Weekly brief, 2026 week 44

This issue collects seven stories, one of them a follow-up to an earlier article, covering 13 to 23 October.

Rules on access to land records in Hong Kong

According to a Development Bureau announcement on 16 October, the Hong Kong government gazetted eight pieces of subsidiary legislation that day. The provisions on electronic applications take effect on 4 October 2027, and the Secretary for Development will set the commencement date for the rest in the first half of 2027.

Hong Kong Free Press reported on 21 October that the new rules limit land record searches to nine purposes, and news reporting is not among them. "Public interest" is listed as a valid ground, but the Land Registrar vets every application case by case. The Hong Kong Journalists Association called for the amendments to be shelved, arguing that protecting "privacy" should not override the public's right to know, and listed 18 investigative reports produced using land records.

According to a Development Bureau paper to the Legislative Council quoted by Hong Kong Free Press, the purpose of the amendments is to strike a balance between protecting personal data privacy and keeping land records transparent. The South China Morning Post reported that on 23 October the Legislative Council decided to set up a subcommittee to examine them.

The face search engine PimEyes and the AI Act's ban

According to a netzpolitik.org report on 13 October, the EU's Artificial Intelligence Act has since 2 February 2025 banned AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet, but the face search engine PimEyes still operates as usual in Germany. The Federal Network Agency, designated as the competent authority only in summer 2026, declined to comment on planned or ongoing proceedings. A German bill would let the Federal Criminal Police Office and the Federal Police use such search engines, and according to the report, the bill's explanatory memorandum rests on the view that the ban does not apply if no AI system is used to scrape the data. As of 31 October, we had found no response from PimEyes to the report.

Senate committee review of Canada's Bill C-22

Our 20 October article, "Senate second reading of Canada's Bill C-22 and providers' responses", covered this Lawful Access Act. The bill would let the government require telecommunications and online service providers to build technical capabilities to assist law enforcement, and require designated providers to retain metadata (records about communications rather than their content). According to the bill's progress page on the Parliament of Canada website, the bill passed second reading in the Senate on 22 October and was referred to the Standing Senate Committee on National Security, Defence and Veterans Affairs. As of 31 October, the committee had no recorded activity on it.

According to the Senate Debates for the same day, the opposition critic for the bill argued that it should go to the Standing Senate Committee on Legal and Constitutional Affairs instead. The senator also noted that a House of Commons committee had amended the metadata retention period to six months. According to an Electronic Frontier Foundation (EFF) article on 22 October, the Canadian Civil Liberties Association is urging people to sign a petition against the bill, and some senators have also expressed concerns.

Finding of unlawful microtargeting by four German parties

According to an announcement on 21 October by noyb, a European privacy advocacy group, the Berlin data protection authority found that the SPD, the Greens, the Left Party and the CDU targeted ads at users based on their political interests without a legal basis such as consent. dpa-AFX, part of the German Press Agency (dpa), reported that the authority made its decision on 24 September and issued only formal warnings or reprimands to the parties, with no fines. As of netzpolitik.org's report on 23 October, the penalties were not yet final, according to a spokesperson for the authority. As of 31 October, we had found no response from the four parties.

Generative AI pilot for job-search checks at France's public employment service

On 23 October, La Quadrature du Net, a French digital rights group, published a presentation that France Travail gave to its AI ethics committee on 30 June. According to the group, the public employment service is piloting generative AI to help check whether jobseekers are actively looking for work, and the group called for its immediate withdrawal.

In the presentation's own words, the AI consolidates data from the database, interviews and case files into a single report, which an adviser analyses and validates. According to the same presentation, the decision always remains with the adviser. The goals it lists are meeting the 2027 target for checks with unchanged staffing and making checks systematic by 2030.

La Quadrature du Net argues that the advisers' work will be reduced to confirming possible sanctions. As of 31 October, we had found no response from France Travail to the document.

Palantir contracts with European governments

According to a netzpolitik.org report on 15 October, an investigation led by the Dutch outlet Follow the Money, with media from 18 countries taking part, found national-level contracts with Palantir, the US data analytics software company, in 11 European countries, eight of which have dealings with the armed forces or defence ministry. According to the same report, many countries are concerned about dependence, security and democracy, and are looking for alternatives.

According to netzpolitik.org's weekly round-up, the amounts disclosed by individual countries add up to about €1.4 billion. Some governments do not disclose their costs, so this is a lower bound. In its response to the investigative team, Palantir stated that technological sovereignty should be judged by who controls the data and decisions, not only by the nationality of the software vendor.

Enforcement of Ofcom's fines against websites outside the UK

Ofcom, the UK communications regulator, has fined the forum 4chan hundreds of thousands of pounds under the Online Safety Act, and according to a report by the entertainment outlet Dexerto on 20 October, 4chan had not paid. According to the same report, Ofcom's chief executive told a House of Commons committee that some fines may never be recovered if foreign courts get in the way. The chief executive also said that only 2 of the 11 fines issued under the Act since March 2025 had been paid.

A lawyer representing 4chan described this testimony on the lawyer's own website as Ofcom conceding defeat, while Dexerto wrote that the chief executive did not name 4chan and that Ofcom has not publicly said it is abandoning enforcement. According to news from the University of Oxford's Faculty of Law, the lawsuit 4chan brought against Ofcom in the US was dismissed by a federal district court in mid-September on grounds of foreign sovereign immunity. As of 31 October, we had found no response from Ofcom or any new enforcement action.