EU
- The European Data Protection Board released a statement on data protection challenges posed by smart glasses, emphasising transparency and GDPR requirements.
- Germany’s BMI, BMDS and BSI jointly published guidelines on transitioning to post-quantum cryptography, implementing the EU roadmap to strengthen security against future quantum computing threats.
- Italy’s Garante fined a healthcare research company EUR 7 million for unlawfully processing health data relating to approximately one million patients.
- Spain’s AEPD published guidance on transparency and data protection safeguards for algorithmic systems used in workplaces, clarifying how Royal Decree 723/2026 interacts with GDPR requirements.
- Ireland’s DPC found Children’s Health Ireland in breach of GDPR requirements on security and confidentiality of children’s health records and ordered corrective measures.
- Poland’s Council of Ministers adopted a draft law designating the Office of Electronic Communications as the national authority to supervise and enforce the EU Data Act.
- Norway’s Datatilsynet fined an advertising technology company NOK 92 million for unlawfully sharing sensitive personal data without a valid legal basis.
Americas
- Canada’s OPC updated its guidance on recording customer calls, clarifying consent requirements and safeguards for processing voice data.
- Iowa’s Attorney General filed a lawsuit against a security company over security concerns in its surveillance cameras and misleading privacy claims.
- Maryland’s Protection from Predatory Pricing Act entered into force, restricting food retailers and delivery service providers to set personalised pricing based on consumers’ personal data.
- New Mexico’s Attorney General announced a proposed Frontier AI Safety and Accountability Act that will require safety disclosures, incident reporting and stronger accountability requirements.
- South Carolina’s Attorney General requested information from a safety company regarding AI use, restrictions on data access and data retention practices.
APAC
- Malaysia’s Personal Data Protection Department launched a public consultation on a proposed AI and Personal Data Protection Framework.
- Japan’s Personal Information Protection Commission issued an advisory for companies to strengthen data security safeguards and delete unnecessary personal and sensitive data in response to a chain of large-scale personal data breaches.
- Australia’s OAIC launched an investigation into the privacy practices of a smart glasses app, focusing on collection, access and storage of personal information.
Middle East and Africa
- Saudi Data and AI Authority launched public consultation on proposed amendments to the Implementing Regulation of the Personal Data Protection Law.
- Turkey published a new regulation in the Official Gazette that requires age verification and bans minors from using social media platforms.
- Mozambique’s Cybersecurity Law and Cybercrime Law entered into force, strengthening the legal framework for cybersecurity, incident response and combating cybercrime.
- South Africa’s Consumer Commission launched an Opt-Out Registry to protect consumers from unsolicited direct marketing communications.
