GRC Report Staff

The Spanish Data Protection Agency (AEPD) concluded in a 2016 legal opinion that a city council cannot authorize a fishermen's society to install video surveillance cameras in public-domain lagoons. Capturing images in public places is reserved to the Security Forces and Corps under Organic Law 4/1997, with authorization granted by the Government Delegate. Compliance teams should note the strict limits on private video surveillance of public spaces and the broad treatment of images, voice, and license plates as personal data.

On September 3, 2026, the Warsaw Voivodeship Administrative Court upheld the Polish data protection authority's October 2025 reprimand of a Sejm member who disclosed a resident's personal data during a live-streamed parliamentary inspection. The court found no legal basis for the disclosure and held that it was not necessary for the stated purpose. Compliance teams should treat this as confirmation that a legitimate public function does not override the necessity and data minimization requirements of data protection law.

Hundreds of Metropolitan Police officers and staff used an unapproved third-party platform to share personal information about suspected shoplifters, including children, over an 18-month period without adequate data protection safeguards or oversight, according to findings released by the UK's Information Commissioner's Office (ICO).

Financial market infrastructures are expected to maintain sufficient equity-backed liquid assets to withstand losses arising from their business operations. An international assessment found problems with how some of those institutions were applying that requirement, prompting further work by two of the financial system's principal standard-setting bodies.

The European Securities and Markets Authority (ESMA) has called on financial firms to be more precise about claims of positive environmental and social impact and climate transition, warning through new guidance that investors need clearer information about what such claims mean and how the promised results will be assessed.

The Hong Kong SFC has issued a circular requiring management companies of SFC-authorized public funds with direct or indirect private credit or private equity exposure to adopt enhanced offering document disclosures. Funds with 50% or more of NAV in private market assets will be classified as complex products, and the SFC may also designate funds below that level. Compliance teams should begin reviewing existing funds now, as the SFC expects updates as soon as practicable.

The Norway Financial Supervisory Authority has published a warning that references a Luxembourg CSSF notice about fraudulent actors misusing the name of Gekko Fund SICAV. Compliance teams should treat this as an impersonation and investment fraud alert and update screening, monitoring, and customer-protection controls accordingly.