Privacy news archive
Every daily Privacy Prep briefing on privacy, data protection and AI governance. Free to read.
October 2026
September 2026
- UK Information Tribunal strikes out applicant's complaint against the Information Commissioner
- DPC Ireland publishes AI Insights Report detailing supervision of AI products and services from 2021 to 2025
- CNIL closes injunction against SOLOCAL MARKETING SERVICES after 900,000 euro fine for consent failures
- FBI investigates claims of widespread agent data theft
- OpenAI AI agents uploaded user images to third party sites
- Fundamental Rights Impact Assessment (FRIA) for high risk AI systems becomes mandatory by 1 December 2027
- ICO governance changes confirmed for 30 September 2026
- Spanish DPA Fines Securitas Direct EUR 100,000 for Obstructing Data Subject Rights
- Irish DPC fines Google €403 million for unlawful location data processing
- The Dutch DPA reviews a draft Platform Work Act on automated monitoring of platform workers
- Organisations must conduct FRIAs by 1 December 2027
- Fundamental Rights Impact Assessment (FRIA) becomes mandatory for high risk AI systems by 1 December 2027
- EU AI Act obligations for high risk AI embedded in regulated products apply by 2 August 2027
- ICO to become Information Commission by 30 September 2026
- ICO fines Elderly Aids Ltd £190,000 for nuisance calls targeting vulnerable individuals
- Spanish DPA receives first data breach notification caused by AI agent attack
- Comments on Privacy Commissioner of Canada's guidance for businesses working with third party service providers, responses are due 4 December 2026
- ICO blog post addresses inappropriate access to patient data in healthcare
- CNIL Fines EXTIA EUR 300,000 for Failures in Data Subject Rights Exercise
- Privacy Commissioner of Canada publishes guidance for businesses on third party service providers
- Designated VLOPs and VLOSEs must meet full DSA obligations by 1 January 2027
- DPC welcomes prosecution outcome for Brown Thomas Arnotts Limited over marketing offences
- Dutch DPA to monitor municipal registration of scan cars in algorithm registers from July 1
- Dutch DPA finds businesses unprepared for handling algorithms and AI, will provide guidance
- French CNIL Fines Hôpital Privé de la Loire EUR 500,000 for Health Data Violations
- FTC Orders Payment Processor Nuvei to Pay $4.85 Million for Facilitating Merchant Fraud
- ICO Emphasises Strong Data Protection Governance for Facial Recognition in Policing
- Data Protection Commission Fines HSE EUR 645,000 for Personal Data Breaches in Paper Records
- Call for tenders: Study on how online marketplace design influences user behaviour by 23 September 2026
- Pilot for Fundamental Rights Impact Assessment (FRIA) for AI Systems by 21 September 2026
August 2026
- EDPB issues final guidelines on processing personal data with blockchain technologies
- Stakeholder event on guidelines on the interplay between data protection and competition law by 15 September 2026
- Australian Privacy Regulator Reviews Transparency Practices
- Application deadline for AP's FRIA pilot by 21 September 2026
- Meta to Pay Up to $17.1 Billion and Implement Child Safety Reforms Following Multistate Settlement
- CNIL Fines NEXPUBLICA FRANCE EUR 1.7 Million for Insufficient Data Security Measures Leading to Breach
- Dutch Regulator Fines Uber EUR 824.99 million for Automated Driver Deactivation Violations
- Organisations planning to deploy high risk artificial intelligence systems in the Netherlands must apply to the
- Dutch regulator pilot lets organisations shape AI Act fundamental rights reporting
- Deadline for participation in AP's FRIA pilot programme by 21 September 2026
- ICO research highlights growing gap between parental confidence and children's digital reality
- Uitvoeringswet dataverordening (Data Regulation Implementation Act) in effect by 21 November 2026
- Dutch Data Protection Authority to Oversee Data Act Compliance, Focusing on Connected Products
- Public Comment Request for Privacy International Civil Aviation Organisation (ICAO) Address by 25 August 2026
- Stockport NHS Foundation Trust Undergoes Follow Up Data Protection Audit by ICO
- European Health Data Space begins to apply by 26 March 2027
- ICO reprimands ACRO Criminal Records Office for UK GDPR security failings after cyber incident affecting 10,000 data subjects
- EU Data Act cloud switching charges must be withdrawn by 12 January 2027
- 30 October 2026: EDPB draft guidelines on AI web scraping close for consultation
- CNIL sets a decision making test for when a second role disqualifies the DPO
