Legal & Compliance — 2026年9月28日 週次レポート
Legal & Complianceのニュース＆アップデート — すべての記述に一次ソースのリンク付き。
重要な発見
エグゼクティブサマリー（4件）
- •The week's dominant theme is the simultaneous tightening of accountability across AI, data protection, and children's online safety — three domains that were once treated as distinct compliance silos but are now converging into a single integrated governance challenge. The €403 million Google location data fine, the EU CRA reporting obligations going live, the EU KIDS Act proposal, and California's AB 1709 all arrived in the same week, signaling that the era of voluntary self-governance in digit…
- •The Delaware Court of Chancery's Dodiya v. Franklin ruling is the most consequential corporate governance development of the week: it establishes that the 2025 DGCL Section 144 safe harbors, while powerful, will not protect boards that run reckless processes or make material misstatements to stockholders. Combined with the sustained practitioner debate over the SEC's Rule 14a-8 rescission, the corporate governance landscape is undergoing structural reconfiguration that will require boards and M&…
- •EEOC and USCIS enforcement simultaneously reached high-intensity levels this week — the EEOC with its highest-dollar settlement week of the current period and USCIS with a concentrated focus on voter fraud and naturalization fraud. The pattern across both agencies suggests that federal enforcement is operating at maximum institutional capacity in areas of political priority, regardless of the broader deregulatory environment, and compliance programs that assumed reduced scrutiny in these areas f…
- •The international legal architecture is expanding on multiple fronts: the EDPB harmonized its GDPR fining methodology the same week the Irish DPC issued a €403 million Google fine, the Council of Europe adopted its first LGBTI rights strategy, and the UNGA produced a global digital crime blueprint. Organizations with multinational operations face a compliance environment where international standards are becoming more uniform, more enforceable, and more consequential simultaneously.
今回の要点（15件）
- 1.The Irish Data Protection Commission fined Google €403,000,000 on September 23, 2026 for location data processing violations, one of the largest GDPR fines to date, announced the same week the EDPB harmonized its fining methodology [15].
- 2.The Delaware Court of Chancery issued Dodiya v. Franklin on August 26, 2026 — the first opinion applying the 2025 DGCL Section 144 safe harbor amendments — holding both safe harbors unavailable due to reckless process defects and a material proxy statement misstatement [7a].
- 3.California enacted AB 1709 (signed September 10, 2026) restricting addictive features on covered platforms for users under 16, with civil penalties up to $50,000 per knowing violation per affected minor [3a].
- 4.The European Commission published a proposed EU KIDS Act on September 17, 2026, establishing tiered age-based access regimes for social media and imposing safety-by-design requirements [3b].
- 5.The FTC sought public comment on September 24, 2026 on whether to update its Rule on Impersonation of Government and Businesses to address online platforms' role in promoting impersonation scams [4].
- 6.The FTC also approved revisions to its Rules of Practice on September 24, 2026, including organizational changes reflecting the creation of the American Competition Enforcement unit [4].
- 7.The EU Cyber Resilience Act's incident reporting obligations became active on September 11, 2026, requiring manufacturers to submit early warnings within 24 hours and full notifications within 72 hours of awareness of actively exploited vulnerabilities or severe incidents [3c].
- 8.The EEOC announced its highest-dollar enforcement week of the current period: Mile Hi Foods agreed to pay $1,500,000 for race, sex, and national origin discrimination, and North American Stamping Group subsidiaries agreed to pay $620,000 for sex harassment [14].
- 9.USCIS reported four enforcement actions this week focused on voter fraud and naturalization fraud, including a Haitian alien who pleaded guilty to illegally voting in the 2024 election and a Bhutanese naturalized citizen indicted for naturalization fraud [8].
- 10.The OCC issued a new Cybersecurity Supervision Work Program bulletin on September 21, 2026, updating examiner guidance on cybersecurity assessment at OCC-supervised institutions [16].
