Latest Worldwide Developments on Personal Data

ICO publishes encryption guidance.

The U.K. Information Commissioner's Office finalized guidance on encryption under the U.K. General Data Protection Regulation. The guidance includes definitions on encryption and data protection, how to store encrypted data and how to securely transfer it. It also offers explanations for how to implement encryption and scenarios that require its application.

Click on the link for the full story.

US court requires Google to share search data with rivals in monopoly case.

The U.S. District Court for the District of Columbia ruled in Google's search antitrust lawsuit that the company must share some search data with rival companies, but stopped short of imposing major penalties on the company, such as requiring it to sell off its Chrome browser, The New York Times reports. Meanwhile, closing arguments were made in a USD30 billion U.S. class-action lawsuit, in which plaintiffs alleged Google continued to track their browsing activity after they opted out of app tracking, Courthouse News Service reports.

Click on the link for the full story.

Disney agrees to $10M FTC settlement to resolve COPPA violations.

The U.S. Federal Trade Commission announced Disney agreed to pay a USD10 million settlement to resolve claims the company violated the Children's Online Privacy Protection Act by allowing nonconsensual collection of children's personal data when they viewed "kid-directed" videos on YouTube. Under the proposed settlement order, Disney will be required to change how it labels children-specific content. A Disney spokesperson told the IAPP the settlement "does not involve Disney owned and operated digital platforms but rather is limited to the distribution of some of our content on YouTube's platform."

Click on the link for the full story.

European Commission issues draft adequacy decision for Brazil.

The European Commission published a draft adequacy decision with Brazil. The draft decision now goes to the European Data Protection Board to provide an opinion on the agreement before a committee composed of member state representatives and the European Parliament also weigh in. "Brazil has built a robust framework for safeguarding privacy and personal data, firmly anchored in the protection of fundamental rights," European Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection Michael McGrath said in a statement.

Click on the link for the full story.

Roblox to implement age checks by end of the year.

The Guardian reports video game platform Roblox will require age checks for people who use its chat or text features. The idea is to prevent children from talking to adult strangers after reports of adults coercing children into sending them sexually explicit photos.

Click on the link for the full story.

CNIL issues third-party cookie fines totaling 475M euros.

France's data protection authority, the Commission nationale de l'informatique et des libertés, announced fines of 325 million and 150 million euros to Google and Shein, respectively, over alleged noncompliance with third-party cookie rules. The CNIL claimed in each instance that the companies placed cookies without user consent, a point of emphasis in the regulator's compliance strategy it outlined in 2020.

Click on the link for the full story.

Denmark-based furniture company fined for alleged GDPR violations.

Denmark's Western High Court fined furniture company ILVA DKK1.5 million for alleged EU General Data Protection Regulation violations after Denmark's data protection authority, Datatilsynet, launched an investigation into the company's data protection standards. Datatilsynet Director Cristina Angela Gulisano said the court's decision is important "because it establishes that management's knowledge of actual circumstances — about processing that is in breach of data protection rules — makes it an intentional violation of the rules."

Click on the link for the full story.

Google to pay $425M following nonconsensual tracking verdict.

A federal jury found Google's alleged nonconsensual user tracking over an eight-year span broke privacy laws and the company must pay USD425 million in damages, Reuters reports. The trial at the U.S. District Court for the Northern District of California considered class-action claims regarding allegations Google continued to track and collect data from users' mobile devices after they opted out. Google issued a statement indicating it will appeal the decision. Editor's note: The IAPP Research and Insights Team published a series exploring U.S. privacy litigation trends.

Click on the link for the full story.

UK government questioned over security review, data protection safeguards implementation.

The U.K. government is facing pushback after a security report detailing major data breaches in the U.K. found government agencies have not implemented recommended privacy safeguards, the Guardian reports. A U.K. government spokesperson said the review was finalized under previous leadership, and current efforts have worked to strengthen "security guidance across departments, updated mandatory training for civil servants, and announced plans to upgrade digital infrastructure across the public sector."

Click on the link for the full story.

ICO fines nursing home for allegedly refusing DSAR.

The U.K. Information Commissioner's Office issued a 6,540 GBP fine to Bridlington Lodge Care Home after Director Jason Blake allegedly refused to comply with a subject access request from a resident's family member and deleted relevant data connected to the patient without permission.

Click on the link for the full story.

IAPP Weekly News 01.09.2025 - 05.09.2025