Cyber Law Watch – Insight on how cyber risk is being mitigated and managed across the globe

EU AI Act: Final Guidelines on Transparency Obligations Under Article 50

Jul 28 2026

On 20 July 2026, the European Commission published its final Guidelines on the transparency obligations under Article 50 of the EU AI Act. Although non-binding, the Guidelines provide important practical clarification ahead of the application of these obligations. Article 50 is not limited to high-risk AI systems and may apply to a broad range of AI solutions, including chatbots, generative AI tools, emotion recognition systems, biometric categorization tools, and deepfake technologies.

AI Models Were Asked To Solve The Test But Instead Hacked The Examiner

Jul 27 2026

By: Cameron Abbott and Emre Cakmakcioglu

An artificial intelligence research organisation has released a statement detailing how two of its cybersecurity models escaped from an internal testing sandbox to hack AI research platform Hugging Face.

EDPB Adopts Common Data Breach Notification Template

Jun 29 2026

By: Sarah Pearce and Veronica Muratori

One of the more practically significant outcomes of the European Data Protection Board (EDPB)’s June 2026 plenary session, was the adoption of a common template for personal data breach notifications under the GDPR.

An AFS Licensee First: Receiving an Order to Pay AU$2.5 Million for Cybersecurity Failures

Jun 16 2026

By: Cameron Abbott, Daniel Knight, Rob Pulham, Alex Parker, Madison Jeffreys, Emre Cakmakcioglu and Annaliese Filippis

In a key decision against an Australian financial services licence (AFSL) holder, the Federal Court of Australia has ordered the AFSL holder to pay AU$2.5 million in penalties for inadequate cybersecurity measures. The Australian Securities and Investments Commission (ASIC) took action following a cyberattack on the AFSL holder’s IT systems, resulting in approximately 385GB of data being downloaded from its servers.

ICO Publishes Soft Opt-in Electronic Marketing Guidance for United Kingdom Charities

May 11 2026

By: Dr. Thomas Nietsch and Noirin M. McFadden

The UK’s data protection regulator, the Information Commissioner’s Office (ICO) has published guidance for charities to use the new charitable purposes soft opt-in for electronic marketing.

Washington State Enacts First-of-Its-Kind Chatbot Disclosure Law

Apr 16 2026

By: Nicole H. Buckley and Whitney E. McCollum

Washington State Governor Bob Ferguson recently signed House Bill 2225 (the Chatbot Disclosure Act) into law, effective 1 January 2027. The Chatbot Disclosure Act requires people and entities who operate AI “companion” chatbots to provide clear and ongoing disclosure to Washington consumers that they are interacting with an automated system and not a human being.

Mixed Blessings: Decision on Appeal by Bunnings Against Privacy Commissioner’s Determination Re the Use of Facial Recognition Technology

Feb 09 2026

By: Cameron Abbott and Rob Pulham

The Administrative Review Tribunal of Australia (Tribunal) has partially overturned the findings of the Privacy Commissioner on Bunnings’ use of facial recognition technology (FRT) in its stores.

NSW Expands Surveillance Powers and Introduces Public Interest Protections

Jan 20 2026

By Cameron Abbott, Damien Timms and Maryam Ahmed (Graduate, Melbourne)

The NSW Government has announced legislative reforms that will enhance the surveillance powers of investigative agencies including NSW’s Independent Commission Against Corruption (ICAC).

Australia’s Privacy Regulator Beginning 2026 With Its First Compliance Sweep

Jan 16 2026

By: Rob Pulham, Cameron Abbott, and Annaliese Filippis (Graduate, Melbourne)

The Office of the Australian Information Commissioner (OAIC), Australia’s privacy regulator, is conducting its first ever privacy compliance sweep, as of this January. The compliance sweep will include a review of the privacy policies of businesses that collect information in person.

Australian Clinical Labs fined AU$5.8 Million for 2022 Medlab Data Breach in an Australian First

Oct 10 2025

By Cameron Abbott, Rob Pulham and Stephanie Mayhew

The Federal Court has ordered Australian Clinical Labs (ACL) to pay AU$5.8 million in civil penalties following a 2022 data breach involving its then-newly acquired Medlab Pathology business. The breach affected over 223,000 individuals whose data was accessed and infiltrated by malicious actors and is one of Australia’s most significant healthcare cyber incidents.