ICO publishes draft guidance for IoT developers.

The U.K. Information Commissioner's Office issued draft guidance for developers of Internet of Things products to ensure they offer an adequate level of data protection. Guidance included how products can legally obtain consent from users, providing transparent privacy information and what tools companies should implement to give users control over the data products generate.

Click on the link for the full story.

Netherlands' government recommends limiting social media for kids under

The Netherlands' government is advising parents not to allow children under age 15 to use social media, Euronews reports. The Ministry of Health, Welfare and Sport's guidance is legally nonbinding and part of a greater push by some European countries to raise awareness around the psychological harms associated with some online platforms.

Click on the link for the full story.

CMA to consider freeing Google from privacy sandbox commitments.

The U.K. Competition and Markets Authority said it is considering releasing Google from its obligations under a privacy sandbox program, now that the technology company is no longer planning to deprecate third-party cookies. Meanwhile, Brookings Institute Nonresident Senior Fellow Mark MacCarthy wrote about the privacy challenges in the U.S. Department of Justice's suggestion of Google sharing search data with company rivals as a remedy to its search monopoly.

Click on the link for the full story.

23andMe fined 2.31M GBP after UK, Canada data security probe.

The U.K. Information Commissioner's Office issued a 2.31 million GBP fine against genetic testing company 23andMe following a joint data security probe with the Office of the Privacy Commissioner of Canada. The action stems from alleged insufficient security measures that led to the 2023 data breach impacting 6.9 million customers, including hundreds of thousands in Canada and the U.K. IAPP News Editor Joe Duball reports on the enforcement work and remarks from both enforcers.

Click on the link for the full story.

US delays TikTok ban for 90 days.

U.S. President Donald Trump extended the deadline for ByteDance to sell social platform TikTok by 90 days, The New York Times reports. Under the Protecting Americans from Foreign Adversary Controlled Applications Act, the app must be sold due to concerns about TikTok potentially sharing U.S. consumer data with China.

Click on the link for the full story.

Germany's DSK issues data protection guidelines for AI developers.

The Conference of the Independent Data Protection Authorities of Germany published guidelines for manufacturers and developers of AI systems to ensure their products comply with data protection laws throughout the AI life cycle. The DSK's guidelines include key requirements for data protection measures within AI systems and recommendations for technical and organizational measures.

Click on the link for the full story.

Norway's DPA publishes DPO survey results.

Norway's data protection authority, Datatilsynet, published the results of a survey issued to a sample of 2,000 data protection officers. Key findings included that 60% of DPOs said they regularly asked for advice to a "large or very large extent on important and relevant processes in the business" and nearly 76% reported their organization followed their recommendations.

Click on the link for the full story.

Cyberattack targets Washington Post national security journalists.

A cyberattack on the Washington Post targeted U.S. national security journalists' Microsoft accounts, allegedly compromising journalists' emails, The Wall Street Journal reports. The data breach affected a small number of journalists and could potentially be linked to foreign actors.

Click on the link for the full story.

AEPD says companies cannot request individuals DNI documents for accommodations.

Spain's data protection authority, the Agencia Española de Protección de Datos, released information detailing the types of information and documentation organizations can request when confirming accommodations. The AEPD said organizations cannot ask individuals to provide passports or a National Identity Document due to potential identity theft.

Click on the link for the full story.

Florida attorney general alleges cybersecurity, surveillance violations against Chinese health tech provider.

Florida's Office of the Attorney General said it will take legal action against China-based patient monitor provider Contec for allegedly creating a backdoor into its products, potentially allowing patient information to be accessed by third parties in violation of the state's consumer protection laws. The office alleged "serious cybersecurity vulnerabilities" and misrepresentations over security measures. The office is also targeting Florida-based Epsimed, a reseller of the monitors.

Click on the link for the full story.

Latest Worldwide Developments on Personal Data 25.06.2025