Legal & Regulatory Risk – Cyber Law Watch

EU Digital Omnibus on AI Enters Into Force

Jul 31 2026

The EU has adopted its first substantive amendment to the AI Act. Regulation (EU) 2026/1744, commonly referred to as the AI Omnibus, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. While the legislation postpones certain aspects of the AI Act’s compliance timetable, it would be a mistake for organisations to view the Omnibus as a broad pause on AI regulation in Europe.

Publication Alert: Encrypted Messaging in the Crosshairs: Compliance, Legal Risks, and Global Perspectives

Jul 03 2025

By: Corey Bieber and Guillermo Christensen

K&L Gates partners Corey Bieber and Guillermo Christensen have published an article in Volume 2 of the June 2025 edition of CPI Antitrust Chronicle.

Higher Regional Court of Hamm (Germany): Claims for Moral Damages Under Art. 82 GDPR are Assignable – German Class Actions Coming?

Oct 04 2024

By Dr. Thomas Nietsch and Andreas Müller

On July 24, 2024, the OLG Hamm ruled that claims for moral damages under Art. 82 GDPR are generally assignable (case number: 11 U 69/23).

Modern Adtech Regulated Under Antiquated Law: How Video Killed the Internet Star

Jul 29 2024

By Cameron Abbott and Rob Pulham

In their recent article available here, Katie Staba and Corey Bieber from our Chicago office discuss emerging advertising technology issues, including new applications of the California Invasion of Privacy Act and the Video Privacy Protection Act.

9,948,575,739 Reasons to Change Your Passwords now

Jul 18 2024

By Cameron Abbott, Rob Pulham, and Stephanie Mayhew

Cybernews has reported on its researchers’ discovery of what could be the largest leaked password compilation of all time, with a record 9,948,575,739 plaintext passwords in a file called “rockyou2024.txt” (see article).

Jul 10 2023

By Amigo L. Xie, Lingjun Zhang, and Dan Wu

About four months after the Cyberspace Administration of China (CAC) released the Measures for the Standard Contract for the Export of Personal Data from China (China SCC Measures), and 15 working days after the China SCC Measures became effective, Beijing CAC published a notice announcing that a Beijing-based company passed the first-ever China SCC filing on 25 June 2023 (Notice).

Based on the Notice, the first China SCC filing relates to a cross-border personal data transfer from a Beijing-based data exporter, an online data service provider, to a Hong Kong-based data recipient. The type of data exported by the Beijing-based data exporter is personal data related to credit references as disclosed by the Notice.

The completion of the first-ever China SCC filing conveyed some positive messages to the market:

Jul 06 2023

By Yuki Sako and Aiko Yamada

Following the call for international standards on Artificial Intelligence (AI) at the recent G7 summit, on 2 June 2023, in a rare move, Japan’s Personal Information Protection Commission (PPC) issued two warnings in a publicly released letter (the “Letter”):

Firstly to the three categories of users of generative AI services, i.e.,
- business operators who collect personal information and thus are subject to the Act on the Protection of Personal Information of Japan (APPI);
- government agencies, which may adopt generative AI services into their operations; and
- the general public; and
Secondly to the “ChatGPT” developers/publishers.

Jun 22 2023

By Cameron Abbott, Daniel Knight, Rob Pulham, Stephanie Mayhew, and Dadar Ahmadi-Pirshahid

Amid the rapid acceleration of tools like ChatGPT and global calls for tailored regulation of artificial intelligence tools, the Australia Federal Government has released a discussion paper on the safe and responsible use of AI. The Government is consulting on what safeguards are needed to ensure Australia has an appropriate regulatory and governance framework to manage the potential risks, while continuing to encourage uptake of innovative technologies.

May 24 2023

By Noirin M. McFadden and Claude-Étienne Armingaud

Today, the UK data protection regulator, the ICO, has published guidance to assist employers in responding to data subject access requests (DSARs) from current and former employees. DSARs have become the primary tool for employees attempting to gain leverage against employers during a dispute or grievance process: they can be extremely time-consuming and resource intensive for employers to deal with, and it is a difficult balance to strike between upholding employees’ right of access under the UK GDPR and applying exemptions from disclosure in an appropriate way.

The new guidance covers issues that often occur when employers try to strike this balance, and notably:

May 05 2023

By Cameron Abbott, Rob Pulham, Stephanie Mayhew and Dadar Ahmadi-Pirshahid

You’ve reached the end of a long week, riddled with proselytising about the importance of being privacy aware and privacy prepared. You get it! You lay your head to a well-earned rest…and like Kate McCallister wake screaming “Privacy Policy”! In true “back-to-basics” fashion, the privacy policy is getting a reboot!

Catagory:Legal & Regulatory Risk

EU Digital Omnibus on AI Enters Into Force

Publication Alert: Encrypted Messaging in the Crosshairs: Compliance, Legal Risks, and Global Perspectives

Modern Adtech Regulated Under Antiquated Law: How Video Killed the Internet Star

9,948,575,739 Reasons to Change Your Passwords now

Beijing CAC Approved the First China SCC Filing

Japanese Privacy Regulator Cautioned Businesses regarding Issues Relating to Generative AI Services

Australian Government contemplates Asimov’s Omnibus

Privacy Awareness Week Part V – Return of the Privacy Policy