auDA Policy Change Affects 80% of Existing Registrants

If you hold, or compete for, federal set-aside contracts, SBA just proposed the biggest rewrite of small business size standards in over a decade. Some thresholds are jumping 10x or more. That means the competitive landscape for your NAICS code could look completely different by next year: more (and bigger) competitors qualifying as "small," tighter margins on set-asides, and a compressed 30-day window to weigh in. If your business operates under one of the 338 affected NAICS codes, this is worth 15 minutes of your time. Generic comments don't move the needle — specific, data-backed comments from people who actually compete in these markets do. Comments close September 21, 2026. Submit at regulations.gov under RIN 3245-AI67 / Docket SBA-2026-0199. If you're not sure whether your industry is affected, check the proposed rule, reach out to the team at Women Impacting Public Policy (WIPP) for guidance.

The date has been set for the Information Commissioner's Office to be replaced by the Information Commission. The Secretary of State has issued regulations which have set the date at 30 September 2026. From a practical standpoint (vis a vis changes to be made by organisations), this is really an administrative change. It has been reported that the ICO may keep its branding as ICO which will certainly make any name changes in policies and procedures etc. a bit less painful!

The Information Commissioner's Office breached the FOI Act last week. Using What Do They Know, Greg Oliver asked them for the preamble to an FOI request sent by James Kelsall (also via WDTW). The text was removed on the basis that it might be defamatory. I suspected the ICO asked them to do this, but when I asked them under FOI, they said they held no information. That's not the same as confirming they didn't do it, but it's pretty close. The ICO definitely holds the data; they confirmed that when they publish their response to the original request on their disclosure log, they will include the full text. But they said this: "WhatDoTheyKnow has previously removed parts of this request from its platform. We recognise that WhatDoTheyKnow has complete discretion concerning what content it hosts on its platform. With this in mind, out of respect for WhatDoTheyKnow, we will not re-upload this content to its platform again in response to this request." This is a refusal. Oliver asked for the text that had been removed, and the ICO has refused to supply it. They could have used S22 to refuse the request on the basis that they intend to publish the information in the future, subject to both a reasonableness and public interest test, but they had no other option. Instead, they ignored FOI and just invited Oliver to hang about for a bit. If anyone else did this, the decision notice would be incredibly snooty. But either they don't think the rules apply to them or they've just given up trying. The breach itself is trivial, but the fact that they're responsible for it is significant. The original Kelsall request is perplexing: ICO refused his request with this terse reply: "We are refusing this request in accordance with Section 14 of the FOIA. Please contact us directly for further details." There's a long, unhappy history between the ICO and Kelsall which is outlined in a FTT decision which went against Kelsall following an avalanche of correspondence, some of which was abusive. He also made allegations of forgery which I am convinced are bogus. I have no doubt that he is a nightmare to deal with. But having said that, the response is still odd. Telling the applicant to contact them for further details isn't a valid response. Once a request has been refused as vexatious, it's valid to ignore follow-ups on the same theme, but otherwise, you have to send the applicant a proper refusal. If they don't want to publish that on What Do They Know, they should contact Kelsall by another route (given that torrid history, I suspect they have his deets). The ICO is mired in the chaos left behind by John Edwards' embarrassing exit and the uncertainty over what senior people did to stop his appalling behaviour. This has unleashed a tidal wave of FOI requests that are almost certainly awkward and unwelcome, but the law remains what it is. The ICO wouldn't tolerate this approach from anyone else, so why is it different for them? https://lnkd.in/eYbth6hC

The Summer brought us good news on the Data Omnibus! MEPs from several political groups have answered to our concerns, tabling amendments in the main committees to ensure that public sector information keeps being shared under open licenses. There's still a long way to go, but for now it's looking promising. Read my analysis here: https://lnkd.in/eBSP-r4g

On 10 September, the European Parliament’s ITRE Committee adopted its European Business Wallet position by 64–7, and voted 65–9 to open negotiations with the Council. Parliament retains the Commission’s central model: - voluntary use by businesses; - mandatory acceptance by all public-sector bodies; - legally valid identification, authentication, signing, sealing, document submission and notifications; - a required implementation roadmap covering milestones, priority use cases and interoperability with existing systems. I am not sure that the Parliaments addition - of stronger sovereignty conditions covering wallet providers, QERDS and cloud hosting, as well as restrictions on using wallet-generated data to train third-country AI systems - is needed at this point. In any case the political discussion has moved from whether EBWs should exist to how quickly public administrations can accept them and how the ecosystem will be governed. Our argument that governments must provide the infrastructure and credential supply is now increasingly reflected in the legislative direction. The implementation roadmap is especially important. It should become the vehicle for prioritising organisation identity, Power-to-Act, licences, IBAN, e-invoice addresses and other high-volume credentials. However, “interoperability” must also cover more semantics, authority and status—not merely technical wallet connectivity.

Another important milestone in the implementation of the Data (Use and Access) Act 2025. From 30 September 2026, the Information Commission will take over the functions of the Information Commissioner. My short update in FIN. has more details. https://lnkd.in/e6VjQymZ #DUAA #ICOTransferOfFunctions #FIN #DataUpdate

Disclosure: Sirveil Inc. builds consumer privacy tools and a commercial verification API. This is general information, not legal advice. Five data brokers were asked whether they check that opt-outs work. One said yes. In February, a minority-staff report from the U.S. Congress Joint Economic Committee, issued by Ranking Member Maggie Hassan, put a plain question to five registered data brokers: do you audit whether your opt-out options are visible, and whether opt-out requests actually succeed? One company stated that it contracts third-party auditors for both. Most of the others stated that they do not conduct such audits at all. One never responded. That is the whole gap in one paragraph. A consumer files a request, the broker says "done", and the confirmation comes from the party that did the work. Nobody looks at the public web afterwards to see what is still there. We read the report the week it published because it describes the thing we build: an independent check, with the evidence attached, of whether a named person's information is still showing on a given site, right now. Not an audit, and we don't call it one. A dated record you can hand to whoever asks. Sirveil for business: sirveil.ai/for-business. Source: Opt-Out Obstacles, U.S. Congress Joint Economic Committee (Minority), 27 Feb 2026 (jec.senate.gov).

🇬🇧 The ICO will become the Information Commission on 30 September 2026 On 15 September 2026, the Information Commissioner’s Office (ICO) announced that the UK Government has confirmed the ICO will transition to the Information Commission on 30 September 2026. The change follows the Data (Use and Access) Act 2025, which introduces a new governance structure while maintaining the ICO’s existing regulatory functions and responsibilities. The transition follows the appointment of seven Non-Executive Members to the new Information Commission Board in July 2026. According to the ICO, these members will take up their roles on 30 September. What does this mean for organisations? While the governance structure of the regulator is changing, its existing regulatory functions and responsibilities will remain in place. The transition therefore represents an important development in the UK’s data protection regulatory framework, particularly for organisations that regularly engage with the ICO. Read the ICO’s full announcement here: https://lnkd.in/eHBwCa9R