GRC Report Staff

Norway FSA Relays UK FCA Warning on PSP-Claimback Clone of Authorized Firm

The Norway Financial Supervisory Authority (Finanstilsynet) has republished a warning originating from the UK Financial Conduct Authority (FCA) about "PSP-Claimback," a clone of an FCA-authorized firm. Compliance teams should treat this as a fraud and impersonation alert, and take steps to prevent customers and the institution from being exposed to the scam.

Norway FSA Warns of Eoscoinvest Clone of FCA-Registered Firm

Norway's Financial Supervisory Authority (Finanstilsynet) has published a warning about Eoscoinvest, citing a UK Financial Conduct Authority (FCA) notice that the entity operates as a clone of an FCA-registered firm. Compliance teams should treat Eoscoinvest and its associated websites as high-risk for investment fraud and update screening and customer protection controls accordingly.

Norway FSA Publishes Warning on Swift TradeX, Flagged by UK FCA as Unauthorized Entity

Finanstilsynet (Norway FSA) has issued a warning about "Swift TradeX," referencing a prior warning from the UK Financial Conduct Authority (FCA). The notice signals a cross-border investor protection concern and a likely unauthorized or fraudulent investment offering. Compliance teams should treat the name as a high-risk counterparty indicator and update screening controls accordingly.

Spanish DPA Flags Data Protection Gaps in Health Sciences Student Patient Privacy Protocol

The Spanish Data Protection Agency's legal office (Gabinete Jurídico) reviewed a draft protocol governing student and resident access to patient information and identified three data protection concerns. These were the unclear legal basis for patient refusal of student presence, overly vague limits on clinical record access, and missing file-creation requirements for a student register. Although the report applies the now-superseded LOPD (Organic Law 15/1999), it shows how regulators assess health data access, consent, and governance, which remains relevant for organizations handling sensitive data.

Norway FSA Warns of Nexdiltd Clone Firm Impersonating FCA-Registered Entity

The Norway Financial Supervisory Authority (Finanstilsynet) has issued a warning about "Nexdiltd," described as a clone of an FCA-registered firm, and has referenced the related UK Financial Conduct Authority (FCA) warning. Compliance teams should treat this as a fraud and impersonation alert and screen customers, counterparties, and payment flows for links to the entity.

Spanish DPA Rules City Councils Cannot Authorize Video Surveillance Cameras in Public Lagoons

The Spanish Data Protection Agency (AEPD) concluded in a 2016 legal opinion that a city council cannot authorize a fishermen's society to install video surveillance cameras in public-domain lagoons. Capturing images in public places is reserved to the Security Forces and Corps under Organic Law 4/1997, with authorization granted by the Government Delegate. Compliance teams should note the strict limits on private video surveillance of public spaces and the broad treatment of images, voice, and license plates as personal data.

Polish Court Upholds UODO Reprimand of MP for Unlawful Disclosure of Personal Data

On September 3, 2026, the Warsaw Voivodeship Administrative Court upheld the Polish data protection authority's October 2025 reprimand of a Sejm member who disclosed a resident's personal data during a live-streamed parliamentary inspection. The court found no legal basis for the disclosure and held that it was not necessary for the stated purpose. Compliance teams should treat this as confirmation that a legitimate public function does not override the necessity and data minimization requirements of data protection law.