Data Privacy Frontline Report

Here are key highlights from August 2026 detailing global news and regulatory updates.

US & Canada

• California’s privacy regulator takes its first enforcement action under both the CCPA and Delete Act, fining an Iowa data broker $116K for failing to register as a data broker and unlawfully requiring partial Social Security numbers before Californians could exercise their opt-out rights.
• US House Energy and Commerce Committee Republicans launch a review of the Federal Trade Commission (FTC), seeking input on possible reforms following Supreme Court rulings that curtailed the agency’s powers, independence, and regulatory authority.
• US Senate lawmakers advance bipartisan legislation to extend HIPAA-like privacy, security, and breach-notification protections to consumer health data, including information from wearables, apps, and AI-enabled health technologies.
• US National Institute of Standards and Technology (NIST) seeks public feedback on a new human-centered cybersecurity initiative aimed at improving security outcomes by designing programs and controls around people’s needs, abilities, workflows, and limitations.
• US organizations launch PACT AI, a coalition of enterprises, AI assurance providers, insurers, and civil society groups aimed at developing standards, policy, and independent verification to promote trustworthy AI adoption.
• Washington’s Attorney General releases the state’s first Data Privacy Report, highlighting risks from data overcollection, weak consent practices, sensitive-data sales, and data brokers, while recommending stronger privacy protections, enforcement, and public education.

EMEA

• France’s data protection authority issues guidance on identifying and managing conflicts of interest for Data Protection Officers, emphasizing independence, case-by-case assessments, and remediation measures where DPO responsibilities overlap with decision-making roles (article in French).
• Latvia’s data protection authority publishes guidance outlining how organizations should respond to personal data leaks, emphasizing risk assessment, breach management, and compliance with GDPR notification and mitigation requirements.
• Netherlands’ data protection authority urges organizations to prepare for mandatory Fundamental Rights Impact Assessments (FRIAs) for high-risk AI systems by 2027, launching guidance and a pilot program to build practical experience (article in Dutch).
• Poland’s data protection authority publishes practical AI readiness checklists to help organizations assess GDPR compliance before deploying or using AI systems, while highlighting the need for risk, privacy, and fundamental-rights impact assessments (article in Polish).
• UK’s National Cyber Security Centre issues guidance on managing the risks of agentic AI, urging organizations to use safeguards, sandboxing, monitoring, and human oversight to prevent unintended autonomous actions while realizing productivity benefits.
• UK data protection authority launches a public consultation on draft guidance for anonymization and pseudonymization in research, archiving, and statistical uses, seeking feedback to improve clarity and practical support before final publication.