- 11.The SEC's Rule 14a-8 rescission proposal generated sustained practitioner analysis from Mayer Brown and Paul Weiss, with Paul Weiss noting the rule will likely remain effective for most of the 2026-27 proxy season and that the rescission could be challenged in courts [7b].
- 12.The ABA Journal reported that courts are imposing consequences for AI-generated legal errors, with an appeals court warning that 'AI slop' threatens courts' ability to function and the 5th Circuit directing lawyers to verify citations [1a].
- 13.The Council of Europe adopted its first Strategy for equal rights of LGBTI people covering 2027-32 on September 24, 2026 [13].
- 14.The Republic of Moldova acceded to the HCCH 2007 Child Support Convention on September 16, 2026, bringing the total bound parties to 56 states and the EU [11].
- 15.The UNGA high-level week produced a global blueprint to tackle fast-evolving digital crime, and the Security Council was briefed by OpenAI and Anthropic on AI risks described as 'real and imminent' [6].
市場動向
AI Hallucination Liability Crystallizes as Courts and Ethics Bodies Act
A pattern of judicial and professional accountability for AI-generated legal errors intensified this week. An appeals court warned that 'AI slop' is threatening courts' ability to function [1], the 5th Circuit directed lawyers to verify citations while itself citing the wrong rule [1a], and a senior associate filed a court apology detailing how she would avoid future AI mistakes [1b]. A new ABA Journal feature published September 26, 2026 reported that ethics professionals say rule changes are n…
FTC Expands Enforcement Scope to Impersonation Scams and Rules of Practice
The FTC added two new enforcement vectors this week beyond its prior settlement activity. On September 24, 2026, the FTC sought public comment on whether to update its Rule on Impersonation of Government and Businesses to address online platforms' role in promoting impersonation scams [4]. On the same date, the FTC approved publication of Federal Register notices revising its Rules of Practice to align with the FTC Act and reflect organizational changes including the creation of the American Com…
SEC Rule 14a-8 Rescission Generates Sustained Corporate Governance Debate
The SEC's September 16, 2026 proposal to rescind Rule 14a-8 continued to generate significant analysis this week. Mayer Brown published analysis on September 23, 2026 examining the proposal's grounds and implications [7c]. Paul Weiss published a companion analysis on September 24, 2026 outlining how shareholder engagement strategies will evolve if the rule is rescinded, noting that Rule 14a-8 will likely remain effective for most of the 2026-27 proxy season and that the proposed rescission could…
UNGA High-Level Week Produces Global Crime and AI Governance Commitments
The UN General Assembly's high-level week produced two legally significant outputs relevant to compliance professionals. On September 27, 2026, UN News reported that countries adopted a global blueprint to tackle fast-evolving crime in the digital age [6]. The Security Council was briefed by OpenAI and Anthropic on what was described as a 'real and imminent' threat posed by runaway AI [6]. These developments signal that international legal frameworks for digital crime and AI governance are movin…
Children's Online Safety Regulation Accelerates Across Multiple Jurisdictions
This week saw simultaneous legislative and regulatory action on children's online safety across the US and EU. California Governor Newsom signed AB 1709 on September 10, 2026, restricting addictive features on covered platforms for users under 16 and establishing an e-Safety Advisory Commission, with civil penalties up to $50,000 per affected minor for knowing violations [3]. The European Commission published a proposed EU KIDS Act on September 17, 2026, establishing tiered age-based access regi…
競合動向
Delaware Section 144 Safe Harbor Limits Tested in Dodiya v. Franklin
The Delaware Court of Chancery issued Dodiya v. Franklin on August 26, 2026, the first opinion applying the amended DGCL Section 144 safe harbors to a challenged merger transaction. The court held that the Section 144(a)(1) safe harbor was unavailable because the board acted with 'reckless indifference' to process defects — specifically permitting a conflicted CEO to access transaction materials after his information leak was discovered — and that the Section 144(a)(2) stockholder vote safe harb…
SEC Tokenized Securities Innovation Exemption Analyzed for Market Implications
Sullivan & Cromwell published detailed analysis on September 25, 2026 of the SEC's September 17, 2026 Innovation Exemption for tokenized NMS stock trading, noting that the exemption is limited to five-year terms expiring September 17, 2031, requires permissioned access and OFAC compliance, is limited to AMM-based trading, and does not cover synthetic tokenization structures [7d]. The analysis also noted that the exemption does not address decentralized protocols lacking an identifiable operator …
