INTERNATIONAL 

UNITED STATES OF AMERICA

8. Banking Regulator clarifies Limited Crypto-Asset Holding by Banks^[8]

The Office of the Comptroller of the Currency (“OCC”) has clarified that national banks may, in limited circumstances, hold crypto-assets on their own balance sheets where such holdings are incidental and necessary for permissible banking activities. This clarification specifically addresses situations where banks need to hold crypto-assets to pay transaction or network fees required to operate on blockchain-based systems. The OCC has indicated that banks may maintain crypto-assets in amounts that are reasonably connected to supporting authorised activities, including testing, operating, or facilitating distributed ledger platforms. However, such activities must continue to comply with existing prudential standards, including safety and soundness requirements, robust risk management, and applicable compliance obligations.

While the clarification does not amount to a broader endorsement of proprietary crypto-trading by banks, it removes an important operational barrier for institutions engaging with blockchain infrastructure. The move signals a measured regulatory approach allowing functional use of crypto-assets for infrastructure and settlement purposes, while maintaining strict supervisory oversight over exposure and risk.

9. California Strengthens Privacy Regulations Concerning Health Data ^[9]

California has strengthened protections for health-related personal information through Assembly Bill 45 (AB 45) (“Amendment”), which amends the California Medical Information Act, 1981 (“CMIA”). The amendment broadens the scope of what qualifies as “medical information” to include health-adjacent data collected by non-traditional entities such as mobile apps, digital platforms, wearables, and online services, even where the data does not originate from a hospital, physician, or health insurer.

The Amendment recognises that modern health insights are increasingly derived from behavioural data, wellness metrics, reproductive-health activity, and geolocation information linked to medical visits. By bringing such data within the CMIA framework, California has extended healthcare-grade confidentiality obligations to businesses operating outside the regulated healthcare ecosystem, addressing gaps that previously allowed sensitive health inferences to be commercially exploited.

Recent enforcement actions have highlighted how health-adjacent data is increasingly exploited outside traditional healthcare settings, as seen in the Flo Health matter, where sensitive reproductive and fertility data was shared with third parties contrary to user assurances, and in scrutiny of Gravy Analytics for collecting and selling precise geolocation data capable of revealing visits to medical facilities. Amendment responds directly to these risks by extending CMIA-level confidentiality and use restrictions to digital platforms, apps, and data brokers that derive health insights indirectly, making clear that the absence of a formal healthcare relationship does not dilute obligations where data can expose medical conditions, treatment decisions, or reproductive choices.

10. Telecommunications Provider penalized over Vendor Data Breach^[10]

FCC has imposed a USD 1.5 million penalty on Comcast Cable Communications LLC (“Company”) a major telecommunications service provider, following an investigation into a data breach originating from a third-party vendor responsible for handling online customer activation and account-related services. The breach resulted in unauthorised access to sensitive subscriber information, including names, phone numbers, account identifiers, and, in some instances, partial Social Security numbers.

The incident arose after the Company’s vendor failed to secure systems containing legacy customer data. An unauthorised actor gained access to the vendor’s network, exposing personal information of a significant number of current and former subscribers. Notably, the compromised data had been retained by the vendor even after the commercial relationship had ended, highlighting gaps in data minimisation, retention controls, and post-termination oversight of third-party processors. The FCC found that Company had insufficient vendor-management safeguards, inadequate monitoring of third-party security practices, and weaknesses in breach-response escalation, including delays in notification. Under the settlement, the Company must strengthen vendor risk-management frameworks, implement enhanced technical and organisational security measures, improve internal risk assessments, and comply with ongoing FCC monitoring requirements underscoring regulatory expectations that service providers remain accountable for subscriber data even when handled by external vendors.

This enforcement action highlights that vendor due diligence is no longer a procedural formality but a core compliance obligation, particularly where third parties handle large volumes of personal data. Weak oversight of legacy data, retention practices, and breach-response protocols can expose organisations to regulatory liability even when the incident occurs outside their own systems. As India begins implementing the DPDP Act, Indian companies should treat third-party risk management, contractual safeguards, and continuous vendor monitoring as foundational compliance measures rather than post-incident controls.

11. California introduces Measures addressing Youth Safety and Privacy on Social Media^[11]

California has passed Assembly Bill 56 (AB 56) (“Legislation”) as part of its continued effort to enhance protections for children and teenagers using social-media platforms. The Legislation responds to growing concerns around teen mental health, behavioural profiling, and the influence of algorithm-driven content, and will come into force from January 01, 2027.  The Legislation places heightened obligations on social-media and online platforms that are reasonably likely to be accessed by minors, requiring them to reassess how data collection, recommendation systems, and engagement-driven design choices impact young users. A key feature of the Legislation is increased platform accountability, particularly around design and algorithmic choices that can harm minors. This includes curbing addictive features such as endless scrolling, autoplay of videos, and frequent push notifications that encourage prolonged screen time, as well as addressing risks from automated content curation, where algorithms repeatedly promote certain videos or posts based on past behaviour, potentially exposing children to inappropriate, harmful, or distressing content. The Legislation aims to ensure that engagement-driven technology does not come at the cost of children’s mental health and well-being.

