A single GDPR violation used to mean one regulator. One fine. One corrective order. That model is over. The EDPB’s Coordinated Enforcement Framework has been operational since 2023. What it means in practice: a violation that might once have drawn…
A privacy fine just triggered a Congressional trade investigation. Then the President’s stock trades surfaced. South Korea’s PIPC imposed two separate fines on Coupang Inc. totalling ~$410 million: $278M for a November 2025 breach affecting 33.7 million users, and $132M…
Attackers exploited a third-party software vulnerability in KDDI’s shared email platform, potentially exposing login credentials of up to 14.22 million customers across six ISPs: STNet, JCOM, Chubu Telecom, NIFTY, BIGLOBE, and KDDI Web Communications. The breach was detected June 17…
The G7 DPA roundtable — hosted by CNIL in Paris during France’s G7 presidency — adopted two formal documents this week. The first: a declaration on privacy-preserving age assurance, establishing principles for robust, rights-respecting, and interoperable age verification across jurisdictions…
31% of production AI agent deployments are being rolled back for a single reason: PII exposure. Not hallucination. Not performance. Personal data surfacing where it shouldn’t — in customer interactions, in logs, in outputs that were never meant to contain…
₩248 million. A separate fine, against a separate entity — and a fundamentally different set of violations. While South Korea’s record $409M penalty against Coupang focused on a breach affecting 37.5 million consumers, the PIPC’s action against Coupang Fulfillment Services…
€5 million. Tens of millions of patient records. And a compliance argument that failed at first contact with a regulator. France’s CNIL fined IQVIA Operations France for breaches in two health data warehouses — one fed by 14,000 pharmacies, one…
Seven weeks. That’s the gap between today and August 2, 2026 — the date the EU AI Act’s high-risk obligations become enforceable. Annex III covers AI systems in biometrics, critical infrastructure, employment, education, law enforcement, and migration. From August 2,…
€18 million. Spain’s largest-ever privacy fine. For using data passengers already gave you — just not for this. Spain’s AEPD fined Amadeus IT Group for building a traveller-profiling system from historical booking data. The data was real. The consent wasn’t…
€200M fine. Not for selling illegal products — for failing to assess whether they were being sold. The EU just issued its largest-ever Digital Services Act penalty against Temu. The Commission’s finding: Temu’s 2024 risk assessment described risks facing “the…
