By: Cameron Abbott, Daniel Knight, Rob Pulham and Emre Cakmakcioglu
Western intelligence alliance Five Eyes has issued a strong warning to business leaders: AI-driven transformation of cyber risk is already here, and the time to act is now.
Read MoreBy: Cameron Abbott, Daniel Knight, Rob Pulham and Emre Cakmakcioglu
Mere days after an AI firm’s model hacked into Hugging Face, a separate AI company has now revealed that three of its models have hacked into three external companies during testing.
Read MoreBy: Cameron Abbott, Rob Pulham, and Emre Cakmakcioglu
The Office of the Australian Information Commissioner (OAIC) has published updated guidance for entities considering using facial recognition technology (FRT) in high-volume, publicly accessible physical spaces, like retail shopfronts.
Read MoreBy: Sarah Pearce and Sophie Verstraeten
The European Data Protection Board (EDPB) has called on the European Commission to assess the implications of the recent US Supreme Court decision in Trump v. Slaughter for the EU-US Data Privacy Framework (DPF), the mechanism that facilitates transfers of personal data between the EU and participating US organisations.
Read MoreBy: Sarah Pearce and Thomas Nietsch
The EU has adopted its first substantive amendment to the AI Act. Regulation (EU) 2026/1744, commonly referred to as the AI Omnibus, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. While the legislation postpones certain aspects of the AI Act’s compliance timetable, it would be a mistake for organisations to view the Omnibus as a broad pause on AI regulation in Europe.
Read MoreBy: Cameron Abbott, Daniel Knight, Rob Pulham, Alex Parker, Madison Jeffreys, Emre Cakmakcioglu and Annaliese Filippis
In a key decision against an Australian financial services licence (AFSL) holder, the Federal Court of Australia has ordered the AFSL holder to pay AU$2.5 million in penalties for inadequate cybersecurity measures. The Australian Securities and Investments Commission (ASIC) took action following a cyberattack on the AFSL holder’s IT systems, resulting in approximately 385GB of data being downloaded from its servers.
Read MoreBy: Cameron Abbott and Rob Pulham
The Administrative Review Tribunal of Australia (Tribunal) has partially overturned the findings of the Privacy Commissioner on Bunnings’ use of facial recognition technology (FRT) in its stores.
Read MoreBy: Rob Pulham, Cameron Abbott, and Annaliese Filippis (Graduate, Melbourne)
The Office of the Australian Information Commissioner (OAIC), Australia’s privacy regulator, is conducting its first ever privacy compliance sweep, as of this January. The compliance sweep will include a review of the privacy policies of businesses that collect information in person.
Read MoreBy Cameron Abbott, Rob Pulham and Stephanie Mayhew
The Federal Court has ordered Australian Clinical Labs (ACL) to pay AU$5.8 million in civil penalties following a 2022 data breach involving its then-newly acquired Medlab Pathology business. The breach affected over 223,000 individuals whose data was accessed and infiltrated by malicious actors and is one of Australia’s most significant healthcare cyber incidents.
Read MoreBy: Rob Pulham, Cameron Abbott, and Maryam Ahmed
Not to be outdone by its regional peers, New Zealand updated its privacy laws with the passing of the Privacy Amendment Act 2025 (the Act) last month: see the NZ Privacy Commissioner’s media release here.
Read MoreCopyright © 2026, K&L Gates LLP. All Rights Reserved.