Digital Economy and Data Protection Newsletter（26.19）

（Click on the source or copy the corresponding link to view the details）

1. The General Office of the CPC Central Committee and the General Office of the State Council issue the Opinions on Promoting the Deep Integration of Scientific and Technological Innovation and Industrial Innovation, calling for improved AI laws and regulations and stronger intellectual property protection in emerging fields

   Source: General Office of the CPC Central Committee; General Office of the State Council

   https://www.most.gov.cn/xxgk/xinxifenlei/fdzdgknr/fgzc/gfxwj/gfxwj2026/202610/t20261021_197540.html

   
   

2. The Central Cyberspace Affairs Commission issues the National Informatization Plan for the 15th Five-Year Plan Period, setting out tasks for cybersecurity, cross-border data flows and development of digital industries

   Source: Central Cyberspace Affairs Commission

   https://www.cac.gov.cn/2026-10/23/c_1794509044378569.htm

   
   

3. The China National Intellectual Property Administration issues a notice revising application forms for layout-designs of integrated circuits, in line with new rules taking effect on October 30

   Source: China National Intellectual Property Administration (CNIPA)

   https://www.cnipa.gov.cn/art/2026/10/21/art_75_208634.html

   
   

4. The revised Implementing Rules of the Regulations on the Protection of Layout-Designs of Integrated Circuits issued by the China National Intellectual Property Administration take effect on October 30

   Source: China National Intellectual Property Administration (CNIPA)

   https://www.cnipa.gov.cn/art/2026/10/9/art_106_208422.html

   
   

5. The Ministry of Industry and Information Technology seeks public comments on five mandatory national standards, including Automotive Data Security Requirements

   Source: Ministry of Industry and Information Technology (MIIT)

   https://www.miit.gov.cn/jgsj/zbys/qcgy/art/2026/art_0ea967f5be48474b9f50c3c6f7db8e1f.html

   
   

6. The Department of Science and Technology of the Ministry of Industry and Information Technology publishes 69 proposed industry standard projects for comment, including Requirements for Internet Agent Management Capabilities and Security Specifications for Smart Terminal Devices Dedicated to Minors

   Source: Ministry of Industry and Information Technology (MIIT)

   https://www.miit.gov.cn/jgsj/kjs/jscx/bzgf/art/2026/art_a3c22fc7b8a5485e97cbd811985074a1.html

   
   

7. The National Development and Reform Commission issues Order No. 49 of 2026, Measures for the Administration of Outbound Investment

   Source: National Development and Reform Commission (NDRC)

   https://www.ndrc.gov.cn/xxgk/zcfb/fzggwl/202610/t20261022_1408298_ext.html

   
   

8. The Ministry of Commerce and eight other departments issue opinions on invigorating commerce through science and technology, promoting the use of AI and data technologies in commerce and trade

   Source: Ministry of Commerce (MOFCOM)

   https://www.mofcom.gov.cn/zwgk/zcfb/art/2026/art_787f0441da1f4c0e8b5bad10118247f3.html

   
   

9. The Ministry of Commerce seeks public comments on the Special Provisions on the Protection of Chinese Trade Secrets (Draft for Comments)

   Source: Ministry of Commerce (MOFCOM)

   https://tfs.mofcom.gov.cn/lfzqyj/art/2026/art_db6a858a9d4e4ec0a3dbeece659c324d.html

   
   

10. The State Administration for Market Regulation approves 515 important national standards, including two mandatory national standards on intelligent connected vehicle data security

    Source: State Administration for Market Regulation (SAMR)

    https://www.samr.gov.cn/xw/zj/art/2026/art_1ac084d4d7e74bab8006036b88f93780.html

    
    

11. The Jiangsu Intellectual Property Office issues the Guidelines for the Registration, Utilisation and Protection of Data Intellectual Property in the Field of Artificial Intelligence in Jiangsu Province

    Source: Jiangsu Intellectual Property Office

    https://jsip.jiangsu.gov.cn/art/2026/10/28/art_85036_11849727.html

    
    

