GRC Report Staff

The Danish Data Protection Agency (Datatilsynet) has submitted a consultation response on the revised draft of the AI Authorization Act, which would give public authorities a data protection legal basis to develop and use AI systems. While the Agency acknowledges improvements from the earlier draft, it stresses that a legal basis alone does not satisfy broader GDPR obligations, a critical reminder for compliance teams involved in public-sector AI deployment.

BaFin has issued a public warning against Zyrtex-X, an entity operating through wealthinvsthubs.com, which is suspected of offering financial, securities, and cryptocurrency services in Germany without the required authorization. Compliance teams should treat this as a reminder to maintain vigilance around unauthorized third-party financial service providers and to reinforce customer due diligence processes related to unlicensed entities.

ASIC's CP 391 proposes a revised access model for the companies register, introducing tiered access across general, company, business, and government user categories while restricting sensitive personal details like residential addresses and full dates of birth. Compliance teams at financial institutions should assess how these changes affect due diligence, KYC, and fraud-prevention processes that rely on register data, and consider submitting feedback before the October 12, 2026 deadline.

The Bank of England has refreshed its Statistics webpage, consolidating release schedules for money and credit, mortgage, capital, and regulatory data through early 2027, and disclosing a corrected gilt repo transactions series in its sterling money market data. Compliance and treasury teams relying on BoE statistical series for benchmarking, risk modeling, or regulatory reporting should note the correction and upcoming release dates to ensure data integrity in downstream processes.

The Spanish Data Protection Agency (AEPD) issued a legal opinion clarifying that bar associations and legal aid commissions may process family unit members' personal data based on legal obligation or public interest grounds under GDPR Article 6.1(c)/(e), rather than requiring individual consent from each family member. The opinion also invalidates opt-out consent mechanisms (unchecked boxes) used in Valencia's legal aid application forms, finding them non-compliant with GDPR's active consent requirements, which has direct implications for public bodies and professional associations administering benefits requiring family-based means testing.

The HKMA has released detailed guidance drawn from the second cohort of its GenA.I. Sandbox, covering 27 use cases across 20 banks and 14 technology partners. The report provides practical reference points on data strategy, solution design, and risk mitigation for generative AI and AI agent deployments, directly supporting application of the HKMA's updated Supervisory Guidance for Responsible Adoption of Artificial Intelligence (the "ART" framework: Accountability, Resilience, Trust).

The Spanish Data Protection Agency (AEPD) issued an opinion limiting a medical college's transfer of members' national ID numbers (DNI) and dates of birth to a regional health service for temporary disability control purposes. The ruling confirms that only data on doctors actually competent to issue disability reports within the requesting authority's territory may be shared, and that DNI (not date of birth) is the only additional identifier proportionate to the stated purpose. This decision offers a useful precedent on data minimization and purpose limitation for any organization sharing professional registry data with public administrations.