July 28, 2026

A federal civil rights lawsuit filed against DHS marks a significant escalation in litigation over government surveillance of constitutionally protected activity. EPIC and three U.S. citizens allege that ICE and CBP systematically collected facial recognition data, license plate records, and identifying information on individuals peacefully observing immigration enforcement operations, then used that data to revoke their Trusted Traveler status. The 55-page complaint infers an undisclosed agency policy authorizing creation and retention of records on non-suspect observers — a theory that, if sustained by courts, would impose material constraints on federal surveillance infrastructure near immigration operations nationwide.

Watch level: PREPARE (immigration and civil liberties counsel, DHS vendor compliance teams, Trusted Traveler program administrators)

The EDPB's draft Guidelines 02/2026 on Anonymisation, published July 7, represent the most consequential update to EU anonymisation doctrine in over a decade. Replacing the Article 29 Working Party's 2014 opinion, the guidelines adopt a relative, context-dependent standard drawn from the CJEU's ruling in EDPS v SRB: the same dataset may constitute personal data for one organisation and genuinely anonymous data for another, depending on their respective capabilities and access. Organisations using purportedly anonymised data for AI training, research sharing, or secondary analytics should treat the draft as the operative framework for gap assessments now, ahead of finalisation.

Watch level: PREPARE (data science and AI training teams, research institutions, privacy counsel across all EU-exposed sectors)

The Italian Garante's €2 million fine against U.S.-based data broker Lusha Systems reinforces a durable enforcement pattern: EU supervisory authorities will pursue non-European entities that aggregate and commercialise personal profiles without a lawful GDPR basis. The Lusha action is notable because the company's core product — professional contact data harvested at scale — has not historically been treated as high-risk by the industry. That framing is no longer tenable under EU enforcement posture, and similar aggregation-and-resale business models should expect equivalent scrutiny.

Watch level: PREPARE (data broker operators, B2B sales intelligence vendors, US firms with EU data subject exposure)

A UK court's rejection of Bahrain's state immunity defense in a spyware surveillance case narrows a legal avenue that foreign governments have routinely invoked to block civil accountability claims in British courts. The ruling signals judicial willingness to allow claims alleging deployment of commercial spyware — including remote activation of microphones and cameras — to proceed against sovereign state actors. The decision has direct relevance to ongoing cross-border accountability efforts and may encourage parallel litigation strategies in other common law jurisdictions.

Watch level: MONITOR (government legal advisors, human rights litigation teams, commercial spyware vendors and their investors)

Meta's expanding deployment of video selfie-based biometric verification for Facebook — previously covered in the context of its broader rollout — has advanced materially, with confirmed regulatory mandates now driving adoption in Singapore and Thailand alongside voluntary product expansion. Compliance teams should note that the technical implementation differs by market: Singapore requires detection of government official impersonation, while Thailand mandates verification against national ID records for advertisers. The EU rollout remains subject to divergent biometric data rules under GDPR, and the absence of a harmonised consent framework across these jurisdictions creates layered legal exposure.

Watch level: MONITOR (platform compliance teams, EU and Southeast Asia privacy counsel, ad-tech and marketplace operators)

Across Asia, governments are converging on age assurance mandates for social media through structurally distinct models — hard access bans, mandatory verification without bans, and national digital identity integration — creating a fragmented compliance landscape with no common technical standard. Indonesia's enforcement actions have already compelled TikTok and YouTube to deactivate millions of accounts; Malaysia is integrating requirements into its MyDigital ID ecosystem; Vietnam, separately, is advancing draft legislation that would extend state-managed electronic identity to physical goods, digital assets, and transactions. That Vietnamese proposal, open for public comment through August 2, signals ambitions well beyond age assurance — toward a comprehensive state-linked identity layer for economic and legal activity that warrants early monitoring by multinationals operating in the market.

Watch level: MONITOR (platform trust and safety teams with APAC exposure, digital identity vendors, multinationals with Vietnam operations)