Two high-risk compliance deadlines just moved. The transparency deadline did not. It hits on 2 August. On 29 June, the EU Council gave final approval to the AI Act Digital Omnibus — the first substantive amendment since the Act’s 2024…
The legal foundation of EU-US data transfers is under formal challenge for the third time in a decade. On 30 June, privacy organisation noyb sent a formal letter to the European Commission requesting withdrawal of the EU-US Data Privacy Framework…
The EDPB just published guidelines that redefine when data qualifies as anonymous — and the answer now depends on who holds it. On 8 July, the European Data Protection Board adopted new guidelines on anonymisation, incorporating the Court of Justice…
A privacy fine just triggered a Congressional trade investigation. Then the President’s stock trades surfaced. South Korea’s PIPC imposed two separate fines on Coupang Inc. totalling ~$410 million: $278M for a November 2025 breach affecting 33.7 million users, and $132M…
Attackers exploited a third-party software vulnerability in KDDI’s shared email platform, potentially exposing login credentials of up to 14.22 million customers across six ISPs: STNet, JCOM, Chubu Telecom, NIFTY, BIGLOBE, and KDDI Web Communications. The breach was detected June 17…
The G7 DPA roundtable — hosted by CNIL in Paris during France’s G7 presidency — adopted two formal documents this week. The first: a declaration on privacy-preserving age assurance, establishing principles for robust, rights-respecting, and interoperable age verification across jurisdictions…
₩248 million. A separate fine, against a separate entity — and a fundamentally different set of violations. While South Korea’s record $409M penalty against Coupang focused on a breach affecting 37.5 million consumers, the PIPC’s action against Coupang Fulfillment Services…
€5 million. Tens of millions of patient records. And a compliance argument that failed at first contact with a regulator. France’s CNIL fined IQVIA Operations France for breaches in two health data warehouses — one fed by 14,000 pharmacies, one…
€18 million. Spain’s largest-ever privacy fine. For using data passengers already gave you — just not for this. Spain’s AEPD fined Amadeus IT Group for building a traveller-profiling system from historical booking data. The data was real. The consent wasn’t…
$409M. 37.5M users. One unrevoked key. South Korea just issued its largest-ever data protection fine — against Coupang, the country’s biggest e-commerce platform. What The Investigation Found • A former engineer who built Coupang’s authentication system stole the signing key before…
