Moderate
Guidance
Published
European Union · Oct 12, 2026
noyb ranks EU Parliament members on their stance toward GDPR and ePrivacy amendments
noyb analysed over 1,000 amendments to the GDPR and ePrivacy Directive linked to the Digital Omnibus reform, grading each MEP on whether their changes strengthen or weaken privacy protections. The report finds the European People’s Party…
ePrivacy Directive
Moderate
Executive order
Signed
United States (federal) · Oct 9, 2026
President Trump issues executive order creating federal voter eligibility list
In March 2026, President Trump issued an executive order directing DHS to compile a list of U.S. citizens 18 years or older and directing DOJ to prosecute officials who provide ballots to ineligible voters. The order has been challenged by…
Privacy Act of 1974
Low
Guidance
Announced
California · Oct 9, 2026
EFF joins Oakland Tech Week to discuss surveillance and AI impacts
The Electronic Frontier Foundation participated in Oakland Tech Week on Sept. 30, co‑presenting an all‑day event with MediaJustice and Upturn. Attendees discussed how technology can empower or oppress communities, focusing on surveillance…
Low
Enforcement
In effect
TR · Oct 9, 2026
Turkish courts block LGBTQ+ NGOs' websites and detain activists under obscenity and criminal organization laws
Since mid‑September, Turkish courts have ordered the blocking of websites and social media accounts of several LGBTQ+ organizations and have detained over 60 activists. Investigations are being conducted under Article 226 (obscenity) and…
Turkish Penal Code
Moderate
Fine
In effect
Italy · Oct 9, 2026 · effective Aug 6, 2026
Italian DPA fines security firm €39,000 for employee data violations
The Italian Data Protection Authority (Garante) imposed a total administrative fine of EUR 39,000 on La Patria S.p.A. for failing to respond to employee access requests and for inadequate information about GPS‑derived geolocation data. The…
Garante – Italian Data Protection Authority · General Data Protection Regulation
Moderate
Guidance
Published
France · Oct 9, 2026
CNIL hosts 2nd Rencontres Informatique & Libertés on connected glasses and data‑sanctions
The French data‑protection authority CNIL held its second Rencontres Informatique & Libertés on 29 September 2026, featuring panels on the privacy impact of connected glasses and the role of sanctions under the GDPR. The event gathered…
CNIL · RGPD
High
Data protection authority action
Decided
Italy · Oct 9, 2026 · effective Sep 23, 2026
Italian DPA fines IQVIA €7 million for unlawful processing of patients’ health data
The Italian Data Protection Authority imposed an administrative fine of EUR 7,000,000 on IQVIA Solutions Italy S.r.l. for processing health data without a legal basis, inadequate information to patients, and missing DPIA and retention…
Italian Data Protection Authority · General Data Protection Regulation
High
Fine
Decided
Italy · Oct 9, 2026 · effective May 14, 2026
Italian DPA fines Emirates €180,000 for health data infringements
The Italian Data Protection Authority imposed an administrative fine of EUR 180,000 on Emirates for violations of GDPR transparency and retention requirements concerning passengers' health data. Emirates was ordered to clarify which…
Italian Data Protection Authority · General Data Protection Regulation
High
Fine
In effect
Italy · Oct 9, 2026 · effective Jul 3, 2026
Italian DPA fines BBVA €5.508 million for ignoring customer’s objection to direct marketing
The Italian Data Protection Authority issued a final decision on 3 July 2026 finding BBVA infringed Articles 5, 12, 21 and 24 of the GDPR by failing to honor a customer's objection to direct marketing. BBVA was ordered to pay an…
Italian Data Protection Authority · General Data Protection Regulation
Low
Proposed regulation
Announced
United States (federal) · Oct 9, 2026
CISA submits Final CIRCIA Rule to OIRA for interagency review
On October 1, 2026, CISA submitted a draft of the Final Rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) to OIRA. CIRCIA will require covered critical‑infrastructure entities to report…
Cybersecurity and Infrastructure Security Agency (CISA) · Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)
Moderate
Guidance
Published
European Union · Oct 9, 2026