12. Wenzhou market regulators issue the Guidelines for the Protection of Trade Secrets in Artificial Intelligence Training Data in Wenzhou (2026 Edition)

    Source: Wenzhou Municipal Administration for Market Regulation

    
    

1. International: INTERPOL reports a joint cybercrime enforcement operation involving 21 countries, resulting in 1,462 arrests

   Source: International Criminal Police Organization (INTERPOL)

   https://www.interpol.int/en/News-and-Events/News/2026/Cybercrime-crackdown-in-Africa-nets-1-462-arrests-recovers-over-USD-105-million

   
   

2. European Union:

1. The European Commission publishes the first harmonised standard supporting implementation of the AI Act in the Official Journal of the European Union

   Source: European Commission

   https://digital-strategy.ec.europa.eu/en/library/first-harmonised-standard-supporting-ai-act-published-official-journal

   
   

2. The European Commission opens an information-request channel for fundamental rights authorities under Article 77 of the AI Act

   Source: European Commission

   https://digital-strategy.ec.europa.eu/en/miscellaneous/ai-act-request-channel-national-fundamental-rights-authorities

   
   

3. The Council of the European Union agrees its negotiating position on the “digital omnibus” proposal to simplify the GDPR, ePrivacy rules and cyber incident reporting requirements

   Source: Council of the European Union

   https://www.consilium.europa.eu/en/press/press-releases/2026/10/21/digital-rulebook-council-agrees-position-to-simplify-data-protection-privacy-and-cyber-reporting-rules/

   
   

4. The European Commission opens an investigation into Booking.com under the Digital Services Act concerning fraud and advertising transparency (October 21, 2026)

   Source: European Commission

   https://ec.europa.eu/commission/presscorner/detail/en/ip_26_2223

   
   

5. The European Commission accepts Temu’s action plan to remedy its breach of obligations under the Digital Services Act concerning illegal products

   Source: European Commission

   https://digital-strategy.ec.europa.eu/en/news/commission-accepts-temus-action-plan-remedy-breach-digital-services-act

   
   

6. The European Union Agency for Cybersecurity, together with the European Commission, Europol and other bodies, issues a joint security advisory on critical PHP vulnerabilities

   Source: European Union Agency for Cybersecurity (ENISA)

   https://www.enisa.europa.eu/news/joint-statement-on-critical-php-vulnerabilities

   
   

7. The European Union Agency for Cybersecurity (ENISA) publishes a technical advisory on software bills of materials (SBOMs)

   Source: European Union Agency for Cybersecurity (ENISA)

   https://www.enisa.europa.eu/publications/enisa-technical-advisory-for-software-bill-of-materials

   
   

8. The European Data Protection Supervisor (EDPS) publishes frequently asked questions on personal data breach notification

   Source: European Data Protection Supervisor (EDPS)

   https://www.edps.europa.eu/data-protection/our-role-supervisor/personal-data-breach/faq-about-data-breach-notification_en

   
   

3. United States:

1. U.S. NIST, NSA and CISA jointly publish PP-26-4396, identifying an AI agent’s “significant action without instruction” as a reportable control incident for the first time

   Source: National Institute of Standards and Technology (NIST)

   https://www.nist.gov/news-events/news/2026/10/key-practices-incident-readiness-and-response-super-intelligence-training

   
   

2. The U.S. Department of the Treasury publishes proposed regulations to implement the Comprehensive Outbound Investment National Security Act, seeking to expand outbound investment restrictions to six critical technology sectors

   Source: U.S. Department of the Treasury

   https://home.treasury.gov/news/press-releases/sb0667

   
   

3. The Securities and Exchange Commission publishes proposed amendments to the Options Clearing Corporation’s cybersecurity obligations, seeking to strengthen security incident reporting by clearing members and oversight of third-party service providers

   Source: U.S. Government Publishing Office (GovInfo)

   https://www.govinfo.gov/content/pkg/FR-2026-10-23/html/2026-21649.htm

   
   

4. The U.S. Copyright Office initiates a new rulemaking on exemptions from the prohibition on circumvention of technological protection measures under Section 1201 of the Copyright Act

