apple. The fact that Apple’s logo was well known was not sufficient to prevent this

Trademark - The Norwegian Board of Appeals for Industrial Property Rights – KFIR-2025-54 – 14 November 2025 The Norwegian football club Bodø Glimt is known for a distinctive football philosophy, and they have applied to register their slogan “VÅRRES MÅTE” as a trademark, which can best be translated as “our way”. The mark is, however, written as it is pronounced in the dialect used in the city of Bodø. Bodø Glimt applied to register the mark for food and beverages and books and gaming, as well as for educational services. The Norwegian Industrial Property Office concluded that the mark would only be perceived as a promotional slogan, and that it would not be perceived as a trademark. The Norwegian Board of Appeals for Industrial Property Rights, however, held that slogans may also meet the requirements of a trademark, and that since the words were written in dialect, the mark had sufficient distinctive character to be registered.

18

EU Case law Copyrights - Protection and assessment of infringement for applied art – EU Court of Justice - Joined Cases C-580/23 (MIO) and C-795/23 (USM) 4 December 2025 The Court of Justice of the European Union (CJEU) issued preliminary rulings in two joined cases between, respectively, the Swedish companies MIO AB and Galleri Mikael & Thomas Asplund Aktiebolag, and between the two German companies USM U. Schärer Söhne AG and Konektra GmbH. The cases raised three main questions regarding copyright protection for applied art.

First, questions were raised about the relationship between design law and copyright law. Second, the CJEU was asked how the assessment of originality should be carried out for works of applied art. The third question related to the infringement assessment itself and whether it is necessary to determine whether creative elements of the protected work have been reproduced in a recognizable manner in the allegedly infringing subject matter.

Regarding the first question, the referring courts asked whether Directive 2001/29 on the harmonisation of certain aspects of copyright and related rights in the information society (the “Infosoc-directive”) must be interpreted as meaning that there is a relationship of rule and exception between design protection and copyright protection, meaning that the requirements for copyright protection for works that are design protected would be different than for other works.

The CJEU concluded that there is no relationship of rule and exception between design protection and copyright protection, and no stricter requirements are to be applied to works of applied art.

The CJEU found that subject matter constitutes a copyright-protected work if it reflects the author’s personality as an expression of free and creative choices. Choices dictated by technical or other constraints are not free and

creative. Factors such as the author’s intentions, sources of inspiration, use of existing shapes, the likelihood of similar independent creation, or recognition in professional circles may be considered, but are not necessary or decisive for establishing originality.

The CJEU further stated that to establish copyright infringement, it must be determined whether creative elements of the protected work have been reproduced in a recognizable manner in the allegedly infringing subject matter.

Norwegian copyright legislation is largely harmonized with the Infosoc-directive, and the judgment will accordingly be significant for the interpretation of the Norwegian Copyright Act. 19

Marketing - Marketing of non-alcoholic spirit drinks prohibited – EU Court of Justice – C-563/24 In a recent preliminary opinion from the CJEU, it was ruled that marketing a non-alcoholic spirit drink as “Virgin Gin alkoholfrei” (non-alcoholic) was not permissible, as it presumably had characteristics imitating the juniper-based alcohol.

The Verband Sozialer Wettbewerb, a so called “warning association” in Germany, filed a claim against the producer of such drink, claiming the presentation and labelling was contrary to the provisions of Regulation 2019/787. The Regulation provides rules on the production and labelling of spirit drinks, including the protection of geographical indications of such.

The CJEU found that the Regulation clearly disallowed gin to be marketed as non-alcoholic, as point 20 Annex I of the Regulation stipulates a minimum alcoholic percentage of 37,5%.

The reason behind the prohibition is protection of consumers and the reputation of certain categories of spirit drinks, which was why the CJEU also ruled that the prohibition in Article 10 (7) of the Regulation was not invalid in the light of the freedom to conduct a business enshrined in Article 16 of the Charter of Fundamental Rights of the European Union. As Regulation 2019/787 is incorporated in the Norwegian regulation on spirit drinks and aromatic drinks, the decision is also relevant for actors operating in Norwegian spirits markets.

Patent settlement considered anti-competitive by object – EU Court of Justice - C-2/24 P – 23 October 2025 In late 2005, Teva Pharmaceutical Industries Ltd, the proprietor of a patent for modafinil, the active ingredient in a medicinal treatment for narcolepsy, entered a settlement agreement with the now acquired Cephalon Inc., a generic manufacturer of the same compound, after initiating court proceedings in the United Kingdom (then an EU member state).

