Compliance & Ethics

The Spanish Data Protection Agency's legal office (Gabinete Jurídico) reviewed a draft protocol governing student and resident access to patient information and identified three data protection concerns. These were the unclear legal basis for patient refusal of student presence, overly vague limits on clinical record access, and missing file-creation requirements for a student register. Although the report applies the now-superseded LOPD (Organic Law 15/1999), it shows how regulators assess health data access, consent, and governance, which remains relevant for organizations handling sensitive data.

The Norway Financial Supervisory Authority (Finanstilsynet) has issued a warning about "Nexdiltd," described as a clone of an FCA-registered firm, and has referenced the related UK Financial Conduct Authority (FCA) warning. Compliance teams should treat this as a fraud and impersonation alert and screen customers, counterparties, and payment flows for links to the entity.

The Spanish Data Protection Agency (AEPD) concluded in a 2016 legal opinion that a city council cannot authorize a fishermen's society to install video surveillance cameras in public-domain lagoons. Capturing images in public places is reserved to the Security Forces and Corps under Organic Law 4/1997, with authorization granted by the Government Delegate. Compliance teams should note the strict limits on private video surveillance of public spaces and the broad treatment of images, voice, and license plates as personal data.

The Hong Kong SFC has issued a circular requiring management companies of SFC-authorized public funds with direct or indirect private credit or private equity exposure to adopt enhanced offering document disclosures. Funds with 50% or more of NAV in private market assets will be classified as complex products, and the SFC may also designate funds below that level. Compliance teams should begin reviewing existing funds now, as the SFC expects updates as soon as practicable.

The Norway Financial Supervisory Authority has published a warning that references a Luxembourg CSSF notice about fraudulent actors misusing the name of Gekko Fund SICAV. Compliance teams should treat this as an impersonation and investment fraud alert and update screening, monitoring, and customer-protection controls accordingly.

The Norway Financial Supervisory Authority (Finanstilsynet) has posted a warning about Impound Services Ltd, a United Kingdom-issued notice that links to the UK Financial Conduct Authority (FCA) warnings list. Compliance teams should treat the entity as a high-risk, potentially unauthorized or fraudulent counterparty and screen for any exposure. The source material is sparse, so internal verification against the FCA page is essential.

The Norway Financial Supervisory Authority has published a warning that references a UK FCA alert about "Blackswan Trading," a clone of an FCA-registered firm. Clone firms impersonate legitimate authorized entities to defraud investors, so compliance teams should update screening controls and customer-protection messaging.