EDPB Harmonizes GDPR Fining Methodology and Issues DSA-GDPR Guidelines
The European Data Protection Board adopted harmonized fining methodology and final guidelines on the interplay between the Digital Services Act and GDPR on September 21, 2026 [15]. The Irish Data Protection Commission fined Google €403,000,000 following an inquiry into Google's processing of location data, announced September 23, 2026 [15]. The Spanish DPA fined Securitas Direct €100,000 for directing individuals to a chargeable telephone number to exercise data subject rights, announced Septemb…
Republic of Moldova Accedes to HCCH Child Support Convention
On September 16, 2026, the Republic of Moldova deposited its instrument of accession to the 2007 HCCH Child Support Convention, bringing the total number of states and the EU bound by the Convention to 56 [11]. The Convention will enter into force for Moldova on a future date following the accession deposit [11]. This accession expands the geographic reach of the international child support recovery framework, with practical implications for cross-border family law practitioners and enforcement …
Council of Europe Adopts First LGBTI Rights Strategy and Minority Rights Report
The Council of Europe adopted its first Strategy for equal rights of LGBTI people covering 2027-32 on September 24, 2026, setting a common direction for ensuring LGBTI people fully enjoy their human rights, and simultaneously released a new report on anti-LGBTI hate speech [13]. A separate Council of Europe report published September 23, 2026 highlighted worrying trends in the treatment of national minorities, including increasing hostility and unequal treatment across Europe in 2024-26 [13]. Th…
制度・規制動向
EU Cyber Resilience Act Reporting Now Operational; Compliance Obligations Active
The EU Cyber Resilience Act's incident reporting obligations for manufacturers of products with digital elements became active on September 11, 2026, confirmed by both Hunton Privacy Blog and Privacy World Blog. Manufacturers must submit early warnings within 24 hours, full notifications within 72 hours, and final reports within 14 days (for actively exploited vulnerabilities) or one month (for severe incidents) of awareness [3c]. Reporting must be made through the CRA Single Reporting Platform …
EEOC Sustains High-Volume Enforcement Across All Protected Categories
The EEOC announced an unusually high volume of enforcement actions this week spanning disability, religious, age, sex, and race discrimination. Notable actions include: North American Stamping Group subsidiaries agreed to pay $620,000 for sex harassment and discrimination (September 22, 2026); Mile Hi Foods agreed to pay $1,500,000 for race, sex, and national origin discrimination against Black, female, and Afghan applicants (September 25, 2026); EEOC sued Mercy Health for religious and race dis…
USCIS Intensifies Voter Fraud and Naturalization Fraud Enforcement
USCIS reported four distinct enforcement actions this week focused on immigration fraud and illegal voting. A Haitian alien pleaded guilty on September 22, 2026 to falsely claiming US citizenship to register to vote and casting a ballot in the 2024 general election [8]. A federal grand jury indicted Sha Bahadur Ghaley, a naturalized citizen from Bhutan, for naturalization fraud, with three others facing denaturalization (September 23, 2026) [8]. Two additional aliens were charged on September 25…
Delaware Privacy Law Amendments Significantly Expand Applicability and Obligations
Delaware Governor Matt Meyer signed House Bill 380 on September 2, 2026, significantly expanding the Delaware Personal Data Privacy Act effective January 1, 2027. The amendments lower the applicability threshold from 35,000 to 10,000 Delaware consumers, and to 5,000 for businesses deriving more than 20% of gross revenue from personal data sales [3d]. Notably, HB 380 extends the Act to third parties that acquire personal data from controllers — a provision with no equivalent in other state consum…
OCC Issues Cybersecurity Supervision Work Program Bulletin
The OCC issued a new Cybersecurity Supervision Work Program bulletin on September 21, 2026, providing updated guidance on how examiners will assess cybersecurity at OCC-supervised institutions [16]. This follows the OCC's September 11, 2026 announcement of proposed revised third-party risk management guidance and the interagency statement on core service provider supervision for community banks [16]. The OCC also reported mortgage performance data for the second quarter of 2026 on September 23, …
ソース活動
先週からの変化
Irish DPC Fines Google €403 Million for Location Data Processing
The Irish Data Protection Commission announced on September 23, 2026 a €403,000,000 fine against Google following an inquiry into Google's processing of location data [15]. This is one of the largest GDPR fines issued to date and follows the EDPB's adoption of harmonized fining methodology on September 21, 2026 [15]. The fine signals that the harmonized methodology is already being applied in major enforcement actions.
