📬 NicFab Newsletter #38 | September 15, 2026

Privacy, Data Protection, AI & Cybersecurity — weekly review.

In this issue:

🔴 CNIL fines EXTIA EUR 300,000: over three-quarters of 265 erasure requests received in 2024 went unhandled or mishandled (Articles 12 and 17 GDPR)

🏛️ Data Act: the "access by design" obligation under Article 3(1) applies to connected products placed on the market after 12 September 2026

📖 AI Act Explained, Part 38: Article 42 and the presumption of conformity linked to training data, cybersecurity certification and the new ground added by Regulation (EU) 2026/1744

🟢 Neuro-AI: the European Group on Ethics calls for protection of neurodata and inferences, plus governance of collection and reuse infrastructures

🔴 Garante Privacy fines BBVA Italia EUR 5.5 million for unwanted in-app marketing, and EUR 24,000 the Friuli Centrale health authority over health records

⚠️ Cyber Resilience Act: the 24-hour reporting clock has been running since 11 September, as APT29 and ShinyHunters weaponise AI models for malware and credential theft

🔍 ICO investigates Police Scotland over its handling of subject access requests

🏛️ Council Working Party on Data Protection: 17 September agenda on international data flows and the review of Regulation (EU) 2018/1725

📊 Research corner: membership inference and privacy auditing, differential privacy in clinical settings, split learning and attacks on LLM agents

👉 Read the full issue: https://www.nicfab.eu/en/newsletter-issues/2026-09-15-issue-38/?utm_source=telegram&utm_medium=organic-social&utm_campaign=issue-38

📩 Subscribe to the newsletter: https://www.nicfab.eu/en/pages/newsletter/#subscribe-now

#Privacy #GDPR #AIAct #Cybersecurity

Daily Digest | 15 September 2026

Garante privacy, azienda sanitaria di Udine sanzionata per 24mila euro. Il dossier sanitario è accessibile solo per r...
Garante Protezione dei dati personali - news
https://www.gpdp.it/garante/doc.jsp?ID=10295403

OpenAI stuck fighting Musk antitrust suit after Apple finds a way out
Ars Technica
https://arstechnica.com/tech-policy/2026/09/musk-drops-apple-from-antitrust-suit-but-keeps-gunning-for-openai/

Apple releases iOS 27, macOS Golden Gate 27 with Siri AI and Liquid Glass refinements
Ars Technica
https://arstechnica.com/apple/2026/09/apple-releases-ios-27-macos-golden-gate-27-with-siri-ai-and-liquid-glass-refinements/

Hackers hijack HBO Max Reddit account to push malware in ClickFix ads
BleepingComputer
https://www.bleepingcomputer.com/news/security/hackers-hijack-hbo-max-reddit-account-to-push-malware-in-clickfix-ads/

ClickFix attacks are tricking Mac and Windows users into hacking themselves
TechCrunch
https://techcrunch.com/2026/09/14/clickfix-attacks-are-tricking-mac-and-windows-users-into-hacking-themselves/

#Privacy #AI #Cybersecurity #DailyDigest

Daily Digest | 16 September 2026

Personal, Financial Info Exposed in Revolut Data Breach
SecurityWeek RSS Feed
https://www.securityweek.com/personal-financial-info-exposed-in-revolut-data-breach/

240,000 Hit by Data Breach at Japan’s Digital Agency
SecurityWeek RSS Feed
https://www.securityweek.com/240000-hit-by-data-breach-at-japans-digital-agency/

CISA: Critical VMware RCE flaw now exploited by ransomware gangs
BleepingComputer
https://www.bleepingcomputer.com/news/security/cisa-critical-vmware-vcenter-rce-flaw-now-exploited-by-ransomware-gangs/

Cisco patches Secure Email Gateway zero-day exploited in attacks
BleepingComputer
https://www.bleepingcomputer.com/news/security/new-cisco-secure-email-zero-day-exploited-to-execute-commands-as-root/

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
The Hacker News
https://thehackernews.com/2026/09/china-linked-hackers-exploit-chrome.html

#Privacy #AI #Cybersecurity #DailyDigest

Daily Digest | 17 September 2026

CONSIL:ST_12914_2026_ADD_3: COMMISSION STAFF WORKING DOCUMENT IMPACT ASSESSMENT REPORT Accompanying the document Prop...
EUR-Lex | AI Act | EN
https://eur-lex.europa.eu/legal-content/AUTO/?uri=CONSIL:ST_12914_2026_ADD_3

