Artificial Intelligence

Rhode Island’s new AI and healthcare privacy lawAI Appreciation Day 2026 and key developments in governance and complianceWhen AI becomes the cyber attacker: Mythos and what comes next

Australian privacy reform

Australian Privacy Alert: Parliament passes major and meaningful privacy law reform

BIPA

BIPA damages accrue per transactionBIPA and the record retention requirementAnother Day, another large BIPA Settlement

CCPA

Getting ready for California’s new cybersecurity audit requirementsPartial compliance is noncompliance: Lessons from California’s $2.75 million settlement with DisneyCalifornia’s proposed cybersecurity audit regulation

Compliance and risk management

Record €18m fine for an IT service provider to the aviation sector - reuse of customer dataUK data protection complaints – new complaints handling obligations for controllers from 19 JuneCybersecurity and Personal Data: The CNIL toughens its stance

COPPA

FTC’s COPPA Rule changes include AI training consent requirementFTC finalizes COPPA rule amendments 

Cybercrime

Happy Cyber Awareness MonthDutch DPA publishes report on personal data breachesTR v Land Hessen – DPA not obliged to fine under the GDPR

Cybersecurity

AI Appreciation Day 2026 and key developments in governance and complianceNYDFS issues guidance “in a heightened cybersecurity environment”When AI becomes the cyber attacker: Mythos and what comes next

Data breach

Changes to EU and UK data protection law – a tale of two GDPRs?California tightens data breach notification timelines, imposes 30-day notice requirementDutch DPA publishes report on personal data breaches

Data protection

Quantum computing and cyber riskAI Appreciation Day 2026 and key developments in governance and complianceRecord €18m fine for an IT service provider to the aviation sector - reuse of customer data

Data transfer

Pseudonymised data could fall outside data protection law – introducing the “means reasonably likely” assessmentLessons on international transfers to the US to organisations caught by the GDPRThailand – The Regulation with respect to Cross-border Transfer of Personal Data

Dispute resolution and litigation

Protective order violations lead to sanctions in Uber MDL litigationTR v Land Hessen – DPA not obliged to fine under the GDPRUS SEC charges SolarWinds and its CISO for alleged cybersecurity misstatements and controls failures

Enforcement

Record €18m fine for an IT service provider to the aviation sector - reuse of customer dataOnline Safety Act: Protecting Children from Harmful Content Online – Ofcom’s Guidance on Age Assurance for Part 3 ServicesCSA releases guidance on the use of artificial intelligence in capital markets

Fintech

Can you access your outsourced data?CSA releases guidance on the use of artificial intelligence in capital marketsFCA sets out plans to make Big Tech a priority and provides update on its approach to AI

General

FTC finalizes COPPA rule amendments New Horizons in Data Protection: Malaysia’s Personal Data Protection (Amendment) Act 2024Minnesota enacts comprehensive privacy law

HIPAA

Navigating AI compliance with HIPAA essentialsUS Dept of Health proposes Security Rule amendments that includes new deadlines$3 million HIPAA Settlement

HIPPA

HHS updates online tracker guidance

Information governance

HHS and state AGs fine ambulance firm over $500,000, require enhanced security, privacy, and data minimization practicesCelebrating Global Information Governance Day: Why information governance matters more than everHappy Information Governance Day

Intellectual property

Generative AI: Updated global guide to key IP considerationsDeal-maker or deal-breaker: the legal ins and outs of using AI in M&APractical steps for businesses to comply with Bill C-27: part 2

M&A transactions

Integrating artificial intelligence in M&A processes: A new strategic era - Part 1: Leveraging AI and its advantagesDeal-maker or deal-breaker: the legal ins and outs of using AI in M&APrivacy and Cybersecurity Due Diligence Considerations in M&A Transactions

Metaverse

Privacy in a Parallel Digital Universe: The Metaverse

NT Analyzer blog series

Partial compliance is noncompliance: Lessons from California’s $2.75 million settlement with DisneyThe California Privacy Protection Agency may be clicking through your websiteNT Analyzer can help determine “data broker” status under the new Bulk Data Transfer requirements

PDPA

Singapore proposes Governance Framework for Generative AISingapore Releases Proposed Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision SystemsEuropean Commission and ASEAN releases Guide to ASEAN Model Contractual Clauses and EU Standard Contractual Clauses

PHIPA

Ontario moves towards introducing new privacy law

PIPEDA

Federal Privacy Commissioner Published Guidance on What Is “Sensitive” Personal InformationPrivacy in a Parallel Digital Universe: The MetaverseOntario moves towards introducing new privacy law

Privacy

UK data protection complaints – new complaints handling obligations for controllers from 19 JuneTax authorities’ access to individuals’ banking data: the European Court of Human Rights sets privacy limits in the case of Ferrieri and Bonassisa v. ItalyPrivacy Day 2026: Why trust is the new competitive advantage

Privacy law

Tax authorities’ access to individuals’ banking data: the European Court of Human Rights sets privacy limits in the case of Ferrieri and Bonassisa v. ItalyAgentic AI: the ICO’s early thoughts on the data protection implicationsThe Healthline Order: Privacy law grows teeth

Ransomware

Dutch DPA publishes report on personal data breachesRare recovery in a complex ransomware case: Major NetWalker arrest leads to significant asset seizureFTC Signals Additional Scrutiny for Data Breaches

Regulatory response

Agentic AI: the ICO’s early thoughts on the data protection implicationsPseudonymised data could fall outside data protection law – introducing the “means reasonably likely” assessmentDutch DPA publishes report on personal data breaches

SHIELD Act

New York changes data breach law—in December and FebruaryViolation of HIPAA Security Rule = Violation of NY SHIELD Act

Uncategorized

NYDFS issues guidance “in a heightened cybersecurity environment”Is my use case a high-risk AI system? Applying the Commission’s guidelines and next stepsColorado’s new AI governance law

Vendor management and transactions

Regulators, including FCC, emphasize third party vendor cybersecurity monitoring requirementsNYDFS releases guidance on third-party service provider risksCan you access your outsourced data?