This update integrates critical legal changes regarding sensitive data usage, breach liability, and UK-specific regulations.

Key Course Additions

• Targeted Ads & Consent: New slides clarify that "special category" data (health, religion, etc.) requires explicit, documented consent for advertising—even if the information was shared publicly by the user.
• "Loss of Control" Damages: Updates reflect recent EU court rulings where individuals can claim compensation for data exposure without needing to prove financial or emotional harm.
• The Data Use and Access Act (DUAA): Content updated to reflect the July 2025 UK law. While the UK still holds "adequacy" status for easy data transfers from the EU, the DUAA introduces new domestic deviations from the EU GDPR.

Revised Penalties

HHS OCR Fines: Updated the non-compliance slide to reflect new maximums of $71,162 per violation and $2.13 million per year.

We have updated the Penalties for Non-Compliance slide to reflect the latest civil money penalty adjustments. It is crucial for learners to understand the significant financial risks associated with regulatory violations.

Key Updates:

• Civil Penalty Increases: The HHS Office for Civil Rights (OCR) has updated its enforcement thresholds.
• Per-Violation Caps: Organizations may now face fines of up to $71,162 per single violation.
• Annual Limits: For repeated violations of the same provision, the total penalty can reach up to $2.13 million per calendar year.

We have added new modules to reflect critical 2025/2026 legal rulings and regulatory clarifications.

What’s New:

• Sensitive Data in Ads: New slides clarify that "special category" data (e.g., health, religion) requires explicit, documented consent for targeted advertising, even if the information was shared publicly by the individual.
• Foreign Data Requests (Article 48): Following new 2025 EDPB guidance, personal data cannot be shared with non-EU authorities unless a valid international agreement and a GDPR transfer mechanism are both in place. Mandatory escalation to Legal/DPO is required.
• "Loss of Control" Damages: Updates reflect recent court rulings where individuals can now claim damages for data breaches based on "loss of control" alone, without needing to prove financial or emotional harm.

We have updated the Penalties for Non-Compliance slide to reflect the latest civil money penalty adjustments. It is crucial for learners to understand the significant financial risks associated with regulatory violations.

Key Updates:

• Civil Penalty Increases: The HHS Office for Civil Rights (OCR) has updated its enforcement thresholds.
• Per-Violation Caps: Organizations may now face fines of up to $71,162 per single violation.
• Annual Limits: For repeated violations of the same provision, the total penalty can reach up to $2.13 million per calendar year.