Privacy Headlines

Data Protection Report · 10/9/2026

On September 30, 2026, the California Governor signed SB 690 , which amends the California Invasion of Privacy Act (CIPA) to restrict private enforcement—but only for claims under CIPA’s pen register and trap-and-trace provisions arising from websites and online or mobile applications. As we had previously written , the bill originally created additional exclusions, but the legislative process narrowed its scope. This new law not only bars new private lawsuits alleging CIPA violations based on its pen register and trap-and-trace provisions, but also applies retroactively to any claim pending in an action commenced within the past two years. The Governor signed the bill, but made clear in his signing letter that he would like to see additional legislation next year: This measure addresses the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses that unwittingly install software on their websites that at times have tracked and sh

Data Protection Report · 10/6/2026

Happy October and Cyber Awareness Month! Ghosts and ghouls of Halloween are not the only danger lurking around the corner. Beware of increasingly sophisticated cyber threats. It is time to ward your surroundings with appropriate cybersecurity measures and candy. As the constant alarms of data breaches hitting the news and mailboxes, it is easy to become numb to the importance of cybersecurity. But resist that urge. Recognizing that cybersecurity is not just a technical challenge but also a strategic imperative touching every corner of an organization is key, and that makes coordinated legal, technical, and operational responses essential. Witnessed this year, AI is reshaping the cybersecurity landscape, introducing new risks and opportunities from enhanced threat detection to novel attack vectors. Significantly, AI-enabled offensive capabilities have been accelerating faster than the governance and defensive frameworks designed to contain them. For example, AI has now become a cyber at

Data Protection Report · 9/15/2026

Anyone who contracts for internet or social-media-based advertising may have overlooked two recent actions by the California Privacy Protection Agency (CalPrivacy) and the proposed draft AI regulations from Colorado, but there are some important takeaways that should not be missed. California fines data broker over $100,000 for broker and privacy law issues California’s new data broker deletion requirements (known as the Delete Act) went into effect on August 1, 2026. On August 10, CalPrivacy announced an order against an Iowa data broker, LocateSmarter, LLC, alleging that the company violated both California’s data broker law and the California Consumer Privacy Act (CCPA). According to the order, LocateSmarter required consumers wishing to opt out of the sale or sharing of their personal data to submit not only their mailing addresses but also the last four digits of their Social Security numbers. The order found that this conduct violated CCPA because LocateSmarter: requi

Data Protection Report · 9/1/2026

As cyber incidents become more costly and complex, organisations are facing increasing exposure to personal data claims, mass actions and contractual disputes. We explore the key litigation trends, emerging risks and practical considerations shaping the UK data breach claims landscape. Read our briefing here

Data Protection Report · 8/18/2026

On August 5, 2026, the New York Department of Financial Services (NYDFS) entered into a consent order with Order Express, Inc., a money transmitter licensed by NYDFS. Although Order Express qualified for a limited exemption under the NYDFS cybersecurity regulation , NYDFS found that the company violated the regulation’s applicable requirements in three ways: (1) failure to “conduct a risk assessment sufficient to inform the design of its cybersecurity program”; (2) as a result of the risk assessment’s deficiencies, failure “to design a cybersecurity program based on the Company’s risk assessment and sufficient to identify and assess risks to NPI”; and (3) failure “to implement and maintain written cybersecurity policies addressing systems and network security.” Order Express agreed to pay $250,000. Although this consent order pertains to a limited exemption licensee, it remains relevant to larger covered entities not exempted from t

Data Protection Report · 7/21/2026

We recently published an article to commemorate AI Appreciation Day , but readers may also appreciate a law that recently passed In Rhode Island, known as the “ Use of Artificial Intelligence by Healthcare Providers Notification Act .” The bill went into effect on June 16, 2026. The law’s stated purpose is “is to ensure patients are properly notified of the use of artificial intelligence by healthcare providers.” The law contains three definitions, two for healthcare (“Healthcare providers” and “healthcare facility”), and the third definition is for AI: “any technology that can simulate human intelligence including, but not limited to, natural language processing, training language models, reinforcement learning from human feedback and machine learning systems.” Unlike many other states’ AI laws that can require multiple pages to explain, Section 23-106-3 of Rhode Island General Statutes reads in its entirety: Any

Data Protection Report · 7/16/2026

As artificial intelligence ( AI ) becomes embedded in business operations, data protection frameworks are increasingly shaping how organizations manage AI use. This update highlights key regulatory developments, including risk-based approaches and sector-specific rules, and outlines practical considerations for compliance, oversight and responsible deployment. Read the full article, “ AI Appreciation Day 2026: Regulations, risks and opportunities “.

Data Protection Report · 6/15/2026

Spain’s data protection agency, the Agencia Española de Protección de Datos ( AEPD ), has fined Amadeus IT Group, S.A. ( Amadeus ) €18 million in relation to a traveller profiling pilot project. The enforcement decision, published in May 2026, has found breaches of Article 14 and Article 6 REGULATION (EU) 2016/679 ( GDPR ). Amadeus has made a €14.4 million voluntary payment, representing a 20% reduction from the proposed total fine, and has stated that they intend to appeal the ruling. Background Amadeus is a major Global Distribution System ( GDS ) provider and is one of the largest travel booking networks used by airlines and travel agencies, responsible for processing the personal data of millions of individuals for bookings in the travel industry. Following an anonymous complaint on 26 September 2023, the AEPD initiated proceedings against Amadeus to investigate possible GDPR breaches in relation to a pilot scheme called ‘PLATAFORMA.1’ (the