According to the European Commission, the settlement agreement contained non-compete and non-challenge clauses which incentivised the parties to not compete on the merits in the relevant market. The settlement agreement consisted of the generic delaying entry to the market and was granted a license in return for royalty payments to the originator, as well as data licenses, API and supply terms and reimbursement for litigation costs. The arrangement as a whole was considered to be a “pay-for-delay” agreement, a restriction by object within the meaning of Article 101(1) TFEU. The parties were fined approx. 60 million EUR, and challenged the decision before the EU General Court, which sided with the Commission. It then appealed to the CJEU.

20

The CJEU sided with the previous instance and the Commission, finding that there were no errors in law when interpreting and applying the two-step test as delineated by the CJEU in the earlier Generics (UK) case (C-307/18). According to the test, a patent settlement agreement is a restriction “by object” pursuant to Article 101 TFEU if the value transfers have no plausible explanation other than the parties’ shared interest in avoiding competition on the merits, and there are no proven pro-competitive effects capable of creating reasonable doubt that it causes a sufficient degree of harm to competition.

Other jurisdictions Unified Patent Court Norway is not part of the Unified Patent Court (the “UPC”), and decisions of the courts of this organisation are not legally binding in Norway. Decisions may still hold relevance as sources of legal interpretation of corresponding rules of Norwegian patent law.

The development of the so-called “holistic approach” to inventive step Court of Appeal - UPC_CoA_528/2024 and UPC_CoA_529/2024 (Sanofi v.

Amgen), UPC_CoA_464/2024 et al (Meril v. Edwards) The UPC Court of Appeal have in two decisions of 25 November 2025 adopted an inventive step-assessment closer to the so-called “holistic approach”.

These decisions are viewed as the culmination of a diverging set of cases from the Local Divisions, which have applied different legal standards. Both cases concerned several points of law which were challenged by the applicants, wherein the issue of inventive step has gathered the most attention.

The assessment of inventive step - whether an invention would have been obvious to a skilled person - can be approached through different methodologies. The two decisions from 25 November 2025 state that the UPC approach is to apply a three-step test, which broadly corresponds to that of one of the decisions under appeal, the Paris Local Division in UPC_CFI_434/2024 of 20 October 2025 (Meril v Edwards). The decision is also in line with the Court of Appeal’s previous decision in UPC_CFI_2/2023 of 15 December 2023 ( Nanostring v. 10x Genomics). First, the “objective problem” of the invention is framed.

Second, one or more “realistic starting points” in the prior art are identified.

Third, it is assessed whether the claimed solution would be obvious to the skilled person when starting from each starting point and considering the objective problem. A central question is whether the skilled person, when starting at the realistic starting point and wishing to solve the technical problem, would (and not only “could”) have arrived at the claimed solution.

By contrast, the problem-solution approach developed by the European Patent Office imposes a structured three-step methodology that has become the cornerstone of EPO practice. This systematic framework requires first identifying

21

the closest prior art, then establishing the objective technical problem that the invention solves, and finally assessing whether the proposed solution would have been obvious to the skilled person attempting to solve the objective technical problem.

Among the more significant differences between EPC and UPC is the framing of the objective technical problem. Whereas the framing of the objective technical problem under the EPO’s problem-solution approach focuses on the features of the patent claims that distinguishes the claimed invention from the prior art, and such features’ contribution to the claimed invention’s technical effect, the UPC Court of Appeal seems, in these two cases, to assess the patent claims as a whole in context of the description and the drawings, and the technical effect that the skilled person understands to be achieved when confronted with the application.

The Norwegian Industrial Property Office and Norwegian courts tend to apply the problem-solution-approach, in an effort to align Norwegian patent law with the case law of the EPO. As Norway is not a party to the UPC, it has not been established what significance decisions from these courts impart on Norwegian patent law. The UPC Court of Appeal stated itself that, provided that Article 56 EPC is correctly applied, different approaches to assessing the establishment of inventive step should lead to substantially the same conclusions.22

The requirement of urgency in provisional measures - Paris Local Division - UPC_CI_697/2025, Final Order of 21 November 2025 The Paris Local Division of the UPC has recently handed down an important decision regarding pharmaceutical patents where it essentially rules that the completion of pricing and reimbursement steps is the critical trigger for the assessment of “imminent infringement”.

According to Rule 211.4 of the Order on the Application for provisional measures, the “The Court shall have regard to any unreasonable delay in seeking provisional measures”. The central question for the court was when the applicant at the earliest had or should have had, after exercising due diligence, the necessary facts and evidence to file an application for provisional measures with a reasonable prospect of success.

