Latest Worldwide Developments on Personal Data

US senator introduces legislation to protect health data collected from apps.

U.S. Sen. Bill Cassidy, R-La., introduced the Health Information Privacy Reform Act, a bill aiming to protect health care information not covered by the Health Insurance Portability and Accountability Act, The Record reports. The bill would prevent health care data collected by apps or smart devices from being shared. Cassidy said smartwatches and health care apps are "helpful tools, but present new privacy concerns that didn't exist when it was just a patient and a doctor in an exam room."

Click on the link for the full story.

EDPB issues opinion on draft adequacy decision for Brazil.

The European Data Protection Board adopted an opinion on the European Commission's draft decision granting Brazil adequacy to engage in cross-border data transfers with the EU. In its opinion, the EDPB noted Brazil's General Data Protection Law closely aligns with EU legislation and case law set by the Court of Justice of the European Union. "The EDPB welcomes the alignment between Brazil and Europe's data protection frameworks," EDPB Chair Anu Talus said in a statement. "This is a pivotal moment that will strengthen legal certainty for organisations and competent authorities transferring personal data from Europe to Brazil." However, the EDPB also noted it wants to see additional clarification from the Commission regarding how Brazil's LGPD governs data protection impact assessments and limitations on transparency in the areas of commercial and industrial secrecy.

Click on the link for the full story.

Australia's eSafety Commissioner informs platforms of age restriction compliance.

Australia's eSafety Commissioner has told several platforms they will be required to comply with the Social Media Minimum Age rules when they come into effect 10 Dec. The informed platforms include Facebook, Instagram, Snapchat, Threads, TikTok, X, YouTube, Kick and Reddit, but the office also said the list is not exhaustive and the broader online platform community should constantly assess whether they meet the criteria for the law.

Click on the link for the full story.

EDPB holds public consultation for developing GDPR compliance templates.

The European Data Protection Board opened a public consultation to gather input on how to craft EU General Data Protection Regulation compliance templates for organizations. The EDPB is seeking feedback from organizations on what information should be contained within the templates to facilitate easier compliance. As an example, the board cited potential templates covering privacy notice and record of processing activities. The consultation ends 3 Dec.

Click on the link for the full story.

Investigators used DNA testing tech to quickly catch suspects in Louvre heist.

The access to DNA testing technology using France's National Automated Genetic Fingerprint File allowed for police to quickly identify alleged suspects in the Louvre heists, The New York Times reports. The database holds more than 4.4 million fingerprints and individuals' sensitive genetic data for police investigations. "I am convinced that we would not have found these people if the DNA that was found at this theft hadn't matched with this database," said Gaëtan Poitevin, a criminal lawyer in Marseille whose master’s thesis was on France's DNA database.

Click on the link for the full story.

Texas attorney general announces $1.38B settlement with Google in 2022 privacy lawsuit.

Texas Attorney General Ken Paxton announced Google agreed to a USD1.38 billion settlement in a 2022 lawsuit for illegal tracking and collection of users' private data, incognito searches and biometric data. The settlement represents the largest fine assessed to a Big Tech company under U.S. state privacy law enforcement actions. "This historic $1.375 billion price tag for Google's misconduct sends a clear warning to all of Big Tech that I will take aggressive action against any company that misuses Texans' data and violates their privacy," Paxton said in a statement.

Click on the link for the full story.

Swedish DPA investigating data breach affecting 1.5M individuals.

The Swedish data protection authority, Integritetsskyddsmyndigheten, is investigating a data breach sustained by the system supplier company Miljödata after a large amount of personal data was published on the dark web. The attack is believed to have compromised more than 1.5 million people's information. The agency said it would be looking into the company's security practices and what kinds of data were being kept in the systems. The probe will look at the City of Gothenburg, Älmhult Municipality and Region Västmanland as well.

Click on the link for the full story.

Ireland's DPC releases use case on the right to erasure.

Ireland's Data Protection Commission released use case guidance detailing an example where a consumer requested their data be deleted while a data controller was implementing a new data processing system, causing complications over the consumer's right to have their data deleted. The DPC noted communication between data controllers and consumers can allow for an understanding resolution, though companies must ensure they are still compliant with data deletion obligations and respond to requests in a timely manner.

Click on the link for the full story.

New Zealand's DPA releases primer on indirect data collection.

The New Zealand Office of the Privacy Commissioner published its final guidance on IPP3A, the indirect data collection notification requirement coming online 1 May 2026. The guidance details what counts as indirect personal information collection, how that information can be used, notification timings and more. It includes a visual guide to help understand when someone needs to be informed of indirect data collection through a flowchart. The guidance stresses such rules are meant to preserve trust in how agencies handle information.

Click on the link for the full story.

Telecom company reports large revenue drop after data breach compensation efforts.

South Korean telecommunications company SK Telecom said the data breach it sustained earlier this year caused a 90% drop in operating profits for the third quarter, The Record reports. The loss shows the impact data breaches can have on a company's operations. The incident exposed the data of about 27 million customers after hackers were able to get into its network using malware in 2022. SK Telecom was fined and required to overhaul its cybersecurity system as a result, and the company spent heavily on rate discounts and free data vouchers as a way to regain customer trust.

Click on the link for the full story.

IAPP Weekly News 03.11.2025 - 07.11.2025