Privacy and data protection Archives | Digital Watch Observatory

UNESCO report calls for regional approach to digital platform regulation

A UNESCO report has called for a more coordinated regional approach to digital platform regulation in Mexico, Central America and the Caribbean, warning that existing legal frameworks are struggling to keep pace with the risks posed by online platforms.

The report, ‘The Regulation of Digital Platforms in Mexico, Central America and the Caribbean: From Diagnosis to a Roadmap for Action‘, examines Costa Rica, El Salvador, Guatemala, Honduras, Mexico, Panama and the Dominican Republic. It assesses how national legal frameworks align with UNESCO’s Guidelines for the Governance of Digital Platforms.

The report finds that all seven countries provide constitutional protections for freedom of expression, privacy and safeguards against prior censorship. However, most still lack comprehensive rules for digital intermediaries and robust personal data protection frameworks, with Mexico and Panama identified as partial exceptions.

According to UNESCO, these regulatory gaps have encouraged sector-specific, reactive or punitive measures rather than the shared responsibility, transparency and accountability model promoted in its guidelines. The report also highlights concerns about regulatory independence, noting that some oversight bodies remain subordinate to executive authorities.

Electoral integrity is identified as a major concern. The report says social media platforms, microtargeting and generative AI have outpaced the capacity of many electoral authorities, increasing exposure to disinformation and manipulation. Panama is highlighted as an exception because it has criminalised large-scale manipulation through bots and deepfakes.

The roadmap recommends shifting regulation away from individual content moderation towards oversight of platform systems, algorithms, transparency and risk management. It also calls for moderation practices that better reflect local languages, cultures and indigenous communities.

The report concludes that countries in the region have limited bargaining power when dealing individually with major technology companies. It recommends stronger regional cooperation, including negotiating blocs, and suggests using banking and tax authorities to improve oversight of advertising revenues, monetisation and other platform-related economic activity.

Why does it matter?

The report argues that effective digital platform governance requires regional cooperation rather than fragmented national approaches. For many smaller countries, limited regulatory capacity and bargaining power make it difficult to influence the practices of global technology companies or address cross-border challenges such as disinformation, algorithmic transparency and AI-enabled manipulation.

The recommendations also reflect a broader shift in platform regulation. Instead of focusing primarily on individual pieces of content, UNESCO advocates greater oversight of platform design, algorithms, transparency and systemic risks, aligning with emerging international approaches to digital governance.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

US House of Representatives passes Kids Internet and Digital Safety Act

The US House of Representatives has passed the Kids Internet and Digital Safety Act in a bipartisan 267-117 vote, advancing a broad package that combines 14 online child safety proposals into a single piece of legislation.

The legislation includes provisions requiring AI chatbots to remind users they are not human, provide mental health resources, encourage regular breaks and avoid promoting potentially harmful topics. Lawmakers also removed the original Kids Online Safety Act’s proposed ‘duty of care’ provision after concerns it could lead to censorship, a decision criticised by several senators who co-authored the earlier bill.

Critics, including digital rights organisations and several lawmakers, argue the legislation weakens existing protections and does not go far enough in holding technology companies accountable. The Electronic Frontier Foundation warned that compliance could encourage widespread age verification, potentially requiring users to submit personal information and raising concerns about privacy and freedom of expression.

Supporters reject those criticisms, arguing that the bill does not explicitly require age verification but instead strengthens safeguards for minors and expands parental controls. The legislation now moves to the Senate, where it is expected to face further scrutiny.

Why does it matter?

The legislation represents one of the most comprehensive federal efforts to strengthen online child safety in the United States. Its inclusion of AI chatbot requirements reflects growing recognition that conversational AI introduces new risks for younger users that existing online safety frameworks were not designed to address.

At the same time, the bill highlights the continuing challenge of balancing child protection with privacy and freedom of expression. As it moves to the Senate, debate is likely to focus on whether stronger platform accountability can be achieved without expanding age verification requirements or creating incentives for broader online censorship.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

UK and Germany deepen AI safety cooperation

The United Kingdom and Germany have agreed to strengthen cooperation on AI safety and security, expanding collaboration on advanced AI evaluation, cybersecurity risks and research into frontier AI systems.