   Source: U.S. Copyright Office

   https://www.copyright.gov/newsnet/2026/1097.html

   
   

5. The U.S. Court of Appeals for the Eleventh Circuit vacates a preliminary injunction blocking enforcement of Senate Bill 351

   Source: Office of the Attorney General of Georgia

   https://law.georgia.gov/press-releases/2026-10-15/carr-secures-major-victory-defense-georgias-social-media-law

   
   

6. The U.S. Department of Justice announces that a former employee pleads guilty to criminal copyright infringement involving the unlawful copying and sale of unreleased musical works by a well-known singer

   Source: U.S. Department of Justice

   https://www.justice.gov/opa/pr/former-eminem-employee-pleads-guilty-criminal-infringement-copyright

   
   

7. The U.S. Department of Justice reports a federal criminal sentence in a transnational cyberattack case involving approximately 47 organisations

   Source: U.S. Department of Justice

   https://www.justice.gov/opa/pr/syrian-man-sentenced-wide-ranging-hacking-conspiracy-conducted-behalf-bashar-al-assad-regime

   
   

8. The U.S. Federal Trade Commission imposes conditional requirements on Publicis Groupe’s acquisition of LiveRamp, restricting access to customer data

   Source: Federal Trade Commission (FTC)

   https://www.ftc.gov/news-events/news/press-releases/2026/10/ftc-order-preserves-competition-digital-advertising-ecosystem-part-publiciss-acquisition-liveramp

   
   

9. The Federal Trade Commission (FTC) launches an inquiry into personalised pricing and compensation practices involving nine companies, including Delta Air Lines and Uber

   Source: Federal Trade Commission (FTC)

   https://www.ftc.gov/news-events/news/press-releases/2026/10/ftc-launches-personalized-pricing-compensation-inquiry

   
   

10. The U.S. Department of Homeland Security makes public an order excluding procurement of DeepSeek technology products and requiring their removal from systems

    Source: U.S. Federal Register

    https://public-inspection.federalregister.gov/2026-21447.pdf

    
    

11. The California Attorney General’s Office announces a USD 6 million settlement in litigation over 23andMe data privacy

    Source: California Attorney General’s Office

    https://oag.ca.gov/news/press-releases/attorney-general-bonta-secures-6-million-settlement-23andme-litigation

    
    

12. The California Attorney General’s Office reaches a USD 1.8 million settlement with Lyft over privacy rights violations

    Source: California Attorney General’s Office

    https://oag.ca.gov/news/press-releases/privacy-rights-can%E2%80%99t-be-left-rearview-attorney-general-bonta-secures-18-million

    
    

13. On October 21, a judge of the First Judicial District Court of New Mexico rules in litigation arising from the Cambridge Analytica scandal that Meta made misleading statements concerning access to user data and its handling of hate speech and misinformation, in more than 43 million violations of the state Unfair Practices Act, imposing USD 25 billion in civil penalties plus interest at 15% per annum

    Source: New Mexico Department of Justice

    https://nmdoj.gov/press-release/the-new-mexico-department-of-justice-secures-another-landmark-victory-against-big-tech-with-historic-25-billion-penalty-against-facebook/

    
    

14. The Attorneys General of New York and Connecticut reach a USD 2.7 million settlement with BCHP and XTIUM over failures to protect data

    Source: New York State Attorney General’s Office

    https://ag.ny.gov/press-release/2026/attorney-general-james-and-attorney-general-tong-secure-27-million-pediatric

    
    

15. The Governor of New York signs a law on AI companion chatbot safety for minors, prohibiting specified high-risk interactive functions for minors

    Source: New York State Senate

    https://www.nysenate.gov/legislation/bills/2025/S9051

    
    

16. The Texas Attorney General sues OpenAI and its CEO, alleging that ChatGPT safety claims misled consumers

    Source: Office of the Attorney General of Texas

    https://www.oag.state.tx.us/news/releases/attorney-general-ken-paxton-sues-openai-and-ceo-sam-altman-lying-users-and-harming-texans

    
    

