High
Guidance
Published
France · Oct 1, 2026 · effective Oct 1, 2026
CNIL and Cybermalveillance.gouv.fr release guide for individuals on personal data breach response
The French data protection authority (CNIL) and Cybermalveillance.gouv.fr have published a practical support document titled “Violation de données personnelles, que faire en 3 étapes clés ?”. The guide provides a three‑step checklist for…
CNIL
Low
Guidance
Published
United States (federal) · Sep 30, 2026
EFF discusses privacy implications of Apple Siri AI features in iOS 27
The EFF newsletter examines how Apple’s new Siri AI in iOS 27 handles user data. It contrasts on‑device processing with server‑side processing and explains the privacy risks. The piece offers guidance on limiting the data Siri can access.
Moderate
Guidance
Published
United States (federal) · Sep 30, 2026
HUD modifies system of records notice for Inventory Management System and Housing Information Portal
The Department of Housing and Urban Development (HUD) Office of Public and Indian Housing is updating its system of records notice for the Inventory Management System and Housing Information Portal. The amendment adds three new routine…
Department of Housing and Urban Development · Privacy Act of 1974
Moderate
Guidance
Announced
France · Sep 28, 2026
CNIL to host AIR 2026 event on political communication ethics and election manipulation on 16 Nov 2026
The French data‑protection authority CNIL will hold a public debate on 16 November 2026 about the ethical challenges of digital political communication and foreign interference. The programme will examine voter consent, data‑minimisation…
CNIL · RGPD
Moderate
Guidance
Published
Ireland · Sep 28, 2026
Data Protection Commission releases AI Insights Report covering 2021‑2025 supervision
The Irish Data Protection Commission published a report on its supervision of AI products and services from 2021 to 2025, noting a rise in AI engagements and improvements in lawful basis, transparency and data‑minimisation. The report…
Data Protection Commission
High
Guidance
In effect
United States (federal) · Sep 25, 2026 · effective Oct 26, 2026
Peace Corps announces new CRM system of records (PC 38) effective Oct 26, 2026
The Peace Corps Office of Planning and Performance issued a public notice of a new system of records, the Peace Corps Customer Relationship Management (PC 38) system. The system will monitor, track, and analyze interactions with…
Peace Corps Office of Planning and Performance · Privacy Act of 1974
Moderate
Proposed bill
Proposed
United States (federal) · Sep 24, 2026
State bills propose exemption for biometric data converted to irreversible mathematical representations
Several U.S. state privacy bills are introducing a new exception that excludes biometric data once it is transformed into an irreversible mathematical representation that cannot be used to recreate the original measurement. The proposed…
Illinois Biometric Information Privacy Act
High
Settlement
Settled
New York · Sep 24, 2026
NY AG secures $2.3M settlement and reforms from Labcorp after data breach
The New York Attorney General, together with 43 other state AGs, secured a $2.3 million settlement and mandated security reforms from Laboratory Corporation of America (Labcorp) following a 2019 breach that exposed personal and health data…
New York Attorney General's Office
Moderate
Enforcement
Published
Spain · Sep 23, 2026
Spanish Data Protection Agency issues warning to company over AI-driven resume screening
On 23 September 2026 the AEPD sent a formal warning to a company planning to use an AI tool for analysing CVs and assigning scores. The agency stresses that data protection must be built in from the start, including DPIA for high‑risk…
Agencia Española de Protección de Datos (AEPD) · Reglamento General de Protección de Datos (RGPD)
High
Fine
Decided
Ireland · Sep 23, 2026 · effective Sep 21, 2026
Irish Data Protection Commission fines Google €403 million for GDPR violations over location data
The Irish Data Protection Commission issued its final decision on 21 September 2026, imposing administrative fines of €403 million on Google Ireland Limited. The DPC found infringements of GDPR principles relating to lawfulness, fairness…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU proposes Article 88c/88bis to allow unrestricted AI use of personal data
A leaked Irish Presidency document proposes that personal data used "in the context of AI" be automatically lawful, removing consent requirements. The draft Article 88c (now 88bis) would permit AI companies to process any personal data for…
European Commission · General Data Protection Regulation
Low
Guidance
Published
Global · Sep 18, 2026
How to limit Siri AI access in iOS 27
Apple’s iOS 27 introduces a more powerful Siri AI that can access data from native and third‑party apps and may send information to Apple’s Private Cloud Compute. Users can mitigate privacy risks by disabling Siri, turning off app content…
Low
Guidance
Published
Global · Sep 18, 2026
Secure Messaging and AI Remain In Conflict Despite the Promise of TEEs
The EFF warns that cloud‑based trusted execution environments (TEEs) do not provide the same privacy guarantees as end‑to‑end encryption. When AI features offload message data to TEEs, the content leaves the device and is exposed to…
Low
Court ruling
Decided
United States (federal) · Sep 15, 2026
Supreme Court hears challenge to DHS/SSA upgrades to SAVE database
The League of Women Voters and EPIC urged the Supreme Court to deny the administration’s emergency request to stay a Washington, D.C., federal judge’s summary judgment that set aside DHS and SSA upgrades to the Systematic Alien…
Moderate
Investigation
Announced
United States (federal) · Sep 14, 2026
Police misuse ALPR data with frivolous reasons, EFF finds
EFF analysis of Flock Safety ALPR logs shows officers across the United States entering nonsensical reasons such as "LOL", "LMAO" and "idk" to access vehicle location data. The lack of warrant requirements and weak audit controls enables…
CPPA · California Delete Act
Moderate
Guidance
In effect
France · Sep 10, 2026 · effective Sep 1, 2026
CNIL guidance on data‑protection obligations under the electronic invoicing reform effective 1 Sept 2026
The CNIL explains the data‑protection implications of the French electronic invoicing reform that entered into force on 1 Sept 2026. It details which personal data may be processed, the roles of issuers, receivers and certified platforms…
CNIL · réforme relative à la facturation électronique
Moderate
Guidance
Published
France · Sep 10, 2026
CNIL releases Volume 2 of “L’Agence Privacy” to educate adolescents on cybercrime and data privacy
On 10 September 2026 the French data‑protection authority CNIL published the second volume of its educational comic series “L’Agence Privacy”. The free online and paper resource targets teenagers and parents, covering risks such as…
CNIL
Low
Enforcement
Announced
Germany · Sep 10, 2026
noyb to file injunction against SCHUFA over shadow database
noyb sent a cease-and-desist letter to SCHUFA demanding the removal of its shadow database. SCHUFA's deadline to comply has expired and the agency has rejected the allegations. noyb announced it will now file an injunction and invites…
Low
Guidance
Announced
Global · Sep 9, 2026
EFF blog outlines digital sovereignty and its impact on privacy, data control and security
The post explains that digital sovereignty refers to the ability of individuals, nations and organizations to control their digital destiny, including data, technology and infrastructure. It highlights policy discussions in Europe and…
Moderate
Enforcement
Announced
Spain · Sep 9, 2026
AEPD opens investigation into Ministry of Interior report listing journalists and political leanings
The Spanish Data Protection Agency announced it will launch a formal, ex officio investigation into a Ministry of Interior communication office report that includes journalists' names and alleged political ideologies. The probe will…
Agencia Española de Protección de Datos · Reglamento General de Protección de Datos (RGPD)
