The EU Fines Google €890M & Origin Energy Loses Customer Banking Details (07/23/2026)

Today’s stories all turn on the same question: who has to answer for what a system does with people’s data. Brussels put a number on Google’s conduct. An energy company had to tell customers their bank details were taken. A governor decided a bill regulating pricing built on surveillance data reached too far. Each is a different institution drawing the line in a different place.

Top 5 Critical Privacy Alerts

1. The EU Fines Google €890 Million

The European Commission fined Google a total of €890m (£760m) for breaches of online competition law by its search and app store services, and directed the company to treat third-party services appearing in its results in a fair and non-discriminatory manner (The Guardian). The remedy matters more than the fine here, because an order about how results are ranked reaches the mechanism that decides what billions of people see.

2. Origin Energy Loses Customer Banking Details

Origin Energy said attackers accessed Australian customers’ names, addresses, dates of birth, phone numbers, and some bank account details (The Guardian). That specific combination is the full kit for identity fraud, and a utility holds it on nearly every household it serves, which makes an energy retailer a richer target than its own risk register usually admits.

Operator Note: Name, address, date of birth, and bank details together are enough to open accounts in someone else’s name. If you hold that combination, treat it as its own crown-jewel data set with separate access controls, not as ordinary customer records.

3. Colorado’s Governor Vetoes a Surveillance-Pricing Bill

Colorado Governor Jared Polis vetoed HB 26-1210, a bill that would have imposed requirements on the use of surveillance data to set individualized prices for consumers or individualized wages for workers (Inside Privacy). Pricing a person from what has been observed about them is one of the sharper edges of data collection, and the veto leaves the practice governed by general law while states keep working out where the limit belongs.

4. States Keep Amending Their Privacy Statutes

Several state legislatures amended their comprehensive privacy laws in recent weeks, with some changes enacted and others awaiting a governor’s signature, including Delaware HB 380 (Inside Privacy). Compliance built against a snapshot of these laws goes stale quickly, and organizations operating across states need a way to track amendments rather than a one-time mapping exercise.

5. Google Adds Selfie Video Account Recovery

Google introduced a selfie video option for users locked out of their accounts, offered alongside existing recovery methods (The Hacker News). Account recovery is the softest part of any identity system, and moving it toward biometrics trades one problem for another, because a face is convenient to present and impossible to reissue once it has been captured and copied.

Additional Privacy Alerts

AI & Data Protection

• What the EDPB’s Web Scraping Guidelines Mean for AI Training Data: The European Data Protection Board published draft guidelines on web scraping for generative AI on July 7, offering practical GDPR direction for organizations building training datasets. Sidley Data Matters

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.