IT Security & Privacy

The Dutch Data Protection Authority has completed its mandatory GDPR Article 36(4) legislative review of the draft Data Governance Regulation Implementation Regulation and raised no objections. This clears a key regulatory checkpoint for the decree's progression, signaling that the Dutch government's approach to implementing the EU Data Governance Regulation aligns with GDPR principles and fundamental rights protections.

The Dutch Data Protection Authority (DPA) reviewed a draft regulation on the Smoking Cessation Programme Scheme and identified a single but significant deficiency: the draft fails to specify which categories of personal data healthcare providers must exchange when declaring mutually provided services. This matters for compliance teams because it reinforces the DPA's consistent expectation that any legal basis permitting data sharing, particularly data touching on health information, must meet strict legal certainty standards under GDPR.

The Netherlands Data Protection Authority (AP) has reviewed the draft Regulation on the Experiment in Rehabilitation and Recovery Care (NR/REG-2701) under Article 36(4) GDPR and raised no objections. While this is a sector-specific healthcare regulation, it illustrates the AP's assessment framework for evaluating proportionality and data protection safeguards in draft legislation, which is instructive for compliance teams managing GDPR-related legislative consultations.

The FCA has published findings from its Defence, Security, and Resilience (DSR) Lab, a joint exercise with the Ministry of Defence that tested firms' preparedness for systemic, sector-wide shocks such as satellite spoofing, subsea cable damage, and cyberattacks on critical infrastructure. While not formal guidance or a statement of regulatory obligations, the update signals growing supervisory focus on shared dependencies and national resilience, and provides a self-assessment framework compliance teams should use proactively.

A gambling operator in Croatia offered its casino customers a shortcut. Instead of producing an identity card on every visit, players could use an RFID chip or their fingerprints to identify themselves more quickly. For 34,933 players, consent to biometric processing was recorded. But when Croatia’s Personal Data Protection Agency examined how that system actually worked, it found that the operator was collecting more than it said it was collecting.

The SEC is hosting a roundtable to discuss the regulatory, operational, and infrastructure requirements necessary to transition toward 24-hour trading markets. This announcement signals an upcoming regulatory focus on market integrity, enhanced surveillance capabilities, and robust systems readiness during non-traditional hours.

Italy’s privacy regulator has fined IQVIA Solutions Italy €7 million over a database containing the health information of roughly 1 million patients, finding that data the company regarded as anonymous could, in fact, be traced back to individuals.