In the case at hand, the applicants for provisional measures hold a supplementary protection certificate (SPC) covering the active ingredient fampridine, issued on the basis of a patent with the title “Methods of using sustained release amino-pyride compositions”. The defendant produced a generic medicine for the same compound which it launched on 10 June 2025, after the grant of a marketing authorisation in France on 19 November 2011. On 22 UPC_CoA_528/2024 and UPC_CoA_529/2024 (Novartis v Sanofi), para. 124 of Decision issued on 25 November 2025 and UPC_CoA_464/2024 et. al. (Meril v Edwards), para 5 of Decision issued on 25 November 2025.

22

22 November 2024, the price of the generic medicine was published. In August 2025, the application was filed to the UPC. The court ruled that the obligation to act diligently arises at the moment the imminence gave the patentee reason to bring the application with a reasonable chance of success. Because the completion of all regulatory requirements amounted to imminent patent infringement, November 2024 was the time in which imminence occurred. Since the applicant had not taken action when infringement first became “imminent”, the requirement of urgency for provisional measures was not met at a later launch of the generic medicine.

Although Norway is not part of the UPC framework and EP patents cannot have unitary effect here, the decision provides insight into when an originator should be expected to enforce its rights against generics through provisional measures.

Europe Copyright and communication to the public – The Danish Supreme Court (BS-46528/2023-HJR) – 6 November 2025 In Denmark, the Danish Supreme Court has delivered judgment in a dispute between Region Midtjylland and Copydan. Copydan is a collective management organisation that handles copyright in connection with the distribution of Danish and foreign TV and radio channels. This particular case concerned the use of Danish public service TV channels in hospitals. The question was whether the hospitals in Region Midtjylland had to pay remuneration to rights holders via Copydan when patients could watch TV in common rooms and in patient rooms.

Copydan argued that this was use subject to remuneration, as the hospitals’ use of TV involved a communication to the public.

The Supreme Court noted that there were continuously several thousand patients at the relevant hospitals, and that this must be regarded as a communication to the public. The Court concluded that using TV in patient rooms and in common rooms constituted a communication of a work within the meaning of the Danish Copyright Act. The Supreme Court concluded that the hospitals had infringed the rights holders’ copyright, and that they had to pay reasonable remuneration to Copydan. The Court pointed out that what constitutes reasonable remuneration must be determined on a case-by-case basis and took into account the remuneration level in previous and similar agreements, as well as to the remuneration level in Norway and Sweden. Furthermore, the Supreme Court referred to the number of TV screens that the hospitals had at their disposal and used in patient rooms and in common rooms respectively. In the specific assessment, emphasis was also given to the fact that the TV use was not carried out in commercial activity.

Following a specific assessment, the Supreme Court concluded that the hospitals collectively owed Copydan DKK 4,000,000 for the period 2019-2022.

23

Copyright and AI - Munich Regional Court - Az. 42 O 14139/24 The Regional Court in Munich has ruled that OpenAI violated German copyright law by training its ChatGPT language models on copyright-protected song lyrics.23 The court found that ChatGPT had trained its chatbot on copyright-protected songs, and that the song lyrics were “memorised” in the language models. It is known from information technology research that training data can be contained in language models and can be extracted as outputs. The court held that this memorisation was to be regarded as a reproduction covered by the exclusive right to reproduction of works and related rights pursuant to Article 2 of the InfoSoc-directive and its equivalents in the German Copyright Act. If the judgment becomes final, AI providers will have to negotiate with collective management organisations to obtain permission to use musical works to train their chatbots.

23 https://www.justiz.bayern.de/gerichte-und-behoerden/landgericht/muenchen-1/presse/2025/11. php

24

25

Regulatory and data protection At BAHR, we recognise the vital role of data privacy and security in today’s digital world. Our team of legal experts is committed to providing clear guidance on regulatory matters to ensure businesses remains compliant and secure. We offer customised solutions to help businesses navigate the complexities of the Norwegian and EU Digital regulations.

This section will provide updates on the regulatory framework within Norway and the EU, offering insights into recent developments and trends.

26

Norway Regulatory updates The Government is consolidating solutions for sensitive data at the universities into one national infrastructure The Government has decided to consolidate the current solutions for processing sensitive data at the universities into one national infrastructure.24 The aim of this initiative is to strengthen research, preparedness and innovation, and the goal is to facilitate safe and efficient use of health data for the benefit of patients, research and the society.

