Data Protection News

🇬🇧

The Home Office updated Immigration Enforcement's live facial recognition legal mandate as the programme moves from proof of concept to a pilot.

29 October 2026 Policy

🇬🇧

The ICO updated its detailed special-category data guidance to reflect the Data (Use and Access) Act 2025 and clarify current UK compliance requirements.

29 October 2026 Guidance

🇫🇷

France's CNIL fined two FNAC companies €7 million for using an app tracker without consent to collect browsing activity for recommendations and algorithm training.

29 October 2026 Enforcement

🇭🇰

The PCPD advises smart-glasses users to provide notice, avoid recording in private places, minimise collection, secure data and delete it when no longer needed.

27 October 2026 Guidance

🇦🇺

Australia's privacy regulator received 667 breach notifications in January-June 2026, with a marked increase in incidents affecting large populations.

26 October 2026 Research

🇨🇦

Loblaw accepted monitored security, assessment and notification commitments while Canada's Privacy Commissioner keeps its PIPEDA investigation open.

26 October 2026 Enforcement

🇺🇸

A state court imposed a $25 billion civil penalty after a jury found nearly 43.9 million violations involving Meta's representations about privacy, third-party data access and other platform practices.

21 October 2026 Judgment

🇬🇧

The ICO reprimanded the Metropolitan Police and issued an enforcement notice over officers' use of an unapproved retail-crime intelligence platform.

14 October 2026 Enforcement

🇪🇺

The EDPB says discreet recording, unclear signals and connected services create transparency, accountability and rights risks for users and bystanders.

13 October 2026 Guidance

🇮🇹

The Garante sanctioned Wind Tre for unlawful promotional contacts, contracts activated without individuals' knowledge and deficient sales-network controls.

12 October 2026 Enforcement

🇬🇧

Ten major AI developers made or committed to privacy changes, while the ICO opened an agentic-AI call for evidence closing on 20 November 2026.

8 October 2026 Policy

🇮🇳

S.O. 5458(E) makes two textual corrections to DPDP Act sections 9 and 10 concerning protected persons and Significant Data Fiduciary audits.

5 October 2026 Regulation

🇮🇹

Italy's data protection authority fined IQVIA EUR 7 million after finding that a database covering about one million patients was not anonymous and was operated without an adequate legal basis and safeguards.

2 October 2026 Enforcement

🇺🇸

Four enacted bills expand CCPA deletion coverage, protect privacy settings, accelerate broker deletion processing and narrow specified online CIPA claims.

30 September 2026 Legislation

🇬🇧

TikTok withdrew two appeals, accepting the ICO's £12.7 million 2023 penalty for children's-data violations and ending its challenge to a separate information notice.

24 September 2026 Enforcement

🇪🇸

The EDPB published a summary of a 2023 AEPD decision fining Securitas Direct €100,000 for directing people to a chargeable 902 number to exercise access and objection rights.

22 September 2026 Enforcement

🇪🇺

The EDPB proposed a common five-step method for deciding whether to fine and finalised guidance on the interaction between the DSA and GDPR.

21 September 2026 Guidance

🇮🇪

Ireland's DPC fined Google €403 million for GDPR infringements involving location data processed through Web & App Activity, Location History and Location Accuracy.

21 September 2026 Enforcement

🇯🇪

The Jersey, Guernsey and Isle of Man data-protection authorities issued joint guidance on covert recording, cloud transfers, workplace controls and DPIAs for smart glasses.

16 September 2026 Guidance

🇯🇵

Japan's privacy regulator adopted a multi-stakeholder process for preparing Cabinet orders, Commission rules and guidance under the July 2026 APPI amendments.

9 September 2026 Policy

🇦🇺

Yarra City Council endorsed an investigation into banning smart glasses at council leisure centres, childcare centres and playgrounds, with disability-related carve-outs to be considered.

9 September 2026 Policy

🇫🇷

France's CNIL published a €300,000 fine against EXTIA for failures to handle and report back on erasure requests under GDPR Articles 12 and 17.

9 September 2026 Enforcement

🇪🇺

The European Group on Ethics urged the EU to treat neurodata and related inferences as specially protected data and assess whether existing GDPR, AI and product rules adequately govern neuro-AI systems.

8 September 2026 Policy

🇪🇺

A joint EU study identifies 10 emerging technologies and calls for skills, forensic capacity and governance that balance access to electronic evidence with privacy rights.