17. United States: CRRC Meishan Fastening Systems files an inter partes review (IPR) petition with the USPTO Patent Trial and Appeal Board (PTAB) to challenge the validity of a U.S. patent, but the petition is denied for failure to disclose its state-owned ownership background

    Source: United States Patent and Trademark Office (USPTO)

    https://ptacts.uspto.gov/ptacts/public-informations/petitions/1558920/download-documents?artifactId=ad_UIvrPsBdE5LWcNBaFvadEUdPFpVMsubCna-m92fumTH6usMrriYc

    
    

4. United Kingdom:

1. The Financial Conduct Authority publishes guidance on good and poor practices in the use of AI in financial services

   Source: Financial Conduct Authority (FCA)

   https://www.fca.org.uk/publications/good-poor-practice/ai-financial-services

   
   

2. The Information Commissioner’s Office (ICO) updates its guidance “Does an organisation need my consent?” under the Data (Use and Access) Act, adding examples and a template letter for withdrawing consent from organisations

   Source: Information Commissioner’s Office (ICO)

   https://ico.org.uk/consent

   
   

3. Ofcom opens formal investigations into two adult-content platforms under the Online Safety Act, focusing on duties to prevent the sharing of non-consensual intimate imagery

   Source: Office of Communications (Ofcom)

   https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/Enforcement-programme-into-measures-being-taken-by-services-to-prevent-users-from-encountering-or-sharing-non-consensual-intimate-imagery-NCII?language=en

   
   

4. Ofcom publishes an assessment of the effectiveness of age-assurance technology for 16-year-olds

   Source: Office of Communications (Ofcom)

   https://www.ofcom.org.uk/online-safety/protecting-children/rapid-assessment-of-highly-effective-age-assurance-at-16

   
   

5. Ofcom publishes a report assessing the impact of app stores on children’s online safety

   Source: Office of Communications (Ofcom)

   https://www.ofcom.org.uk/online-safety/protecting-children/report-on-the-use-of-app-stores-by-children

   
   

6. The High Court of England and Wales finds Shanghai-based Molssi Fashion in breach of contract and confirms that the ROCKFISH trademark licence agreement was validly terminated

   Source: High Court of England and Wales

   https://caselaw.nationalarchives.gov.uk/ewhc/bp/2026/2787

   
   

7. The High Court finds that a seller on Amazon UK infringed trademarks by selling counterfeit Marshall headphones

   Source: High Court of England and Wales

   https://caselaw.nationalarchives.gov.uk/ewhc/ipec/2026/2753

   
   

8. The ICO issues formal reprimands to two organisations following a ransomware attack that exposed the personal information of approximately 3,300 people

   Source: Information Commissioner’s Office (ICO)

   https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/10/password1-is-not-an-appropriate-password

   
   

9. The UK Competition and Markets Authority (CMA) proposes to designate Microsoft’s business software ecosystem as having strategic market status and seeks public comments

   Source: Competition and Markets Authority (CMA)

   https://www.gov.uk/government/news/cma-takes-first-steps-to-ensure-choice-in-business-software

   
   

5. South Korea:

1. The Korea Fair Trade Commission (KFTC) seeks public comments on the Draft Guidelines on AI-Related Labelling and Advertising

   Source: Korea Fair Trade Commission (KFTC)

   https://m.korea.kr/briefing/pressReleaseView.do?newsId=156786092

   
   

2. The Personal Information Protection Commission (PIPC) imposes fines totalling KRW 3.885 billion on Daekyo Co. and the Young Hoon Medical Foundation for breaches of security safeguard obligations

   Source: Personal Information Protection Commission (PIPC)

   https://pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=12600

   
   

3. The Ministry of Science and ICT announces the expansion of information security disclosure requirements to all KOSPI- and KOSDAQ-listed companies from 2027

   Source: Ministry of Science and ICT (MSIT)

   https://www.korea.kr/news/policyNewsView.do?newsId=148973964

   
   

6. Hong Kong, China:

1. The Office of the Privacy Commissioner for Personal Data (PCPD) issues guidance entitled “Smart Glasses: Tips for Protecting Personal Data Privacy”

