EU Extends Chat Control 1.0 Regulation to 2028 Despite Privacy Concerns and Parliamentary Opposition
The European Council has extended the temporary Regulation (EU) 2021/1232, commonly referred to as Chat Control 1.0, until 2028. This regulation permits internet service providers to voluntarily scan unencrypted communications on platforms including Discord and Gmail for CSAM material.
What is Chat Control 1.0
Officially titled the Regulation to Prevent and Combat Child Sexual Abuse, the measure has been in force since 2021. It applies to email and messaging providers, allowing them to conduct voluntary mass scanning of user traffic. Because the regulation is time-limited, periodic extensions are required.
Chat Control 2.0 Proposal
A follow-up proposal, COM(2022) 209, would make scanning mandatory and extend it to encrypted communications. This approach directly conflicts with the principles of end-to-end encryption used in modern messaging services. Privacy advocates argue that the measure would grant authorities access to all private correspondence across Europe.
The Chat Control 2.0 draft is intended as permanent legislation rather than a temporary regime. It remains under active debate in both the European Parliament and the Council.
How the Extension Was Approved
The original deadline for the current regime was April 2026. The European Commission proposed an extension, while the Parliament sought amendments to limit scanning and protect encryption. The Council rejected these changes. A parliamentary vote scheduled for 9 July 2026, the final plenary session before summer recess, saw 112 members absent. The motion to block the extension received 314 votes in favor and 276 against, with 17 abstentions, falling short of the 361-vote threshold needed.
Investigations by Balkan Insight highlighted close links between Commissioner Ilva Johansson's cabinet and the U.S. nonprofit Thorn, a vendor of CSAM detection software, as well as the WeProtect Global Alliance. The European Data Protection Supervisor ruled that targeted advertising promoting the regulation on X in several member states violated EU data-protection rules by excluding users based on political interests.
Related articles
Rethinking SSO: Centralized User Data Provision and Authorization Processing in Corporate Systems
The article examines Single Sign-On systems not merely as authentication gateways but as architectural hubs for delivering user attributes and executing additional authorization logic. It highlights how SSO can aggregate data from sources like Active Directory, HR systems, and IDM platforms, then deliver it via OIDC claims to downstream applications. The discussion covers the shift from fragmented integrations across dozens of apps to a single trusted enforcement point using standards such as aggregated and distributed claims. It also explores the authorization pipeline where SSO acts as a Policy Enforcement Point querying external Policy Decision Points via the AuthZEN Authorization API 1.0. Practical examples include electronic business cards, role assignment, access routing, and mandatory MFA checks before token issuance. The piece stresses maintaining data ownership with source systems while establishing SSO as the single point of trust for applications.
Bitrix24 Releases Fully On-Premise BI Constructor for Regulated Enterprises
Bitrix24 has introduced a new delivery model for its BI Constructor that allows complete deployment inside a customer's own infrastructure. The update eliminates any requirement for external servers, cloud APIs, or internet connectivity, ensuring that all corporate data remains within the organization's closed perimeter. Previously, even the boxed version of the platform needed access to external infrastructure for updates and auxiliary services, creating conflicts with internal security policies and regulatory demands in highly regulated sectors. The new on-premise variant performs all data processing and storage exclusively on customer servers, giving organizations full control over access rights, backups, updates, and integration with internal protection tools. The solution is compatible with the boxed edition of Bitrix24 running on PostgreSQL and does not connect to external CDNs or cloud services. Bitrix24 expects strong interest from large enterprises and organizations handling restricted-access data that must stay inside the corporate network. Pilot implementations have already been completed, with broader customer pilots planned in the coming months.
Russia's Data Leak Penalties: 2.6 Million Rubles in Fines Despite 1.58 Billion Records Exposed in 2025
Russia introduced turnover-based fines for personal data leaks through Federal Law 420-FZ in late 2024, fundamentally altering the economics of information security investments. Over the first 18 months, Roskomnadzor opened 52 administrative investigations and issued 40 protocols totaling just 2.6 million rubles in penalties, with zero turnover fines applied. This occurred against a backdrop of 1.58 billion compromised records in 2025 alone. Public data leaks dropped fourfold in the first half of 2026, yet trading activity on underground forums rose nearly 60 percent as operators shifted to private sales. The law now ties penalties directly to the number of affected individuals and adds a turnover component for repeat violations under Article 13.11 of the Code of Administrative Offenses. Analysts note that the mere threat of larger fines has prompted companies to reassess data retention policies and risk models even without actual enforcement precedents.
Russia Authorizes Temporary State Takeover of Unprotected Critical Infrastructure
President Vladimir Putin has signed a decree that empowers the Russian government to appoint temporary managers for critical infrastructure facilities whose owners have failed to ensure adequate security. The measure directly targets operators of objects classified as critical infrastructure who have not met protection requirements. Under the new rules, the state can intervene by installing an interim administrator to oversee operations until security standards are satisfied. This approach aims to prevent potential disruptions or threats arising from insufficiently defended assets. The decree provides a legal mechanism for rapid governmental response without permanent nationalization of the facilities. It reflects ongoing efforts to strengthen oversight of sectors deemed essential to national security and stability.