Compliance Pulse

The US Senate has unanimously passed the Health Care Cybersecurity and Resilience Act, which now moves to the House of Representatives, according to SecurityWeek. The bill would fund cybersecurity improvements across healthcare providers, boost support for rural clinics, and formalise coordination between the Department of Health and Human Services and CISA. Last year, over 730 breaches affected more than 270 million Americans. For patients, a stronger legal floor on healthcare cybersecurity means your medical records face at least some mandated protection — not just best-effort goodwill.

OpenAI, Google, Meta, Nvidia, xAI, and Anthropic have signed the White House Accord on Super Intelligence, committing to internal AI safety controls, independent audits, and board-level oversight of frontier AI development, according to Dark Reading.

The agreement is entirely voluntary with no binding deadlines. Security experts broadly welcomed it as a starting point while noting that self-regulation without mandatory enforcement has a mixed track record. For everyday users, it signals that even the companies building these systems acknowledge the risks are real.

President Trump and the CEOs of Anthropic, Google, Meta, OpenAI, Nvidia, and xAI signed a voluntary agreement pledging internal controls, independent external audits, and board-level oversight of AI safety, according to SecurityWeek. The accord is described as "morally binding" but carries no legal enforcement mechanism. Critics note that several commitments are steps the companies had already announced. The agreement leaves the door open to future legislation.

A New Mexico jury found this week that Facebook violated state consumer protection law nearly 44 million times by misrepresenting how it handles user data — including false claims that users controlled their own information and that Facebook did not sell it to advertisers. Each violation carries up to $5,000 in civil penalties, meaning the final bill could reach billions. A judge will set the damages amount in the coming weeks.

For everyday users, the verdict is a reminder that platform privacy promises are worth reading critically. For businesses, it signals that state-level enforcement of data privacy claims is very much active, according to The Record.

Senators Mark Warner and Ted Cruz have introduced the Telecommunications Cybersecurity and Resilience Act, according to The Record. The bill would establish a working group inside the NTIA (National Telecommunications and Information Administration) to develop cybersecurity best practices for telecoms — but participation is voluntary.

The bill follows the Salt Typhoon campaign, in which Chinese government hackers spent years inside nine major US carriers. Critics note that mandatory rules introduced after Salt Typhoon were scrapped last year, and voluntary frameworks without penalties may not compel meaningful change.

Canada's Privacy Commissioner has opened a formal investigation into IDScan.net, a company that provides ID verification technology to retailers and hospitality businesses, according to The Record. Hackers accessed the company's cloud platform and stole personal data and driver's licence scans belonging to 153 million people. The probe will examine whether IDScan's security practices were adequate and whether affected individuals were notified properly under Canadian federal privacy law. If you have had your ID scanned at a bar, hotel, or retail store, your details may be among those exposed.

Ireland's Data Protection Commission has fined Google 403 million euros ($463 million) for failing to handle users' location data lawfully under GDPR (the General Data Protection Regulation — the EU's main privacy law), according to SecurityWeek. The investigation covered Google's Web & App Activity, Location History, and Android's Location Accuracy features between 2018 and 2020.

What to do: Review your Google account's location settings at myaccount.google.com and turn off any location tracking you do not actively want.

The European Commission has outlined the EU KIDS Act, a proposal that would bar children under 13 from social media entirely and require parental "mini accounts" for 13–15 year olds, with screen time capped at one hour per day, according to The Record. Platforms would be required to deploy age verification tools and build services that are safe by default — not something parents have to configure themselves. The proposal still needs approval from the European Parliament and member states before becoming law.

European Commission President Ursula von der Leyen has proposed a new Emergency Security Protocol, modelled on NATO's Article 4, that would allow any single EU member state to convene all 27 governments in response to cyberattacks, sabotage, or drone incursions, according to The Record. Von der Leyen cited recent incidents across Denmark, Lithuania, and Poland as evidence that current EU decision-making is too slow. For businesses operating across EU borders, a formal coordinated response mechanism would mean faster official guidance during major incidents.

The National Security Agency is reorganising itself into five mission centres focused on China, cybersecurity, artificial intelligence, combat support, and global intelligence, according to The Record. NSA Director General Joshua Rudd set a 30-day implementation timeline, with full operational capability expected by January.

For everyday users, a dedicated NSA cybersecurity centre signals increased federal attention to domestic threat defence. Whether that translates to faster public advisories and threat warnings remains to be seen.