The DoJ just updated its frequently asked questions about the Data Security Program (“DSP”) implemented by the National Security Division (“NSD”) under Executive Order 14117.

Simplification: Council agrees positions on digitalization and common specifications, as well as on small mid-caps, to boost EU competitiveness, including reducing record-keeping obligations for SMEs and small mid-caps under Article 30 of GDPR. www.consilium.europa.eu/en/press/pre....

The Amsterdam Court of Appeal has accepted the appeal and has scheduled a hearing for oral arguments on December 11. This hearing will focus on Meta's processing of personal data for AI purposes under the DMA (and the GDPR*). uitspraken.rechtspraak.nl/details?id=E...

Is AI vendor lock-in a sovereignty issue? Denmark and other Nordics are pushing the debate, and the Commission’s consultants are similarly exploring pro-competition measures for the upcoming Cloud & AI Development Act. www.mlex.com/mlex/article...

Shaped by years of public input, California Finalizes Major New Privacy Rules! The CPPA has approved new regs on: - Cybersecurity audits - Risk assessments - ADMT - Insurance - CCPA updates 🗓️ Effective 1/1/26 Final docs coming soon to the CPPA website. Read more: cppa.ca.gov/announcement...

Interesting!

Data transfers outside of Quebec:

The DPAs of the Netherlands, Hungary, Italy, and Liechtenstein have drawn up a report after a joint exploratory investigation into smart TVs. See www.linkedin.com/posts/luisal...

NZ Privacy Amendment Act 2025 received Royal Assent on 22 Sep 2025.

On September 5, the General Court announced that joined cases T-262/24 and T-265/24 concerning EDPS' decisions on the use of Microsoft 365 by the European Commission were removed from its register.

While TikTok generally disagreed with the findings outlined above, the company agreed to work with the Offices to resolve the matter. More specifically, TikTok committed to:

Here's the joint investigation of TikTok by the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the Office of the Information and Privacy Commissioner for British Columbia, and OIPC: www.priv.gc.ca/en/opc-actio...

The California Privacy Protection Agency (CPPA) announced today that the California Office of Administrative Law has approved regulations covering cybersecurity audits, risk assessments, automated decisionmaking technology (ADMT), insurance companies, and updates to existing CCPA regulations.

The Commission will split the AI Act guidelines on high-risk systems. Classification guidance is due by Feb. 2, 2026, while separate rules on obligations, substantial modification and the AI value chain are planned for Q2–Q3 2026. Details on @mlexclusive. www.mlex.com/mlex/article...

The Office of Administrative Law (OAL) just approved CCPA Updates, Insurance, Cybersecurity Audits, Risk Assessments, and Automated Decisionmaking Technology (ADMT) Regulations. Below are the approved Regulations:

The French DPA announced it imposed a fine on an organization for failing to involve the Data Protection Officer in the implementation of the "test" video surveillance system. www.legifrance.gouv.fr/cnil/id/CNIL...

Latombe is not Schrems III as previously thought. The DPC initiated an inquiry based on a complaint filed by Max Schrems against Facebook on data transfer. In April 2023, the DPC submitted its Draft Decision to peer regulators in the EU/EEA, as specified by Article 60 GDPR.

Mozambique’s Ministry of Communications and Digital Transformation launched a public consultation on its draft Personal Data Protection Law, while Namibia’s Ministry of Information and Communication Technology plans to introduce its Data Protection Bill this month.

I have not read the decision in Case T‑553/23 - Philippe Latombe v European Commission, as the ECJ has yet to release an English or Spanish version. Meanwhile, the CJEU has provided an English summary here: curia.europa.eu/juris/docume...

The DPA strictly limits the sharing of biometric data with third parties and prohibits data controllers from contributing to centralized biometric databases, except when data processors access and process such data on behalf of the controllers.

It is not clear if the Circular makes a reference to the right to data portability, as this would require organizations to implement privacy settings that allow individuals to share their personal data with third parties from their own devices.

While the right to be informed about the details of the existence of ADM is not defined in Law 1581 of 2012, the Colombian DPA instructed fintech organizations to inform individuals what information they use, why it is relevant, and what the likely impact is going to be.

Stay optimistic about Paraguay's Data Protection Bill, 2019. Despite its importance, the bill has faced repeated delays due to insufficient quorum or removal from the agenda.

Had you lost hope on the Massachusetts Data Privacy Protection Act? The Massachusetts Data Privacy Protection Act was reported favorably out of the Ways and Means Committee and has now moved to the Senate.

In Case C-526/24, Advocate General Szpunar advised that an initial access request under Article 12(5) GDPR may be deemed ‘excessive’ if the controller shows the data subject acted with abusive intent. curia.europa.eu/juris/docume...