EU AI Scientific Panel holds special meeting on frontier AI safety and loss-of-control incidents
On 9 October 2026 the European Commission’s AI Scientific Panel met to discuss recent loss-of-control incidents and technical developments that reduce model monitorability. The panel presented recommendations to strengthen EU capabilities…
European Commission · EU AI Act
Low
Interpretation
Published
Global · Oct 8, 2026
EFF warns age‑verification laws risk excluding people without ID
The EFF analysis highlights a global surge in mandatory age‑verification requirements for social‑media and other digital services, citing laws in Australia, India, the United Kingdom, and many U.S. states. It argues that ID‑based checks…
Online Safety Act
Moderate
Proposed bill
Proposed
United States (federal) · Oct 8, 2026
EPIC urges Congress to ban CBP's use of financial data in predictive policing
EPIC reports that Customs & Border Patrol's Predictive Intelligence Targeting Teams are using financial records and travel data to target individuals without disclosing how the data was obtained. The article cites past ICE bulk subpoenas…
U.S. Customs and Border Protection (CBP) · Right to Financial Privacy Act
Moderate
Proposed regulation
Proposed
Vermont · Oct 8, 2026
Future of Privacy Forum submits comments on Vermont Age-Appropriate Design Code rulemaking
On October 2, 2026 the Future of Privacy Forum filed comments to the Vermont Attorney General’s rulemaking for the Age-Appropriate Design Code. The act, enacted in June 2025, sets duties for businesses serving minors and will become…
Vermont Office of the Attorney General · California Age-Appropriate Design Code Act
Moderate
Guidance
In effect
Italy · Oct 8, 2026 · effective Oct 29, 2026 · deadline Oct 29, 2026
Italian Garante's tracking-pixel guidelines become effective Oct 29, 2026
The Italian Data Protection Authority (Garante) issued guidelines governing the use of tracking pixels in email communications. Organizations must comply with the guidelines by October 29, 2026. The guidelines are now effective as of that…
Italian Data Protection Authority (Garante)
Moderate
Proposed regulation
Proposed
France · Oct 8, 2026
CNIL examines draft deliberation authorizing BIG DATA SANTE to process personal data for anonymized medical research (ONCOVAL)
During its plenary session on 8 October 2026, the CNIL will consider a draft deliberation that would permit BIG DATA SANTE (Octopize Mimethik Data) to carry out automated processing of personal data to create anonymised datasets for…
Commission nationale de l'informatique et des libertés (CNIL) · Law of 6 January 1978
High
Fine
Decided
Sweden · Oct 8, 2026
Swedish DPA fines Miljödata approx EUR 160,000 for insufficient security measures
The Swedish Data Protection Authority (IMY) issued an administrative fine of SEK 1,800,000 (≈ EUR 160,000) to IT service provider Miljödata after a cyberattack exposed personal and sensitive data of 2.2 million individuals. The authority…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Moderate
Enforcement
Decided
Greece · Oct 8, 2026 · effective Jul 28, 2026
Hellenic DPA fines Ministry and EETAA for data breach
The Hellenic Data Protection Authority imposed administrative fines of EUR 200,000 on the Ministry of Social Cohesion and Family Affairs and EUR 150,000 on E.E.T.A.A. S.A. for a large‑scale personal data breach. The Authority also ordered…
Hellenic Data Protection Authority · General Data Protection Regulation
High
Fine
Published
Netherlands · Oct 8, 2026
Dutch DPA fines Uber €824.99 million for unlawful automated decision‑making
The Autoriteit Persoonsgegevens imposed an administrative fine of €824,990,000 on Uber for violating GDPR Article 22 by automatically deactivating drivers’ accounts and for failing to provide sufficient information under Article 13. The…
Autoriteit Persoonsgegevens · General Data Protection Regulation
Moderate
Enforcement
Decided
France · Oct 8, 2026
CNIL closes injunction against FRANCE TRAVAIL after compliance with data security measures
The French data protection authority (CNIL) closed the injunction issued on 22 January 2026 against FRANCE TRAVAIL, after the organization demonstrated compliance with the security measures required by Article 32 of the GDPR. The original…
CNIL · RGPD