Delaware Court of Chancery Issues First Section 144 Safe Harbor Ruling
The Delaware Court of Chancery issued Dodiya v. Franklin on August 26, 2026, the first opinion applying the 2025 DGCL Section 144 safe harbor amendments to a challenged merger. The court held both the director-approval and stockholder-vote safe harbors unavailable due to reckless process defects and a material proxy statement misstatement [7a]. This ruling establishes the foundational interpretive framework for the 2025 DGCL amendments and will directly shape M&A process design for conflicted tr…
SEC Rule 14a-8 Rescission Proposal Advances with Sustained Practitioner Analysis
The SEC's September 16, 2026 proposal to rescind Rule 14a-8 generated sustained practitioner analysis this week, with Mayer Brown (September 23) and Paul Weiss (September 24) both publishing detailed assessments [7c]. Paul Weiss noted the rule will likely remain effective for most of the 2026-27 proxy season and that the rescission could be challenged in courts [7b]. The SEC also published a 60-day comment period notice. This is an update from last week's initial proposal announcement.
Children's Online Safety Regulation Converges Across US and EU
California enacted AB 1709 (signed September 10, 2026) restricting addictive features for users under 16 with penalties up to $50,000 per knowing violation per affected minor [3a]. The European Commission published a proposed EU KIDS Act on September 17, 2026 establishing tiered age-based access regimes and safety-by-design requirements for social media platforms [3b]. The simultaneous US state and EU legislative action creates a new cross-jurisdictional compliance obligation for platform operat…
EEOC Enforcement Reaches High-Volume Week with $1.5M Mile Hi Foods Settlement
The EEOC announced its highest-dollar enforcement week of the current period, with Mile Hi Foods agreeing to pay $1,500,000 for race, sex, and national origin discrimination (September 25, 2026), North American Stamping Group subsidiaries paying $620,000 for sex harassment (September 22, 2026), and multiple new lawsuits filed against Mercy Health, Trancasa USA, and others [14]. This represents an escalation from last week's enforcement activity and confirms the EEOC is operating at sustained hig…
ウォッチリスト — 今後の締切
China new Measures for Public Security Organs' Supervision and Inspection of Cyberspace Security take effect, replacing 2018 provisions
ソース: Hunton Privacy BlogDelaware Personal Data Privacy Act amendments (HB 380) take effect, significantly expanding applicability thresholds and obligations
ソース: Privacy World Blog示唆・見るべき論点（10件）
- 1.The EDPB's harmonized fining methodology, adopted September 21, 2026, and the Irish DPC's €403 million Google fine announced two days later are not coincidental — they signal that the EU data protection enforcement system is entering a phase of coordinated, methodology-driven enforcement that will produce more predictable but also more severe outcomes for major data processors.
- 2.The Delaware Section 144 safe harbor ruling in Dodiya v. Franklin establishes a critical compliance principle: the safe harbors require not just procedural compliance but substantive good faith — boards that permit conflicted fiduciaries to access transaction materials after conflicts are discovered will lose safe harbor protection regardless of formal process compliance.
