IT Security & Privacy

APRA has imposed license conditions, a higher minimum liquidity requirement, and an AUD $50 Million operational risk capital add-on on ING Bank Australia Limited after the bank disclosed multi-year miscalculations that overstated its Liquidity Coverage Ratio (LCR). Reported LCR was around 160 percent, but the true figure was substantially lower and at times fell below the 100 percent minimum under APS 210. The action shows that APRA treats inaccurate prudential reporting as a governance and risk management failure, not a technical error.

On September 3, 2026, the Warsaw Voivodeship Administrative Court upheld the Polish data protection authority's October 2025 reprimand of a Sejm member who disclosed a resident's personal data during a live-streamed parliamentary inspection. The court found no legal basis for the disclosure and held that it was not necessary for the stated purpose. Compliance teams should treat this as confirmation that a legitimate public function does not override the necessity and data minimization requirements of data protection law.

Hundreds of Metropolitan Police officers and staff used an unapproved third-party platform to share personal information about suspected shoplifters, including children, over an 18-month period without adequate data protection safeguards or oversight, according to findings released by the UK's Information Commissioner's Office (ICO).

The Dutch Data Protection Authority (AP) has formally objected to the draft decree implementing the revised EU Human Trafficking Directive. It found that the GDPR legal bases of public interest task and legal obligation are not properly established in law. Without further regulation, processing of victims' personal data, including special category and criminal data, could be unlawful. Compliance teams should treat this as a signal of how strictly regulators apply the Article 6(3) requirement.

Australian financial services firm Fortnum Private Wealth has been ordered to pay a $939,000 (A$1.35 million) penalty after admitting it failed to adequately manage cybersecurity risks across a network of financial advisers serving around 55,000 retail clients.

South Korean financial authorities are preparing a review of cybersecurity controls after a series of attacks exposed approximately 100,000 pieces of customer information across 16 financial companies, deepening concerns raised by earlier reports that hackers had used a Chinese-developed artificial intelligence agent to breach banking systems.

The AEPD upheld a data subject's GDPR Article 17 complaint against ByteDance Pte. Ltd. after the company allegedly required a user to log in and accept new CapCut terms before it would process an erasure request. The decision shows that regulators will scrutinize identity verification steps that effectively block rights requests. It also shows that a controller's failure to engage with the regulator can lead to an adverse outcome by default.