INTERNATIONAL 

UNITED STATES OF AMERICA

8. Court blocks Government’s Action against AI Company Over Safety Restrictions^[9]

AI company Anthropic PBC (“Company”) filed suit before the US District Court for the Northern District of California challenging its classification as a ‘national security supply-chain risk’ by Department of Defence. The dispute arose after the Company refused to remove two safeguards from its ‘Claude’ model usage policy. This included a prohibition on use in fully autonomous lethal weapons systems, and a prohibition on domestic mass surveillance of citizens. Following this refusal, the Defence Secretary classified the Company as a ‘supply-chain risk’ and the President directed all federal agencies to cease use of its technology, with a six-month phase-out period. On March 26, 2026, the court granted a preliminary injunction in the Company’s’ favour, finding that the Government’s actions appeared to be directed at punishing the Company for its publicly stated AI safety positions, rather than any legitimate national security concern, conduct the court characterised as textbook First Amendment retaliation. The Company separately filed a second suit in Washington D.C. challenging a related designation that could affect its eligibility for civilian Government contracts.

The case highlights a growing tension between AI safety commitments and public-sector expectations, particularly where technology providers seek to restrict high-risk uses of their systems. For businesses, it underscores the importance of clearly defining permissible use cases upfront and anticipating potential conflicts between ethical safeguards, contractual obligations, and Government requirements.

9. AI Research Company sued for IP Infringement over AI Training^[10]

Encyclopaedia Britannica, Inc. (“Britannica”) and its subsidiary Merriam-Webster Inc. (collectively “Plaintiffs”) filed suit on March 13, 2026, in the US District Court for the Southern District of New York against OpenAI Inc. (“OpenAI”), alleging large-scale copyright infringement and trademark violation. The complaint alleges that OpenAI unlawfully scraped and used nearly one hundred thousand of Britannica’s online articles and dictionary definitions to train its GPT family of large language models without permission, and that ChatGPT generates outputs that reproduce or closely paraphrase this protected content, diverting users who would otherwise visit the Plaintiffs’ own platforms.

The Plaintiffs further allege trademark infringement, contending that ChatGPT’s hallucinations falsely attribute fabricated content to Britannica, creating a misleading impression of authorisation. OpenAI has disputed the claims, contending that its models were trained on publicly available material and that such use falls within the fair use doctrine. The filing marks the second major copyright action brought by the same plaintiffs, having previously sued AI search engine Perplexity on substantially similar grounds in September 2025.

The case reflects a broader global debate on the use of copyrighted material for training AI models, an issue that is also being tested in India in the ANI vs. OpenAI litigation. Both matters raise similar questions around training data consent, fair use, output reproduction, and attribution, particularly where AI-generated responses may substitute original sources. For AI developers and platforms operating in India, these developments signal that questions around data sourcing, licensing, and output accountability are likely to come under closer judicial and regulatory scrutiny in the near term.

10. Healthcare Records Company sues Health Information Network alleging fraudulent Patient Data Access^[11]

Epic Systems Corporation (“Epic”), the dominant provider of electronic health record systems, filed a federal lawsuit in the US District Court for the Central District of California, alongside a group of healthcare providers. The suit alleges that Health Gorilla Inc., a health information network, enabled at least two companies, Mammoth Path Solution LLC and RavillaMed PLLC, to fraudulently access and commercially exploit the medical records of approximately three hundred thousand patients from Epic’s network, as well as records from the Department of Veterans Affairs and other providers. The defendants allegedly presented themselves as healthcare providers seeking records for treatment purposes, while in fact aggregating and reselling sensitive patient data, including genetic, mental health, and reproductive information, to law firms seeking mass tort claimants. The scheme allegedly relied on fictitious websites, shell entities, and fraudulent National Provider Identification (“NPI”) numbers to disguise the true purpose of data access. One defendant, GuardDog Telehealth, subsequently admitted to improper access and agreed to be barred from health information exchanges.

The case highlights the risks that arise when trust-based access systems are exploited at scale, particularly in health information networks where data is highly sensitive. As digital health ecosystems expand, including in India under initiatives like Ayushman Bharat Digital Mission, the focus must shift from enabling access to verifying legitimacy at every stage of data use. For businesses operating in this space, this underscores the need for robust onboarding checks, strict purpose-limitation controls, and continuous monitoring of access patterns. Without these safeguards, systems designed to improve healthcare delivery can be misused for large-scale data aggregation and commercial exploitation.

11. Oklahoma enacts Comprehensive Consumer Data Privacy Law^[12]

Oklahoma Governor Kevin Stitt signed Senate Bill 546 (“OCDPA”) a comprehensive consumer data privacy law, effective from January 1, 2027. The OCDPA applies to controllers and processors conducting business in Oklahoma or targeting Oklahoma residents, who either process the personal data of at least one hundred thousand consumers annually, or process data of at least twenty-five thousand consumers while deriving more than fifty per cent of gross revenue from data sales.

