€5 million. Tens of millions of patient records. And a compliance argument that failed at first contact with a regulator. France’s CNIL fined IQVIA Operations France for breaches in two health data warehouses — one fed by 14,000 pharmacies, one…
Seven weeks. That’s the gap between today and August 2, 2026 — the date the EU AI Act’s high-risk obligations become enforceable. Annex III covers AI systems in biometrics, critical infrastructure, employment, education, law enforcement, and migration. From August 2,…
€18 million. Spain’s largest-ever privacy fine. For using data passengers already gave you — just not for this. Spain’s AEPD fined Amadeus IT Group for building a traveller-profiling system from historical booking data. The data was real. The consent wasn’t…
€200M fine. Not for selling illegal products — for failing to assess whether they were being sold. The EU just issued its largest-ever Digital Services Act penalty against Temu. The Commission’s finding: Temu’s 2024 risk assessment described risks facing “the…
$409M. 37.5M users. One unrevoked key. South Korea just issued its largest-ever data protection fine — against Coupang, the country’s biggest e-commerce platform. What The Investigation Found • A former engineer who built Coupang’s authentication system stole the signing key before…
For organizations handling large-scale personal data, the compliance risk equation just changed dramatically. South Korea’s Personal Information Protection Commission (PIPC) announced a major enforcement shift focused on prevention-first compliance — while simultaneously increasing the maximum privacy penalty ceiling from 3%…
The UK ICO has fined South Staffordshire Water following a ransomware attack that exposed major failures in cybersecurity governance, monitoring, and data protection controls. What makes this case particularly serious is not just the breach itself — it’s how long…
$12.75 million penalty. Hundreds of thousands of drivers affected. Largest CCPA settlement in California history. General Motors is facing the consequences of treating connected vehicle data as a monetization asset instead of a regulated liability. California regulators allege GM collected…
The Dutch Data Protection Authority, together with regulators from Finland and Norway, imposed a €100 million GDPR fine on Yango’s operator MLU B.V. for allegedly transferring EU user data to Russia without adequate safeguards. Regulators said the company failed to…
Cross-border data transfers to China are moving back into the European regulatory spotlight. Ireland’s Data Protection Commission (DPC) has launched a formal GDPR investigation into Shein over the transfer of European user data to China. Key Focus Areas • Whether…