8 September 2026 Research

🇴🇲

Royal Decree 68/2026 changes Oman's data-protection law on territorial scope, exemptions, consent and automated processing, effective 7 September 2026.

6 September 2026 Legislation

🇬🇧

Natural Resources Wales said a spreadsheet containing diversity-monitoring information about current and former employees was inadvertently published and reported to the ICO.

4 September 2026 Breach

🇺🇸

Delaware enacted HB 381 to clarify when businesses must notify the Attorney General of a computer security breach.

4 September 2026 Legislation

🇺🇸

Delaware enacted HB 380, expanding coverage, sensitive-data protections, third-party controls and profiling duties from 1 January 2027.

4 September 2026 Legislation

🇺🇸

The D.C. Circuit denied an emergency stay, leaving in place a judgment that set aside the expanded SAVE citizenship-verification system while the appeal proceeds.

4 September 2026 Judgment

🇪🇺

A 3 September Council compromise text addresses pseudonymised data and cookie-consent exemptions, but remains a negotiating document rather than EU law.

3 September 2026 Policy

🇪🇺

The Advocate General considered broad Belgian traffic and location-data retention disproportionate while outlining strict technical conditions that could affect future retention regimes.

3 September 2026 Judgment

🇪🇺

The Court held that EU law does not require disclosure of all public-company shareholders and that unrestricted online access to their personal data is disproportionate.

3 September 2026 Judgment

🇮🇹

Italy's Garante fined Fabrizio Corona €4,950 after finding that publishing private audio and chat extracts lacked genuine public interest and breached data-protection rules.

3 September 2026 Enforcement

🇫🇷

France's CNIL fined Hôpital Privé de la Loire €500,000 for inadequate security and failure to notify more than 202,000 affected trusted contacts directly.

3 September 2026 Enforcement

🇺🇸

The US FTC extended by seven days the comment period for a proposed enforcement policy on companies using personal data to set individualized prices.

3 September 2026 Policy

🇺🇸

CalPrivacy's Enforcement Advisory 2026-01 says data brokers can incur daily penalties while incorrect information remains in California's registry.

3 September 2026 Guidance

🇮🇪

The regulator found security, storage-limitation and breach-notification failures after unauthorised access to records at external facilities.

2 September 2026 Enforcement

🇺🇸

SalesIntel must pay $36,400, publish rights metrics and process DROP requests after operating without timely California data-broker registration.

1 September 2026 Enforcement

🇧🇷

Brazil's ANPD opened Tomada de Subsídios 05/2026 on its proposed 2027-2030 Regulatory Result Evaluation Agenda, with comments due 16 October 2026.

1 September 2026 Policy

🇧🇷

Brazil's ANPD opened Tomada de Subsídios 04/2026 for public input on its proposed 2027-2028 regulatory agenda through 16 October 2026.

1 September 2026 Policy

🇦🇺

Australia opened consultation on draft privacy reforms covering fair-and-reasonable processing, erasure, consent and personal-data trading, with submissions due 18 September 2026.

31 August 2026 Policy

🇰🇷

The PIPC announced passage of a Personal Information Protection Act amendment intended to govern and enable personal-data use in AI development.

27 August 2026 Legislation

🇺🇸

Azul Vision paid $50,000 and accepted two years of monitoring after providing requested records almost two years after the initial request.

27 August 2026 Enforcement

🇺🇸

Cox Media Group and two firms must pay $930,000 after claiming an ad service listened to smart-device conversations and that consumers had opted in, though it did neither.

27 August 2026 Enforcement

🇳🇱

The regulator imposed a €824.99 million penalty concerning automated decisions that blocked drivers from the platform.

21 August 2026 Enforcement

🇺🇸

A federal court temporarily restrained acquisition of a state-owned driver database containing names, birth dates and Social Security numbers while a multistate challenge proceeds.

20 August 2026 Judgment

🇻🇳

Decrees 333/2026 and 330/2026 took effect on 19 August, adding cybersecurity implementation duties and an administrative-penalty framework covering personal-data protection.

19 August 2026 Regulation

🇯🇵

The regulator announced action under the APPI involving KDDI and internet service providers and issued a related warning to email-service users.

19 August 2026 Enforcement

🇬🇧

Unclear patch responsibility and failure to act on alerts left data of up to 10,920 people, including criminal and biometric information, at risk.

