Privacy and Cybersecurity Roundup Covers EU Rules, AI Threats and US Oversight

Summary

A policy roundup covers EU privacy measures, UK warnings about AI-enabled cyber threats, updated HIPAA security guidance, and US surveillance oversight findings, alongside analysis of privacy risks in foundation models.

Key points

The EDPB adopted a voluntary DPIA template for public consultation through June 9, covering risk assessment, safeguards and mitigation plans.
The EDPB approved updated Europrivacy criteria for global certification and a GDPR data-transfer mechanism, with binding commitments and a transfer impact assessment required.
CNIL guidance says email tracking pixels generally require consent for marketing and profiling, with narrow exemptions and requirements for granular consent and easy withdrawal.
UK ministers warned businesses that AI models can identify vulnerabilities and generate exploit code; the AI Security Institute says offensive capabilities are doubling approximately every four months.
Updated HHS OCR guidance emphasizes HIPAA risk management and documenting recognized security practices maintained for at least 12 months.
A PCLOB report says FBI queries of US persons fell approximately 87% from 2023 to 2025 and post-RISAA compliance exceeded 98%, while warning that lawful queries may be underused.
A Stanford HAI brief outlines privacy risks across foundation-model data collection, model outputs and user interactions, as well as threats including prompt injection and data poisoning.

Article Details

Event Type: UK government warning on escalating AI-enabled cyber threats, alongside updated U.S. healthcare security guidance and a report on Section 702 surveillance oversight.
Impact: The UK government warned that frontier AI models can identify vulnerabilities and generate exploit code at scale, making cyber risk an immediate operational concern across sectors and emphasizing board preparedness and supply-chain security. HHS OCR reinforced risk-management and documentation expectations for HIPAA-regulated entities. PCLOB reported improved compliance with Section 702 querying safeguards while noting continuing system limitations and uncertainty about long-term effects.