The solution concerns both user-friendliness and security, and the goal is to facilitate better and safer utilisation of sensitive data. The main target group is researchers, but in certain areas it is also a prerequisite for being able to provide health services. The Government proposes to allocate NOK 10 million to the work of establishing this national infrastructure, which will be formally established from 1 January 2026.

The Norwegian Data Protection Authority has changed its view on the necessity to report breaches On the yearly data privacy course held in Sandefjord, Norway, the Director of the Norwegian Data Protection Authority (NDPA), Line Coll, focused on the fact that the NDPA is currently, and has historically, been struggling to process all reported breaches.

The NDPA has therefore made adjustments as to which breaches should be reported. The guidelines on their websites have been updated, and the focus on reporting breaches when there is uncertainty as to whether a breach should be reported, to be on the safe side, has been removed. Also worth noting is that the listed breaches now “may” be reported, instead of “shall”.

The NDPA’s updated guidelines is available here.

Proposed amendments to the DORA regulations On 13 November 2025, the Ministry of Finance initiated a public consultation for a proposal to amend the DORA regulations and repeal the ICT regulations.25 The Norwegian Financial Supervisory Authority (Nw. Finanstilsynet) has assessed how the ICT activities of undertakings not subject to the Norwegian DORA Act should be regulated going forward, as well as how tasks related 24 https://www.regjeringen.no/no/aktuelt/regjeringen-samler-losninger-for-sensitive-data-i-ennasjonal-infrastruktur/id3126781/ 25 https://www.regjeringen.no/no/aktuelt/foreslar-endringer-i-dora-forskriften/id3139243/

27

to “threat-led penetration testing” (TLPT) should be distributed between the Financial Supervisory Authority and Norges Bank (The central bank of Norway).

Additionally, the Ministry has, in the proposal for amendment, assessed a supplementary proposal on Norges Bank’s ability to impose a fee when exercising TLPT tasks.26 The consultation deadline is 5 January 2026.

The Data Prioritisation Council has begun its work The Council (Nw. Dataprioriteringsrådet) met for the first time on 16 October 2025.27 The Data Prioritisation Council has been established to advise the Government on what public data should be prioritised for sharing, and will contribute to ensuring that data are used where they provide the greatest value.

The background for the establishment of The Data Prioritisation Council is the Norwegian Government’s aim to make more data available for use in the public sector, business, research and civil society.

Norwegian case law, decisions from the Norwegian Data Protection Authority and the Privacy Appeals Board Grindr appeal unsuccessful - LB-2024-154313 – 21 October 2025 In 2020, the NDPA issued an administrative fine of NOK 65 million to the company behind the Grindr app for unlawfully sharing users’ personal data with third parties for advertising purposes without valid consent, and therefore without a legal basis, under GDPR. Grindr is an American company which offers an online dating app. There are several versions of the app, the free version being the most popular. The free version is indirectly financed by ads, which are personalised using personal data related to the individual user. The personal data processed includes age, gender, location and presumed sexual interest. Some of Grindr’s revenue relies on Grindr sharing personal data with its advertising partners. Grindr shared data regarding the users age, gender and location, and App-ID. The App-ID identified that the personal data was gathered from Grindr, but personal data directly concerning presumed sexual interest was not shared.

On this background, the NDPA issued an administrative fine. Grindr appealed this decision, and in 2022 the Privacy Appeals Board upheld the conclusion (PVN-2022-22). The case has since been taken to court, and in 2024, the District Court of Oslo upheld the fine.

The case was appealed to the Borgarting Court of Appeal, and the court reached 26 https://www.regjeringen.no/no/dokumenter/horing-justeringer-i-og-utfyllende-forskrifter-tildora-loven-og-enkelte-endringer-i-annet-regelverk/id3139221/ 27 https://www.regjeringen.no/no/aktuelt/dataprioriteringsradet-i-gang-med-arbeidet-skal-gi-radom-deling-av-offentlege-data/id3125427/

28

its decision in October 2025.28 The question was primarily whether the personal data shared by Grindr with its advertising partners constitutes “data concerning a natural person’s sex life or sexual orientation”, cf. GDPR article 9 (1), and whether Grindr had a valid consent for transfer of such personal data.

Data concerning a natural person’s sex life or sexual orientation The App-ID does not in itself contain information on a natural person’s sex life or sexual orientation. However, the ID provides information on what app a data subject has been using when the data are transferred to the advertising partners.

The question was therefore what information could - directly or indirectly – be revealed by the fact that a person was using the Grindr app. The court referred to the company’s own marketing of the app, where Grindr promoted the fact that the goal of the app was to help homosexual men find other homosexual men. The court also referred to different parameters that are entered into the app by the users, such as sexual preferences, and that other marketing materials clearly depicted the app as a dating app for homosexual men. The court

therefore held that the app is primarily aimed at men seeking sexual experiences with other men.

