Issue 316

APAC

  • The Securities and Exchange Board of India issued an advisory on cybersecurity risks associated with advanced AI-powered vulnerability detection tools.
  • China’s Ministry of Industry and IT released a national classification standard for AI terminals, establishing intelligence levels and evaluation criteria.
  • Australia’s Office of Information Commissioner published updated guidance on the collection of solicited personal information.
  • Vietnam’s government approved the National Standards Strategy for 2026-2035.
  • South Korea’s PIPC fined a funeral services company KRW 553.9M for a personal data breach and failures to implement adequate security measures.

EMEA

  • The European Data Protection Board published an opinion on Finland’s proposed accreditation requirements for GDPR certification bodies.
  • UK’s ICO fined a water services company GBP 963,900 for data security failures following a cyberattack and personal data breach.
  • Germany’s BfDI and partner authorities released a roadmap clarifying the application of EU AI Act for AI-enabled medical devices.
  • France’s CNIL published recommendation on use of personal data for creditworthiness assessment, including guidance on automated decisions.
  • The EU Council and Parliament reached a provisional agreement to streamline certain rules in the EU AI Act.
  • Ireland’s DPC imposed EUR 277,500 fine on a bank for data security deficiencies and failure to timely notify personal data breaches.
  • Belgium’s DPA fined a fintech company EUR 120,000 for incorrectly classifying itself as a data processor and failing to meet data controller obligations.
  • The European Commission adopted a recommendation establishing an EU-wide framework for age verification technologies.
  • Poland’s Ministry of Digital Affairs notified entities of new compliance obligations under the amended National Cybersecurity System Act.
  • Turkish Data Protection Authority publishes a data breach notification involving a hospitality company.

Americas

  • The U.S. Federal Trade Commission urged companies ensure compliance with the Take It Down Act.
  • Colorado Legislature advanced amendments to the Colorado AI Act, refining compliance requirements for high-risk AI systems.
  • Brazil’s ANPD published preliminary guidance and implementation timeline for age verification under the Digital ECA framework.
  • California’s AG secured USD 12.75 million settlement with an automotive manufacturer over the unlawful sale of drivers’ location and driving data.
  • The U.S. Cybersecurity and Infrastructure Security Agency launched CI Fortify initiative to strengthen resilience of critical infrastructure.
  • Texas’ AG sued a streaming platform over alleged deceptive data collection practices, privacy misrepresentations and unlawful user profiling.
  • Illinois’ Senate Committee passed a bill on AI safety measures, establishing governance, transparency and audit requirements for frontier AI models.