The European Supervisory Authorities are preparing to enter 2026 with one of their most consequential joint programs to date, a year that will test the strength of the EU’s new digital resilience architecture while reshaping how consumer protection, sustainability, and supervision converge across sectors.
The UK Information Commissioner’s Office (ICO) has fined outsourcing giant Capita and its pensions subsidiary a combined £14 million for failing to protect personal data in a 2023 cyberattack that exposed the information of 6.6 million people.
Ofcom has fined Royal Mail £21 million after the postal operator once again failed to meet its statutory delivery targets for First and Second Class mail during the 2024/25 financial year.
Europe’s data regulators are turning the spotlight on transparency, one of the GDPR’s most fundamental principles. During its October plenary, the European Data Protection Board (EDPB) agreed that its 2026 Coordinated Enforcement Framework (CEF) action will focus on how well organizations are informing people about the use of their personal data under Articles 12, 13, and 14 of the regulation.
Eight major auto insurance companies have agreed to pay more than $19 million in penalties to New York State following a sweeping cybersecurity investigation by the Department of Financial Services (DFS). The enforcement action, announced Tuesday by Superintendent Adrienne A. Harris, revealed failures in data security controls that exposed the personal information of New Yorkers through online insurance quoting systems.
The European Parliament’s Legal Affairs Committee has approved new draft rules that would significantly reduce the number of companies required to conduct sustainability reporting and comply with due diligence obligations.
The UK’s Financial Conduct Authority (FCA) has secured $101 million in redress for UK and other non-U.S. investors in a fund sub-managed by BlueCrest Capital Management, concluding a years-long legal battle over the firm’s mishandling of conflicts of interest.