On this background, the court stated that information that reveals that a person is seeking sexual experiences with another person, is – regardless of gender and sexual orientation – personal data which falls under the regulation of “sexual orientation” in article 9 (1).

The court then concluded that information about the app-ID of a Grindr user indirectly provides grounds for drawing the conclusion that the user is, with a high degree of probability, a homosexual man seeking sexual contact with other homosexual men, and that this constitutes “data concerning a natural person’s sex life of sexual orientation”.

Valid consent for the transfer of data Consent is a legal ground for processing both in GDPR article 6 and 9. The court mainly assessed whether Grindr had obtained consent in accordance with article 6, stating that if the consent did not fulfil the requirements of article 6, it would in any case be unnecessary to assess whether the consent fulfilled the requirements in article 9.

For a consent to be valid, it must be freely given, specific, informed and an unambiguous indication of the data subject’s wishes. For a user to be able to register with the app, the user had to accept both the general terms and conditions, and Grindr’s privacy and cookie policy. If the user had already accepted the general terms and conditions, but refused to accept the privacy and

28 https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2025/lagmannsretten-opprettholdergebyret-mot-grindr/

29

cookie policy, the user would be unable to register with the app. Accordingly, the user had to decide whether to not use the app at all, or to consent to the privacy and cookie policy.

As it was not possible to use the app without consenting to the transfer of personal data, the court held that the users were given no real choice as to whether they consented to the transfer. On this background, the court found that the consent was not freely given. The fact that users may use other, alternative apps instead of the Grindr app, that the users could download the subscription versions of the app where they could restrict subsequent (though not initial) transfers, and that users could change the privacy settings of their phones or other digital products to prohibit such transfer, did not change the court’s conclusion.

The court then evaluated whether the information provided to the data subject fulfilled the requirements for the consent to be informed and an unambiguous indication of the data subject’s wishes. As Grindr’s privacy policy had a scope and a content that did not make it clear to the data subjects that by accepting the policy, they would also consent to Grindr sharing personal data with its advertising partners, the court found that Grindr’s solution did not satisfy the requirement that consent must be specific and unambiguous.

The Norwegian Intelligence Service has stored data unlawfully On 11 November 2025, the EOS committee (Nw. EOS-utvalget) published a message to the Norwegian Parliament (the Storting) where they criticise the Norwegian Intelligence Service (Nw. E-tjenesten) for unlawful storage of subject fields in emails.29 The Intelligence Service has methods whereby they may obtain electronic communication that crosses Norway’s border in fibre cables in the form of, for example, emails. The Act related to the Norwegian intelligence service (Nw. etterretningstjenesteloven) has different regulations for obtaining such information, depending on whether data are categorised as “metadata” or “content data”.

The EOS committee has concluded that the Service has incorrectly registered the content of subject fields of emails as metadata and has therefore not followed the requirements for prior judicial control that apply to content data. The storage may in itself have potentially harmful effects, seeing as the subject fields of emails may reveal information. This is especially the case for professional practitioners who depend on confidential communication, e.g. for lawyers who have to maintain attorney-client privilege.

29 https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2025/e-tjenesten-har-lagret-data-ulovlig/

30

The message to the Storting is available here.

The Privacy Appeals Board upholds the administrative fine to Argon Medical Devices The Privacy Appeals Board (Nw. Personvernnemnda) has processed Argon Medical Devices’ appeal of the NDPA’s decision from 2023.30 In July 2021, the company had discovered a security breach concerning the personal data of their European employees, and did not notify the NDPA of the breach before September 2021, in violation with the 72-hour deadline. Argon wrongly believed that breach did not have to be reported until after a complete overview of the incident and its consequences had been completed.

The NDPA found that this was in violation of the deadline, and issued an administrative fine of NOK 2.5 million, which was later reduced to NOK 1.5 million due to a long processing time. This fine has now been upheld by the Privacy Appeals Board.

Notice of rectification order issued to Helseplattformen AS In 2024, the NDPA conducted an audit of Helseplattformen AS (Helseplatformen), the company providing the Norwegian platform for healthcare services, HelsaMi.31 In the final report, the NDPA concluded that there were significant deficiencies in the organisational measures for the actors using the solution. The report further underlined that Helseplattformen was in breach with requirements regarding clear allocation of responsibilities and the requirement of an adequate governance system.