12 August 2026 Enforcement

🇺🇸

LocateSmarter was fined $116,490 after late registration and requiring partial Social Security numbers before Californians could opt out.

11 August 2026 Enforcement

🇰🇷

The regulator found deficient femtocell access controls allowed nearly a year of unauthorised internal-network access and ordered security and governance changes.

7 August 2026 Enforcement

🇺🇸

OSF paid $552,250 and accepted two years of monitoring after a ransomware incident exposed health information of 53,907 people.

29 July 2026 Enforcement

🇺🇸

The complaint alleges the telehealth provider sent sensitive condition-related data to Meta, Snap and others despite privacy promises, alongside subscription-practice claims.

29 July 2026 Enforcement

🇺🇸

The regulator's first sectoral audit will test whether major gig platforms honor access and control rights for consumers and independent-contractor workers.

21 July 2026 Enforcement

🇮🇳

An official Aadhaar-governance register records approval for voluntary Aadhaar authentication when users log in to and file complaints through the Data Protection Board's digital office portal.

20 July 2026 Policy

🇯🇵

The reform expands cessation rights for certain biometric-related data, adds an administrative monetary-charge regime and adjusts consent rules for specified statistical disclosures.

17 July 2026 Legislation

🇪🇺

Member States may publish names and sanction details, but the controller must balance interests, limit duration and allow a preventive DPA complaint.

14 July 2026 Judgment

🇺🇸

A 43-jurisdiction coalition resolved claims arising from the 2023 breach affecting 6.9 million users and imposed new security, deletion and governance requirements.

14 July 2026 Enforcement

🇪🇺

Making unedited public criminal-conviction documents available online for payment is not automatically journalistic processing under GDPR Article 85.

9 July 2026 Judgment

🇺🇸

The FTC and DOJ alleged RentGrow duplicated criminal and eviction records, omitted data sources from disclosures and mishandled disputes in tenant screening.

9 July 2026 Enforcement

🇪🇺

New draft guidance addresses when data are anonymous and the GDPR conditions for AI web scraping, while the blockchain guidance became final.

8 July 2026 Guidance

🇺🇸

The FTC and DOJ alleged Amazon repeatedly failed to provide identity-theft victims with transaction records within the FCRA's 30-day deadline.

30 June 2026 Enforcement

🇺🇸

A federal stipulated order restricts Kochava and its subsidiary from selling or disclosing location data capable of tracing visits to sensitive places without consumer consent.

26 June 2026 Enforcement

🇪🇺

The Court held that judges must comply with the GDPR when processing third-party data, while unlawful collection does not automatically make the evidence unusable under EU law.

18 June 2026 Judgment

🇪🇺

The Court addressed how GDPR Articles 77 and 79 operate in parallel and how national procedure must manage the risk of contradictory decisions.

18 June 2026 Judgment

🇺🇸

The employer-sponsored health plan paid $200,000 and accepted two years of monitoring after OCR identified potential HIPAA risk-analysis and disclosure violations.

18 June 2026 Enforcement

🇰🇷

The regulator found key-management, access-control, notification, deletion, governance and behavioural-data violations, alongside separate CFS findings.

17 June 2026 Enforcement

🇮🇪

The decision followed a ransomware attack affecting laboratory systems and potentially about 84,000 people, including sensitive clinical information.

15 June 2026 Enforcement

🇨🇦

The federal Commissioner found X and xAI violated PIPEDA after launching image generation without safeguards adequate to prevent non-consensual sexualised depictions.

11 June 2026 Enforcement

🇦🇺

Optus failed to take reasonable steps to keep phone numbers unlisted despite customers expressing that preference during number porting.

11 June 2026 Enforcement

🇪🇺

The common form aims to reduce fragmented notification practices and make cross-border GDPR breach reporting more consistent.

10 June 2026 Guidance

🇺🇸

Illuminate must delete unnecessary data, limit collection and retention and operate a security programme after a breach exposed data concerning 10.1 million students.

5 June 2026 Enforcement

🇪🇺

The Board resolved an Article 65 dispute concerning Belgian public broadcaster VRT, requiring the competent authority to align its final action with the binding decision.

28 May 2026 Enforcement

🇫🇷

The French regulator sanctioned IQVIA over safeguards intended to limit risks to individuals in the processing of health data.

28 May 2026 Enforcement

🇳🇿

The regulator concluded its inquiry into the patient-portal cyber incident with breach findings concerning the platform and the public health body.

