Moderate
Guidance
Published
France · Oct 9, 2026
CNIL hosts 2nd Rencontres Informatique & Libertés on connected glasses and data‑sanctions
The French data‑protection authority CNIL held its second Rencontres Informatique & Libertés on 29 September 2026, featuring panels on the privacy impact of connected glasses and the role of sanctions under the GDPR. The event gathered…
CNIL · RGPD
High
Data protection authority action
Decided
Italy · Oct 9, 2026 · effective Sep 23, 2026
Italian DPA fines IQVIA €7 million for unlawful processing of patients’ health data
The Italian Data Protection Authority imposed an administrative fine of EUR 7,000,000 on IQVIA Solutions Italy S.r.l. for processing health data without a legal basis, inadequate information to patients, and missing DPIA and retention…
Italian Data Protection Authority · General Data Protection Regulation
Low
Proposed regulation
Announced
United States (federal) · Oct 9, 2026
CISA submits Final CIRCIA Rule to OIRA for interagency review
On October 1, 2026, CISA submitted a draft of the Final Rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) to OIRA. CIRCIA will require covered critical‑infrastructure entities to report…
Cybersecurity and Infrastructure Security Agency (CISA) · Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)
Moderate
Guidance
Published
European Union · Oct 9, 2026
EU AI Scientific Panel holds special meeting on frontier AI safety and loss-of-control incidents
On 9 October 2026 the European Commission’s AI Scientific Panel met to discuss recent loss-of-control incidents and technical developments that reduce model monitorability. The panel presented recommendations to strengthen EU capabilities…
European Commission · EU AI Act
Low
Interpretation
Published
Global · Oct 8, 2026
EFF warns age‑verification laws risk excluding people without ID
The EFF analysis highlights a global surge in mandatory age‑verification requirements for social‑media and other digital services, citing laws in Australia, India, the United Kingdom, and many U.S. states. It argues that ID‑based checks…
Online Safety Act
Moderate
Proposed bill
Proposed
United States (federal) · Oct 8, 2026
EPIC urges Congress to ban CBP's use of financial data in predictive policing
EPIC reports that Customs & Border Patrol's Predictive Intelligence Targeting Teams are using financial records and travel data to target individuals without disclosing how the data was obtained. The article cites past ICE bulk subpoenas…
U.S. Customs and Border Protection (CBP) · Right to Financial Privacy Act
High
Fine
Decided
Sweden · Oct 8, 2026
Swedish DPA fines Miljödata approx EUR 160,000 for insufficient security measures
The Swedish Data Protection Authority (IMY) issued an administrative fine of SEK 1,800,000 (≈ EUR 160,000) to IT service provider Miljödata after a cyberattack exposed personal and sensitive data of 2.2 million individuals. The authority…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Moderate
Enforcement
Decided
Greece · Oct 8, 2026 · effective Jul 28, 2026
Hellenic DPA fines Ministry and EETAA for data breach
The Hellenic Data Protection Authority imposed administrative fines of EUR 200,000 on the Ministry of Social Cohesion and Family Affairs and EUR 150,000 on E.E.T.A.A. S.A. for a large‑scale personal data breach. The Authority also ordered…
Hellenic Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Decided
France · Oct 8, 2026
CNIL closes injunction against FRANCE TRAVAIL after compliance with data security measures
The French data protection authority (CNIL) closed the injunction issued on 22 January 2026 against FRANCE TRAVAIL, after the organization demonstrated compliance with the security measures required by Article 32 of the GDPR. The original…
CNIL · RGPD
Moderate
Guidance
Published
Spain · Oct 8, 2026
AEPD publishes second issue of scientific journal “Privacy, Innovation and Technology”
The Spanish Data Protection Agency released the second issue of its scientific journal PIT, dedicated to the 10th anniversary of the GDPR. The monograph examines proactive responsibility, the right to explanation in automated decisions…
Agencia Española de Protección de Datos (AEPD) · Reglamento General de Protección de Datos (RGPD)
Moderate
Proposed bill
Introduced
