Europe Clarifies Fines and Platform Privacy Rules
On 21 September 2026, the European Data Protection Board (“EDPB”) adopted draft guidelines setting out a five-step approach for deciding whether to impose administrative fines under the GDPR. Data protection authorities must determine whether an infringement can lead to a fine and who may be held liable, assess intent or negligence, consider aggravating and mitigating factors, and evaluate whether a fine would be effective, proportionate and dissuasive. Minor infringements would generally not result in a fine, although a reprimand may be issued instead, while other infringements carry a strong presumption in favour of a fine. Open for consultation until 13 November 2026, the draft would replace previous WP29 guidance and complement the EDPB’s existing guidelines on calculating fine amounts.
The Board also finalised guidance explaining how the Digital Services Act (“DSA”) and the GDPR work together. The DSA sets rules for how online platforms operate, while the GDPR governs how they handle personal data. When a platform processes personal data to meet a DSA obligation, it must also follow the GDPR’s rules. The Board also finalised its guidelines on the interplay between the DSA and the GDPR. While the DSA regulates how online platforms operate, the GDPR governs their processing of personal data. Where a platform processes personal data to comply with a DSA obligation, it must also comply with the GDPR, including by having a lawful basis, informing individuals clearly and respecting their data protection rights.
EU Proposes New Age Restrictions on Social Media
On 17 September 2026, the European Commission adopted a proposal for the EU KIDS Act, which would prohibit children under 13 from accessing social media and set 15 as the minimum age for opening an independent account. The proposal would also shift the burden of proof to service providers, requiring them to demonstrate that their services are age-appropriate and safe by design.
Central Africa Advances a Common Regional Data Governance
On 4 September 2026, the United Nations Economic Commission for Africa (“UNECA”) and its partners announced the completion of a five-day programme in Douala, Cameroon, supporting the development of a Regional Data Governance Framework for the Economic Community of Central African States (“ECCAS”). Differences in national regulations, digital infrastructure and institutional capacity currently make data sharing across the region difficult. Drawing on the African Union (“AU”) Data Policy Framework, the proposed framework aims to align national approaches and enable secure cross-border data flows while protecting individuals’ rights and countries’ control over their data. The programme brought together national representatives and other stakeholders to review the draft framework, discuss implementation responsibilities and risks, and receive training on tools for tracking progress. Their contributions will support the framework’s development and implementation roadmap.
EDPS Examines Privacy-Preserving Data Analysis Technology
On 17 September 2026, the European Data Protection Supervisor (“EDPS”) published a technical report on Secure Multi-Party Computation (“SMPC”), a technology that allows organisations to analyse data jointly without disclosing their underlying datasets to one another. The report examines how SMPC can support data minimisation, confidentiality and privacy by design, while highlighting challenges such as technical complexity, costs and scalability. The EDPS also notes that SMPC alone cannot guarantee the protection of personal data.
Google Fined €403 Million Over Location Data
On 21 September 2026, the Irısh Data Protection Commission (“DPC”) announced fines totalling €403 million against Google following an investigation prompted by complaints from European consumer organisations. The inquiry examined location data processing through “Web & App Activity”, “Location History” and “Location Accuracy” between May 2018 and February 2020. The DPC found unlawful and unfair processing and retention failures in the first two features, accountability failures in Location Accuracy and insufficient transparency across all three. Google was also ordered to bring its processing into compliance within six months.
Commenting on the decision, DPC Deputy Commissioner Graham Doyle emphasised that location data can reveal inherently private information and that Google’s failures could leave users unaware of how their data was used or cause them to lose control over it. He also noted that retaining location data longer than necessary aggravated this loss of control.
Irish DPC Fines Health Service Executive €645,000 Over Insecure Medical Records
On 2 September 2026, the Irısh DPC announced a €645,000 fine against the Health Service Executive (“HSE”) following an investigation into the storage of paper medical records at former psychiatric hospitals. The investigation revealed that sensitive medical records had been kept in unsuitable and insecure conditions, with some damaged by mould and water. The DPC found breaches of the GDPR’s security and storage limitation requirements, as well as failures to notify the authority and affected individuals of certain data breaches. The HSE was also ordered to improve its records management practices, audit its storage facilities and securely dispose of records no longer needed.
TikTok Withdraws Appeals and Accepts Fine for Data Protection Breaches
The UK’s data protection authority, the Information Commissioner’s Office (“ICO”), had imposed a £12.7 million fine on TikTok in 2023. Although TikTok’s rules prohibited children under 13 from opening accounts, the ICO estimated that up to 1.75 million children in this age group used the platform in the UK in 2020. The ICO found that TikTok had failed to carry out adequate checks to identify and remove underage users, obtain the necessary parental consent, and clearly explain how personal data was used. TikTok appealed the fine, but its withdrawal of the appeal, announced on 24 September 2026, made the penalty final, and the company agreed to pay it.
Separately, in February 2025, the ICO opened an investigation into how TikTok uses the personal data of children aged 13–17 in its content recommendation systems, following concerns that these systems could expose children to inappropriate or harmful content. TikTok had also appealed the ICO’s request for information and documents in this investigation; the withdrawal of that appeal in September allows the investigation to proceed. No finding of infringement has been made to date.
California Broadens the Right to Delete
On 27 September 2026, California Governor Gavin Newsom signed the Expanding Privacy Rights Act, strengthening consumers’ right to request the deletion of their personal information. Under the existing California Consumer Privacy Act (“CCPA”), this right does not generally cover information a business obtains from third parties. The new law expands the right to include such information, including data purchased from data brokers, subject to applicable exceptions. The law also expressly permits businesses to maintain suppression lists to prevent deleted information from being reintroduced when new third-party data is acquired. In addition, businesses operating exclusively online and having a direct relationship with consumers will be required to provide an online request form for submitting privacy requests, rather than relying solely on an email address. The law takes effect on 1 January 2027.
Australia Clarifies Privacy Disclosures for Automated Decisions
On 30 September 2026, the Office of the Australian Information Commissioner (“OAIC”) published updated guidance to help organisations prepare for new transparency requirements taking effect on 10 December 2026. Entities subject to the Australian Privacy Principles (“APPs”) will need to explain in their privacy policies how personal information is used in computer programs that make or directly support decisions that could significantly affect individuals’ rights or interests.
The policies must describe the types of personal information used and the kinds of decisions involved, distinguishing between decisions made entirely by computer programs and those in which a computer program directly supports a human decision-maker. To help organisations understand when these rules apply, the OAIC has also published fact sheets and a flowchart.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
