GRC Report Staff

On September 3, 2026, the Warsaw Voivodeship Administrative Court upheld the Polish data protection authority's October 2025 reprimand of a Sejm member who disclosed a resident's personal data during a live-streamed parliamentary inspection. The court found no legal basis for the disclosure and held that it was not necessary for the stated purpose. Compliance teams should treat this as confirmation that a legitimate public function does not override the necessity and data minimization requirements of data protection law.

Hundreds of Metropolitan Police officers and staff used an unapproved third-party platform to share personal information about suspected shoplifters, including children, over an 18-month period without adequate data protection safeguards or oversight, according to findings released by the UK's Information Commissioner's Office (ICO).

Financial market infrastructures are expected to maintain sufficient equity-backed liquid assets to withstand losses arising from their business operations. An international assessment found problems with how some of those institutions were applying that requirement, prompting further work by two of the financial system's principal standard-setting bodies.

The European Securities and Markets Authority (ESMA) has called on financial firms to be more precise about claims of positive environmental and social impact and climate transition, warning through new guidance that investors need clearer information about what such claims mean and how the promised results will be assessed.

The Hong Kong SFC has issued a circular requiring management companies of SFC-authorized public funds with direct or indirect private credit or private equity exposure to adopt enhanced offering document disclosures. Funds with 50% or more of NAV in private market assets will be classified as complex products, and the SFC may also designate funds below that level. Compliance teams should begin reviewing existing funds now, as the SFC expects updates as soon as practicable.

The Norway Financial Supervisory Authority has published a warning that references a Luxembourg CSSF notice about fraudulent actors misusing the name of Gekko Fund SICAV. Compliance teams should treat this as an impersonation and investment fraud alert and update screening, monitoring, and customer-protection controls accordingly.

The Norway Financial Supervisory Authority (Finanstilsynet) has posted a warning about Impound Services Ltd, a United Kingdom-issued notice that links to the UK Financial Conduct Authority (FCA) warnings list. Compliance teams should treat the entity as a high-risk, potentially unauthorized or fraudulent counterparty and screen for any exposure. The source material is sparse, so internal verification against the FCA page is essential.