SWD:2026:982:FIN: COMMISSION STAFF WORKING DOCUMENT IMPACT ASSESSMENT REPORT Accompanying the document Proposal for a...
EUR-Lex | AI Act | EN
https://eur-lex.europa.eu/legal-content/AUTO/?uri=SWD:2026:982:FIN

CONSIL:ST_12967_2026_ADD_3: COMMISSION STAFF WORKING DOCUMENT IMPACT ASSESSMENT REPORT Affordable Housing Act Accompa...
EUR-Lex | AI Act | EN
https://eur-lex.europa.eu/legal-content/AUTO/?uri=CONSIL:ST_12967_2026_ADD_3

CONSIL:ST_12970_2026_ADD_2: COMMISSION STAFF WORKING DOCUMENT IMPACT ASSESSMENT REPORT Accompanying the document Prop...
EUR-Lex | AI Act | EN
https://eur-lex.europa.eu/legal-content/AUTO/?uri=CONSIL:ST_12970_2026_ADD_2

CELEX:52026SC0567: COMMISSION STAFF WORKING DOCUMENT IMPACT ASSESSMENT REPORT Accompanying the document Proposal for ...
EUR-Lex | AI Act | EN
https://eur-lex.europa.eu/legal-content/AUTO/?uri=CELEX:52026SC0567

#Privacy #AI #Cybersecurity #DailyDigest

Daily Digest | 18 September 2026

CELEX:52026PC0980: Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on digitalising the coordi...
EUR-Lex | AI Act | EN
https://eur-lex.europa.eu/legal-content/AUTO/?uri=CELEX:52026PC0980

CONSIL:ST_13320_2026_ADD_4: COMMISSION STAFF WORKING DOCUMENT EXECUTIVE SUMMARY OF THE IMPACT ASSESSMENT REPORT Accom...
EUR-Lex | AI Act | EN
https://eur-lex.europa.eu/legal-content/AUTO/?uri=CONSIL:ST_13320_2026_ADD_4

CONSIL:ST_13320_2026_ADD_3: COMMISSION STAFF WORKING DOCUMENT IMPACT ASSESSMENT REPORT Accompanying the document Prop...
EUR-Lex | AI Act | EN
https://eur-lex.europa.eu/legal-content/AUTO/?uri=CONSIL:ST_13320_2026_ADD_3

CONSIL:ST_13320_2026_INIT: Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Directive ...
EUR-Lex | AI Act | EN
https://eur-lex.europa.eu/legal-content/AUTO/?uri=CONSIL:ST_13320_2026_INIT

CELEX:52026SC0982: COMMISSION STAFF WORKING DOCUMENT IMPACT ASSESSMENT REPORT Accompanying the document Proposal for ...
EUR-Lex | AI Act | EN
https://eur-lex.europa.eu/legal-content/AUTO/?uri=CELEX:52026SC0982

#Privacy #AI #Cybersecurity #DailyDigest

Daily Digest | 21 September 2026

CONSIL:ST_13321_2026_INIT: Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL EU KIDS ACT - 'EU ...
EUR-Lex | AI Act | EN
https://eur-lex.europa.eu/legal-content/AUTO/?uri=CONSIL:ST_13321_2026_INIT

CONSIL:ST_13321_2026_ADD_1: COMMISSION STAFF WORKING DOCUMENT Analysis of impacts Accompanying the document Proposal ...
EUR-Lex | AI Act | EN
https://eur-lex.europa.eu/legal-content/AUTO/?uri=CONSIL:ST_13321_2026_ADD_1

FRA contributes to Council work on digitalisation in justice and law enforcement access to data
FRA News
https://fra.europa.eu/en/news/2026/fra-contributes-council-work-digitalisation-justice-and-law-enforcement-access-data

Fundamental rights in the EU Entry/Exit System feature at Darmstadt Biometrics Week 2026
FRA News
https://fra.europa.eu/en/news/2026/fundamental-rights-eu-entryexit-system-feature-darmstadt-biometrics-week-2026

Viral AI actress' hotline face-scans every caller, watches their mood
BleepingComputer
https://www.bleepingcomputer.com/news/security/viral-ai-actress-hotline-face-scans-every-caller-watches-their-mood/

#Privacy #AI #Cybersecurity #DailyDigest

━━━━━━━━━━━━━━━━━━━━

⚖️ EU Case-Law

🔹 Raidió Teilifís Éireann (RTÉ) v Commissioner for Environmental Information (C-330/25)
Judgment · 10 September 2026 · Court of Justice of the European Union