High
Guidance
Published
France · Oct 16, 2026 · effective Oct 16, 2026
CNIL guidance on lawful reconstitution of professional email addresses
The CNIL explains that reconstructing professional email addresses from publicly available data must comply with the GDPR and can rely on legitimate interest only if specific conditions are met. Organizations must assess the visibility of…
CNIL · RGPD
Moderate
Guidance
Announced
United States (federal) · Oct 16, 2026
FFIEC Extends Regulatory Capital Reporting Collection (FFIEC 101) for Three Years
The Federal Financial Institutions Examination Council (FFIEC) announced a three‑year extension of the Regulatory Capital Reporting collection for institutions subject to the Advanced Capital Adequacy Framework (FFIEC 101). No public…
Federal Financial Institutions Examination Council (FFIEC) · Paperwork Reduction Act of 1995
Low
Court ruling
Decided
New York · Oct 15, 2026
Southern District of New York denies government motion to dismiss lawsuit over Trump admin social media surveillance of noncitizens
A federal district court rejected the government’s arguments that immigration law bars the case and that the unions lack standing, allowing the lawsuit to proceed. The court found that the surveillance program causes concrete injuries…
Immigration and Nationality Act
Moderate
Proposed regulation
Proposed
France · Oct 15, 2026
CNIL examines draft decree on real‑time audio capture by public transport operators
The CNIL plenary session on 15 October 2026 will examine a draft deliberation providing an opinion on a draft decree concerning the experimentation of real‑time sound capture and transmission systems by bus and coach operators. The agenda…
Commission nationale de l'informatique et des libertés (CNIL) · décret n° 2022‑377 du 17 mars 2022
Moderate
Enforcement
In effect
United States (federal) · Oct 15, 2026
FTC orders Walmart to pay over $9.8M to consumers harmed by wire‑transfer scams
The Federal Trade Commission is sending payments totaling more than $9.8 million to consumers harmed by Walmart’s alleged failure to stop scammers that used its wire transfer services to defraud U.S. customers. The restitution follows FTC…
Federal Trade Commission
High
Guidance
Published
Spain · Oct 15, 2026 · deadline Dec 20, 2026
AEPD launches call for articles for third issue of Revista PIT on GDPR and emerging regulations
The Spanish Data Protection Agency (AEPD) announced a call for original research articles for the third issue of its scientific journal "Privacidad, Innovación y Tecnología (PIT)". Submissions are accepted from 1 November to 20 December…
Agencia Española de Protección de Datos (AEPD) · Reglamento General de Protección de Datos (RGPD)
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 15, 2026
DOJ proposes to exempt EOIR "Fraud and Abuse Prevention Program Records" from certain Privacy Act provisions
The Executive Office for Immigration Review (EOIR) announced a new system of records titled "Fraud and Abuse Prevention Program Records" (JUSTICE/EOIR-006). EOIR proposes to exempt this system from specific provisions of the Privacy Act to…
Executive Office for Immigration Review · Privacy Act of 1974
High
Guidance
In effect
United States (federal) · Oct 15, 2026 · effective Nov 24, 2026
Farm Credit Administration amends employee payroll system of records under Privacy Act, effective Nov 24, 2026
The Farm Credit Administration announced an amendment to its FCA-1 system of records covering employee attendance, leave, and payroll. The amendment updates the categories of individuals and records maintained and revises the policies and…
Farm Credit Administration · Privacy Act of 1974
Low
Enforcement
Published
United States (federal) · Oct 14, 2026
DHS OIG audit finds TSA failed to safeguard passenger facial recognition data
The DHS Office of Inspector General reported a significant weakness in TSA's facial recognition system, noting that the vendor could access and extract sensitive driver’s license and passport images without TSA’s knowledge. The audit found…
Department of Homeland Security Office of Inspector General (DHS OIG)
Low
Court ruling
Decided
United States (federal) · Oct 14, 2026
Court allows lawsuit against government surveillance program "Catch and Revoke" to proceed
A court issued a ruling permitting the EFF‑led lawsuit challenging the "Catch and Revoke" mass surveillance program to move forward. The program is alleged to use AI to suppress protected speech online. The decision is viewed as a win for…