   Source: Office of the Privacy Commissioner for Personal Data (PCPD)

   https://www.pcpd.org.hk/english/news_events/media_statements/press_20261027.html

   
   

2. The Office of the Privacy Commissioner for Personal Data (PCPD) publishes its 2025–26 Annual Report and submits it to the Legislative Council, reviewing privacy enforcement and public education activities on its 30th anniversary

   Source: Office of the Privacy Commissioner for Personal Data (PCPD)

   https://www.pcpd.org.hk/english/whatsnew/20261028.html

   
   

3. The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) issues a third-party supplier security risk alert following data breaches affecting companies including Cathay Pacific

   Source: Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT)

   https://www.hkcert.org/blog/data-leakage-and-third-party-risk-when-real-customer-information-becomes-a-tool-for-scammers

   
   

7. Russia:

1. The Federation Council passes a bill regulating IT outsourcing and cloud services in the financial sector, establishing requirements for outsourced processing of customer data and information security audits

   Source: Bank of Russia

   https://www.cbr.ru/press/event/?id=32940

   
   

2. A revised list of countries providing adequate protection of personal data issued by the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) takes effect on October 30

   Source: Official Internet Portal of Legal Information (Russia)

   https://publication.pravo.gov.ru/document/0001202610190001

   
   

8. Japan: The Personal Information Protection Commission seeks public comments on draft amendments to the Enforcement Rules of the Act on the Protection of Personal Information and other instruments, proposing to digitise administrative service by public notice

   Source: e-Gov Public Comment (Japan)

   https://public-comment.e-gov.go.jp/pcm/detail?CLASSNAME=PCMMSTDETAIL&Mode=0&id=240000131

   
   

9. Canada:

1. The Office of the Privacy Commissioner of Canada (OPC) issues its first Children’s Privacy Code, setting out safeguards concerning profiling of minors and AI-based decision-making

   Source: Office of the Privacy Commissioner of Canada (OPC)

   https://www.priv.gc.ca/en/opc-news/news-and-announcements/2026/nr-c_261020/

   
   

2. Federal, provincial and territorial privacy regulators jointly issue a resolution on the responsible use of AI in healthcare

   Source: Office of the Privacy Commissioner of Canada (OPC)

   https://www.priv.gc.ca/en/opc-news/news-and-announcements/2026/nr-c_261029/

   
   

3. The Privacy Commissioner of Canada launches an investigation into Navigate360 over a Crime Stoppers data breach and confirms that PIPEDA does not apply to non-profit organisations

   Source: Office of the Privacy Commissioner of Canada (OPC)

   https://www.priv.gc.ca/en/opc-news/news-and-announcements/2026/nr-c_261027/

   
   

4. The Office of the Privacy Commissioner of Canada (OPC) publishes its submission to the government’s public consultation on AI transparency

   Source: Office of the Privacy Commissioner of Canada (OPC)

   https://www.priv.gc.ca/en/opc-news/news-and-announcements/2026/nr-c_261023/

   
   

5. The Office of the Privacy Commissioner of Canada (OPC) publishes Loblaw’s commitments to strengthen information security following an earlier privacy breach

   Source: Office of the Privacy Commissioner of Canada (OPC)

   https://www.priv.gc.ca/en/opc-news/news-and-announcements/2026/nr-c_261026/

   
   

10. Germany:

1. The Bundestag passes a draft law implementing the EU Cyber Resilience Act

   Source: German Bundestag

   https://www.bundestag.de/dokumente/textarchiv/2026/kw42-de-cyberresilienz-1224508

   
   

2. The Bundestag Committee on Digital Affairs and State Modernisation (Digital Committee) approves draft amendments to the Digital Identity Act

   Source: German Bundestag

   https://dserver.bundestag.de/btd/21/074/2107408.pdf

   
   

3. The Federal Court of Justice (BGH) issues a clarifying judgment on disclosure obligations relating to SCHUFA credit scores under the General Data Protection Regulation

   Source: Federal Court of Justice (BGH)

   https://www.bundesgerichtshof.de/SharedDocs/Pressemitteilungen/DE/2026/2026198.html