- 3.The simultaneous California AB 1709 and EU KIDS Act proposal create a compliance design challenge for platform operators: the California law focuses on addictive features and age verification, while the EU proposal establishes tiered age-based access regimes. Platforms will need to build compliance architectures that satisfy both frameworks without creating inconsistent user experiences across jurisdictions.
- 4.The FTC's proposed update to its Impersonation Rule to address platform-facilitated scams represents a significant expansion of platform liability theory — if finalized, platforms that host or facilitate impersonation scams could face FTC enforcement, not just the scammers themselves.
- 5.The OCC's new Cybersecurity Supervision Work Program bulletin, combined with the prior week's third-party risk management guidance, signals that OCC examiners are being equipped with updated frameworks that will translate into more structured and demanding cybersecurity examinations — financial institutions should treat these bulletins as advance notice of examination priorities.
- 6.The USCIS concentration on voter fraud and naturalization fraud enforcement this week — four separate actions in one week — suggests a deliberate enforcement priority shift that will likely intensify as the 2026 midterm election cycle approaches. Organizations with immigration-dependent workforces should ensure their employees understand the legal consequences of false citizenship claims.
- 7.The ABA Journal's reporting that ethics professionals say rule changes are not needed despite widespread AI citation errors creates a compliance gap: courts are imposing consequences through sanctions and reputational damage, but bar associations are not updating professional conduct rules. Law firms must develop their own AI verification protocols without waiting for formal rule guidance.
- 8.The Paul Weiss analysis of the Rule 14a-8 rescission noted that shareholders may increasingly turn to company bylaws to submit proposals — companies should review their advance notice provisions now to ensure appropriate procedural and disclosure requirements are in place before the 2027 proxy season.
- 9.The EU KIDS Act proposal's requirement for age verification using the EU age verification tool or equivalent public-authority solutions creates a new technical compliance obligation that will require significant platform infrastructure investment — operators should begin assessing their age verification capabilities against the proposed standard now.
- 10.The HCCH Moldova accession to the Child Support Convention, combined with the ongoing CBDC working group activity, confirms that the HCCH is expanding its membership and substantive agenda simultaneously — multinational family law and financial services practitioners should monitor HCCH outputs as they will increasingly affect cross-border enforcement and digital asset treatment.
信頼度サマリー
今週引用したソース 18 件あなたが選んだ 30 件の監視URLから検出（1つのURLから複数記事が出ることがあります）。
各ソースは信頼度レベルに応じて重み付けされています。単独ソースの主張は AI 合成時に未検証としてフラグ付けされます。
参照ソース一覧
Source for legal profession news including AI hallucination liability developments, 5th Circuit citation verification order, 'AI slop' threatening courts, ABA Legal Ed accreditor status committee decision, and Supreme Court developments including the government's use of Social Security data for voter identification.
Source for UK Law Commission news including specialist courts announcement (September 21, 2026) and prior publications on homicide offences consultation and weddings law reform.
Source for privacy and cybersecurity developments including California AB 1709 age restrictions (signed September 10, 2026), EU KIDS Act proposal (September 17, 2026), FCC TCPA Revoke All rule amendments (September 22, 2026), FTC rescission of 2021 Health App Breach Policy Statement (September 9, 2026), EU Cyber Resilience Act reporting obligations active (September 11, 2026), and Dutch DPA Uber fine of €824,990,000.
Source for FTC actions including proposed update to Impersonation Rule (September 24, 2026), revised Rules of Practice (September 24, 2026), FTC endorsement of Education Department accreditation competition proposal (September 22, 2026), and prior week's major settlements with Amway, FleetCor, and Amazon.
Source for SEC actions including updated market statistics showing increase in IPOs (September 23, 2026), OTC Link LLC censure for Regulation SCI compliance failures with $575,000 civil penalty (September 22, 2026), and prior week's Innovation Exemption for tokenized NMS stock and Rule 14a-8 rescission proposal.