Modelled on the Virginia consumer privacy framework, OCDPA grants Oklahoma consumers rights of access, correction, deletion, portability, and opt-out from targeted advertising, data sales, and certain profiling activities. Controllers are required to publish clear privacy notices, conduct data protection assessments for high-risk processing activities, and obtain explicit consent for the processing of sensitive personal data. Enforcement rests solely with the Oklahoma Attorney General, who must provide a thirty-day right to cure before initiating action, with civil penalties of up to USD 7,500 per violation.

For organisations already compliant with other state privacy laws, the practical priority will be ensuring that data protection assessments, consent workflows, and privacy notices are appropriately configured for Oklahoma residents well in advance of the January 2027 effective date.

12. Major Tech Platform rolls back Direct Message privacy feature^[13]

Meta Platforms Inc. (“Meta”) announced that end-to-end encryption (“E2EE”) for Instagram direct messages will cease to be available after May 8, 2026, effectively reversing a privacy feature introduced on an opt-in basis in 2021. Meta attributed the decision to low user uptake, directing users wishing to retain E2EE messaging to migrate to WhatsApp Inc. From May 8, 2026, Instagram direct messages will be accessible to Meta at the infrastructure level, reopening the platform to automated content moderation, AI-driven scam detection, and compliance with law enforcement requests. The announcement is notable in its timing with the Take It Down Act, 2025 requiring platforms to remove certain content within forty-eight hours of a removal notice, takes effect on May 19, 2026, and E2EE significantly complicates compliance with such obligations. Meta’s decision coincides with the European Parliament’s extension of a temporary exemption permitting voluntary detection of child sexual abuse material until August 2027.

For users, and in particular for journalists, activists, and professionals who relied on the feature for confidential communications, the practical consequence is that direct message content becomes accessible to Meta for moderation, advertising personalisation, and legal requests. For digital platforms globally, this development reinforces the importance of clearly disclosing to users the actual privacy protections applicable to their communications.

13. SEC and CFTC issue landmark Joint Interpretation on Crypto Asset Classification^[14]

Securities and Exchange Commission (“SEC”) and the Commodity Futures Trading Commission (“CFTC”) jointly issued a comprehensive interpretive release (“Release”) clarifying the application of federal securities laws to crypto assets and transactions, the most definitive regulatory statement on digital assets in over a decade. The interpretation establishes a five-part token taxonomy, categorising crypto assets as digital commodities, digital collectibles, digital tools, payment stablecoins, or digital securities, with only the last category remaining subject to full securities regulation.

The Release addresses the circumstances under which a non-security crypto asset may become subject to an investment contract based on issuer representations, and equally, when such obligations cease upon sufficient network decentralisation. The Release also addresses specific activities including airdrops, protocol mining, staking, and the wrapping of non-security assets, and expressly supersedes prior SEC staff guidance including the 2019 digital assets framework. The Release follows a memorandum of understanding signed between the SEC and CFTC on March 11, 2026.

The joint interpretation reflects a more structured and coordinated approach to classifying and regulating crypto assets, moving away from fragmented enforcement-driven guidance. For India, this is particularly relevant in light of the proposed Asset Tokenisation (Regulation) Bill, 2026, which similarly seeks to bring clarity to tokenised assets through a defined regulatory framework. Together, these developments indicate a broader global shift toward categorisation-based regulation of digital assets, where legal treatment depends on the nature and function of the asset rather than a one-size-fits-all approach.

EUROPEAN UNION

14. CJEU permits refusal of GDPR Access Requests driven by Compensation Motives^[15]

CJEU delivered its judgment in Brillen Rottler (Case C-526/24) on March 19, 2026, clarifying that a data subject’s request for access to personal data under Article 15 of the GDPR may, in certain circumstances, be refused as excessive where it is made not for the purpose of verifying lawful processing, but with the abusive intention of artificially creating conditions for a compensation claim under Article 82 of the GDPR.

The issue arose from an individual who subscribed to an optician’s newsletter, lodged a data subject access request merely thirteen days later, and subsequently sought at least GBP 1,000 in compensation upon the request being refused. The CJEU held that evidence of a data subject having systematically submitted access requests across multiple controllers followed by compensation claims may be taken into account in establishing such abusive intent. The CJEU further clarified that compensation under GDPR requires the actual demonstration of damage, and that where the data subject’s own conduct is the determining cause of the alleged harm, compensation may be denied.

This judgment gives data controllers a meaningful tool to push back against industrialised DSARs-for-compensation schemes. By confirming that even a first request can be deemed excessive where bad faith is demonstrable, the CJEU offers practical relief from systematic rights abuse. Organisations should nonetheless ensure refusals are well-evidenced and documented, as the burden of establishing abusive intent rests with the controller.

