Data Privacy Frontline Report

June 2026

Here are key highlights from June 2026 detailing global news and regulatory updates.

 

US & Canada

  • Canada launches its “AI for All” strategy to boost AI adoption and economic growth—targeting higher uptake, job creation, and stronger domestic infrastructure—while reinforcing digital sovereignty and addressing governance, privacy, and AI‑related risks.

  • Canadian government introduces Bill C‑36 to modernize private‑sector privacy law by recognizing privacy as a fundamental right, strengthening consent and deletion rights, and shifting enforcement to a new regulator with significant penalty powers.

  • Louisiana enacts the Louisiana Data Privacy Act, establishing a comprehensive consumer privacy framework—effective in 2027—that mirrors common US state models while imposing obligations on businesses through CCPA‑style thresholds and broad exemptions.

  • US Department of Health and Human Services (HHS) announces a settlement with a group health plan following a ransomware attack investigation, resolving potential HIPAA violations related to inadequate risk analysis and security controls through a financial penalty and corrective action plan.

  • US Commerce Department orders the Census Bureau to stop using differential privacy techniques that add statistical noise to protect, a move experts warn could reduce data detail or availability.

  • Vermont becomes the 23rd U.S. state to enact a comprehensive consumer privacy law with the Data Privacy and Online Surveillance Act, introducing a Connecticut‑style framework with some differences in applicability thresholds and opt‑out requirements, and with enforcement set to take effect in 2028.

EMEA

  • EU and Brazil sign a Digital Partnership to deepen cooperation on data governance, AI, and digital infrastructure, to be implemented through regular high-level exchanges and technical workstreams. (also in LATAM)

  • EU European Commission publishes a voluntary Code of Practice to guide providers and deployers in marking and labelling AI‑generated content ahead of the AI Act’s transparency obligations.

  • EU European Parliament approves amendments to the AI Act to simplify compliance and delay certain obligations while maintaining its risk‑based framework, including changes to reduce overlaps, support SMEs, and adjust timelines for high‑risk AI requirements and transparency measures. 

  • EU European Commissioner and the European Data Protection Board (EDPB) adopt a common data breach notification template to help organizations and regulators standardize, streamline, and harmonize GDPR breach reporting processes across the EU.

  • EU European Data Protection Supervisor (EDPS) warns that “shadow AI”—the unauthorized use of AI tools by employees without organizational approval or oversight—creates hidden data breach risks by bypassing safeguards and placing personal data into unmonitored systems.

  • Italy's data protection authority fines airline €180,000 for unfair handling of passengers’ health data, citing inadequate transparency and excessive retention periods despite finding the underlying data processing itself was lawful.

  • Nigeria's data protection authority and Meta launch a two‑year campaign to promote data privacy awareness, strengthen regulatory capacity, and enhance protections for data subjects, as part of a court‑approved settlement following investigations into Meta’s data processing practices.

  • Romanian hospitals disconnect from the internet and revert to pen‑and‑paper operations after a major ransomware attack spreads through a widely used healthcare system, disrupting care but helping stop the hackers’ advance.

Gain confidence to use and share sensitive data
Find out how our advisory services can help you safely leverage data derived from information about people. Watch this 15-minute webinar.
Watch On-Demand Now
APAC

  • Australia's data protection authority finds that two healthcare providers breached privacy laws by using third‑party tracking pixels to collect and share sensitive patient data for targeted advertising without proper consent, concluding such practices require explicit consent under the Privacy Act.

  • Japan and the Philippines sign a memorandum of cooperation to strengthen cross‑border data protection and privacy enforcement, including collaboration on information sharing, mutual assistance in investigations, and joint initiatives such as research, training, and capacity building.

  • Singapore's data protection authority launches a public consultation on proposed advisory guidelines clarifying how personal data protection laws apply to generative AI.

  • South Korea's data protection authority imposes a record $409 million fine on an e-commerce company for a massive data breach affecting tens of millions of users, citing inadequate security controls, failure to detect and report the breach in time, and illegal collection of personal data.

LATAM

  • Argentina advances new legislative proposals to reform its data protection regime, aiming to align with international standards such as the GDPR by introducing stronger principles, expanded data subject rights, and modern obligations for organizations handling personal data. (article in Spanish) 

  • Brazil and EU sign a Digital Partnership to deepen cooperation on data governance, AI and digital infrastructure, to be implemented through regular high-level exchanges and technical workstreams. (also in EMEA)