On this background, the NDPA issued a notice of order for rectification on 8 December 2025, and Helseplattformen has until 6 January 2026 to revert to the NDPA with comments.

EU Regulatory updates The Digital Omnibus proposal has been unveiled In a press release 19 November 2025, the European Commission unveiled the “Digital Omnibus,” a two-part legislative package intended to streamline and update EU digital legislation, with the stated aim of cutting the administrative burden on small and medium enterprises.32 The package suggest changes to the 30 https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2025/personvernnemnda-opprettholderovertredelsesgebyr-til-argon-medical-devices/ 31 https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2025/varsel-om-palegg-tilhelseplattformen-as/ 32 https://digital-strategy.ec.europa.eu/en/library/digital-omnibus-regulation-proposal

31

GDPR, ePrivacy Directive, NIS2 and the Data Act, and a separate Omnibus on AI with targeted amendments to the AI Act. The reception of the Digital Omnibus has been mixed, with numerous reactions from stakeholders.

The Omnibus would introduce a “subjective” approach to the definition of personal data, meaning that data may constitute personal data for some entities but not for others. Certain interest groups fear that the proposed changes could create uncertainty and enforcement gaps by making GDPR applicability depend on a controller’s individual capabilities.

The ePrivacy “cookie” rule would be migrated into the GDPR. The use of cookies will still rely on consent and introduces a new six-month “do-not-re-ask” period after every refusal.

The legislation would codify the use of legitimate interests as a legal basis for processing personal data in the development and operation of AI systems, subject to enhanced transparency requirements and an unconditional right to

object. For special-category data, controllers would be permitted to process residual sensitive data in AI training if they implement measures to avoid, identify and remove such data, or effectively protect it where removal requires disproportionate effort.

Critiques from stakeholders highlight limited real burden-reduction, unresolved definitional gaps, retention of fundamental-rights impact assessments for highrisk AI, and a research exemption that some consider too broad.33 The package is at proposal stage and subject to Council and Parliament negotiations; adoption around mid-2027 is a realistic expectation.

The full proposal can be accessed here.

Whistleblower tool for the AI Act has been launched On 24 November 2025, the European Commission launched a whistleblower tool for the AI Act. The AI Act aims to promote the use and innovation of artificial intelligence and safeguard democracy and the rule of law, while at the same time addressing the potential risks to fundamental rights, health and public trust.34 By creating a whistleblower tool for the AI Act, violations can be detected at an early stage, which may contribute to the transparent and safe development of AI technologies in the EU. The tool provides a secure and confidential channel that enables whistleblowers to submit information in any of the EU official languages and in any relevant 33 https://noyb.eu/en/digital-omnibus-first-analysis-select-gdpr-and-eprivacy-proposalscommission 34 https://digital-strategy.ec.europa.eu/en/news/commission-launches-whistleblower-tool-ai-act

32

format. Furthermore, the system allows whistleblowers to respond to potential follow-up questions from the AI Office and to receive updates on the progress of their report, without compromising their anonymity.

The whistleblower tool can be accessed here.

Council reaches position on regulation to prevent and combat child sexual abuse On 26 November 2025, EU member states’ representatives agreed on the Council position on a regulation to prevent and combat child sexual abuse.35 The proposed regulation, commonly known as “Chat Control”, was originally introduced on 11 May 2022, with the stated aim of preventing child sexual abuse online through detection and reporting of child sexual abuse material (CSAM) by digital platforms. The new stance no longer mandates scanning of encrypted communications, marking a significant shift from earlier proposals.

Under the Council’s position, online service providers will be required to assess

the risk that their services could be misused for the dissemination of child sexual abuse material or for the solicitation of children. Based on this assessment, they will have to implement mitigating measures to counter that risk. The Council also wants to make permanent a currently temporary measure that allows companies to voluntarily scan their services for child sexual abuse, with providers of messaging services permitted to voluntarily check content shared on their platforms for online child sexual abuse material, and report and remove it.

The regulation also provides for the establishment of a new EU agency, the EU centre to prevent and combat child sexual abuse, to support the implementation of the regulation by assessing and processing information supplied by online providers about child sexual abuse material identified on services, and creating, maintaining and operating a database for reports submitted to it by providers.

The removal of mandatory detection orders represents a substantial departure from the Commission’s original proposal, which had raised significant concerns amongst privacy advocates regarding the potential for mass surveillance of encrypted communications. The Council’s risk-based approach instead emphasises voluntary measures and risk mitigation obligations, though questions remain regarding the practical distinction between voluntary activities and formal risk management requirements that providers must implement to demonstrate compliance.