- Irish Data Protection Commission to publish guidance on EU AI Act compliance
- AI Therapy Systems Under Scrutiny by EU AI Act
- Department for Work and Pensions Breaches FOIA by Failing to Disclose Information and Respond Within Statutory Timeframe
- ICO Welcomes Upper Tribunal Decision Dismissing TikTok's Appeal on Special Purposes Provisions
- EDPB Publishes Draft Guidelines on Anonymisation for Public Consultation
- EDPB requests review of EU-US Data Privacy Framework following US Supreme Court decision on independent agencies
- State and Federal Developments in Minors' Privacy in 2026 Highlight Emerging Regulatory Approaches
- ICO Executes Search Warrants in Car Finance Nuisance Marketing Crackdown
- European Commission begins enforcing AI Act rules and transparency requirements
July 2026
- EDPB and European Commission to Host Stakeholder Event on Data Protection and Competition Law Interplay
- FTC and States Act Against Hims & Hers for Deceptive and Unlawful Privacy Practices
- EDPB consults on draft anonymization and AI web scraping guidelines
- FTC takes action against Elite Events for violating Better Online Ticket Sales Act
- Italian Garante fines Lusha EUR 2 million for unlawful data processing and sale of personal data
- DentaQuest Notifies 15 Million Individuals of May 2026 Cyber Incident
- CNIL Publishes Guidance on Implementing 'Pixel' Tracking Recommendations in Emails
- Google fined $1 billion by EU for antitrust violations related to search services and Play Store steering
- CalPrivacy Initiates First CCPA Compliance Audit Targeting Gig Economy Tech Platforms
- FTC Permanently Bans Student Loan Forgiveness Scammer from Debt Relief and Telemarketing
- AliExpress fined almost $630 million for illegal product sales under EU DSA
- Atrium Health Settles Pixel Tracking Lawsuit for Up to $1.8 Million
- 23andMe Fined $18 Million by NY Attorney General for Genetic Data Breach
- Illinois Enacts Comprehensive AI Safety and Transparency Law, Mandating Third-Party Audits for Frontier AI Developers
- OpenAI's GPT-5.6 Deletes User Files, Citing 'Honest Mistakes' and 'Misaligned Behavior'
- Australian Privacy Commissioner finds Qantas not in breach despite massive data leak from tech support scam
- Canada Proposes Comprehensive Online Safety Regime for Social Media and Chatbots, Including Child Social Media Ban
- Canada Proposes Social Media Ban for Children Under 16 and Chatbot Regulation
- AI Agents Vulnerable to Image Based Prompt Injection Attacks
- AI Agents Vulnerable to Image Based Prompt Injection Attacks
- EU Data Protection Authorities Address Anonymization and Data Scraping for Generative AI
- EU 'Chat Control' Proposal Reemerges Amidst Renewed Concerns Over Mass Surveillance
- Massive Driver's License Data Leak Exposes Millions of Citizens
- Predatorgate Victims Seek €8M in Damages from Spyware Vendor
- EU Demands Action as Spyware Inquiry MEP's Phone Compromised by Pegasus
- Financial Institutions Lagging on Essential MFA Practices, Exposing Customer Accounts to Risk
- AI-Powered Ransomware Attacks Emerge, Automating Entire Exploitation Process
- AI Hallucination Leads to False Espionage Accusation and Lawsuit Against Cybersecurity Vendor
- AI Hallucination Leads to False Espionage Accusation and Lawsuit Against Cybersecurity Vendor
- Supreme Court Reinforces Privacy Rights Against Geofence Warrants
- French Privacy Regulator Publishes Recommendations for Location Data in Connected Vehicles
June 2026
- Supreme Court Upholds Privacy Rights Against Geofence Warrants
- Massive Data Breach Impacts 14.2 Million Email Accounts Across Multiple ISPs
- AI Revolutionizes Vulnerability Discovery, Posing New Challenges for Cybersecurity Teams
- G7 Data Protection Authorities Forge Key Principles for Emerging Technologies and Children's Privacy
- London Police Implement Live Facial Recognition Technology in West End
- Nation state actors compromise Australian critical infrastructure, posing existential threat
- Significant Health Data Breach Impacts 1.4 Million Individuals
- Five Eyes Alliance Warns AI Amplifies Cybersecurity Risks to Critical Infrastructure
- Texas Government Vendor Breach Exposes Data of Millions of Citizens
- Amazon's Stance on Human in the Loop AI Governance Sparks Industry Debate
- UK Privacy Watchdog Resigns Amidst Controversy, Signaling Governance Challenges
- Texas Government Data Breach Exposes Millions of Driver's Licenses and Passports
- Massive Fortinet Firewall Breach Exposes VPN Credentials of Tens of Thousands of Organizations
- Cardiac Device Manufacturer Suffers Data Breach Exposing Patient Information
- Council of Europe Hit by ShinyHunters Data Breach via PeopleSoft Vulnerability
