A single GDPR violation used to mean one regulator. One fine. One corrective order. That model is over. The EDPB’s Coordinated Enforcement Framework has been operational since 2023. What it means in practice: a violation that might once have drawn…
€5 million. Tens of millions of patient records. And a compliance argument that failed at first contact with a regulator. France’s CNIL fined IQVIA Operations France for breaches in two health data warehouses — one fed by 14,000 pharmacies, one…
€18 million. Spain’s largest-ever privacy fine. For using data passengers already gave you — just not for this. Spain’s AEPD fined Amadeus IT Group for building a traveller-profiling system from historical booking data. The data was real. The consent wasn’t…
The UK ICO has fined South Staffordshire Water following a ransomware attack that exposed major failures in cybersecurity governance, monitoring, and data protection controls. What makes this case particularly serious is not just the breach itself — it’s how long…
Two Chinese State Council decrees entered into force on April 7, 2026 — with no transition period, no grace period, and no implementing guidelines. For any organization subject to EU law that maintains commercial relationships with Chinese entities, these regulations…
A Danish court has fined a public authority DKK 500,000 for failing to remediate a known security vulnerability — marking a clear enforcement signal on operational security. The ruling by Vestre Landsret clarifies when data controllers are held liable under…
If you think compliance risk sits only in cybersecurity… you’re already exposed. In March, Intesa Sanpaolo was hit twice by the Garante per la protezione dei dati personali—for very different failures, but with a single underlying message: 1. Strategic failure:…
The signal is clear: Europe wants AI-driven innovation in healthcare — but not at the expense of data protection. What Matters • Support for scale: Regulators back efforts to streamline clinical trials and enable cross-border data use • No compromise on fundamentals:…
Spain’s data protection authority, AEPD, has fined Yoti €950,000 over its facial age-verification technology — a clear signal that biometric compliance is now under intense regulatory scrutiny. Key GDPR Breaches Identified • Unlawful processing of biometric data (special category data) • Invalid consent (not sufficiently informed,…
The EU’s Digital Omnibus initiative — aimed at simplifying digital regulations — has taken a notable turn. A leaked Council draft (Feb 2026) shows that EU member states have removed the European Commission’s proposal to redefine “personal data” under the…
