Latest Worldwide Developments on Personal Data

Poland's DPA warns parents about posting children on social media.

Poland's data protection authority, the Urząd Ochrony Danych Osobowych, is urging parents to limit social media posts that include children's personal information, including pictures and videos. The DPA claimed posting children online could lead to bullying, AI-generated deepfakes or identity theft.

Click on the link for the full story.

Australia's updated ransomware disclosure obligations take effect.

Australia's ransomware payment disclosure rules under the Cyber Security Act 2024 have taken effect, requiring organizations to inform the Australian Signals Directorate if they pay a ransomware group after a cyberattack, Infosecurity Magazine reports. NCC Group APAC, Director of Professional Services, Tim Dillon said the obligations are a "significant step in bolstering national digital resilience against an ever-evolving threat landscape."

Click on the link for the full story.

CNIL examines economic benefits of GDPR cybersecurity regulation.

France's data protection authority, the Commission nationale de l'informatique et des libertés, published a report looking at the EU General Data Protection Regulation's economic effect on cybersecurity. The analysis delves into the externalities created by the cybersecurity industry and how it effects businesses, customers and potential cybercriminals.

Click on the link for the full story.

BEUC files dark patterns complaint against e-commerce company.

The European Consumer Organisation filed a complaint against e-commerce company Shein for its alleged use of dark patterns, Reuters reports. BEUC Director General Agustin Reyna said the company needs to "get rid of these dark patterns, but the question is whether they will have enough incentive to do so, knowing the potential impact it can have on the volume of purchases."

Click on the link for the full story.

Germany's BfDI fines cellular provider 45M euros for GDPR violations.

Germany's Federal Commissioner for Data Protection and Freedom of Information issued Vodafone two fines totaling 45 million euros for alleged EU General Data Protection Regulation violations related to insufficient due diligence with third parties and inadequate data security. The BfDI assessed a 30 million euro fine for alleged security flaws in its authentication process for its "MeinVodafone" online portal. The remaining 15-million-euro fine was issued because Vodafone had not properly vetted a third-party service in its terms of data protection.

Click on the link for the full story.

TikTok to appeal ruling by Ireland's DPA on data transfer practices.

TikTok will ask the High Court of Ireland to stay the Data Protection Commission's decision preventing the social media platform from sending data overseas within six months, The Irish Times reports. The DPC found that TikTok's practices violated transfer rules in the EU, but the company says the potential ban would cause significant damage to its business.

Click on the link for the full story.

Apple, Meta challenge European Commission on DMA decisions.

Apple appealed the European Commission's decision ordering interoperability with third parties under the Digital Markets Act, Euractiv reports. The company argued the order will infringe upon users' privacy because it will mean turning their data over to other companies and create questions around necessity and proportionality. Meanwhile, Meta is challenging the Commission's classification of Messenger and Marketplace under the DMA.

Click on the link for the full story.

Finland's DPA fines a pharmacy for alleged tracking technology violations.

Finland's Office of the Data Protection Ombudsman fined University Pharmacy 1.1 million euros for allegedly using cookies and tracking technologies on its online platforms. That data was later leaked to third parties. The DPA said it is looking into similar problems at other pharmacies.

Click on the link for the full story.

Tech companies look to clarify hacker names.

Technology companies Microsoft, CrowdStrike, Palo Alto and Google announced they will work to create a glossary aiming to clarify hacker group names, Reuters reports. The initiative will work to provide information about specific hackers to victims of cyberattacks and identify which groups are potentially responsible.

Click on the link for the full story.

MEPs propose more funding, regulatory reforms to improve digital sovereignty.

The European Parliament Committee on Industry, Research and Energy adopted a proposal to enhance Europe's technological sovereignty and digital infrastructure with an emphasis on increasing investments and overhauling regulations. It calls for a digital public infrastructure focused on creating semiconductors, connectivity, cloud infrastructure, data software and AI technologies.

Click on the link for the full story.

IAPP Weekly News 02.06.2025 - 06.06.2025