United States (federal) · Oct 7, 2026
Sen. Gillibrand reintroduces Data Protection Act to create U.S. Data Protection Agency
U.S. Senator Kirsten Gillibrand (D‑NY) has reintroduced the Data Protection Act, which would establish an independent federal Data Protection Agency. The bill aims to limit collection, use and sharing of personal data, oversee high‑risk…
Moderate
Proposed regulation
Proposed
United States (federal) · Oct 7, 2026
DOJ proposes exemption for Firearms Rights Restoration Electronic Records Database from Privacy Act provisions
The Office of the Pardon Attorney within the U.S. Department of Justice announced a notice of a new system of records called the Firearms Rights Restoration Electronic Records Database (FRRERD). The agency proposes to exempt this system…
U.S. Department of Justice · Privacy Act of 1974
High
Enforcement
Published
Spain · Oct 6, 2026 · effective Oct 6, 2026
AEPD issues warnings to two Spanish municipalities over AI‑enabled video surveillance projects
The Spanish Data Protection Agency (AEPD) sent preventive warnings (AI‑00170‑2026 and AI‑00171‑2026) to two local councils regarding planned video‑surveillance systems that use automated image analysis with AI. The agency stresses that the…
Agencia Española de Protección de Datos · Reglamento General de Protección de Datos
High
Final regulation
Announced
United States (federal) · Oct 6, 2026 · effective Nov 5, 2026
Treasury exempts new tip intake records from certain Privacy Act provisions
The Department of the Treasury issued a final rule exempting the system of records titled "Treasury .032--Federal Program Waste, Fraud, and Abuse Tip Intake and Referral Records" from specific provisions of the Privacy Act of 1974. The…
Department of the Treasury · Privacy Act of 1974
Low
FRAMEWORK UPDATE
Announced
Global · Oct 5, 2026
Future of Privacy Forum urges standardized privacy benchmarks for frontier AI systems
The paper argues that standardized privacy benchmarks are needed to evaluate privacy risks in frontier AI models, including data memorization, inference of sensitive attributes, and over‑collection. It describes emerging efforts such as…
Moderate
Guidance
Published
United States (federal) · Oct 5, 2026
EPIC analysis links pixel‑tracking litigation under ECPA and CIPA to upcoming Supreme Court VPPA case
EPIC outlines how recent court decisions using the Electronic Communications Privacy Act (ECPA) and California Invasion of Privacy Act (CIPA) address non‑consensual pixel tracking and its privacy harms. The analysis cites multiple…
HHS OCR · HIPAA Privacy, Security and Breach Notification Rules
Low
Proposed bill
Introduced
United States (federal) · Oct 2, 2026
Rep. Darrell Issa introduces the American Copyright Protection Act (H.R. 10364) targeting VPNs for site‑blocking
Rep. Darrell Issa (R‑CA) has introduced H.R. 10364, the American Copyright Protection Act, which would allow copyright owners to seek court orders blocking U.S. users from foreign piracy sites. The bill expands blocking obligations to…
American Copyright Protection Act (ACPA)
Moderate
Settlement
Settled
United States (federal) · Oct 2, 2026
Meta’s Muse AI Agent raises privacy, security, and child safety concerns amid past FTC consent decree
Meta launched the Muse personal AI agent in September 2026, which collects extensive personal data and can act without clear user permission. EPIC reports multiple incidents where Muse accessed messages, shared home addresses, and…
Federal Trade Commission
Low
Court ruling
Decided
New York · Oct 2, 2026
Federal judge rejects motion to dismiss social media surveillance lawsuit against Trump administration
A U.S. District Court in New York denied the government’s motion to dismiss a lawsuit filed by three labor unions alleging viewpoint‑based social media surveillance of noncitizens. The case, filed in October 2025, targets the Departments…
Administrative Procedure Act
Low
Enforcement
In effect
EC · Oct 2, 2026
Ecuador orders security expert Ola Bini deported and bans return for 10 years
Ecuadorian immigration authorities detained free software developer Ola Bini in Quito and ordered his immediate deportation, prohibiting his return for a decade. The decision was based on a secret report alleging threats to public…
Ecuadorian immigration authorities