By mandating stronger privacy and safety standards for minors by default, Legislation reinforces California’s position that digital platforms must prioritise child well-being over engagement metrics. The Legislation is expected to have wide-reaching implications for global technology companies, particularly those offering interactive, algorithm-driven services to minors.

EUROPEAN UNION

12. German Court rules AI-generated Song Lyrics breached Copyright Law^[12]

Germany District Court has held that OpenAI Inc. (“Company”) models violated copyright law by generating song lyrics that closely mirrored protected works without permission. The case was initiated by the German music industry, which argued that Company’s systems were trained on copyrighted material and subsequently reproduced lyrics in ways that were ‘substantially similar’ to the originals. The court found that such outputs constituted unauthorised reproductions under German copyright rules, particularly because the lyrics are creative works that afforded strong protection. This ruling mark one of the earliest European judicial findings directly concluding that an AI system generated infringing output. The ruling also highlights the growing legal pressure on AI developers to ensure transparency and compliance in their training practices. The court emphasised that training models on copyrighted works without licences, when it leads to recognisable reproductions, breaches Germany’s copyright framework. Although, the Company argued that model training should fall under permissible text-and-data mining exceptions, the court rejected this defence.

The ruling is expected to influence ongoing EU-wide debates on AI regulation and copyright obligations, particularly as the EU AI Act and updated copyright guidance take shape. Notably, a similar copyright infringement dispute is currently pending in India against the same company, concerning the alleged unauthorised use of news content by a television news channel. While not binding, the EU court’s reasoning could serve as a persuasive reference point for Indian courts in assessing liability for AI-driven or automated reuse of copyrighted news content.

13. Council adopts New Rules to Streamline Cross-border GDPR enforcement ^[13]

The Council of the European Union has adopted Regulation on Additional Procedural Rules Relating to the Enforcement of the GDPR in Cross-Border Cases (“GDPR Additional Procedural Regulation”) designed to make enforcement of the GDPR more efficient when complaints involve data processing that crosses national borders. GDPR Additional Procedural Regulations harmonises key procedural elements between national data protection authorities, including common criteria for admissibility of cross-border cases, clear rights for complainants and investigated entities, and cooperative mechanisms that reduce administrative complexity. It also introduces targeted deadlines for investigations, with standard procedures to be completed within 15 months and simpler cooperation cases wrapped up within 12 months, helping avoid lengthy delays that have historically slowed cross-border enforcement.

By setting uniform processes across EU Member States, the reform aims to strengthen consistency in how privacy complaints are handled and give individuals and companies greater predictability and transparency in the GDPR enforcement landscape. GDPR Additional Procedural Regulation will enter into force 20 days after its publication in the Official Journal of the European Union and will become applicable 15 months later. This marks the final legislative step in a long-standing effort to improve cooperation between national data protection authorities and to support more effective protection of privacy rights across the single market.

14. Spanish Data Protection Authority issues Practical Guide to Assist Freelancers and SMBs Secure Personal Data^[14]

Spain’s data protection authority, the Agencia Española de Protección de Datos (“AEPD”), has published Encryption Guide for Freelances and SMBs (“Guide”) aimed at assisting freelancers and small and medium-sized enterprises improve how they handle personal information. The Guide is designed for organisations with limited resources and focuses on everyday data-processing activities such as customer management, billing, marketing and online presence. It explains key data protection principles in simple terms and highlights common risks faced by smaller businesses when managing personal data. The Guide places strong emphasis on basic but effective security measures, including access controls, secure storage, password hygiene, data minimisation and incident response planning. It also encourages small and medium business and independent professionals to assess their data practices regularly and adopt a proactive approach to compliance rather than treating data protection as a one-time obligation. By issuing this Guide, the AEPD aims to promote better privacy practices at the grassroots level and reduce avoidable data breaches through practical, easy-to-follow recommendations.

UNITED KINGDOM

15. Cyber Security and Resilience Bill introduced^[15]

Government has introduced the Cyber Security and Resilience (Network and Information Systems) Bill (“Bill”) wide-ranging legislative proposal aimed at strengthening the country’s ability to prevent, withstand, and respond to cyber threats. The Bill is designed to modernise the existing Network and Information Systems (NIS) framework, which has increasingly struggled to keep pace with the scale, complexity, and interdependence of today’s digital infrastructure and cyber risks. A key feature of the Bill is its expanded scope, which brings managed service providers, data centres, and other critical digital supply-chain actors under direct regulatory oversight, recognising their central role in supporting essential services. These organisations would be required to identify and regularly assess cyber risks, implement proportionate technical and organisational security measures, and maintain clear governance structures for cyber resilience. The Bill also strengthens incident detection and reporting obligations, requiring timely notification of significant cyber incidents that could disrupt services, along with cooperation with regulators during investigations. In addition, regulators are empowered to issue binding directions, require remedial action, and intervene where systemic or emerging cyber risks threaten national infrastructure, shifting the focus from reactive breach response to ongoing cyber preparedness and resilience.

If approved, the Bill will significantly raise compliance expectations for organisations operating in or supporting essential services. Businesses may be required to adopt more structured cyber-risk governance, improve supplier and third-party security controls, and implement faster and more detailed incident-reporting processes. For many organisations particularly technology providers and service vendors previously outside direct regulation the Bill signals a shift towards greater accountability for cyber resilience as a core operational responsibility, rather than a purely technical or reactive function.