IT Security & Privacy

The UK Information Commissioner's Office (ICO) has confirmed a live investigation into whether Police Scotland is meeting its legal obligations when handling subject access requests (SARs), including statutory response timescales. Although the matter concerns a law enforcement body, it signals continued regulatory focus on SAR compliance that financial institutions should treat as a prompt to review their own processes.

Moody’s Investors Service Middle East reported seven incidents of inadvertent data disclosure to Dubai’s financial regulator over a period of nearly two and a half years. Four involved confidential information reaching recipients outside the company. During that period, the credit rating agency had discontinued using a data security tool without immediately replacing it.

The Office of the Australian Information Commissioner (OAIC) received 667 notifications between January and June, compared with 662 in the preceding reporting period. Figures released Monday show that breaches involving large numbers of people became considerably more frequent, even as organizations improved the speed with which they identified incidents.

A New Mexico judge has ordered Meta Platforms to pay $25 billion in civil penalties after a jury found that Facebook repeatedly misled consumers about their personal information and the company's handling of harmful content. The judgment, issued Wednesday, is among the largest financial penalties ever imposed on a U.S. corporation.

Norway's data protection authority received 282 reports of personal data breaches linked to deliberate cyberattacks in the first half of 2026, up from 103 during the same period last year, as intrusions at shared technology suppliers exposed information belonging to multiple organizations.

The European Commission has opened a formal investigation into Booking.com over concerns that fraudulent accommodation listings, phishing scams and undisclosed paid promotions may be exposing travelers to risks the platform has failed to adequately address.

The UK's Information Commissioner's Office (ICO) reprimanded Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, on October 20 after finding that both organizations had failed to maintain adequate security controls and oversight of accounts on Data Cymru's network.