cyber.hendryadrian.com
Security News · keplernewsletter.substack.com

Cybersecurity and Privacy Roundup: Norway Raises Risk Level, NIST Sets PQC Timeline

· Original article ↗

Summary

This roundup covers new cybersecurity and privacy developments, including Norway’s HIGH national cyber risk level and recommended controls, NIST’s post-quantum migration deadlines, breach-risk guidance, AI-agent safeguards and data-protection policy changes.

Key points

  • The EDPS recommended stronger safeguards for proposed EU–US border data sharing, including objective criteria for queries, limits on sensitive data use and clearer oversight.
  • Lithuania’s data protection authority published GDPR breach-risk guidance using the likelihood and severity of potential harm to help determine notification duties; it also stresses evidence-based reassessment.
  • Norway’s data protection authority warned that autonomous AI agents may retain access to personal and confidential information without clear oversight, and recommended inventories, access limits and assigned ownership.
  • Norway’s NSM raised the national cyber risk level to HIGH, citing increased successful cyber operations and serious incidents. Its recommended measures include phishing-resistant MFA, segmentation, monitoring and supply-chain risk management.
  • Noyb filed five GDPR complaints alleging that Scale AI’s Outlier platform tracks workers, requires biometric verification and failed to respond to access requests; these are allegations in the complaints.
  • NIST’s NIST IR 8547 roadmap plans to deprecate quantum-vulnerable public-key algorithms after 2030 and disallow them after 2035; specified federal systems have earlier post-quantum migration deadlines.
  • NIST published a draft revision of its executive information-security handbook, organizing guidance around the Cybersecurity Framework 2.0 and linking governance, monitoring and incident response.

Article Details

Event Type
Multi-jurisdiction cybersecurity and privacy policy announcements, guidance, legislation, and regulatory complaints.
Impact
The developments call for stronger safeguards for personal data, AI systems, and critical infrastructure. Norway raised its national cyber risk level to HIGH and urged organizations in exposed sectors to act immediately. Other measures address breach-risk assessments, AI oversight and transparency, post-quantum cryptography migration, and protections for minors. noyb alleges that Scale AI’s Outlier platform tracks workers and requires disproportionate biometric verification; the complaints seek regulatory investigation.

People

Abigail SpanbergerVirginia Governor who issued Executive Directive 6 establishing a statewide preparedness approach to cybersecurity threats posed by AI.Kathy HochulNew York Governor who signed Senate Bill S9051B restricting specified unsafe AI companion features for minors.

Vendors

Personamandatory biometric verification procedures, conducted through the identity verification provider Persona. Workers are reportedly required to submit facial video recordings and identity documents repeatedly toScale AInoyb Files Five GDPR Complaints Against Scale AI Over Worker Surveillance

Products

Outlierfiled five GDPR complaints against US-based Scale AI, the operator of the AI training platform Outlier. The complaints, submitted in France, Italy, the Netherlands and Austria, concern extensive tracking of

Countries

Austriaof the AI training platform Outlier. The complaints, submitted in France, Italy, the Netherlands and Austria, concern extensive tracking of platform workers, mandatory biometric identity verification and failuresCanada🇨🇦 Canada’s Privacy Regulators Call for Stronger AI Governance in HealthcareFranceagainst US-based Scale AI, the operator of the AI training platform Outlier. The complaints, submitted in France, Italy, the Netherlands and Austria, concern extensive tracking of platform workers, mandatory biometricItalyUS-based Scale AI, the operator of the AI training platform Outlier. The complaints, submitted in France, Italy, the Netherlands and Austria, concern extensive tracking of platform workers, mandatory biometric identityLithuania🇱🇹 Lithuania Publishes Guidance on Assessing Personal Data Breach RisksNetherlandsAI, the operator of the AI training platform Outlier. The complaints, submitted in France, Italy, the Netherlands and Austria, concern extensive tracking of platform workers, mandatory biometric identity verificationNorway🇳🇴 Norway’s Data Protection Authority Warns of Privacy Risks from Autonomous AI AgentsUnited States(EDPS) issued Opinion 27/2026 on the proposed Framework Agreement between the European Union and the United States concerning the reciprocal exchange of personal information for identity verification, screening and

Industries

Artificial intelligenceThe guidance separately addresses the implications of artificial intelligence for breach risk assessments. The VDAI observes that AI tools can facilitate the combination of information from multiple sources, theCritical infrastructurerisks to national security. The authority identifies the defense industry, space sector, critical infrastructure operators, and suppliers to organizations important to national security as particularly exposed.Defenseserious consequences and posing potential risks to national security. The authority identifies the defense industry, space sector, critical infrastructure operators, and suppliers to organizations important toHealthcare🇨🇦 Canada’s Privacy Regulators Call for Stronger AI Governance in HealthcareSpaceand posing potential risks to national security. The authority identifies the defense industry, space sector, critical infrastructure operators, and suppliers to organizations important to national security