Negotiations with the European Parliament will commence with a view to agreeing on the final regulation, with former member of the European Parliament Patrick Breyer expecting adoption of the regulation by EU Parliament 35 https://www.consilium.europa.eu/en/press/press-releases/2025/11/26/child-sexual-abusecouncil-reaches-position-on-law-protecting-children-from-online-abuse/

33

and Council as early as July 2026..36

Adequacy decisions for the UK have been renewed On 19 December 2025, the European Commission renewed the two adequacy decisions for the UK, formally determining that the level of data protection in the UK is still essentially equivalent to that which exists within the EU.37 This allows for the continued free flow of personal data between the EU and the UK. The extension comes after the Commission adopted a six-month technical extension in July 2025, which was set to expire on 27 December 2025.

The two adequacy decisions cover transfers governed by the GDPR, and law enforcement data exchanges under the Law Enforcement Directive. The renewed GDPR decision now also expressly includes personal data processed for UK immigration control purposes, previously excluded from the original decision’s scope.

Both renewed determinations will remain valid until 27 December 2031, subject to a mandatory review after four years of operation. This review mechanism allows the Commission and the European Data Protection Board to monitor ongoing compliance with EU data protection standards and respond to any material changes in UK law or practice.

The renewal preserves the legal basis for unrestricted personal data transfers between the European Economic Area and the United Kingdom without requiring additional safeguards such as Standard Contractual Clauses or Binding Corporate Rules. This continuity avoids the operational disruption that would follow from the lapse of adequacy status, whilst maintaining robust protection for personal data on both sides of the Channel.

The two decisions can be accessed here and here.

Case law and sanctions European General Court upholds the EU-US Privacy Framework In September 2025, the General Court of the European Union rejected a challenge to the EU-U.S. Data Privacy Framework (DPF) brought by Mr. Latombe, confirming the adequacy decision remains valid. The Court confirmed that, on the date of adoption of the contested decision, the U.S. ensured an adequate level of protection for personal data transferred from the European Union to organisations in that country.

The DPF replaces the Privacy Shield framework, invalidated by the CJEU in 2020 in the Schrems II judgment. Privacy Shield had itself replaced the Safe Harbor 36 https://www.patrick-breyer.de/en/posts/chat-control/#timeline 37 https://ec.europa.eu/commission/presscorner/detail/en/ip_25_3059

34

Framework, struck down in 2015 following Schrems I. The European Commission adopted the DPF adequacy decision in July 2023 after the United States implemented reforms, including the establishment of the Data Protection Review Court (DPRC) as an independent supervisory mechanism.

Latombe raised two main issues he meant invalidated the framework. First, he argued that the DPRC lacked the necessary degree of impartiality and independence as it is part of the U.S. executive branch. Second, he submitted that the practices of U.S. intelligence agencies on the bulk collection of personal data in transit from the EU to the U.S. amount to an unlawful interference with the rights to privacy and data protection.

The General Court disagreed and stated that the appointment of judges to the DPRC are accompanied by several safeguards to ensure the independence of its members. Moreover, judges of the DPRC may be dismissed only by the Attorney General and only for cause, and the Attorney General and intelligence agencies may not hinder or improperly influence their work. On the question of bulk data collection, the Court determined that the Schrems II judgment does not necessarily require that such collection be authorised in advance by an independent body. Instead, the Court concluded that a decision to collect must at a minimum be controlled by a judicial body after the fact.

The General Court stated that third countries may achieve the same level of protection as the EU by different means.

The General Court’s decision will be welcomed by the more than 2,800 U.S. companies that rely on the DPF to transfer personal data from the EU.38 An appeal, limited to points of law only, may be brought before the Court of Justice against the decision of the General Court. Given the possibility of an appeal and the European Commission’s ongoing monitoring, organisations relying on the DPF should maintain alternative transfer mechanisms, such as Standard Contractual Clauses as contingency measures should future legal challenges or political developments lead to invalidation of the framework.

The full decision can be read here.

Amazon’s action against the European Commission dismissed – EU General Court - T-367/23 - 19 November 2025 On 19 November 2025, the General Court of the CJEU dismissed Amazon’s action against the European Commission’s decision to designate Amazon as a “very large online platform” under the Digital Services Act (DSA).39 Being designated as such under the DSA entails that Amazon is subject to specific obligations, such as obligations of transparency, cooperation and access to data.

