Brian O’Donovan reports: Tech giant Google has been fined €403m by the Data Protection Commission (DPC) over the processing of location data. Under data protection rules, such information must be processed in a lawful, fair and transparent manner. The DPC said that its investigation into Google found failures in this regard meaning that people could...

Source

Dan Cooper, Jadzia Pierce, Kristof Van Quathem, Atli Stannard, Anna Sophia Oberschelp de Meneses, Diego Bonomo, John Bowers, Sam Jungyun Choi, and Laura Schukraft of Covington and Burling write: In recent months, children’s online safety and privacy have moved to the top of the EU’s digital agenda. The European Commission is expected to outline its...

Source

Nicholas Boyle, Claire Kermond, and Alexandra Moore of White & Case write: On August 31, 2026, the Australian Government released a Privacy Reform – Consultation Paper (the Consultation Paper) and an exposure draft of the Privacy Amendment (Personal Data Protection Bill) 2026 (Exposure Draft) detailing proposed changes to the Privacy Act 1988 (Cth) (the Privacy...

Source

Roxanne Libatique reports: A data breach affecting more than one million students, parents, and teachers across Australia and New Zealand has produced one of the clearest test cases the Australian cyber insurance market has seen for how patch-management obligations in policy wordings translate into real claims consequences. Online mathematics platform Mathspace confirmed on September 6,...

Source

DutchNews.nl reports: The Dutch’ healthcare inspectorate has found that the country’s only online abortion service fell short on its duties for care, but will let it keep operating after the site agreed to change its practices. Thuisabortus.nl, which launched in March, was the first service in the Netherlands to let women get the abortion pill prescribed...

Source

From the Autoriteit Persoonsgegevens (AP), the Dutch data protection agency: The streaming platform Twitch announced that Amazon is using Twitch users’ personal data to train AI models. Users who do not want Amazon to use their streams, images and other personal data can now opt out from this feature. The Autoriteit Persoonsgegevens (AP), the Dutch...

Jadzia Pierce and Virginie de France of Covington and Burling write: On August 14, 2026, the French Constitutional Council (the “Constitutional Council”) struck down Article 1 of France’s Act to protect minors from the risks posed by the use of social media (the “Act”), which would have barred minors under the age of fifteen from...

VOCM reports: The province’s Privacy Commissioner is recommending that public bodies consider providing the name of anyone involved in snooping-related privacy breaches to affected individuals. The recommendation comes after an employee of NL Health Services had a peek at a person’s health record. NLHS was notified. The Privacy Commissioner says the health authority took the appropriate steps...

Charmian Aw, Ciara O’Leary, and Florence Seow of Hogan Lovells Cadwalader write: Singapore’s Personal Data Protection Commission (“PDPC”) has issued its final Advisory Guidelines on Use of Personal Data in Generative AI (“Guidelines”), marking a significant development in Singapore’s AI governance framework. The Guidelines provide long-awaited clarity on how the Personal Data Protection Act 2012...

Joke Bodewits and Julian B. Flamant of Hogan Lovells Cadwalader write: On 13 July 2026, the Dutch Data Protection Authority (“AP”) published a practical self-assessment tool (“Tool”) and corresponding guidance document (“Guidance”) on generative AI systems. The Guidance outlines the AP’s expectations under the General Data Protection Regulation (“GDPR”) across the generative AI lifecycle, while...

Suzanne Smalley reports: The United Kingdom’s Supreme Court ruled Monday that Bahrain can’t hide behind state immunity to block a lawsuit filed by two dissidents alleging the government infected their devices with spyware. Saeed Shehabi and Moosa Mohammed allege Bahrain secretly installed FinSpy spyware on their laptops, likely in 2011. Government agents then spied on...

Matthew Dalton reports: A man kidnapped a 16-year-old girl at knifepoint in 1998 from the streets of La Rochelle, a port city in western France. He drove her to a wooded area and raped her, leaving her traumatized but alive. Over the next decade, four other girls and young women were sexually assaulted in similar settings...

Robert Booth reports: The UK information commissioner who resigned over sexual harassment and bullying claims is understood to be taking legal action against a woman who flagged his conduct. The science and technology secretary, Liz Kendall, said she was “appalled” by the fact that John Edwards was preparing to serve legal papers on one of the...

Jessica Murray reports: Facial recognition technology in shops will soon alert police in real time to the presence of serious offenders, with civil liberties groups warning of a “dangerous escalation” towards surveillance and criminalisation in the retail sector. Facewatch, a facial recognition system used by more than 100 businesses including Sainsbury’s, B&M and Spar to...

Suzanne Smalley reports: The European Parliament has voted to bring back a rule giving big tech permission to scan users’ messages to hunt for child sexual abuse material (CSAM), a process that critics call Chat Control. Thursday’s vote occurred the day before summer recess and was the product of an unusual legislative procedure requiring an...

The use of AI technologies has added to the risk of harm and privacy violations. The use of AI has also helped people file complaints with the data protection regulator. We may need a “It’s a blessing… and a curse” file for AI stories. Brian O’Donovan reports: The Data Protection Commission (DPC) has described as...

Hunton Andrews Kurth notes: As of June 19, 2026, organizations subject to UK data protection law are required to implement a mechanism or procedure whereby individuals can make complaints relating to their personal data. The new requirements were introduced by the Data (Use and Access) Act 2025. Individuals must first raise their complaint with the...

Paige Collings and Jillian C. York write: This week, politicians in the UK pushed forward with plans to eviscerate privacy and free speech on the internet by announcing a ban on social media for users under 16 that is set to take effect in Spring 2027. The UK government continues to falsely characterize this policy as a necessary response...

Russell Myers reports: A hospital worker at the private clinic where the Princess of Wales had abdominal surgery is set to face a criminal prosecution following an investigation into claims that the Princess’ medical records had allegedly been accessed by staff in 2024, it is understood. A total of three trusted employees, who worked at The...

Canadian privacy law professor Michael Geist writes: The government is set to introduce its long-promised privacy reform legislation early this week, with the recognition of a fundamental right to privacy expected to serve as a foundational element of the bill. Establishing privacy as a fundamental right would be a welcome and long-overdue development, one that many have...