Blog
Data Protection Report
By Norton Rose Fulbright Visit the blog
768 published works
Data Protection Report
Open-Weight AI can bring hidden supply-chain risks
By Steve Roosa (US), Susan Ross (US)
Corporations are increasingly deploying AI models that are available for download and can be operated outside the infrastructure of the companies that originally developed them. These models can offer significant…
Data Protection Report
New California law on lawyer use of generative AI and Connecticut prompt injection ruling
By Susana Medeiros (US), Susan Ross (US)
California enacted a new law that imposes certain obligations on lawyers’ use of generative artificial intelligence beginning January 1, 2027, which is covered in our AI blog. That post also…
Data Protection Report
CIPA legislation enacted
By Eva Yang (US), Susana Medeiros (US), Susan Ross (US)
On September 30, 2026, the California Governor signed SB 690, which amends the California Invasion of Privacy Act (CIPA) to restrict private enforcement—but only for claims under CIPA’s pen register…
Data Protection Report
Happy Cyber Awareness Month
By Chris Cwalina (US), Will Daugherty (US), Ji Won Kim (US), Gerar Mazarakis (US), Eva Yang (US)
Happy October and Cyber Awareness Month! Ghosts and ghouls of Halloween are not the only danger lurking around the corner. Beware of increasingly sophisticated cyber threats. It is time to…
Data Protection Report
Internet privacy updates: CalPrivacy fines data brokers, Colorado proposes new AI regulations
By Susana Medeiros (US), Steve Roosa (US), Susan Ross (US), Wenda Tang (US)
Anyone who contracts for internet or social-media-based advertising may have overlooked two recent actions by the California Privacy Protection Agency (CalPrivacy) and the proposed draft AI regulations from Colorado, but…
Data Protection Report
Cyber incidents and litigation risk: Key developments for UK organisations
By Verity Quartermain, Jonathan Ball (UK)
As cyber incidents become more costly and complex, organisations are facing increasing exposure to personal data claims, mass actions and contractual disputes. We explore the key litigation trends, emerging risks…
Data Protection Report
NYDFS levies $250,000 fine on licensee for inadequate cyber risk assessment
By Susana Medeiros (US), Bhavna Agnihotri (US), Susan Ross (US)
On August 5, 2026, the New York Department of Financial Services (NYDFS) entered into a consent order with Order Express, Inc., a money transmitter licensed by NYDFS. Although Order Express…
Data Protection Report
The EU AI Act – when does it become enforceable now?
The Digital Omnibus on AI (AI Omnibus) has now been published in the EU’s statute book. This pushes back some of the application dates for the AI Act. So, what’s…
Data Protection Report
Quantum computing and cyber risk
By Alexander McGuire, Verity Quartermain, Jonathan Ball (UK)
Most security commentators believe that quantum computing will put the “cracking” of public-key cryptography in reach. This underscores the importance of preparing for the quantum revolution from a legal and…
Data Protection Report
Rhode Island’s new AI and healthcare privacy law
By Susana Medeiros (US), Susan Ross (US)
We recently published an article to commemorate AI Appreciation Day, but readers may also appreciate a law that recently passed In Rhode Island, known as the “Use of Artificial Intelligence…