   
   

11. France:

1. The French Data Protection Authority (CNIL) publishes guidance on the legal and compliance framework for reconstructing professional email addresses

   Source: Commission Nationale de l’Informatique et des Libertés (CNIL)

   https://www.cnil.fr/fr/reconstitution-adresses-professionnelles-quel-cadre

   
   

2. The French Data Protection Authority (CNIL) fines FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT a combined EUR 7 million for cookie and mobile app violations

   Source: Commission Nationale de l’Informatique et des Libertés (CNIL)

   https://www.cnil.fr/en/sanction-app-cookies-fnac

   
   

12. Italy:

1. The National Cybersecurity Agency (ACN) issues a decision simplifying NIS registration procedures for 2027

   Source: Italian National Cybersecurity Agency (ACN)

   https://www.acn.gov.it/portale/w/acn-semplifica-la-registrazione-nis-2027

   
   

2. The government implements domestic legislation accompanying the EU AI Act, specifying the powers of national supervisory authorities and the administrative sanctions regime

   Source: Normattiva (Italian legal information portal)

   https://www.normattiva.it/eli/id/2026/10/08/26G00200/CONSOLIDATED

   
   

13. Netherlands:

1. The Netherlands Authority for Consumers and Markets (ACM) issues guidance on switching cloud services under the Data Act

   Source: Netherlands Authority for Consumers and Markets (ACM)

   https://www.acm.nl/nl/publicaties/acm-publiceert-leidraad-over-overstappen-tussen-clouddiensten

   
   

2. The Dutch Data Protection Authority (AP) opens formal investigations into two websites whose cookie banners lack a directly visible rejection button, having previously warned approximately 100 organisations

   Source: Dutch Data Protection Authority (AP)

   https://autoriteitpersoonsgegevens.nl/actueel/ap-onderzoekt-websites-vanwege-misleidende-cookiebanner

   
   

14. Spain:

1. The Catalan Data Protection Authority (APDCAT) approves a binding circular on the processing of personal data through video surveillance

   Source: Official Gazette of the Government of Catalonia

   https://portaldogc.gencat.cat/utilsEADOP/PDF/9775/2175860.pdf

   
   

2. The Spanish Data Protection Agency (AEPD) publishes ten recommendations for using AI assistants and agents

   Source: Spanish Data Protection Agency (AEPD)

   https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/la-aepd-publica-un-decalogo-para-delegar-tareas-en-asistentes

   
   

15. Poland:

1. The Office of Competition and Consumer Protection (UOKiK) announces Apple’s commitment to change its App Tracking Transparency (ATT) policy and rules on access to user data

   Source: Office of Competition and Consumer Protection (UOKiK)

   https://uokik.gov.pl/apple-zmienia-praktyki-po-interwencji-prezesa-uokik

   
   

2. Key provisions of the Artificial Intelligence Systems Act concerning regulatory authorities, administrative procedures and penalties formally enter into force

   Source: Polish Journal of Laws

   https://eli.gov.pl/eli/DU/2026/1003

   
   

16. Switzerland:

1. The Federal Council takes note of interim progress on ratifying and implementing the Council of Europe Framework Convention on Artificial Intelligence and publishes Guidelines for AI Codes of Conduct (including model text covering ten topics at three levels of detail) and a report on AI activities within the Federal Administration

   Source: Swiss Federal Council

   https://www.wbf.admin.ch/en/newnsb/s2TQiUUjrA5D

   
   

2. The Federal Administrative Court upholds the regulatory position that explicit consent is required for voiceprint processing (October 21, 2026)

   Source: Federal Data Protection and Information Commissioner (FDPIC)

   https://www.edoeb.admin.ch/fr/authentification-par-reconnaissance-vocale-le-tribunal-administratif-federal-confirme-la-position-du-pfpdt

   
   

17. Norway:

1. Norway: The Norwegian Data Protection Authority fines Xandr EUR 8.6 million for unlawful processing of personal data

   Source: European Data Protection Board (EDPB)

   https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en

   
   