AI is taking center stage in the DMA's first review. In my latest deep dive for MLex, I describe how the Commission is framing the issue, the many legal questions that it is facing, and the three policy options that are currently on the table. www.mlex.com/mlex/article...

India's DPDPA final rules are expected by 28th September 2025. Vietnam's Ministry of Public Security has published a draft Executive Decree for the Personal Data Law. Indonesia’s Government Regulation (RPP PDP) under Law No. 27 of 2022 was due to be enacted last month.

The Office of the Australian Information Commissioner found that Kmart Australia breached Australians’ privacy by collecting their personal and sensitive information through a facial recognition technology (FRT) system designed to tackle refund fraud. See www.oaic.gov.au/news/media-c...

Any thoughts?

At this point all I can do is laugh (and look forward to the next DPC letter promising to be in touch with a substantial update on my complaint shortly) www.irishtimes.com/business/202...

The Italian DPA has ordered an airline to stop using its Face Boarding system to process passengers’ biometric data at Milan Linate airport’s access and boarding gates. See garanteprivacy.it/web/guest/ho....

The Spanish DPA has ordered an organization to cease the processing of B2B personal data obtained from a third party until a legal basis under Article 6(1) GDPR is established, and to delete any data processed without such a legal basis within 3 months, at www.aepd.es/documento/ps...

Poland is pushing to delay the EU AI Act’s penalty regime for high-risk AI by 6–12 months. In a non-paper, Warsaw calls for suspending Article 99 sanctions, clearer guidance, alternatives to technical standards, and wider use of AI sandboxes. www.mlex.com/mlex/artific...

Facilitating the secondary use of health data for public interest purposes across borders. See www.oecd.org/content/dam/...

To date, several EU member states have established DPAs tasked with overseeing and enforcing Article 5 of the EU AI Act. There is some uncertainty regarding whether the one-stop shop mechanism applies to investigations into non-compliance with Article 5.

Will the third time be the charm for Canadian Government to reform PIPEDA? Credits: Vance Lockton

The 🇪🇺 Commission just opened a public consultation confirming the digital omnibus will cover the AI Act. It will propose “targeted adjustments” to ensure effective, predictable enforcement. Feedback is open for 4 weeks. ec.europa.eu/info/law/bet...

The Consultative Committee of Convention 108 published its draft Guidelines on Privacy and Data Protection in the context of Large Language Model-based systems. The proposed guidelines will be discussed during the 64th Bureau Meeting.

Were you able to access the complaint www.courtlistener.com/docket/71255..., dear Mr. @chronotope.aramzs.xyz?

China’s Public Security Network Department announced it had imposed a penalty on Artificial Intelligence Model Training Technology Co., Ltd. for failing to conduct a DPIA before processing sensitive biometric personal information such as faces.

The processing of personal data of third parties who are not parties to the contract or the pre-contractual measure is not covered by the legal basis. Therefore, manufacturers, providers, or users of an AI system cannot use contracts as legal basis for such processing.

The Federal Administrative Court of Austria recently ruled that the Public Employment Service's use of an algorithm to classify job seekers counts as 'automated decision-making' under Article 22, but since human intervention was present, it did not violate GDPR.

Under GDPR, individuals can request human oversight for certain ADM. The Federal Administrative Court recently ruled that the Public Employment Service's use of an algorithm to classify job seekers counts as ADM, but since human intervention was present, it did not violate GDPR.

SB 7 passed and heads to Newsom

Titus Wu - While Bauer-Kahan's AB1018 targeting algorithmic discrimination from AI tools is paused, SB 53, Sen. Wiener's AI safety disclosures measure and arguably the most watched Calif AI bill, passed and heads to Newsom.

The Baden-Württemberg DPA created ONKIDA, a GDPR-compliant AI standard, to help organizations interpret GDPR rules for AI. It provides positions, guidance and recommendations from data protection authorities to support compliance.

From my understanding, these provisions apply to large-scale online platforms, which are defined as network platforms with over 50 million registered users or more than 10 million monthly active users

The Cyberspace Administration of China (CAC) issued the draft Provisions on the Establishment of Personal Information Protection Supervisory Committees by Large Internet Platforms under Article 58 of China’s PIPL.

As the Commission and Brazil make progress toward a mutual adequacy decision, Paraguay's Data Protection Bill have been dropped from the Chamber of Deputies' agenda. If Brazil gains adequacy, Paraguay will be the only Mercosur country without both an adequacy decision and a DPL.

Colombia's Constitutional Court instructed Meta to revise Instagram’s Terms of Use and Privacy Policy for Colombian users.