Both governments described AI as one of the most consequential technologies of the era, offering significant economic and societal benefits while creating new security risks that require closer international cooperation.

The cooperation builds on the UK–Germany Strategic Science and Technology Partnership, a priority initiative under the UK-Germany Friendship and Bilateral Cooperation Treaty signed last year.

Under the partnership, the UK’s Department for Science, Innovation and Technology and AI Security Institute will work alongside Germany’s Federal Ministry for Digital Transformation and Government Modernisation, the Federal Ministry of the Interior and the German AI Safety and Security Institute.

The partners will deepen institutional cooperation by sharing best practices in AI evaluation, aligning research priorities and exchanging expertise. The collaboration will also examine the cybersecurity implications of advanced AI systems and contribute to the international evidence base on AI safety.

Germany’s Minister Dr Wildberger said the cooperation is open by design and reflects Germany’s position as an EU member state, including the role of the EU AI Office under the EU AI Act. He said the work is intended to be consistent with each country’s engagement with other partners.

UK Secretary Liz Kendall said the UK and Germany are natural partners on AI safety and security because their scientific communities are connected and their security interests are closely aligned.

She said the statement reflects a shared determination to ensure the public benefits from advanced AI while risks are rigorously understood and managed.

The partnership adds to a growing international network of public-sector AI safety institutions. Both governments said their work is intended to complement broader international initiatives while contributing new research and practical experience.

Why does it matter?

The agreement reflects a broader shift in AI governance from national initiatives to international cooperation. As advanced AI systems become more capable, governments are increasingly pooling expertise to improve model evaluation, understand emerging risks and develop common approaches to AI safety and security.

The partnership also reinforces the growing connection between AI governance and cybersecurity. By coordinating research, sharing technical expertise and aligning institutional capabilities, the UK and Germany aim to strengthen preparedness for frontier AI risks while supporting the responsible development and deployment of advanced AI technologies.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

OpenAI launches GeneBench-Pro for AI biology research

OpenAI has introduced GeneBench-Pro, a research benchmark designed to assess whether AI agents can perform the complex, judgment-intensive analysis required in real-world computational biology.

Unlike conventional benchmarks that focus on factual recall or routine workflows, GeneBench-Pro is designed to measure what OpenAI calls ‘research taste‘, the sequence of judgement calls involved in scientific analysis, from interpreting ambiguous data and revising assumptions to deciding whether findings are robust enough to inform downstream research.

The benchmark comprises 129 problems spanning ten domains within computational biology, including statistical genetics, cancer genomics, clinical diagnostics, and pharmacogenomics. Each problem presents an AI agent with a realistic and deliberately messy dataset, brief experimental context, and a target to estimate.

To answer correctly, the model must explore the data iteratively, select an appropriate analytical approach, and supply a final answer without exploiting shortcuts or matching arbitrary author preferences. To prevent common benchmark shortcuts, every problem uses synthetically generated data whose underlying causal structure is fully known, allowing performance to be measured against a controlled ground truth.

OpenAI said its flagship model, GPT-5.6 Sol, achieved a pass rate of 28.7% at the highest reasoning setting, increasing to 31.5% in Pro mode. By comparison, the strongest model available when the original GeneBench was introduced scored below 5%.

External reviewers estimated that completing a typical GeneBench-Pro task would require 20 to 40 hours of expert work and cost thousands of dollars, whereas AI inference currently costs only a few dollars per run. OpenAI argues this suggests substantial economic potential even before models achieve expert-level performance.

OpenAI acknowledged that frontier models still solve fewer than one-third of the benchmark problems, often making partial progress but failing to complete the full chain of scientific reasoning expected from experienced researchers. To encourage independent evaluation, the company is open-sourcing ten representative tasks on Hugging Face and providing a 50-question subset to Artificial Analysis for third-party benchmarking.

Why does it matter?

GeneBench-Pro reflects a broader shift in AI evaluation from testing factual knowledge and coding ability to assessing whether models can support complex scientific reasoning. As computational biology increasingly becomes limited by data interpretation rather than data generation, reliable AI assistance in analytical workflows could accelerate research in areas such as genomics, drug discovery and precision medicine.

