{ "schema_version": 1.1, "generated_at": "2026-10-17T04:30:36.075Z", "channel": "regulatory_change", "channel_label": "Regulatory Change", "public": true, "count": 3, "contract": "https://radar.trulysovereign.com/docs/feed", "items": [ { "id": "a498b8b9-fc70-42db-b188-a3081f31d429", "channel": "regulatory_change", "headline": "Norwegian DPA fines Xandr €8.6M for RTB without valid consent for sexual orientation data", "what_changed": "On 2 October 2026, Norway's DPA fined Xandr Inc. €8,600,000 for processing Grindr users' personal data—including advertising IDs, IP addresses, and the fact of using Grindr—during real-time bidding without a legal basis under Article 6(1) GDPR and without valid consent for special category data under Article 9(1) GDPR. The DPA ruled that Xandr, as a joint controller in both supply-side and demand-side platform roles, could not rely on Grindr's invalid consent and must independently verify that consent is valid and covers its own processing. The fact of using Grindr was classified as data concerning sexual orientation under Article 9(1).", "why_matters": "This establishes that ad tech platforms in real-time bidding chains are joint controllers who cannot outsource accountability for consent verification to the publisher. If your platform processes bid requests containing data that reveals special category information—even indirectly, such as app usage implying sexual orientation—you must independently verify explicit consent under Article 9(2)(a) before processing. Relying on upstream consent strings without verification exposes you to enforcement and fines calibrated to the sensitivity of the data.", "what_to_do": "Audit your RTB processing to identify bid requests that contain or imply special category data, including app identifiers, contextual signals, or audience segments that reveal health, sexual orientation, religion, or other Article 9 categories. For each such flow, verify that you obtain and validate explicit consent directly, not by assuming upstream consent is sufficient. If you cannot verify consent independently, stop processing those bid requests in EEA markets.", "severity": "action_needed", "action_type": "assess_exposure", "tags": [ "security", "terms" ], "confidence": 0.95, "source_name": "EDPB news", "source_url": "https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en", "published_at": "2026-10-16T11:28:21.914712+00:00", "corrected_at": null, "correction": null, "correction_cause": null, "url": "https://radar.trulysovereign.com/items/a498b8b9-fc70-42db-b188-a3081f31d429", "affects": [ { "id": "eu", "type": "jurisdiction", "label": "european union" }, { "id": "gdpr", "type": "regulation", "label": "gdpr", "unmapped": true } ], "action_due": null, "time_to_correct": null }, { "id": "bcba245e-af6e-4eeb-85d1-9f35aca95826", "channel": "regulatory_change", "headline": "Italian DPA: controllers cannot require specific channels for rights requests", "what_changed": "On 3 July 2026, Italy's DPA fined BBVA EUR 5,508,000 for continuing direct marketing for seven months after a customer objected via the bank's app and customer service. The DPA ruled that controllers must accept rights requests through any channel the customer uses and cannot require submission through a preferred channel listed in the privacy policy. BBVA must report compliance measures to the DPA within 30 days of notification.", "why_matters": "If your product offers multiple contact points—app settings, support tickets, email—you must honor GDPR rights requests from any of them, not just a designated address. A technical failure that prevents synchronization between systems does not excuse continued processing after objection. Customer service telling users a control does not exist when it does is itself a GDPR violation under Article 12.", "what_to_do": "Audit every channel where a user can contact you (app settings, support forms, chat, email) and verify that objections and deletion requests submitted through any of them reach the systems that execute them. If you currently route users to a specific email for rights requests, remove any language suggesting other channels are invalid.", "severity": "worth_knowing", "action_type": "assess_exposure", "tags": [ "terms", "security" ], "confidence": 0.85, "source_name": "EDPB news", "source_url": "https://www.edpb.europa.eu/news/italian-dpa-fines-bbva-eur-5-508-000-for-failing-to-respect-a-customers-objection-to-direct_en", "published_at": "2026-10-09T22:40:45.627996+00:00", "corrected_at": null, "correction": null, "correction_cause": null, "url": "https://radar.trulysovereign.com/items/bcba245e-af6e-4eeb-85d1-9f35aca95826", "affects": [ { "id": "gdpr", "type": "regulation", "label": "gdpr", "unmapped": true }, { "id": "eu", "type": "jurisdiction", "label": "european union" } ], "action_due": null, "time_to_correct": null }, { "id": "b66157ad-83dd-4a1f-bee3-0b399973bace", "channel": "regulatory_change", "headline": "Italian DPA rules persistent identifiers plus health details enable re-identification", "what_changed": "On 23 September 2026, Italy's DPA fined IQVIA €7M and ruled that a database of ~1M patients was not anonymous as claimed. The authority found that a persistent patient identifier combined with year of birth, sex, diagnoses, prescriptions, and location data allowed individuals to be singled out and potentially re-identified using reasonably available means. The database also contained directly identifying information for 3,370 patients. IQVIA was found to have processed health data without legal basis, failed to conduct a data protection impact assessment, and failed to establish retention periods or adequate security measures.", "why_matters": "This establishes that persistent identifiers combined with detailed demographic and clinical attributes do not constitute anonymization under GDPR, even when names are removed. If your product assigns stable IDs to individuals and stores granular health or behavioral data alongside demographic fields, EU regulators may treat that data as personal and subject to Article 9 special category rules. The finding directly contradicts a pseudonymization-as-anonymization approach that multiple health analytics and research platforms have relied on.", "what_to_do": "Audit any database where you assign persistent identifiers to individuals and store health, biometric, or other Article 9 data with demographic or location fields. If the combination allows singling out individuals over time, treat it as personal data requiring a legal basis (typically explicit consent or legitimate interest with safeguards), conduct a DPIA, define retention periods, and provide Article 13 notices. If you cannot establish a legal basis, either have data minimized at source by the collecting entity or cease processing within 120 days, the timeline Italy imposed on IQVIA.", "severity": "action_needed", "action_type": "assess_exposure", "tags": [ "security", "terms" ], "confidence": 0.88, "source_name": "EDPB news", "source_url": "https://www.edpb.europa.eu/news/italian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-data_en", "published_at": "2026-10-09T22:40:20.999148+00:00", "corrected_at": null, "correction": null, "correction_cause": null, "url": "https://radar.trulysovereign.com/items/b66157ad-83dd-4a1f-bee3-0b399973bace", "affects": [ { "id": "gdpr", "type": "regulation", "label": "gdpr", "unmapped": true }, { "id": "eu", "type": "jurisdiction", "label": "european union" } ], "action_due": null, "time_to_correct": null } ] }