Source for UNGA high-level week coverage including global blueprint to tackle fast-evolving digital crime (September 27, 2026), Security Council briefing by OpenAI and Anthropic on AI risks (September 24, 2026), and world leaders' pandemic preparedness meeting (September 25, 2026).
Source for corporate governance analysis including Dodiya v. Franklin Section 144 safe harbor ruling (September 24, 2026), Rule 14a-8 rescission analysis by Mayer Brown (September 23) and Paul Weiss (September 24), SEC Innovation Exemption analysis by Sullivan & Cromwell (September 25), 2026 Say-on-Pay recap (September 26), and 2026 sustainability reporting analysis (September 27).
Source for USCIS enforcement actions including Haitian alien guilty plea for illegal voting (September 23, 2026), Bhutanese naturalized citizen indicted for naturalization fraud with three others facing denaturalization (September 23, 2026), two aliens charged with illegal voting and false statements (September 25, 2026), and Nigerian alien indicted for illegal voting (September 25, 2026).
Source for privacy analysis including Delaware DPDPA amendments analysis (September 24, 2026), EU Cyber Resilience Act reporting obligations guidance (September 24, 2026), EDPB web scraping guidelines analysis, and US AI law 2026 midyear state update.
Source for CJEU developments including Maria José Costeira elected Vice-President of the General Court (September 23, 2026), CJEU judgment in SVB (C-900/24) on unfair contract terms (September 24, 2026), Advocate General Ćapeta opinion on dual-use items (September 24, 2026), and Acciaierie d'Italia state aid ruling (September 24, 2026).
Source for Republic of Moldova accession to the 2007 HCCH Child Support Convention on September 16, 2026, bringing total bound parties to 56 states and the EU.
Source for Skadden analysis including September 2026 quarterly Insights on life sciences M&A, state antitrust enforcement, and Europe's defense sector competition policy; Inside the Courts securities litigation update; and Delaware Court of Chancery Section 144 safe harbor analysis.
Source for Council of Europe developments including first LGBTI rights strategy 2027-32 adopted (September 24, 2026), worrying minority rights trends report (September 23, 2026), Council of Europe calls for alternatives to short prison stays for women in UK (September 24, 2026), and Secretary General Berset's Washington visit on democratic security (September 25, 2026).
Source for EEOC enforcement actions including Mile Hi Foods $1,500,000 settlement for race, sex, and national origin discrimination (September 25, 2026), North American Stamping Group $620,000 settlement for sex harassment (September 22, 2026), EEOC suits against Mercy Health, Trancasa USA, Circa Resort & Casino, and multiple disability discrimination actions.
Source for EDPB harmonized fining methodology and final DSA-GDPR guidelines (September 21, 2026), Irish DPC €403,000,000 Google fine for location data processing (September 23, 2026), and Spanish DPA €100,000 fine against Securitas Direct for obstructing data subject rights (September 22, 2026).
Source for OCC Cybersecurity Supervision Work Program bulletin (September 21, 2026), OCC mortgage performance report for Q2 2026 (September 23, 2026), and prior week's third-party risk management guidance and interagency statement on core service providers.
Source for Latham analysis including European Commission mandatory sustainability label proposal for data centres (September 25, 2026), UK government corporate sustainability reporting reform consultation (September 22, 2026), and Saudi Arabia new sports law (September 24, 2026).
Source for Baker McKenzie analysis including minority stakes competition compliance concerns (September 23, 2026), Australia modern slavery failure-to-prevent offence consultation, Singapore MAS agentic AI safeguards for financial institutions, and Mexico AML general rules.
Legal & Complianceを毎週、自動で監視
このレポートは一次ソースのみから生成されています。テーマとソースを選べば、引用付きレポートが毎週届きます。7日間無料トライアル・$33/月から。
無料トライアルを始める