The benchmark also highlights the importance of rigorous evaluation methods for frontier AI. By using controlled synthetic datasets with known ground truth, GeneBench-Pro seeks to measure not only whether models reach the correct answer but also how well they make the sequence of judgements required in real-world scientific research.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

UNICEF urges child-focused AI governance

UNICEF has called for child rights to be placed at the centre of AI governance, warning that children are adopting AI technologies faster than adults while safeguards struggle to keep pace. Ahead of the first Global Dialogue on AI Governance, UNICEF said AI is already reshaping childhood worldwide, creating significant opportunities alongside new risks.

Based on data from 10 countries, UNICEF estimates that at least 20 million children have used AI, with adoption rates in many cases more than three times higher than among adults.

More than 2 million children, or one in 10, said they use AI for advice on things that worry them. An estimated 13 million children reported using AI to support learning and homework.

UNICEF warned that governance frameworks, including safeguards for children, are failing to keep pace with rapid AI adoption. The organisation said children are more exposed to AI systems, business models and data practices, while having less power to avoid or challenge them.

UNICEF said most AI governance frameworks do not adequately prioritise children’s interests, despite young people being among those most likely to experience the long-term consequences of today’s policy decisions. While AI can support learning, creativity and play, evidence on its effects on cognitive development, emotional well-being and exposure to harm is still emerging.

The organisation also highlighted children’s own concerns. Across the 10 countries surveyed, one-third worried about AI being used for scams or misinformation, while one-quarter feared their images or videos could be manipulated into sexually explicit deepfakes. UNICEF warned that too many AI systems are reaching children without adequate safeguards.

UNICEF called on governments, the private sector and partners to embed child rights in global AI governance, with a particular focus on safety and protection.

The organisation urged investment in research on AI’s impact on children’s development and wellbeing, stronger laws and corporate accountability to stop AI-enabled sexual exploitation and abuse, and AI systems designed with maximum safety and transparency.

UNICEF called on governments and technology companies to embed children’s rights into AI governance through stronger legal protections, corporate accountability and safety-by-design. It also urged greater investment in research, AI literacy for children and caregivers, and digital infrastructure to reduce inequalities in access. According to UNICEF, decisions made today will shape children’s safety, privacy, wellbeing and opportunities for decades to come.

Why does it matter?

Children are becoming some of the earliest and most frequent users of AI, yet governance frameworks, research and safety measures remain underdeveloped. As AI increasingly influences how children learn, communicate and seek information, gaps in protection could expose them to misinformation, exploitation, privacy risks and harmful content during critical stages of development.

The report also reinforces a broader shift in AI governance towards rights-based policymaking. By arguing that children’s interests should be considered from the design stage through deployment and regulation, UNICEF is framing child protection not as a niche issue but as a core principle for trustworthy AI.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

UK ATOC says social media ban is not enough

The UK Alliance Tackling Online Child Sexual Exploitation and Abuse has welcomed the UK government’s plan to ban social media use by children under 16, while warning that the measure alone will not stop online child sexual abuse.

The alliance said age restrictions on mainstream social media platforms could reduce some risks. Still, children may move to less regulated digital spaces, including encrypted messaging services, gaming platforms and other online environments where grooming, sexual extortion and abuse can continue.

UK ATOC called for a broader, system-wide response focused on prevention, stronger platform accountability and safer-by-design digital services. It said governments, regulators, technology companies and online service providers share responsibility for reducing opportunities for abuse before harm occurs.

The alliance proposed a package of technical, legislative and regulatory measures. These include stronger safeguards in end-to-end encrypted environments, robust age-assurance systems, mandatory safer-by-design principles, stronger enforcement under the Online Safety Act and clearer regulation of AI chatbots and companion services.

It also called for device-level nudity detection, upload prevention for known child sexual abuse material and measures to address livestreamed abuse, grooming and sexual extortion.

UK ATOC welcomed the government’s plan to introduce nudity-detection tools on children’s devices, describing it as an important additional safeguard.

