July 1, 2026

France's CNIL has issued substantive recommendations on connected vehicle location data, establishing the most detailed sectoral guidance yet produced by a major EU supervisory authority on mobility data practices. The recommendations, developed following public consultation, address commercial operators of cars, bicycles, and scooters processing location data under GDPR. Their significance extends beyond France: CNIL guidance in emerging technology sectors has historically informed EDPB-level standard-setting, and automotive and telematics operators with pan-European footprints should treat these recommendations as an early indicator of where EU expectations are heading.

Watch level: PREPARE (automotive OEMs, telematics providers, connected mobility operators with EU exposure)

EU member state data protection authorities have submitted their Article 62 evaluation responses to the European Commission's 2025 review of the Law Enforcement Directive, coordinated through the EDPB. The submissions provide national-level assessments of LED implementation quality, enforcement gaps, and areas warranting legislative revision. A consolidated pattern of identified gaps across multiple member states materially increases the probability that the Commission will advance a formal LED amendment proposal. Organizations processing personal data under law enforcement cooperation frameworks — including private entities subject to data-sharing obligations with law enforcement — should monitor the Commission's forthcoming synthesis closely.

Watch level: MONITOR (law enforcement data processors, criminal justice technology vendors, national DPA compliance teams)

The ICO's guidance on Recognized Legitimate Interest has now received third-party analytical coverage confirming its operational scope, but this development was covered in the previous briefing and no material new legal interpretation has emerged. The guidance remains actionable for UK-established controllers relying on RLI as a lawful basis.

Watch level: MONITOR (UK-established controllers, multinational compliance teams with UK data flows)

HR 9515, introduced in the US House and referred to the Committee on Energy and Commerce, would mandate multi-factor authentication for user access to Healthcare.gov. The bill is narrow in scope but signals a broader legislative pattern: Congress is increasingly inclined to codify specific technical security controls for federally administered health data systems rather than leaving implementation entirely to agency discretion. For healthcare IT vendors and contractors supporting ACA marketplace infrastructure, the bill's trajectory warrants tracking even at early committee stage.

Watch level: MONITOR (healthcare IT vendors, ACA marketplace contractors, federal health data security teams)

Rhode Island's enactment of direct-to-consumer genetic privacy legislation was covered in the previous briefing. No material developments have emerged in the intervening period beyond continued third-party commentary confirming the five-state pattern. DTC genetic testing operators should already have this enactment reflected in their state compliance calendars.

Watch level: AWARENESS (DTC genetic testing operators)