Your Daily Privacy & Surveillance Briefing

California Privacy Protection Agency Secures First CCPA Enforcement Settlement with Data Broker

• The California Privacy Protection Agency (CPPA) recently announced its first enforcement settlement under the California Consumer Privacy Act (CCPA) with a data broker. This settlement addresses allegations that the data broker failed to register with the agency and required consumers to provide unnecessary information when attempting to exercise their opt-out rights. This action signals increased regulatory attention on data brokers and the mechanisms consumers use to control their personal data, marking a significant step in CCPA enforcement.

  Fasken

• The EU-US Data Privacy Framework faces renewed uncertainty after the European Data Protection Board (EDPB) requested the European Commission to assess the impact of a recent U.S. Supreme Court judgment on the framework. The EDPB noted that the independence of supervisory authorities is crucial for assessing adequate data protection, and the framework's adequacy decision explicitly relied on the Federal Trade Commission's (FTC) independence, potentially undermining its legal basis. Privacy advocacy groups in the EU are now calling for the withdrawal of the US adequacy decision.

  Fasken

• In Canada, both federal and provincial bodies are advancing privacy reforms. The Information and Privacy Commissioner of Ontario released updated Privacy Impact Assessment Guidance on August 13, 2026, to assist public institutions in identifying and mitigating privacy risks. Concurrently, the Privacy Commissioner of Canada submitted recommendations for modernizing the federal Privacy Act, advocating for the recognition of privacy as a fundamental right and the incorporation of modern privacy principles.

  Fasken