- French Government Reports Data Breach Affecting Over 73,000 Employees' Secure Messaging Accounts
- US Government Intervenes in AI Model Access, Raising Global Data Governance Questions
- Novo Nordisk Reports Cyberattack Leading to Theft of Clinical Trial Data
- Oracle PeopleSoft Zero Day Exploited in Over 100 Company Breaches by ShinyHunters
- Chinese State Actors Linked to Expanding Botnet Activity and AI Data Center Security Concerns
- Signal Warns UK Device Scanning Proposal 'Endangers All' Privacy and Security
- Massachusetts Legislates Against Sale of Precise Location Data
- OpenAI Introduces Enhanced Data Protection with New Lockdown Mode for Sensitive Data
- OpenAI Introduces Lockdown Mode to Combat Prompt Injection Attacks
- World Food Programme Data Breach Exposes 600,000 Vulnerable Gazan Families
- Dental Insurer DentaQuest Data Breach Exposes 2.6 Million Accounts
- Ultrahuman Data Breach Exposes Customer Wellness Data Via Internal Tool
- Russian Spy Agency Alleges Foreign Surveillance via Officials' Smartphones
- Hackers Exploit Meta AI Support Chatbot to Hijack Instagram Accounts
- California Seeks Accountability for 23andMe Data Breach Following Ownership Change
May 2026
- ShinyHunters Group Breaches Charter Communications and Carnival, Exposing Millions of Customer Records
- California Attorney General Sues 23andMe Over 2023 Data Breach Exposing Genetic and Health Information
- Military Personnel Targeted by Adversaries Using Location Data, Raising National Security Concerns
- UK Visa Portal Data Breach Exposes Passport and Selfie Data, Raises Urgent Privacy Concerns
- UK Visa Portal Exposes Thousands of Applicants' Sensitive Personal Data, Remains Unpatched
- Trump Mobile Confirms Significant Customer Data Exposure
- New Linux Vulnerabilities Signal Emerging Security Threats
- Personal Data Exposure Confirmed for Trump Mobile Customers
- Police Shut Down Major VPN Service Used by Ransomware Groups
- London Police Request Over 700,000 Pieces of Communications Data from Big Tech in Single Year
- US Cyber Agency CISA Exposed Sensitive Credentials on Public GitHub Repository
- Grafana Labs Codebase Compromise Raises Supply Chain Security Concerns
- Hotel Check-in System Exposes Over a Million Passport and Driver's License Records
- OpenAI Confirms Data Theft Following Supply Chain Attack
- US Lawmakers Demand Answers Following Persistent Data Breaches of Educational Platform Canvas
- US Bank Discloses Incident Involving Customer Data Shared with Unauthorized AI Application
- General Motors Agrees to Substantial Settlement for California Driver Data Sale
- Meta Reverses Course on Instagram Encryption, Raising Privacy Concerns
- Meta Reverses Encryption Plans for Instagram Direct Messages, Opting for Plaintext
- Meta Reverses Course on Instagram End to End Encryption Amid Regulatory Scrutiny
- CNIL Hosts G7 Roundtable on Data Protection and Privacy for 2026
- UK Age Verification Plans Threaten Internet Openness and User Privacy
- FTC Moves to Permanently Ban Data Broker Kochava from Selling Location Data
- US Healthcare Marketplaces Exposed Sensitive Citizenship and Race Data to Ad Tech Giants
- International Intelligence Agencies Unanimously Caution Against Rapid Deployment of Agentic AI
- AI-Driven Phishing Campaigns Become Prevalent, Escalating Cyber Threats
- Critical cPanel Vulnerability Exposes Millions of Websites to Exploitation
- AI-Enhanced Phishing Campaigns Increase Sophistication and Frequency
April 2026
- US Supreme Court Hears Arguments on Geofence Search Warrants and Fourth Amendment Rights
- Healthcare and Utility Sector Face Significant Data Breaches
- UK Government Faces Scrutiny for Excluding Media from Digital ID Consultation
- Medical Data of Half a Million UK Biobank Volunteers Allegedly Offered for Sale Online
- French Government Agency Experiences Large Scale Data Breach Affecting Citizen IDs
- UK Biobank Medical Data of 500,000 Volunteers Offered for Sale on Alibaba
- France's National Identity Agency Probes Data Breach Affecting 19 Million Records
- Concerns Mount Over Warrantless US Surveillance Laws Nearing Expiration
- Anthropic's Claude Desktop App Accused of Invasive Browser Data Collection
- Vercel Confirms Data Breach Impacting Customer Credentials
- US Lawmakers Grapple with Warrantless Surveillance as Spy Laws Near Expiration
- US Lawmakers Divided on Reauthorizing Expiring Spy Laws Amid Warrantless Surveillance Concerns
- EDPB Issues Opinion Clarifying Rules for 'Consent or Pay' Models
- EDPB Clarifies 'Main Establishment' for AI Act's Centralised Supervision
- EDPB Clarifies Consent Requirements for 'Pay or Okay' Models