2. The Norwegian National Security Authority (NSM) raises the national cyber risk level to “high”

   Source: Norwegian National Security Authority (NSM)

   https://nsm.no/aktuelt/nsm-hever-det-nasjonale-cyberrisikonivaet-til-hoyt

   
   

18. Sweden: The Swedish Post and Telecom Authority (PTS) submits consultation comments on the proposed EU Cloud and AI Development Act

    Source: Swedish Post and Telecom Authority (PTS)

    https://pts.se/nyheter-och-pressmeddelanden/remissvar-pa-eu-kommissionens-forslag-till-forordning-om-moln-och-ai/

    
    

19. Finland: The Finnish Transport and Communications Agency (Traficom) updates the rules on reporting telecommunications disruptions

    Source: Finlex (Ministry of Justice of Finland)

    https://www.finlex.fi/fi/viranomaiset/maarayskokoelmat/traficom-viestinta/2026/27

    
    

20. Australia:

1. The Office of the Australian Information Commissioner (OAIC) publishes privacy impact assessment (PIA) guidance resources

   Source: Office of the Australian Information Commissioner (OAIC)

   https://www.oaic.gov.au/news/blog/privacy-impact-assessments

   
   

2. The Office of the Australian Information Commissioner (OAIC) publishes its 2025–26 Annual Report, showing growing public demand regarding privacy and information access rights

   Source: Office of the Australian Information Commissioner (OAIC)

   https://www.oaic.gov.au/news/media-centre/oaic-annual-report-shows-growing-demand-as-australians-engage-privacy-and-information-access-rights

   
   

3. The Office of the Australian Information Commissioner publishes its data breach report for the first half of 2026, highlighting a marked increase in breaches affecting personal information on a million-record scale

   Source: Office of the Australian Information Commissioner (OAIC)

   https://www.oaic.gov.au/news/media-centre/large-scale-data-breaches-on-the-rise,-latest-oaic-statistics-reveal

   
   

4. The House of Representatives passes the Cyber Security Amendment (Digital Duty of Care) Bill 2026, proposing a statutory duty for online platforms to take proactive steps to prevent online harm

   Source: Parliament of Australia

   https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=r7553

   
   

5. On October 22, the Federal Court issues a remedies judgment in Epic Games v Apple ([2026] FCA 1552), ordering Apple to allow users with Australian accounts access to third-party app stores and alternative payment systems without imposing a fixed deadline

   Source: Federal Court of Australia

   https://www.judgments.fedcourt.gov.au/judgments/Judgments/fca/single/2026/2026fca1552

   
   

21. Singapore: The Infocomm Media Development Authority (IMDA) releases its first online safety assessment report for app distribution services, identifying 65 harmful apps and 24 apps with incorrect age ratings

    Source: Infocomm Media Development Authority (IMDA)

    https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/first-online-safety-assessment-report-for-app-distribution-services

    
    

22. Brazil:

1. The National Data Protection Authority (ANPD) publishes a report analysing public consultation submissions on the regulatory framework for the Marco Civil da Internet (Brazilian Civil Rights Framework for the Internet)

   Source: National Data Protection Authority (ANPD), Brazil

   https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-publica-analise-contribuicoes-marco-civil-internet

   
   

2. The National Data Protection Authority (ANPD) seeks public comments on draft amendments to the sanctions regulation

   Source: National Data Protection Authority (ANPD), Brazil

   https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-consulta-publica-dosimetria-e-sancoes

   
   

3. The Chamber of Deputies (Câmara dos Deputados) examines a bill on algorithmic governance and the use of personal data

   Source: Chamber of Deputies (Brazil)

   https://www.camara.leg.br/noticias/1313023-projeto-proibe-plataformas-de-induzir-uso-compulsivo-e-manipular-usuarios

   
   

4. The National Data Protection Authority (ANPD) updates 40 entries in its personal data protection glossary

   Source: National Data Protection Authority (ANPD), Brazil

   https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-atualiza-e-inclui-novos-verbetes-no-glossario

   
   

