By: Cameron Abbott, Rob Pulham, and Emre Cakmakcioglu
The Office of the Australian Information Commissioner (OAIC) has published updated guidance for entities considering using facial recognition technology (FRT) in high-volume, publicly accessible physical spaces, like retail shopfronts.
Read MoreBy: Sarah Pearce and Thomas Nietsch
The EU has adopted its first substantive amendment to the AI Act. Regulation (EU) 2026/1744, commonly referred to as the AI Omnibus, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. While the legislation postpones certain aspects of the AI Act’s compliance timetable, it would be a mistake for organisations to view the Omnibus as a broad pause on AI regulation in Europe.
Read MoreBy: Sarah Pearce and Veronica Muratori
One of the more practically significant outcomes of the European Data Protection Board (EDPB)’s June 2026 plenary session, was the adoption of a common template for personal data breach notifications under the GDPR.
Read MoreBy: Nicole H. Buckley and Whitney E. McCollum
Washington State Governor Bob Ferguson recently signed House Bill 2225 (the Chatbot Disclosure Act) into law, effective 1 January 2027. The Chatbot Disclosure Act requires people and entities who operate AI “companion” chatbots to provide clear and ongoing disclosure to Washington consumers that they are interacting with an automated system and not a human being.
Read MoreBy: Cameron Abbott and Rob Pulham
The Administrative Review Tribunal of Australia (Tribunal) has partially overturned the findings of the Privacy Commissioner on Bunnings’ use of facial recognition technology (FRT) in its stores.
Read MoreBy: Rob Pulham, Cameron Abbott, and Maryam Ahmed
Not to be outdone by its regional peers, New Zealand updated its privacy laws with the passing of the Privacy Amendment Act 2025 (the Act) last month: see the NZ Privacy Commissioner’s media release here.
Read MoreBy: Claude-Etienne Armingaud, Thomas Nietsch, Nóirín McFadden, and Sophie Verstraeten
The UK’s major post-Brexit reform of the UK General Data Protection Regulation (UK GDPR), the Data Use and Access Act (DUAA), became law on 19 June 2025.
Read MoreBy: Dr. Thomas Nietsch and Andreas Müller
In proceedings initiated by a Consumer Protection Agency for a preliminary injunction against the operator of a social network to prohibit the use of publicly accessible user data for AI training, the competent court ruled that using such data is permissible under the General Data Protection Regulation (GDPR.)
Read MoreBy: Dr. Thomas Nietsch and Andreas Müller
In a recent ruling (I ZR 161/24, 22 May 2025), the German Federal Court of Justice (BGH) clarified the scope of § 312k German Civil Code (BGB) regarding the obligation to provide a ‘cancellation button’ on websites if traders enable consumers to conclude continuing performance contracts (Dauerschuldverhältnis) via their website.
Read MoreIn a significant ruling on 14 February 2025, the First Instance Court of Nanterre, France ordered a company to suspend the deployment of several artificial intelligence tools until proper consultation with its Works Council has been completed.
Read MoreCopyright © 2026, K&L Gates LLP. All Rights Reserved.