IT Security & Privacy

The Dutch Data Protection Authority (AP) has formally objected to the draft decree implementing the revised EU Human Trafficking Directive. It found that the GDPR legal bases of public interest task and legal obligation are not properly established in law. Without further regulation, processing of victims' personal data, including special category and criminal data, could be unlawful. Compliance teams should treat this as a signal of how strictly regulators apply the Article 6(3) requirement.

Australian financial services firm Fortnum Private Wealth has been ordered to pay a $939,000 (A$1.35 million) penalty after admitting it failed to adequately manage cybersecurity risks across a network of financial advisers serving around 55,000 retail clients.

South Korean financial authorities are preparing a review of cybersecurity controls after a series of attacks exposed approximately 100,000 pieces of customer information across 16 financial companies, deepening concerns raised by earlier reports that hackers had used a Chinese-developed artificial intelligence agent to breach banking systems.

The AEPD upheld a data subject's GDPR Article 17 complaint against ByteDance Pte. Ltd. after the company allegedly required a user to log in and accept new CapCut terms before it would process an erasure request. The decision shows that regulators will scrutinize identity verification steps that effectively block rights requests. It also shows that a controller's failure to engage with the regulator can lead to an adverse outcome by default.

Japan's financial regulator has urged banks to strengthen their cybersecurity defenses following a series of attacks that exposed millions of customer records and prompted a senior government official to describe the situation as a cybersecurity emergency.

Norway's data protection authority has fined Microsoft-owned advertising technology company Xandr approximately $9.6 million (NOK 92 million) for unlawfully processing and sharing sensitive personal information belonging to users of the dating app Grindr.

Australia's privacy regulator has opened an investigation into the developer of an application used in inexpensive smart glasses sold through Kmart, Big W Marketplace and Amazon, after the company failed to answer questions about how the devices collect and handle personal information.