Moderate
Guidance
In effect
France · Sep 10, 2026 · effective Sep 1, 2026
CNIL guidance on data‑protection obligations under the electronic invoicing reform effective 1 Sept 2026
The CNIL explains the data‑protection implications of the French electronic invoicing reform that entered into force on 1 Sept 2026. It details which personal data may be processed, the roles of issuers, receivers and certified platforms…
CNIL · réforme relative à la facturation électronique
Low
Enforcement
Announced
Germany · Sep 10, 2026
noyb to file injunction against SCHUFA over shadow database
noyb sent a cease-and-desist letter to SCHUFA demanding the removal of its shadow database. SCHUFA's deadline to comply has expired and the agency has rejected the allegations. noyb announced it will now file an injunction and invites…
Moderate
Lawsuit filed
Filed
United States (federal) · Sep 8, 2026
EFF releases 1,000 pages of CMS records on AI-driven Medicare WISeR prior‑authorization program
EFF obtained about 1,000 pages of CMS documents through its FOIA lawsuit filed in March, revealing delays, denials, and financial incentives in the WISeR AI model. The records show requests sometimes waited up to 83 days and vendors denied…
Centers for Medicare & Medicaid Services (CMS)
High
Amendment
Signed
Delaware · Sep 3, 2026 · effective Jan 1, 2027
Delaware Governor signs HB 380, amending the DPDPA effective Jan 1 2027
Governor Meyer signed HB 380 on September 2, amending the Delaware Personal Data Privacy Act. The amendment expands the definition of sensitive data, lowers applicability thresholds, adds new contractual and due‑diligence requirements for…
CFPB · Fair Credit Reporting Act
Moderate
Proposed regulation
Announced
France · Sep 3, 2026
CNIL agenda includes review of draft decrees on automated personal data processing and authorizations for health data studies
The CNIL plenary session agenda for 3 September 2026 lists examinations of draft deliberations on a decree modifying decree n° 2023‑935 for the SISPoPP system, a draft decree on the API‑PNR France system, and authorizations for RCTs, IQVIA…
Commission nationale de l'informatique et des libertés (CNIL) · General Data Protection Regulation
Low
Enforcement
Announced
Germany · Aug 26, 2026 · effective Aug 26, 2026
noyb sends cease‑and‑desist letter to SCHUFA over alleged ‘shadow database’ GDPR violations
In July 2026, the NGO noyb issued a cease‑and‑desist letter to German credit agency SCHUFA demanding it stop storing data beyond retention periods and provide full historical data under Article 15 GDPR. The organization warned it will seek…
EDPB · General Data Protection Regulation
Low
Enforcement
Announced
United States (federal) · Aug 19, 2026
Tech firms privately resist ICE subpoenas seeking user data
ICE has sent hundreds of subpoenas to large technology companies for subscriber information. Meta and Reddit have privately pushed back, questioning statutory authority and objecting to requests tied to protected activity. In some cases…
U.S. Immigration and Customs Enforcement · 19 U.S.C. §1509
Low
Court ruling
Decided
United States (federal) · Aug 4, 2026
Ninth Circuit rules Perplexity AI’s Comet browser not liable under CFAA
The Ninth Circuit Court of Appeals held that Perplexity AI’s Comet browser does not violate the Computer Fraud and Abuse Act because the tool itself does not access Amazon’s servers; users do. The court rejected Amazon’s claim that…
Computer Fraud and Abuse Act