5. The National Data Protection Authority (ANPD) issues guidance on the scope of application and obligations under the Digital Statute for Children and Adolescents

   Source: National Data Protection Authority (ANPD), Brazil

   https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-publica-guia-que-esclarece-quem-deve-cumprir-e-quais-sao-as-responsabilidades-das-plataformas-na-protecao-de-criancas-e-adolescentes

   
   

6. The National Telecommunications Agency (Anatel) approves technical standards for mandatory biometric verification of mobile telephone subscribers

   Source: National Telecommunications Agency (Anatel), Brazil

   https://www.gov.br/anatel/pt-br/assuntos/noticias/anatel-aprova-validacao-biometrica-obrigatoria-para-usuarios-de-telefonia-movel

   
   

7. The National Data Protection Authority (ANPD) requests explanations from Meta concerning Facebook and Instagram account suspensions and automated decision-making mechanisms

   Source: National Data Protection Authority (ANPD), Brazil

   https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-pede-explicacoes-a-meta-sobre-denuncias-de-violacoes-na-suspensao-de-contas-e-remocao-de-conteudos

   
   

23. Vietnam: The government submits a draft Data Security Law to the National Assembly

    Source: Government Electronic Newspaper (Vietnam)

    https://baochinhphu.vn/du-thao-luat-an-ninh-du-lieu-phan-chia-5-cap-do-rui-ro-han-che-phat-sinh-thu-tuc-hanh-chinh-102261024164159483.htm

    
    

24. Nigeria: The Nigeria Computer Emergency Response Team (ngCERT) issues a security advisory warning of a significant rise in high-impact cybersecurity incidents targeting organisations across multiple sectors, primarily involving phishing, ransomware and business email compromise (October 22, 2026)

    Source: Nigeria Computer Emergency Response Team (ngCERT)

    https://csirt.ncc.gov.ng/index.php/resources/security-advisories/420-ngcert-security-advisory-on-escalating-cybersecurity-threats-and-ongoing-attacks-targeting-organisations-in-nigeria

    
    

25. Slovenia: The Information Commissioner (IP) issues Opinion No. 07121-1/2026/1080 on the lawfulness of video surveillance in outdoor storage areas

    Source: Information Commissioner (IP), Slovenia

    https://www.ip-rs.si/mnenja-zvop-2/videonadzor-zunanjih-skladi%C5%A1%C4%8Dnih-obmo%C4%8Dij-1793014030

    
    

26. Romania: The National Supervisory Authority for Personal Data Processing (ANSPDCP) fines HAYAT MEDICAL & DENTAL RON 26,750 for breaches of the General Data Protection Regulation

    Source: National Supervisory Authority for Personal Data Processing (ANSPDCP), Romania

    https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_28_10_2026&lang=ro

    
    

27. United Arab Emirates (Dubai International Financial Centre): The Dubai Financial Services Authority (DFSA) fines Moody’s Investors Service Middle East USD 585,825 for breaches of data confidentiality requirements

    Source: Dubai Financial Services Authority (DFSA)

    https://www.dfsa.ae/news/dfsa-fines-moodys-investors-service-middle-east-limited-usd-585825-data-confidentiality-breaches

    
    

28. Industry / Companies:

1. The Association of American Publishers and other organisations file an amicus curiae brief in copyright infringement litigation against OpenAI and Microsoft

   Source: Association of American Publishers (AAP)

   https://publishers.org/news/book-and-journal-publishers-file-amicus-brief-in-in-re-openai-copyright-infringement-litigation/

   
   

2. noyb issues a statement on the Council of the European Union’s negotiating mandate concerning the processing of personal data for AI under the GDPR

   Source: noyb (European digital rights organisation)

   https://noyb.eu/en/ai-eu-member-states-approve-digital-expropriation-europeans-ai-companies

   
   

3. Privacy organisation noyb files five complaints concerning alleged unlawful processing of the personal data of AI trainers by Outlier, a platform owned by Scale AI

   Source: noyb (European digital rights organisation)

   https://noyb.eu/en/ai-training-platform-outlier-illegally-surveils-european-platform-workers