Data Privacy Frontline Report

Here are key highlights from September 2026 detailing global news and regulatory updates.

US & Canada

• California expands consumer privacy protections by closing a loophole in the California Consumer Privacy Act (CCPA), requiring businesses to ensure that personal information deleted at a consumer’s request is also deleted by third parties that received it.
• Delaware significantly revises its consumer privacy law by lowering applicability thresholds, imposing new obligations on third parties that receive personal data, and strengthening protections for sensitive data, profiling, and automated decision-making.
• Illinois consumers file a new class action lawsuit alleging that a major retailer collected and shared consumers' voiceprints without the notice and consent required by the Illinois Biometric Information Privacy Act (BIPA).
• Maryland unveils a new artificial intelligence framework centered on protecting individuals, supporting workers, and safeguarding children, while advancing proposals for stronger AI oversight, privacy protections, and accountability measures.
• Texas attorney general warns businesses and nonprofits about a surge in potentially fraudulent demand letters alleging website privacy violations under the California Invasion of Privacy Act (CIPA), urging recipients to seek legal counsel before responding or making payments.
• US Federal Trade Commission (FTC) withdraws its 2021 policy statement on breaches involving health apps and connected devices, concluding that the guidance is no longer necessary following updates to the Health Breach Notification Rule in 2024.
• US state governors call for federal leadership and nationwide guardrails on AI, arguing that a patchwork of state-level rules cannot adequately address the risks posed by rapidly advancing AI technologies.

EMEA

• EU European Commission spokesperson warns AI developers that incident reporting under the EU AI Act must be detailed and substantive rather than a compliance formality, emphasizing the need for clear information on incidents and corrective measures.
• EU European Data Protection Board (EDPB) adopts a harmonized methodology for calculating GDPR fines and finalizes guidelines clarifying the interaction between the Digital Services Act (DSA) and the GDPR.
• France’s data protection authority fines a private hospital €500,000 after a health data breach exposed the information of more than 524,000 patients, citing inadequate security measures and failures to properly notify affected individuals under the GDPR (article in French).
• Ireland’s data protection authority fines the country’s publicly funded healthcare system €645,000 and imposes corrective measures after finding serious data protection failings in the storage and security of paper medical records following multiple unauthorized access incidents at former hospital sites.
• Kenya's data protection authority issues new guidance on cross-border data transfers, providing organizations with detailed requirements for international data transfers while introducing Kenya-specific rules that differ in key respects from the GDPR framework.
• Poland's data protection authority announces additional inspections of healthcare organizations following a major patient data breach, with a focus on assessing how medical providers protect sensitive health information and implement security safeguards (article in Polish).
• UK Information Commissioner's Office (ICO) formally transitions to the new Information Commission under a board-led governance structure and opens a new headquarters in Manchester, marking a new phase in the regulator’s oversight of data protection and information rights.