Policy experts in Washington strive to adapt to changing dynamics following the U.S. midterm elections.
Policy circles in Washington have become active once again as the U.S. midterm elections shifted the balance of power in Congress. Experts and lobbyists are reshaping their strategies and rhetoric in line with the changing political climate. A letter sent to his colleagues by Democrat Frank Pallone, who is seeking the chairmanship of the House Committee on Energy and Commerce, provided the first concrete signals of this new era. Critical topics such as big tech companies, AI oversight, data privacy, and consumer prices stand out in the letter.
Click on the link for the full story.
A bill debated in Canada raises concerns over data privacy and surveillance standards.
Bill C-22 on Lawful Access, currently on the agenda of the Canadian Senate, lowers the threshold for law enforcement to access subscriber information from "reasonable belief" to "reasonable suspicion". Privacy Commissioner Philippe Dufresne and experts emphasize that seemingly trivial pieces of data collected from critical platforms—such as health, legal, or financial services—can coalesce to expose personal privacy. Calls are being made to ensure the regulation is proportionate and strictly limited to telecommunications providers.
Click on the link for the full story.
The Italian Data Protection Authority fined Deutsche Bank €33,000 for privacy violations during a loan application process.
An investigation was launched after a Poste Italiane employee's loan application was rejected and their salary details along with outstanding debts were shared on a platform accessible to company personnel. As a result of the inquiry, the Authority determined that Deutsche Bank and Poste Italiane had unlawfully designated each other as data processors, whereas they were in fact independent data controllers. Furthermore, it was determined that Deutsche Bank breached transparency principles by failing to specify data recipients in its privacy notice, resulting in an administrative fine against the bank.
Click on the link for the full story.
The European Commission prioritized digital simplification, AI investments, and competitiveness in its 2027 Work Programme.
The European Commission announced its 2027 Work Programme aligned with its objectives of competitiveness, sovereignty, and regulatory simplification. Within the scope of the new roadmap, children's online safety, copyright, and the streamlining of digital rules are prioritized. Planning to support chip and computing power infrastructure alongside the adoption of AI in strategic sectors such as health, defence, and transport, the Commission aims to curb excessive national regulations and withdraw the long-stalled digital tax proposal.
Click on the link for the full story.
The Monetary Authority of Singapore published an AI risk management guide for financial institutions.
The Monetary Authority of Singapore has published comprehensive guidance on the development, deployment, and governance of AI systems by financial institutions. Covering foundation models, generative AI, and autonomous agents, the framework introduces a risk-based approach. Placing ultimate accountability on senior management, the guide stipulates stringent measures across areas including data governance, human oversight, transparency, and cybersecurity. The phased rules mandate that accountability remains with the financial institution even in cases of outsourcing.
Click on the link for the full story.
Regulatory efforts worldwide to protect brain data privacy gain momentum in the face of advancing neurotechnology.
The proliferation of neurotechnological devices capable of reading brain waves has pushed "neuro-privacy" to the center of the global data protection agenda. While the United States lacks comprehensive federal legislation, states are classifying neural data as sensitive data; countries such as Chile, Brazil, and Mexico are introducing constitutional and statutory protections. Handled under the General Data Protection Regulation and the Artificial Intelligence Act in the European Union, this development obliges organizations to implement explicit consent, data mapping, and data minimization practices.
Click on the link for the full story.
The Italian Data Protection Authority fined the Agency for Digital Italy for publishing shortlisted candidates' personal data on its website.
In an investigation initiated following a candidate's complaint, it was found that the names and scores of 15 candidates who qualified for an oral examination were shared on the Agency for Digital Italy's website. Although the agency claimed that the incident was an operational mistake and that the document was removed, the data was determined to have remained accessible online. Stating that national legislation permits only the publication of final lists, the Data Protection Authority imposed an administrative fine of €15,000 on the Agency for violating the principles of data minimization and transparency.
Click on the link for the full story.
Refusing to consider AI technologies in business operations could turn into a legal negligence risk for companies.
Discussions in the legal sphere that once centered on AI errors are giving way to the legal risks of overlooking these tools. Just as with e-discovery and cybersecurity standards, courts' "reasonable professional care" benchmark is evolving alongside the widespread adoption of AI. Organizations that dismiss AI assistance in routine reviews may face future negligence claims over missed critical errors. Rather than adopting these tools blindly, experts advise companies to establish governance mechanisms that document their evaluation processes.
Click on the link for the full story.
The Slovenian data protection authority held that an employer violated data protection rules by forwarding the emails of an employee on prolonged leave.
An employee filed a complaint with the data protection authority against their former employer over the forwarding of their corporate emails to another account during an extended leave of absence. Following its investigation, the authority found a GDPR violation, noting that the company failed to prove it had conducted a prior legitimate interest assessment and that forwarding the emails was disproportionate when less intrusive measures, such as an automated out-of-office reply, were available. However, because the forwarding had ceased and the employee's account had already been closed, no corrective measures were deemed necessary against the company.
Click on the link for the full story.
The Danish data protection authority issued a reprimand to a metro operator that refused an access request for CCTV footage and deleted the recordings.
A passenger involved in an incident at a metro station requested access to the relevant CCTV footage, but the operator denied the request citing difficulties in identification, public safety, and excessive workload, and subsequently deleted the footage. Upon investigating the complaint, the data protection authority determined that the physical description and incident details provided made identification feasible, the claim of excessive burden was not substantiated, and immediately deleting the footage breached the principle of fairness and transparency. The authority issued a formal reprimand against the operator, as data controller, for violating general data protection rules.
Click on the link for the full story.