The statement reflects a wider concern that age bans may reduce children’s exposure to some mainstream platforms, but cannot replace a comprehensive child-safety framework across the broader digital ecosystem.

Why does it matter?

The UK debate shows the limits of age-based social media bans as a child-safety tool. Online child sexual exploitation and abuse can move across platforms, devices, encrypted services, gaming environments and AI-enabled systems. UK ATOC’s response therefore shifts the focus from access restrictions alone towards prevention, safer design, platform duties and technical safeguards that address how abuse actually happens across digital services.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Singapore strengthens cyber resilience against AI threats

Singapore’s Cyber Security Agency (CSA) has outlined new and ongoing initiatives to strengthen national cyber resil i ence as AI reshapes the cyber threat landscape.

The measures are detailed in the Singapore Cyber Landscape 2025/2026 report, which reviews cybersecurity trends and the country’s response to evolving digital threats.

CSA said AI is reshaping the global cyber threat environment by enabling attackers to operate with greater speed, scale and sophistication. The agency said agentic AI is a particular concern because autonomous systems could automate parts of the cyber kill chain, compressing attacks that once unfolded over days into hours.

The agency cited Anthropic’s Mythos and the misuse of OpenClaw, an open-source agentic AI framework, as examples of how AI can accelerate vulnerability research, exploit development and cyberattack preparation.

At the same time, CSA said AI can strengthen cyber defence by improving threat detection, accelerating incident response and helping organisations identify vulnerabilities more quickly. As AI systems become more widely deployed across enterprise networks and critical infrastructure, however, they are also becoming attractive targets, making secure AI deployment an increasing priority.

To support secure AI adoption, CSA has published Guidelines on Securing AI Systems and a Companion Guide for system owners. It also released a discussion paper on securing agentic AI systems in October 2025 and said it will continue working with international partners on AI security standards.

The report also highlights how AI is changing the tactics of phishing and scam operations. CSA said attackers can use AI to generate convincing phishing lures at scale, produce realistic voice clones and video deepfakes, and create tools that can bypass multi-factor authentication.

CSA also warned that AI is making phishing and scam campaigns more convincing through voice cloning, video deepfakes and large-scale generation of personalised phishing messages. Despite these growing capabilities, reported phishing cases fell by 21% in 2025 to around 4,800 incidents.

Singapore has also launched the pilot National Simulated Scams Exercise, supported by the Ministry of Home Affairs. The exercise simulated AI-enabled government official impersonation scam calls to help the public recognise and respond to emerging scam tactics.

CSA said the number of infected infrastructure units detected in Singapore rose sharply to 284,300 in 2025, a 142% increase from 2024. The increase was driven mainly by persistent malicious infrastructure activity and improved detection of infected botnet devices.

The agency said weakly secured consumer Internet-of-Things devices and unpatched firmware continue to create opportunities for botnet operators. To address this, all residential routers sold in Singapore must meet Cybersecurity Labelling Scheme Level 2 requirements by the end of 2027.

Ransomware also remained a significant threat, with reported cases rising slightly from 159 in 2024 to 165 in 2025. CSA said small- and medium-sized enterprises remained disproportionately affected due to lower cybersecurity maturity and limited resources.

To support SMEs, CSA backed the Cyber Resilience Centre, which provides cybersecurity health checks and recovery assistance after incidents. Eligible SMEs can also receive co-funding for cybersecurity advisory services through the CISO-as-a-Service programme.

One of the year’s most significant incidents involved an attempted intrusion by the APT group UNC3886 targeting Singapore’s four largest telecommunications operators. CSA said the attack was contained through Operation CYBER GUARDIAN without disruption to services or evidence of customer data being compromised.

CSA is also requiring critical information infrastructure owners to attain Cyber Trust mark certification by the end of 2027. The requirement is intended to extend good cybersecurity practices across broader enterprise environments that support critical infrastructure operations.

In 2025, Singapore also conducted its largest Exercise Cyber Star, involving close to 500 participants from CSA, the Singapore Armed Forces’ Digital and Intelligence Service and critical infrastructure owners across 11 sectors.

CSA said it has expanded Cyber Essentials and Cyber Trust mark certifications to include mandatory cloud and AI security requirements. More than 800 organisations had attained at least one Cyber Essentials certification as of early 2026.