27 May 2026 Enforcement

🇺🇸

Covered platforms must operate a removal process and remove validly reported intimate images and known identical copies within 48 hours under the TAKE IT DOWN Act.

19 May 2026 Legislation

🇧🇪

SWDE was penalised for deficient transparency, objection handling and processor contracting in its recording and monitoring of customer calls.

12 May 2026 Enforcement

🇬🇧

The breach compromised data of 633,887 customers and employees after initial access went undetected for almost two years.

11 May 2026 Enforcement

🇺🇸

LG agreed to stop using automated content recognition to collect Texans' viewing data without informed consent, clearer disclosures and a simple opt-out.

11 May 2026 Enforcement

🇮🇪

The bank was sanctioned for inadequate call-centre security and failing to notify three impersonation-related breaches within 72 hours.

8 May 2026 Enforcement

🇳🇱

The Dutch regulator imposed a €100 million GDPR penalty on Yango in a decision concerning the taxi app's processing of driver and passenger data.

8 May 2026 Enforcement

🇺🇸

California alleged GM retained and sold location and driving data without adequate knowledge or consent, securing a $12.75 million penalty and deletion, consent and governance terms.

8 May 2026 Enforcement

🇨🇦

The joint investigation identified overcollection, invalid consent, transparency and accuracy concerns and shortcomings in access, correction, deletion and accountability.

6 May 2026 Enforcement

🇮🇳

MeitY invited applications for one chairperson and four members of the Data Protection Board of India, advancing the new enforcement body's staffing.

6 May 2026 Policy

🇭🇰

An outdated remote-access tool, weak authentication and obsolete antivirus and firewall controls contributed to exposure affecting 9,045 people.

23 April 2026 Enforcement

🇺🇸

Four organizations paid a combined $1.165 million and accepted two-year corrective plans after OCR investigations into ransomware breaches and risk-analysis failures.

23 April 2026 Enforcement

🇮🇳

MeitY proposed amendments that would make compliance with Ministry directions part of intermediary due diligence and broaden digital-media oversight, later adding continuous synthetic-content labels.

21 April 2026 Policy

🇪🇺

Guidelines 1/2026 propose six indicators for scientific research and address legal bases, special-category data, transparency and data-subject rights.

16 April 2026 Guidance

🇪🇺

The common template is designed to improve consistency and provide a practical structure for assessing high-risk processing under GDPR Article 35.

14 April 2026 Guidance

🇺🇸

The FTC alleged OkCupid gave an unrelated company access to nearly three million user photos plus location data contrary to its privacy promises and without formal use restrictions.

30 March 2026 Enforcement

🇪🇺

The Court held that Article 15 access may be refused under Article 12(5) where the sole purpose is to manufacture a damages claim, subject to proof by the controller.

19 March 2026 Judgment

🇬🇧

Police extracted a complainant's entire phone, disclosed irrelevant sensitive material without adequate redaction and notified the breach late.

11 March 2026 Enforcement

🇺🇸

HHS OCR settled with software business associate MMG Fusion over an unreported incident affecting about 15 million people and imposed a three-year corrective plan.

5 March 2026 Enforcement

🇺🇸

CalPrivacy's first student-and-schools decision required PlayOn Sports to pay $1.1 million and change privacy practices across its GoFan and school-sports services.

3 March 2026 Enforcement

🇸🇬

The matters identify unpatched systems, weak access controls, missing MFA, outdated software and inadequate monitoring across several sectors.

26 February 2026 Enforcement

🇺🇸

Samsung agreed to stop collecting or processing automated-content-recognition viewing data from Texas consumers without express consent and clearer disclosures.

26 February 2026 Enforcement

🇬🇧

The regulator found Reddit processed under-13s' data without a lawful basis, lacked robust age assurance and failed to complete a timely DPIA.

24 February 2026 Enforcement

🇺🇸

HHS OCR began accepting complaints and breach reports under 42 CFR Part 2 from 16 February 2026, with civil remedies aligned to HIPAA enforcement.

13 February 2026 Regulation

🇪🇺

The joint opinion supports targeted simplification but warns that parts of the proposal affecting GDPR, ePrivacy and the EU data acquis could reduce protection or legal certainty.

11 February 2026 Policy

🇺🇸

California alleged Disney failed to apply sale-and-sharing opt-outs across linked devices and streaming services, requiring a $2.75 million penalty and account-wide controls.

11 February 2026 Enforcement