Latest Worldwide Developments on Personal Data

Australia's eSafety Commissioner launches safety-by-design toolkits.

According to a leaked draft compromise text on the proposed EU Digital Omnibus, the Council of the European Union proposed completely striking the European Commission's potential changes to the EU General Data Protection Regulation's definition of "personal data." EU member state diplomats are expected to discuss the proposed reversal and its broader Omnibus opinion at a 27 Feb. meeting.

Click on the link for the full story.

European Commission opens consultation on draft Cyber Resilience Act guide.

The European Commission published draft guidelines for the application of the Cyber Resilience Act and opened a public consultation for feedback. The guide explains the scope, including the application to hardware and software, and requirements around risk assessments, reporting obligations and "vulnerability handling." The consultation closes 31 March.

Click on the link for the full story.

TikTok begins appeal over potential EU-China data transfer ban.

Politico reports on the beginning of the legal battle between Ireland's Data Protection Commission and TikTok over the DPC's proposed ban on the platform's data transfers to China. TikTok's appeal began before an Irish court 3 March, with TikTok Senior Counsel Paul Gallagher arguing "the consequences of (the Irish DPC's) decision are immense, even for a very large organization like TikTok." Gallagher also highlighted the difference of opinion between the company and the DPC over the applicability of China's surveillance laws and how their requirements might be "problematic" against the EU General Data Protection Regulation. Editor's note: IAPP News Editor Joe Duball reported on the DPC's TikTok decision May 2025.

Click on the link for the full story.

ICO releases tool offering guidance on data transfer under UK GDPR.

The U.K. Information Commissioner's Office launched an interactive guidance tool for organizations to better understand when the data transfer rule governing "restricted transfers" under the U.K. General Data Protection Regulation applies. The tool is modeled using a three-step test that will generate tailored guidance on how the U.K. GDPR would likely apply to their situation. The ICO stressed the tool's guidance does not serve as specific legal advice.

Click on the link for the full story.

CNIL opens public consultation on recommendations for tracking tools.

France's data protection authority, the Commission nationale de l'informatique et des libertés, launched its public consultation into its drafted recommendations for session replay tools. The consultation aims to determine consent considerations and allow the CNIL to better understand the tools used by companies to track user browsing patterns on company websites. Stakeholders have until 22 April to participate in the consultation.

Click on the link for the full story.

EDPB publishes agenda for workshop on EU cross-regulatory interaction, DPA cooperation.

The European Data Protection Board announced programming for its 17 March workshop on cross-regulatory interplay and cooperation in the EU. The event will provide information on the EDPB's role in the EU's cross-regulatory landscape with a specific focus on how existing regulatory frameworks interact with one another. European Commission Vice-President for Technological Sovereignty, Security and Democracy Henna Virkkunen and EDPB Chair Anu Talus will provide keynote remarks.

Click on the link for the full story.

Will the EU's digital simplification plans end up complicating things?

The IAPP released the fourth installment of its series of 2026 predictions on the digital space from the organization's thought leaders. IAPP European Operations Coordinator Laura Pliauškaitė said the EU's efforts to simplify digital regulations could complicate compliance. Pliauškaitė noted, with an array of simplification efforts, practitioners could spend 2026 "untangling different simplification projects and determining which ones will necessitate operational changes to their organization's digital governance programs."

Click on the link for the full story.

CARU urges children's retailer to ensure compliance with COPPA.

BBB National Programs' National Advertising Division and Children's Advertising Review Unit said its evaluation of Dorel Juvenile Group found the company has remained transparent about its CryAssist technology's privacy and functionality. CARU recommended the company ensure Children's Online Privacy Protection Act compliance with updates to its parental consent practices while limiting the amount of data collected through its products.

Click on the link for the full story.

EDPB publishes Support Pool of Experts study on data broker market.

The European Data Protection Board's Support Pool of Experts released its study on the data broker landscape with the aim to generate an EU-wide "methodology" to identify data brokers and present a data broker "typology." The study focuses on Belgium's data broker market, which was found to be "highly diverse" with "varying levels of risk related to personal data usage." The report also delves into brokers in the contexts of data pools and clean rooms as well as AI platforms.

Click on the link for the full story.

CalPrivacy fines Ford over alleged CPPA violations.

The California Privacy Protection Agency fined automaker Ford USD375,703 after the company allegedly violated the California Consumer Privacy Act by requiring users to complete an email verification process before opting out of data collection. CalPrivacy Head of Enforcement Michael Macko said, "unnecessary steps in the opt-out process can discourage consumers from exercising their privacy rights. We will continue to scrutinize practices that create these kinds of barriers for Californians."

Click on the link for the full story.

IAPP Weekly News 02.03.2026 - 06.03.2026