Issue 327

EMEA

  • EU’s Cyber Resilience Act introduced Single Reporting Platform (SRP) for vulnerability and incident reporting in products with digital elements.
  • French CNIL issued guidance on data protection requirements for electronic invoicing, emphasising data minimisation, GDPR compliance and access controls.
  • Ireland’s DPC fined the Health Service Executive EUR 645,000 for GDPR violations relating to data security implementation, principle of data storage limitation and personal data breach reporting requirements.
  • Estonia’s new Information Security Standard came into force, strengthening requirements relating to risk management, system continuity and information security.
  • The UK Parliament’s Joint Committee on Human Rights called for new AI legislation, to address the extent and gravity of threats posed to human rights by artificial intelligence systems.
  • The Netherlands’ AP introduced mandatory publication of GDPR sanctions following amendments to the Implementation Act General Data Protection Regulation.
  • The CJEU held that unrestricted online publication of shareholders’ personal data is incompatible with EU law where access is not conditional upon demonstrating a legitimate interest.
  • Liechtenstein’s Data Protection Authority published its 2025 activity report, highlighting AI, cloud services, video surveillance and international data transfers as key areas of focus.
  • Turkey’s Personal Data Protection Authority issued guidance on the use of personal data obtained from third parties for advertising and marketing purposes.

Americas

  • New York’s Department of Financial Services issued guidance on cybersecurity risk assessments, outlining best practices for financial services entities.
  • A coalition of U.S. Attorneys General secured a preliminary injunction preventing the government from obtaining sensitive personal information of commercial drivers.
  • Colombia’s House of Representatives introduced a bill to amend Statutory Law 1581 of 2012 to strengthen the legal framework relating to the fundamental right to the protection of personal data.
  • Delaware Governor signed the House Bill 380, expanding the applicability of Personal Data Privacy Act and consumer rights.
  • California Department of Insurance advanced 10 legislations establishing privacy requirements for insurance consumers, covering the collection, use, retention and disclosure of personal information.
  • The Office of the Privacy Commissioner Canada issued guidance on assessing third-party service providers, emphasizing accountability, due diligence and appropriate safeguards.

APAC

  • Cyberspace Administration of China issued clarifications on cross-border transfers of personal information, including the thresholds for information protection certification and data export security assessments.
  • Personal Information Protection Commission in South Korea fined social media platforms KRW 10.3 billion for unlawfully collecting users’ behavioural data.
  • Vietnam issued an implementation plan for the Personal Data Protection Law, setting out measures for implementation of the new data protection framework.
  • National Privacy Commission of Philippines published a draft Circular on Data Subject Rights for public consultation.