Data Economy, Privacy and Cybersecurity Newsletter - October 2026

The digital duty of care: the personal liability of boards and their members in relation to technology risks

Alejandro Padín

Cybersecurity is no longer simply a technical issue. It has now become an essential corporate governance responsibility. The convergence of European laws on cybersecurity, digital resilience, and artificial intelligence is shaping a new duty of care for directors, requiring their direct and continuous involvement in managing technology risks and potentially giving rise to personal liability implications.

KEEP READING>

Chile redefines its privacy and cybersecurity framework with new compliance rules and upcoming regulatory changes

Sebastián Barros and Sebastián Hassi

Chile speeds up the transformation of its privacy and cybersecurity framework, with potential changes to adaptation deadlines, new compliance guidelines, and upcoming requirements for the electricity industry. Companies must continue to prepare for a regulatory landscape that is still evolving.

KEEP READING>

Latest news

• First report received in Spain of a personal data breach carried out through an artificial intelligence agent
• AEPD publishes clarification notice on definitions of accuracy, suitability, and quality of data in processing personal data using AI
• AEPD warns a company about the necessary safeguards before implementing an artificial intelligence tool to analyze résumés
• AEPD analyzes the risks of exclusion and threats to data protection in the EU digital identity wallet
• AEPD publishes recommendations on best practices for use of smart sunglasses with built-in cameras and microphones
• Compatibility between blockchain and personal data protection under the GDPR
• Publication of the AI Omnibus Regulation, which simplifies requirements and defers certain obligations provided for in the European AI legislation
• European Commission fines Google €890 million for non-compliance with the Digital Markets Act
• EDPB publishes Guidelines 04/2026 on the imposition of administrative fines in relation to other corrective powers under the GDPR
• New European guidelines on data anonymization and mass data extraction for training artificial intelligence models
• French data protection authority issues recommendations on the processing of location data from connected vehicles
• ENISA launches Cyber Resilience Act single reporting platform for vulnerabilities and serious incidents
• EDPB calls on European Commission to establish a legal basis for the sharing of information between regulatory authorities with different powers
• Publication of the conclusions of a group of more than 100 experts on competitiveness, sovereignty, and security in the field of cutting-edge AI

KEEP READING>

Decisions

• Uber fined for automatically deactivating its drivers’ accounts through fully automated decisions
• Google fined for processing its users’ location data without a valid legal basis or sufficient transparency
• AEPD fines a mutual society €2.4 million for a security breach that compromised genetic and health data
• Telecommunications operator fined for a security breach suffered by its provider
• Used car dealer fined for a personal data breach, providing insufficient information on retention periods and lack of security measures
• Electricity retailer fined for inadequate permission settings and deficiencies in access control
• Irish health service fined €645,000 due to failings in the retention and storage of paper medical records
• Bank fined €510,000 for requiring excessive inheritance documentation and failing to provide adequate information about data processing
• Telecommunications operator fined €900,000 for security and oversight deficiencies relating to its processors following two ransomware attacks
• Security company fined for using a 902 number to exercise data protection rights on CCTV information signs
• AEPD fines the RFEF €100,000 for collecting unnecessary data for the registration of a minor
• AEPD notes that blocking data does not exempt an organization from complying with the right of access
• University commits infringement by revealing that a candidate had been the victim of gender-based violence in an admissions process
• Company fined for failing to implement sufficient security measures on a bulletin board regarding workers included in a collective layoff
• AEPD fines a medical imaging diagnostics provider for failing to have adequate measures in place to detect security breaches
• EDPB rejects the notion that a complaint regarding cookie banners can be dismissed on the grounds that it is part of a coordinated campaign
• Notary's office fined for providing a client with a cadastral certificate containing protected data of a third party without a legitimate basis
• Municipal regulated parking company fined for recording its employees’ conversations using a walkie-talkie app without informing them
• Driving school network fined for a security breach that exposed the data of more than 264,000 people after ignoring warnings from the police
• A municipal council breaches the GDPR by disclosing to the press the reason for an identifiable employee’s leave of absence
• AEPD identifies information failures and insufficient impact assessment in biometric border controls
• AEPD concludes that a breach has taken place due to the failure to conduct an impact assessment in an AI-based virtual assistant project

KEEP READING>

Judgments

• Right of access under article 15 of the GDPR does not generally extend to the identification of healthcare personnel who have accessed medical records
• Court sets aside AEPD guidance on biometric attendance monitoring, holding that it has the substantive nature of a circular
• Online publication of criminal judgments does not always qualify for the journalistic exception under the GDPR
• CJEU rules that the GDPR precludes the indiscriminate publication of the personal data of all the shareholders of corporations
• Loss of independence of the US Federal Trade Commission (FTC), following a U.S. Supreme Court ruling, weakens one of the pillars of the EU-US Data Privacy Framework
• Supreme Court reinforces the duty to verify consent for advertising purposes where contracts are entered into through a representative
• CJEU holds that the GDPR does not preclude online publication of the names of professional athletes who have infringed anti-doping rules, but requires a prior balancing of the interests at issue
• National Appellate Court overturns an AEPD penalty due to data processing in the management of an inheritance
• CJEU's Advocate General considers it insufficient to identify the recipients of data for commercial communications as partners
• Advocate General proposes that the Court should find EU law incompatible with Belgian legislation on the retention of electronic communications data

KEEP READING>