IT Security & Privacy

On September 3, 2026, the Warsaw Voivodeship Administrative Court upheld the Polish data protection authority's October 2025 reprimand of a Sejm member who disclosed a resident's personal data during a live-streamed parliamentary inspection. The court found no legal basis for the disclosure and held that it was not necessary for the stated purpose. Compliance teams should treat this as confirmation that a legitimate public function does not override the necessity and data minimization requirements of data protection law.

Hundreds of Metropolitan Police officers and staff used an unapproved third-party platform to share personal information about suspected shoplifters, including children, over an 18-month period without adequate data protection safeguards or oversight, according to findings released by the UK's Information Commissioner's Office (ICO).

The Dutch Data Protection Authority (AP) has formally objected to the draft decree implementing the revised EU Human Trafficking Directive. It found that the GDPR legal bases of public interest task and legal obligation are not properly established in law. Without further regulation, processing of victims' personal data, including special category and criminal data, could be unlawful. Compliance teams should treat this as a signal of how strictly regulators apply the Article 6(3) requirement.

Australian financial services firm Fortnum Private Wealth has been ordered to pay a $939,000 (A$1.35 million) penalty after admitting it failed to adequately manage cybersecurity risks across a network of financial advisers serving around 55,000 retail clients.

South Korean financial authorities are preparing a review of cybersecurity controls after a series of attacks exposed approximately 100,000 pieces of customer information across 16 financial companies, deepening concerns raised by earlier reports that hackers had used a Chinese-developed artificial intelligence agent to breach banking systems.

The AEPD upheld a data subject's GDPR Article 17 complaint against ByteDance Pte. Ltd. after the company allegedly required a user to log in and accept new CapCut terms before it would process an erasure request. The decision shows that regulators will scrutinize identity verification steps that effectively block rights requests. It also shows that a controller's failure to engage with the regulator can lead to an adverse outcome by default.

Japan's financial regulator has urged banks to strengthen their cybersecurity defenses following a series of attacks that exposed millions of customer records and prompted a senior government official to describe the situation as a cybersecurity emergency.