The agency is also advancing Singapore’s National Quantum-Safe initiative, working with industry, academia and international partners to raise awareness of quantum risks, support migration planning and accelerate adoption of quantum-safe technologies.

CSA said Singapore will continue investing in cybersecurity capabilities, strengthening partnerships and supporting secure adoption of emerging technologies in an AI-driven threat landscape.

Commissioner of Cybersecurity and CSA Chief Executive David Koh said Singapore must ‘lock down, find first, and fix fast’ as AI and quantum technologies reshape cyber risks. He said the response must be continuous, with government, industry and citizens working together to ensure digital innovation develops alongside trust and security.

The report illustrates how Singapore is treating cybersecurity as a continuous national resilience effort encompassing AI, critical infrastructure, ransomware, online scams and future quantum threats.

Why does it matter?

Singapore’s strategy reflects a growing shift from reactive cybersecurity towards continuous cyber resilience. Rather than addressing individual threats in isolation, the government is integrating AI security, critical infrastructure protection, scam prevention, cybersecurity certification and quantum readiness into a coordinated national strategy.

The report also illustrates how AI is changing cybersecurity on both sides of the equation. While attackers are using AI to accelerate phishing, malware development and vulnerability exploitation, governments are increasingly deploying AI to strengthen cyber defence, making secure AI deployment and governance central components of national cybersecurity policy.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

Noyb says US Supreme Court ruling puts EU-US data deal under pressure

The US Supreme Court ruled on Monday in Trump v. Slaughter that the Federal Trade Commission (FTC) may no longer be considered an independent agency, a decision that digital rights organisation noyb argues undermines the legal basis of the EU-US Data Privacy Framework.

According to noyb, the European Commission referred to the FTC’s independence 259 times in its 2023 adequacy decision because EU law requires oversight of personal data protection to be carried out by an independent authority.

The EU-US Data Privacy Framework, adopted by the European Commission in 2023, was the third such agreement since 2000, following the annulment of its two predecessors, Safe Harbour and Privacy Shield, by the Court of Justice of the European Union over concerns about US surveillance laws and the lack of judicial remedies available to EU citizens.

The Supreme Court’s ruling follows the unitary executive theory, under which the conservative majority held that the US President must retain authority over all executive bodies, rendering laws that grant agencies like the FTC independence unconstitutional. Because the EU-US framework’s legal structure depended heavily on the FTC’s independent status, noyb argues that the ruling removes a key legal pillar supporting the Commission’s adequacy decision.

Noyb has sent a formal letter to the European Commission calling for the adequacy decision to be repealed and said it intends to bring a case before the Court of Justice of the European Union seeking its annulment. According to the organisation, such proceedings could take two to three years.

The European Commission’s decision remains formally in force unless repealed by the Commission itself or annulled by the courts, meaning there is no immediate legal effect. However, noyb notes that companies relying on alternative transfer mechanisms such as Standard Contractual Clauses and Binding Corporate Rules are also affected, since these typically depend on impact assessments referencing the same US oversight mechanism that noyb argues have now been legally weakened, including the Privacy and Civil Liberties Oversight Board and the Data Protection Review Court.

Why does it matter?

The ruling introduces fresh legal uncertainty around the EU-US Data Privacy Framework, which underpins transatlantic transfers of personal data used by thousands of businesses. Although the framework remains in force, a successful legal challenge could once again force organisations to reconsider how they transfer data between the EU and the United States.

The case also illustrates the continuing fragility of transatlantic data transfer arrangements. It comes as European policymakers place greater emphasis on digital sovereignty and reducing dependence on foreign digital infrastructure, potentially adding momentum to broader debates over data governance, cloud services and regulatory autonomy.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

NVIDIA and Palantir expand sovereign AI for US government

Palantir has announced a new sovereign AI capability built on NVIDIA’s open-source Nemotron models, enabling US government agencies and critical infrastructure operators to deploy, customise and continuously improve AI models within highly secure environments.

The platform combines NVIDIA Nemotron open models with Palantir’s Sovereign AI Operating System, allowing organisations to retain full control over their data, model weights and deployment infrastructure.

