The European Securities and Markets Authority (ESMA), the EU’s financial markets regulator, has released its European Common Enforcement Priorities (ECEP) for 2024 corporate reporting. This annual guidance aims to harmonize supervision across the EU and outlines areas that ESMA, alongside European national enforcers, will focus on as they review corporate reports in 2025.
Acting Comptroller of the Currency Michael J. Hsu warned financial institutions against falling into compliance tunnel vision, citing historical examples where regulatory focus on specific risks inadvertently created new vulnerabilities in the financial system.
This week, FINRA ramped up its enforcement efforts, penalizing two brokerage firms—Fenix Securities, LLC and Interactive Brokers LLC—for serious compliance violations. The fines and censures handed down highlight the regulator’s ongoing commitment to enforcing rules that safeguard market integrity and protect investors.
The Irish Data Protection Commission (DPC) has levied a substantial fine of €310 million against LinkedIn Ireland Unlimited Company, following a lengthy inquiry into the company's data processing practices. This inquiry, initiated on August 20, 2018, stemmed from a complaint lodged by the French non-profit organization La Quadrature Du Net. Initially filed with the French Data Protection Authority, the complaint was subsequently referred to the DPC, which serves as the lead supervisory authority for LinkedIn.
The Consumer Financial Protection Bureau (CFPB) has mandated that Apple Inc. and Goldman Sachs Group, Inc. pay more than $89 million due to substantial customer service failures and misleading practices affecting hundreds of thousands of Apple Card users. The CFPB's investigation revealed that the two companies mishandled transaction disputes and provided inaccurate information about interest-free payment options for consumers.
Pennsylvania State University (Penn State) has agreed to pay $1.25 million to settle allegations of violating the False Claims Act, stemming from its failure to meet contractual cybersecurity requirements between 2018 and 2023. The university allegedly failed to implement cybersecurity controls mandated by the Department of Defense (DoD) and NASA on 15 contracts or subcontracts. These failures included misrepresenting the implementation of specific cybersecurity controls and using a cloud service provider that did not meet DoD’s security standards for handling sensitive defense information.
The Office of the Australian Information Commissioner (OAIC) has released two new guides to help businesses navigate privacy obligations when using artificial intelligence (AI) products. These guides provide clarity on how the Australian Privacy Act 1988 applies to AI, aiming to improve compliance and safeguard privacy as AI technologies become more prevalent in business practices.