Spanish Data Protection Agency Fosters Notification System Regarding Security Breaches

La cartera europea de identidad digital (EUDI Wallet) establece plazos concretos: los Estados miembros deben ofrecer al menos una cartera gratuita antes del 24 de diciembre de 2026...

In June 2017, the Spanish government published a preliminary draft of the Organic Law's 78 Articles on the Protection of Personal Data, which would repeal the Spanish Data Protection Law...

On September 11, AEPD issued a final decision against a social media company in connection with its data processing activities and issued a fine of €1.2 million.

A draft bill promotes minors' positive use of digital environments in areas such as education or social interaction

The Spanish government has decided to pass this Royal Decree-law as an interim measure which is permitted by the GDPR.

On June 29, the Spanish DPA published a guide on the processing of data captured though cameras in accordance with the GDPR ...

On February 23 2026, the Spanish supervisory authority (AEPD) published an article containing recommendations on operational sovereignty when processing personal data. This follows a major incident on October 20 2025, where a cloud provider experienced technical issues in the United States which affected services globally.

In March, the Spanish DPA (Agencia Española de Protección de Datos) adopted a resolution on the Right To Be Forgotten.

El Tribunal de Justicia de la Unión Europea examina los límites del tratamiento de datos personales en el contexto de las sanciones antidopaje, analizando cuándo la publicación de nombres de deportistas sancionados, las sustancias prohibidas utilizadas y los detalles de las infracciones constituye un tratamiento de datos de salud. La sentencia establece criterios específicos sobre la ponderación individual que deben realizar los responsables del tratamiento antes de publicar es

On June 19, the Spanish DPA published the guidelines for managing security breaches and providing notification in compliance ...

The Code is voluntary, but it will likely become an important reference point for demonstrating compliance with Article 50 of the AI Act.

The Ninth Circuit Court of Appeals vacated a preliminary injunction against Perplexity AI, determining that when an AI agent acts at a user's direction, it is the user—not the AI company—who "accesses" computer systems under federal and California computer fraud statutes. This landmark appellate decision addresses how existing computer-access laws apply to agentic artificial intelligence and has significant implications...

The New York Stock Exchange and Nasdaq are implementing overnight trading sessions starting December 6, 2026, extending the trading day to nearly 23 hours by compressing the daily pause to just one hour. While this evolution toward continuous trading introduces new considerations for corporate actions, disclosure timing, and deal execution, the practical impact varies significantly between NYSE-listed companies,

China's Supreme People's Court has issued comprehensive judicial rules addressing artificial intelligence disputes, establishing frameworks for product liability, intellectual property rights, and data protection. These landmark opinions provide critical guidance for global companies navigating AI-related legal risks in China's evolving regulatory landscape.

The Ninth Circuit has ruled that health plan participants whose confidential information was disclosed without authorization have standing to sue in federal court, even without showing financial loss or future harm. This decision, which departs from the risk-based approach many courts have applied since TransUnion, relies on the centuries-old action for breach of confidence and could have significant implications for companies' privacy commitments and data-sharing practices.

The European Commission has initiated infringement procedures against 20 EU Member States for failing to transpose the EmpCo Directive by the March 27, 2026 deadline. This directive aims to combat greenwashing by requiring substantiation of environmental claims and third-party certification for sustainability labels, with full implementation expected by September 27, 2026.

Mexico's comprehensive anti-money laundering framework has undergone a sweeping transformation through Acuerdo 115/2026, introducing mandatory risk-based methodologies, enhanced client due diligence protocols, and automated monitoring requirements. With implementation deadlines beginning March 1, 2027, obligated parties conducting vulnerable activities face compressed timelines to overhaul their compliance infrastructure while navigating heightened enforcement risks and stricter beneficial ownership thresho

The Illinois Holocaust Museum & Education Center (IHMEC) held a third program as part of its Jones Day Foundation Community Series, a special series of educational events

The European Commission has proposed replacing the EU's three core procurement directives with a single, directly applicable Regulation that would fundamentally reshape how companies compete for public contracts across Member States. The reform introduces mandatory quality criteria thresholds, embeds ESG considerations as evaluation factors, and establishes new security and European-preference provisions that could restrict participation based on ownership, supply chain exposure, and strategic dependencies.

A federal court has struck down New York's Climate Change Superfund Act, which sought to recover $75 billion from fossil fuel companies based on historical emissions. The ruling found the Act preempted by the Clean Air Act, marking the first judicial decision on state climate superfund legislation and establishing that EPA's rescission of the endangerment finding does not alter preemption analysis.