Moderate
Attorney General action
Filed
New York · Oct 14, 2026
NY Attorney General urges bankruptcy court to protect children and consumers in Character.AI sale
New York Attorney General Letitia James and a coalition of 39 state AGs filed a motion in the Character Technologies bankruptcy court demanding strong protections for children and users before any sale of Character.AI. The filing cites…
New York Attorney General's Office
Moderate
Guidance
Published
European Union · Oct 14, 2026
AI adoption more than doubles in EU strategic sectors, JRC report shows
A Joint Research Centre analysis finds AI use in EU strategic sectors rose from 7% in 2021 to 18% in 2025, driven mainly by large language models. The report highlights sector‑specific barriers, especially lack of expertise and regulatory…
European Commission
Moderate
Guidance
Proposed
United States (federal) · Oct 14, 2026
Agency limits programmatic access to FederalRegister.gov and eCFR.gov, requiring API use and CAPTCHA verification
The agency states that due to aggressive automated scraping, programmatic access to FederalRegister.gov and eCFR.gov is restricted to its developer APIs. Users must complete a CAPTCHA to verify they are human and may request a wider IP…
U.S. Federal Government · Paperwork Reduction Act
Moderate
Guidance
Published
United States (federal) · Oct 14, 2026
DoD establishes new matching program to compare TRICARE pharmacy records with Treasury's Do Not Pay system
The Department of Defense announced a new computer‑matching program that will compare its TRICARE Pharmacy Program records with the Treasury's Do Not Pay Working System. The program is established under the Privacy Act of 1974 and the…
Department of Defense · Privacy Act of 1974
Moderate
Guidance
Proposed
United States (federal) · Oct 14, 2026
Federal Register proposes reorganization limiting programmatic access to its sites
The Division of Program Coordination, Planning, and Strategic Initiatives issued a notice proposing a reorganization that will limit programmatic access to FederalRegister.gov and eCFR.gov due to aggressive automated scraping. Access will…
Division of Program Coordination, Planning, and Strategic Initiatives, Office of the Director
Moderate
Guidance
Published
European Union · Oct 13, 2026
CEPD issues guidance on data protection challenges of smart glasses
The European Data Protection Board adopted a declaration on connected glasses and released a report outlining privacy risks. It clarifies when users act as data controllers under the GDPR and stresses that manufacturers and service…
European Data Protection Board (CEPD) · RGPD
Moderate
Guidance
Published
European Union · Oct 13, 2026
EDPB issues guidance on privacy challenges of smart glasses
The European Data Protection Board adopted statement 1/2026 on smart glasses, highlighting serious privacy concerns and the need for transparency. It clarifies when users act as data controllers and stresses that manufacturers and service…
European Data Protection Board · General Data Protection Regulation
Moderate
Guidance
Signed
European Union · Oct 13, 2026
EU and Ukraine sign administrative arrangement between CERT-EU and CERT-UA at 5th Cyber Dialogue
During the 5th EU‑Ukraine Cyber Dialogue on 9 October, the EU and Ukraine signed an administrative arrangement to enable information exchange between CERT‑EU and its Ukrainian counterpart, CERT‑UA. The dialogue also covered alignment with…
CERT-EU · NIS2 Directive
High
Proposed regulation
Proposed
United States (federal) · Oct 13, 2026 · effective Oct 13, 2026
FHFA proposes to rescind SORN FHFA-12 and consolidate records under SORN FHFA-11
The Federal Housing Finance Agency (FHFA) announced a proposal to rescind the existing System of Records Notice (SORN) FHFA-12, which covers parking program records. The agency will consolidate those records with its transit subsidy…
Federal Housing Finance Agency · Privacy Act of 1974
High
Fine
In effect
Italy · Oct 12, 2026 · effective Jun 5, 2026
Italian DPA fines Wind Tre €16.7 million for unlawful telemarketing
The Italian Data Protection Authority imposed an administrative fine of EUR 16 700 000 on Wind Tre S.p.A. for violations of GDPR principles in its telemarketing and contract activation practices. The authority also issued a definitive ban…
Italian Data Protection Authority (Garante) · General Data Protection Regulation
