GRC Report Staff

The Spanish Data Protection Agency (AEPD) issued a favorable opinion on a bill creating the Electronic Judicial Office of Navarre, which implements Law 18/2011 on information technology use in the administration of justice. The AEPD recommends considering links to its own Electronic Office and to that of the General Council of the Judiciary, reflecting the division of supervisory competences over data protection. Compliance teams should note the emphasis on applying personal data security measures to information processed through judicial electronic portals.

The UK Serious Fraud Office secured a combined 15 years and nine months in prison for three former Ethical Forestry Limited directors who defrauded more than 3,000 investors, many of them pensioners, of GBP $70 million over seven years. The case shows continued enforcement focus on pension-linked investment fraud, deceptive cold-calling, and misleading "green" investment claims. Compliance teams should treat it as a reminder to strengthen fraud detection, due diligence on investment products, and customer protection controls.

The Norway Financial Supervisory Authority has listed a warning about fraudulent activities carried out under the name of Gablau Invest Sàrl, a purported Luxembourg company. The warning originates from Luxembourg's CSSF. Compliance teams should treat the entity as a potential investment fraud risk and update screening and client-protection controls.

The Netherlands Data Protection Authority (Autoriteit Persoonsgegevens) has published a downloadable privacy statement template for small and medium-sized enterprises (SMEs) across 10 industries, along with a companion template for a processing register. The templates are voluntary guidance rather than new obligations, but they signal the regulator's baseline expectations for GDPR transparency and record-keeping. Compliance teams should note this benchmark, particularly when assessing SME customers, vendors, and counterparties in the Netherlands.

The Norway Financial Supervisory Authority has published a warning that relays a Luxembourg CSSF notice about fraudulent activities by persons misusing the name of Neventa Management. The notice signals a cross-border impersonation fraud risk, and compliance teams should update screening and client-protection controls accordingly.

Norway's Financial Supervisory Authority (Finanstilsynet) has circulated a warning that originated with Luxembourg's CSSF. It concerns fraudulent activity by persons misusing the name of the Luxembourg company Force Management. Compliance teams should treat this as a fraud and impersonation alert, screen for exposure, and update monitoring controls.

The AEPD examined a claim that Octopus Energy España allowed a fraudulent online contract in a victim's name, followed by an erroneous delinquency listing of EUR $246. The document provided is a truncated resolution to close proceedings. It shows the regulator weighing identity verification controls, risk analysis, and data accuracy. It also shows the weight a controller's prompt remediation carries. Compliance teams should treat it as a practical benchmark for onboarding fraud controls and credit-reporting governance.