UNITED KINGDOM

15. ICO and Ofcom issue Joint Statement on Age Assurance Obligations^[16]

The Digital Regulation Cooperation Forum published a joint policy statement (“Statement”) by the Information Commissioner’s Office (“ICO”) and the Office of Communications (“Ofcom”), setting out how online services can simultaneously discharge age verification obligations and protect users’ personal information.

The Statement addresses how organisations implementing age assurance tools can adopt a risk-based, privacy-compliant approach, and confirms that organisations should consult both Ofcom’s online safety guidance and the ICO’s data protection guidance to ensure that their chosen age assurance processes satisfy both online safety and data protection obligations concurrently. The Statement aims to provide clarity on the selection and deployment of age assurance mechanisms that are proportionate, privacy-preserving, and consistent with applicable regulatory expectations under both the UK Online Safety Act 2023 and the UK General Data Protection Regulation 2016.

The takeaway for organisations is that age assurance cannot be implemented as a purely technical compliance exercise, it must be designed with data minimisation, purpose limitation, and proportionality embedded from the outset. For platforms with a UK user base, or for those assessing how to address comparable age-gating requirements as they emerge in other jurisdictions, this joint regulatory approach offers a useful and adaptable model.

16. Court of Appeal confirms Data Security Obligations extend to Pseudonymised Data^[17]

The Court of Appeal (“Court”) handed down its judgment in DSG Retail Limited v. The Information Commissioner^[18] confirming that a data controller’s duty to implement appropriate security measures applies to all personal data it processes irrespective of whether a third-party attacker who exfiltrates that data would be capable of identifying the individuals concerned. The case arose from a large-scale cyberattack on Dixons Stores Group Retail Limited (operators of Dixons and Currys PC World) (“DSG”) between 2017 and 2018, during which transaction data from over 5.6 million payment cards was compromised, including card numbers and expiry dates but not, in most instances, directly identifying information. DSG contended that since attackers could not re-identify individuals from the stolen data, no personal data breach had occurred. The court rejected this reasoning, holding that the identifiability test for the purposes of the security obligation must be assessed from the controller’s own perspective, not the attackers. The court confirmed that truly anonymised data, from which no individual can be identified even by the controller, falls outside the security duty, preserving the legally significant distinction between pseudonymisation and genuine anonymisation.

For data protection officers and information security teams, this reinforces the need to apply robust technical and organisational measures across the full breadth of personal data processed, and to resist the temptation to calibrate security investment by reference to the re-identification capabilities of a hypothetical external actor.

17. ICO issues Guidance on new ‘Recognised Legitimate Interests’ Lawful Basis^[19]

The Information Commissioner’s Office (“ICO”) published guidance on March 23, 2026, clarifying the operation of the new ‘recognised legitimate interests’ (“RLI”) lawful basis introduced into the UK GDPR by the Data (Use and Access) Act 2025 (“DUAA”), which came into force on February 5, 2026. The RLI basis constitutes a seventh lawful ground for processing personal data and differs materially from the existing legitimate interest’s basis in that it does not require controllers to conduct a balancing test weighing organisational interests against data subject rights.

Five pre-approved qualifying purposes are specified: national security, public security, and defence; detection, investigation, or prevention of crime; responding to requests from public interest bodies; responding to emergency situations; and safeguarding vulnerable individuals. Controllers must still assess necessity, comply with all other data protection obligations, maintain transparency with data subjects, and update their records of processing activities and privacy notices accordingly. The RLI basis is unavailable to public authorities, cannot underpin significant automated decision-making, and does not extend to routine commercial processing such as direct marketing or intra-group data transfers.

For data protection officers and privacy teams, the immediate priorities are updating records of processing activities and privacy notices to reflect the new basis, and auditing existing processing activities to assess whether any currently justified under general legitimate interests could more appropriately migrate to RLI.

SWITZERLAND

18. Federal Data Protection Commissioner issues Consumer Guide on Wearable Device Privacy^[20]

Federal Data Protection and Information Commissioner (“FDPIC”) published a consumer-facing guidance document on the data protection implications of wearable devices, covering smartwatches, fitness trackers, and smart glasses. The guidance explains the privacy risks arising from the continuous collection of sensitive personal data, including sleep patterns, cardiac data, geolocation, and audio and image information, by body-worn internet-connected devices, noting that such data collection may also affect third parties in the vicinity of the wearer. The FDPIC advises consumers to assess, before purchase, whether a manufacturer has configured privacy-friendly default settings, the geographic location of data storage, and whether processing practices are transparent and comprehensible. The guide devotes particular attention to smart glasses, highlighting the heightened sensitivity arising from their capacity to passively capture third parties without notice or consent, a concern that grows more acute as commercially available AI-integrated eyewear proliferates.

For businesses developing or deploying wearable technology targeting Swiss consumers, this guidance underscores the importance of privacy-by-design product architectures, transparent data processing disclosures, and default settings that minimise collection not merely as compliance obligations, but as a baseline expectation of consumer trust.