IT Security & Privacy

The Dutch Data Protection Authority (AP) reviewed the draft bill implementing Regulation (EU) 2023/2844 and Directive (EU) 2023/2843 on the digitalization of judicial cooperation and had no comments on it. The clean opinion signals low data protection friction for the bill's passage. Compliance teams should still track the legislative process, since the bill affects how personal data is exchanged electronically in cross-border judicial matters.

The European Union scored 71.53 out of 100 in its latest assessment of cybersecurity maturity, with most member states reaching at least a mature level of preparedness despite significant differences in their ability to respond to incidents and protect critical infrastructure.

At the SEC's roundtable on 24-hour trading, Commissioner Mark Uyeda said technology is no longer the main constraint on overnight trading. He said the open questions concern whether market participants and regulators can manage clearing, settlement, staffing, resiliency, and liquidity risks around the clock. The speech creates no new requirements, but it signals the areas where future rulemaking or supervisory focus is likely, so compliance teams should begin assessing readiness now.

The Cybersecurity and Infrastructure Security Agency (CISA) unveiled an updated cyber incident reporting form Monday, November 9, designed to help federal analysts identify connections between attacks that might otherwise appear unrelated.

Think about how we make decisions in everyday life. We sometimes take shortcuts because they save us time or make things easier. We might leave our front door unlocked because we're only stepping out for a minute, or share our house keys with someone because it's convenient. Most of the time, nothing happens. But that doesn't necessarily mean the decision was safe. The same applies to cybersecurity.

EIOPA's Eurofi article argues that private credit, Asset Intensive Reinsurance (AIR), and ICT third-party dependencies should be assessed together, because their capacity to interact and amplify one another is what creates systemic risk. The article is not a binding rule, but it signals supervisory priorities. Compliance teams should expect closer scrutiny of AIR, illiquid asset exposures, and DORA implementation.

The European Commission has preliminarily found that TikTok breached the European Union's Digital Services Act by failing to adequately assess and address the risks posed by its recommendation algorithm, which regulators say can repeatedly expose users to content involving mental health struggles, eating disorders and body image.