Evidence
Regulators in Korea and China acted fastest against AI data practices
| Date | Case | Country | What happened | Source |
|---|---|---|---|---|
| Apr 24, 2025 | Korea PIPC DeepSeek findings | South Korea | Data of Korean users sent abroad without consent; service suspended in February | Source |
| Nov 13, 2025 | India DPDP Rules notified | India | Phased rollout; substantive duties from May 12, 2027 | Source |
| Mar 18, 2026 | OpenAI v. Garante | Italy | €15 million fine annulled; Ireland was lead authority | Source |
| Apr 27, 2026 | CAC notice on 33 apps | China | Privacy-policy, SDK and account-deletion violations | Source |
Registry
Three registry incidents drew regulator or court action relevant to personal data law
| Incident | Date | Regulator or court action |
|---|---|---|
| Amazon Echo Sends a Private Conversation to a Contact | May 2018 | None found. |
| Tesla Staff Share Customer Car Camera Footage | 2019 to 2022 | On April 14, 2023, Senators Edward Markey and Richard Blumenthal wrote to Elon Musk demanding Tesla's access policies. An owner filed a proposed class action. No agency penalty was found. |
| EchoLeak Turns Microsoft 365 Copilot Into a Data Leak | Jan 2025 | None reported. |
Rules
China and the EU set binding AI data rules; the US relies on states and a China data rule
| Rule | Jurisdiction | What it requires | Status |
|---|---|---|---|
| GDPR and EDPB Opinion 28/2024 | EU | Case-by-case test of whether a model is anonymous | Dec 2024 |
| PI protection compliance audit measures | China | Audits every two years above 10 million people | Effective May 1, 2025 |
| DPDP Act and Rules 2025 | India | Notice, consent, children's data, breach notice | Fully operative May 12, 2027 |
| Justice Department Data Security Program | US federal | Restricts bulk US data transfers to China and others | In effect since 2025 |
| State comprehensive privacy laws | US states | Consumer rights and opt-outs | 20 states, 2026 |
Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.
Record
Page Record
- Datasets
- ai_governance_evidence.csv (4 rows); ai_rules.csv (245 rows); registry incidents (3 linked)
- Key sources
- Korea PIPC DeepSeek findings
India DPDP Rules notified
OpenAI v. Garante
CAC notice on 33 apps - Last verified
- October 2026