The Brief · Issue 2

Week of 6 July 2026 — the EDPB defines anonymous, Actian folds in Jaspersoft

EDPB adopts anonymisation and AI-scraping guidelines, Actian completes its Jaspersoft deal, and Connecticut's privacy law expands.

September 22, 2026

Compiled on 22 September 2026 for The Brief's launch archive, from sources published between 6 and 12 July 2026.

Four stories that mattered

EDPB sets a concrete test for "anonymous"

On 8 July 2026 the European Data Protection Board adopted three sets of guidelines at its plenary: new guidance on anonymisation, new guidance on web scraping for generative AI training, and the final version of its guidelines on personal data processing through blockchain. The anonymisation guidance sets out a three-criterion test — whether a record can be singled out, linked to other records, or used to infer information about a person — with both a detailed and a simplified version, reflecting a September 2025 CJEU ruling. The web-scraping guidance says GDPR applies whenever scraping collects personal data, that scraping should draw only from reliable sources, and that there is no blanket exemption for training data drawn from special-category information. Both new guidelines are open for public comment until 30 October 2026.

Any team relying on a vendor's claim that a dataset is "anonymised" now has a concrete test to check that claim against, rather than taking the vendor's word for it.

Source: European Data Protection Board, EDPB sheds light on anonymisation and web scraping for generative AI and adopts final version of guidelines on blockchain

Actian completes its Jaspersoft acquisition

Actian, the data and AI division of HCLSoftware, said on 6 July 2026 that it had folded Jaspersoft's embedded analytics and pixel-perfect reporting into its data management portfolio, following HCLSoftware's completed acquisition of the open-source reporting vendor. Jaspersoft brings roughly 1,000 enterprise and mid-market customers and about 90 implementation partners across 44 countries; Actian says it will keep Jaspersoft's open-source library, forums and community channels intact while adding AI-enhanced analytics and agentic BI to the roadmap.

The deal is a reminder that "pixel-perfect" operational reporting — compliance filings, regulatory audits, statements — hasn't gone away even as vendors chase conversational BI; Actian is betting both are needed side by side.

Source: Actian, Actian Expands Data Management Portfolio With Jaspersoft Embedded Analytics and Reporting

Connecticut's privacy law widens sharply

Amendments to the Connecticut Data Privacy Act took effect 1 July 2026, lowering the law's applicability threshold from 100,000 to 35,000 state residents and adding two no-threshold triggers: processing any sensitive data, or selling any personal data. The amendments also widen the definition of sensitive data to cover neural data, transgender and nonbinary status, government-issued IDs and financial account numbers, and require privacy notices to disclose whether personal data is used to train large language models.

The no-volume-threshold triggers matter most for analytics teams: a business that processes sensitive data on even one Connecticut resident, or that shares data with an ad network in a way that counts as a "sale," can now be in scope regardless of size.

Source: Foley & Lardner, Connecticut Dramatically Expands Its Data Privacy Act: What Businesses Need to Know Now

A four-year study complicates the GenAI ROI story

A study published in MIT Sloan Management Review on 8 July 2026 followed generative-AI adoption inside a large US public university over four years and found the tools didn't reduce the hours staff worked — they changed what the work was. Coordination shifted from meetings to writing, from back-and-forth clarification to faster first drafts, and from deliberation to quicker decisions; the effect differed by role, giving executives more decisiveness, operations staff more speed, and frontline staff faster case resolution.

The authors' conclusion for anyone measuring an internal GenAI rollout: a flat "hours saved" metric will miss most of the value, or the cost, of the change.

Source: MIT Sloan Management Review, GenAI Success Metrics: Look Beyond Reduced Workload

Tool moves

One how-to

Run the EDPB's three-question anonymity test. Before you take a vendor's or a colleague's word that a dataset is "anonymised" — and therefore outside GDPR — the EDPB's new guidance gives a three-part check you can run yourself:

  • Singling out — can any one record in the dataset be distinguished from all the others, even without knowing the person's name?
  • Linkability — can two or more records about the same person, in this dataset or across datasets, be linked together?
  • Inference — can you deduce information about a person with reasonable confidence from the data, even if you can't identify them directly?

If the answer to any of the three is yes, the EDPB's view is that the data is not anonymous — it may be pseudonymised at best, and GDPR still applies. This is a materially higher bar than "we removed the names," which is where a lot of internal data classification work still stops. It's also worth applying to any dataset a vendor sells you as training data, given the EDPB's new scraping guidance putting the burden on the buyer, not just the scraper. Build it into data governance review rather than a one-off legal sign-off, since new data sources get added continuously.

One number

20x — the increase in compliance-review capacity Dun & Bradstreet says its new Risk Analytics plugin for Cursor can unlock for developers building AI compliance agents, according to the company's 9 July announcement.

What it doesn't tell you: it's a vendor-supplied figure from Dun & Bradstreet's own materials, with no published baseline, sample size or methodology attached — useful as a directional claim about where AI coding agents are headed, not as an independently verified benchmark.

Source: PR Newswire, Dun & Bradstreet Launches Risk Analytics Plugin for Cursor

Get the next one