Latest Worldwide Developments on Personal Data

EDPB launches coordinated enforcement on GDPR's right to erasure.

The European Data Protection Board launched the Coordinated Enforcement Framework for 2025 focusing on the EU General Data Protection Regulation's right to be forgotten. The 32 data protection authorities across the EU will participate with formal investigations or launch fact-finding probes into entities across various economic sectors. The latest CEF follows 2024's coordinated action on the right of access.

Click on the link for the full story.

Ireland's data protection law allegedly exploited to obtain details on domestic abuse victims.

Sonas Housing, a charity for domestic abuse victims, claimed abusers are trying to exploit Ireland's Data Protection Act to obtain victims' information, The Irish Times reports. Sonas Housing CEO David Hall also claimed Ireland's Data Protection Commission is requesting the charity provide the authority with information after alleged abusers contacted the DPC to obtain victims personal data.

Click on the link for the full story.

Latvia's DPA outlines activities excluded from DPIAs.

Latvia's Data State Inspectorate created a list of activities that do not need a data protection impact assessment. The list includes member and donor data by associations and foundations, data kept within Latvia if it does not require handling biometric or genetic data and patient health data not transferred to third countries.

Click on the link for the full story.

Hard drives with medical data found for sale at a flea market.

Hard drives containing 15 gigabytes of medical data allegedly belonging to software company Nortade ICT Solutions were found at a flea market in Belgium, ITPro reports. The hard drives consisted of sensitive personally identifiable information of Dutch citizens.

Click on the link for the full story.

Utah passes app store age verification bill.

Bloomberg Law reports the Utah Legislature passed a bill giving parents control over what apps their children download on mobile devices while requiring age verification for those under age 18. The bill is supported by some social media platforms who argue app stores have better data protection measures and would create a singular place for age verification. The bill still requires action from the governor.

Click on the link for the full story.

South Korea's PIPC opens probe into vehicle manufacturers' smart vehicles.

South Korea's Personal Information Protection Commission opened in investigation into the data collection and processing of smart vehicles manufactured by Hyundai, Kia, Tesla, Mercedes Benz, BMW and BYD. The investigation coincides with BYD launching its line of electric vehicles in South Korea, which prompted the PIPC to seek information regarding the company's data collection practices. The PIPC has been conducting on-site inspections of the smart car sector since 2024.

Click on the link for the full story.

IMY supports tighter personal data protections for browsing histories.

Sweden's data protection authority, Integritetsskyddsmyndigheten, said it supports a government proposal to provide better protections to personal data appearing in search information history. The government had been investigating whether the country's freedom of press and information laws should have more exceptions for personal data.

Click on the link for the full story.

ICO launches investigation into how social platforms use children's personal data.

The U.K. Information Commissioner's Office launched separate investigations into TikTok, Reddit and Imgur to examine their use of children's data and compliance with U.K. Children's Code obligations. IAPP Staff Writer Lexie White reports on details of the investigation and the ICO's broader efforts on children's privacy.

Click on the link for the full story.

Sweden's DPA publishes FAQ guide for EU-US data transfers.

Sweden's data protection authority, the Integritetsskyddsmyndigheten, published an FAQ regarding transfers of personal data to the U.S. Questions focus on the state of the EU-U.S. Data Privacy Framework in light of recent political developments in the U.S., such as the White House removing Privacy and Civil Liberties Oversight Board's Democrats. The IMY's FAQ follows similar guidance issued by Norway's DPA, Datatilsynet. Editor's note: Baker McKenzie Partners Brian Hengesbaugh and Lukas Feiler, CIPP/E, analyzed the state of play of the DPF.

Click on the link for the full story.

Norway's DPA discusses role in DSA enforcement.

Norway's data protection authority, Datatilsynet, said it is working to incorporate the EU Digital Services Act into the country's legal system. Datatilsynet Director Line Coll said the agency, as a competent authority, will "contribute with our professional knowledge and interpretation of the provisions on what falls within and outside the definition of profiling, special categories of personal data."

Click on the link for the full story.