The system is designed for air-gapped and highly regulated environments where sensitive information cannot be connected to external networks.

Agencies will be able to train AI models using their own operational data, retain ownership of the resulting models and continuously improve performance through internal feedback loops.

The deployment is supported by NVIDIA AI Enterprise and Palantir’s Artificial Intelligence Platform (AIP), Foundry, Ontology and Apollo platforms.

NVIDIA said the initiative reflects the growing importance of open AI models for government and enterprise development, arguing that they offer greater transparency, customisation and lower deployment costs than proprietary alternatives.

The company also highlighted the role of open models in strengthening AI adoption across sectors including defence, healthcare, energy, transportation and public administration.

Why does it matter?

The announcement reflects the growing importance of sovereign AI, as governments and operators of critical infrastructure seek to deploy advanced AI systems without relying on externally hosted services or relinquishing control over sensitive data. Open models combined with secure, self-managed infrastructure offer an alternative approach for organisations with strict security and regulatory requirements.

The partnership also highlights the strategic role of open foundation models in the evolving AI ecosystem. As competition intensifies between proprietary and open AI approaches, governments are increasingly viewing customisable, locally deployable models as critical assets for national security, digital sovereignty and public-sector modernisation.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Chief AI Officers to lead AI adoption across Australian government

Australian public service agencies are formalising the appointment of Chief AI Officers (CAIOs) to guide the safe, strategic and coordinated use of AI across government.

Under the APS AI Plan, all non-corporate Commonwealth entities must appoint a senior leader as Chief AI Officer by 30 June 2026. Corporate Commonwealth entities and Commonwealth companies are strongly encouraged to make similar appointments.

The role is intended to help agencies adopt and use AI, particularly generative AI, as the technology reshapes government operations, public service delivery and internal processes.

Chief AI Officers will complement, rather than replace, AI Accountable Officials. While Accountable Officials focus on governance, compliance and risk management, CAIOs will lead strategic adoption, organisational transformation and AI capability building.

The government said CAIOs should provide strategic leadership rather than focus primarily on technical implementation. Their responsibilities include identifying high-value AI use cases, building staff capability, championing responsible adoption and ensuring AI is deployed safely and effectively.

CAIOs will work across technology, data, policy, cybersecurity, privacy and human resources functions, while collaborating with counterparts across the Australian Public Service and the Department of Finance’s AI Delivery and Enablement team.

Chief AI Officers will also collaborate across the Australian Public Service, including with other CAIOs and the AI Delivery and Enablement function in the Department of Finance.

The government said AI should be viewed as a general-purpose capability rather than a conventional technology upgrade, reflecting its potential to transform multiple areas of public-sector work.

The CAIO role is intended to help agencies move from experimentation to more systematic and responsible adoption. It is also designed to support a whole-of-organisation view of AI risks and opportunities.

The AI Delivery and Enablement team has developed an information pack to support agencies in appointing CAIOs, along with a blog for newly appointed leaders.

A wide range of agencies have already appointed Chief AI Officers. The published list includes major departments, regulators, integrity bodies, health and research agencies, cultural institutions, security agencies and service delivery organisations.

A wide range of organisations have already appointed CAIOs, including major government departments, regulators, law enforcement bodies, research organisations and service delivery agencies such as the Department of Finance, Home Affairs, Treasury, the Australian Federal Police, Services Australia and the Australian Electoral Commission.

The appointments of Chief AI Officers reflect a broader effort to coordinate AI adoption across government while maintaining attention to safety, privacy, cybersecurity, governance and public value.

Why does it matter?

Australia’s initiative reflects a broader shift from experimental AI projects to coordinated, organisation-wide adoption across the public sector. By establishing dedicated AI leadership roles, the government is seeking to embed strategic oversight while ensuring that innovation is balanced with governance, privacy, cybersecurity and public accountability.

The creation of Chief AI Officers also highlights the growing recognition that AI adoption is an organisational transformation challenge rather than solely a technical one. As governments integrate AI into public services, dedicated leadership is becoming increasingly important to coordinate implementation, build capability and ensure AI delivers public value responsibly.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!