38 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52024DC0451 39 https://curia.europa.eu/jcms/jcms/p1_5243899/en/

35

Amazon had challenged the designation, arguing that the provision in the regulation specifying which online platforms are to be designated infringes several fundamental rights guaranteed by the Charter of Fundamental Rights of the European Union. However, the General Court upheld the European Commission’s decision, confirming that the designation process and the resulting obligations are lawful under EU law.

The full decision can be read here.

Russmedia - CJEU - C-492/23 - 2 December 2025 On 2 December 2025, the CJEU delivered a landmark judgment in Case C-492/23, X v. Russmedia Digital. The case arose after an unauthorised advertisement falsely depicting a woman as offering sexual services was posted on an online marketplace operated by Russmedia Digital, a Romanian company.

The court held that online marketplace operators are joint controllers under the

GDPR for personal data contained in user-generated advertisements, even where users design and place the content themselves. The court found that Russmedia exercised decisive influence over the processing by making personal data accessible to internet users and facilitating anonymous publication. This, along with the platform’s commercial purposes established a joint controller status even though it could not determine the content itself.

The joint controllership meant that both parties had to demonstrate that personal data was published lawfully and triggered the requirement for the platform to conclude an Article 26 joint-controller agreement with advertising users.

The Court confirmed that liability exemptions for hosting services under the e-Commerce Directive do not exempt platforms from GDPR obligations. Whilst platforms may avoid civil liability for unlawful content under the Directive, they cannot escape their duties as controllers under data protection law.

This means that platforms must implement technical and organisational measures to identify advertisement data before publication and verify compliance with GDPR principles. Operators must collect and verify the identity of advertising users. Where identity verification proves impossible, the platform must refuse publication. Additionally, platforms must deploy appropriate security measures to prevent advertisements containing sensitive data from being copied and unlawfully republished on other websites.

The judgment requires platforms to shift from removing content after complaints to screening advertisements before publication. This will increase compliance costs and impose stricter user verification processes, particularly

36

challenging smaller platform operators. The ruling aligns with broader regulatory developments under the Digital Services Act, and marks a trend towards greater accountability for platforms regarding data protection and content moderation.

The full decision can be read here.

Commission imposes first Digital Services Act fine On 5 December 2025, the European Commission imposed its first fine under the Digital Services Act (DSA), fining X (formerly Twitter) €120 million for breach of transparency obligations. The decision followed a two-year investigation that began in December 2023, marking the first non-compliance decision under the DSA regime.

The Commission determined that X is in breach of Article 25 DSA through its paid verification system, which permits users to purchase blue checkmark status without meaningful identity verification. This practice undermines users’ ability to assess the authenticity and reliability of accounts and their content, constituting a prohibited deceptive design pattern under the DSA’s requirements that platforms refrain from designing interfaces that manipulate users or materially impair their capacity to make informed decisions.40

The Commission also found that X’s ad repository fails to satisfy DSA requirements. According to the Commission’s assessment, the platform has design features and access barriers, including excessive processing delays, that undermine the purpose of DSA requirements.

Lastly, the Commission concluded that X breaches its obligations to provide researchers with access to publicly available data, noting that the platform’s terms of service prohibit eligible researchers from independently accessing such data, including through scraping methods.

X now has 60 days to outline how it intends to address the complaint about the blue checkmarks, and 90 days to respond with an action plan for addressing the breaches relating to ads and public data transparency and accessibility.

Confirmed breaches of the DSA can face a range of sanctions, including fines of up to 6% of global annual turnover.

The full decision can be accessed here.

40 https://ec.europa.eu/commission/presscorner/detail/en/ip_25_2934

37

BAHR Technology BAHR’s multi-disciplinary Technology group is tailored to meet the diverse needs of technology companies, covering all areas from litigation and M&A to contracts and regulatory matters. We are dedicated to maintaining in-depth knowledge and active engagement with industries at the cutting edge of technological advancement, delivering market-leading expertise to tackle the legal challenges these sectors face. Our clients benefit from lawyers who not only understand their business but also grasp the commercial opportunities and challenges inherent within their industry.

38

“BAHR’s Intellectual Property and TMT practice is

outstanding and the best in Norway due to its deep expertise and innovative approach to complex legal matters. The team is uniquely adept at providing strategic advice that aligns with our business objectives, specially in the rapidly evolving IP and TMT sectors.

– Legal 500

“The lawyers at BAHR are excellent. They are experts on patent litigation and are resultsoriented and super responsive.

– Chambers

Contact us

Jacob A. Møller

PARTNER +47 928 80 017 jam@bahr.no

Eirik Basmo Ellingsen

PARTNER +47 920 88 112 eiell@bahr.no

39