Issue 321

APAC

  • The Reserve Bank of India published draft guidance on regulatory principles for managing risks associated with AI, third-party models and the model lifecycle.
  • South Korea’s PIPC imposed penalties on an e-commerce company and affiliates for data breaches and privacy violations.
  • China’s CAC, Ministry of Industry and IT and Ministry of Public Security jointly issued measures governing network data security risk assessments.

Europe

  • The European Data Protection Board launched a public consultation on a common template for notifying personal data breaches.
  • UK’s ICO published final guidance on data protection compliance for consumer Internet of Things (IoT) products and services.
  • Italian data watchdog fined an airline EUR 180,000 for transparency and data retention violations involving passengers’ health information.
  • Norway’s Datatilsynet published a regulatory sandbox report on developing privacy-friendly AI chatbots for public-sector websites.
  • Latvia enacted amendments to its National Cybersecurity Act, strengthening cybersecurity governance and security requirements.
  • Portugal’s Cybersecurity Centre issued regulation establishing a cybersecurity framework under NIS2.
  • The Netherlands’ Authority for Consumers and Markets introduced stricter telemarketing rules requiring prior customer consent.
  • The European Commission published a code of practice on the marking and labelling of AI-generated content.

Middle East

  • UAE adopted a Cabinet Resolution regulating children’s access to social media platforms through age-verification requirements.
  • The Dubai International Financial Centre launched a public consultation on proposed amendments to the Data Protection Regulations.

Americas

  • U.S. senators introduced the Stopping Illegal Minor Simulations (SIMS) Act in the Parliament.
  • The New York Assembly passed legislation prohibiting AI companion features considered unsafe for minors.
  • Canada’s OPC found a technology company in violation of the PIPEDA for generating harmful synthetic imagery using AI.
  • The U.S. Court of Appeals stayed injunctions that prevented Texas’ App Store Accountability Act from taking effect.
  • Florida’s AG sued a social media platform for allegedly violating the state’s online child protection law and misleading parents about its safety practices.
  • Vermont Governor signed legislation strengthening the regulation of data brokers and enhancing protection of personal information.