Latest Worldwide Developments on Personal Data

CNIL releases guide on using personal data toward loan application assessments.

France's data protection authority, the Commission nationale de l'informatique et des libertés, published guidance on how personal data can be used to assess a loan applicant's creditworthiness. For financial services companies issuing loans and intermediaries in banking and payment services, the CNIL's recommendations include minimizing the data collected to only what is necessary for processing the loan decision and clarifying the framework that is applicable to fully automated decisions to grant or refuse an application.

Click on the link for the full story.

Garante reminds platforms of criminal penalties for allowing deepfakes.

Italy's data protection authority, the Garante, issued guidance reminding that platforms that allow the production and sharing of deepfake content that uses real images or voices can potentially incur criminal penalties beyond civil penalties associated with data protection violations. The Garante also reiterated its need to be able to block services that do not comply with the law, as was the case with the banning of the deepfake, nonconsensual intimate imagery tool Clothoff in 2025.

Click on the link for the full story.

Ireland's communications minster pushes under-16 social media ban if no EU standard emerges.

Addressing Ireland's Parliament, Minister of Communications Patrick O'Donovan said the government would introduce legislation banning children under age 16 from accessing social media unless the EU introduced a similar bloc-wide regulation, RTE News reports. He said his preference is for the EU to pass an overarching standard for youth accessing social media, but "if a common approach at EU level is not achieved, I will seek government approval to take action at a national level."

Click on the link for the full story.

Probe finds ChatGPT's model training violated Canada's federal, provincial privacy laws.

An investigation by Canada's Office of the Privacy Commissioner and provincial privacy authorities from Alberta, British Columbia and Quebec found OpenAI's AI data training practices allegedly violated the relevant federal and provincial privacy statutes, including the Personal Information Protection and Electronic Documents Act. The probe found alleged shortcomings related to OpenAI's data collection and consent practices, as well as issues around data subject access requests. IAPP Staff Writer Lexie White reports on the findings from the joint probe.

Click on the link for the full story.

Meta expands age assurance tech to protect under-13 users.

In a company blog post, Meta announced the expansion of its AI age assurance technology to filter potential teenage users over age 13 and apply teen-restricted protections for Facebook and Instagram users in Brazil, the EU and U.S. The announcement coincides with continued efforts by Meta to use its age assurance technology to continue to remove users under age 13 from its platforms.

Click on the link for the full story.

Ireland's Supreme Court dismisses DPC's appeal on stay of TikTok data transfer fine.

Ireland's Supreme Court dismissed the Data Protection Commission's appeal to lift a prior stay issued on its 530 million euro EU General Data Protection Regulation fine against TikTok, The Irish Times reports. The DPC's appeal sought clarification on whether national or EU law needs to be applied when granting a stay. The court ruled the DPC's decision to fine TikTok was not done jointly with EU data protection authorities, leaving the legal proceedings to follow national law.

Click on the link for the full story.

Report finds children are finding ways around UK age verification mechanisms.

A report from Internet Matters found 46% of children said they believed it was easy to bypass U.K. age verification methods by submitting fake birthdays and altering their appearance, Euronews reports. The report also found 49% of children surveyed said "they experienced harm online in the last month." Internet Matters said the report's findings show children's online safety "should be tailored to their stage of development, rather than a one-size-fits-all approach."

Click on the link for the full story.

US state health insurance exchanges sharing data with Big Tech platforms.

An analysis by Bloomberg of the 20 U.S. state health exchanges revealed a majority are sharing user data with Big Tech companies through user tracking technologies. The data being shared by states ranges from citizenship and gender to zip codes and family history details. The exchanges were used by 7 million Americans to purchase health insurance in 2026.

Click on the link for the full story.

Ireland's media watchdog launches investigations into Meta's compliance with DSA.

Ireland's media regulator, Coimisiún na Meán, launched two investigations into Meta's Facebook and Instagram to assess whether the platforms are compliant with the EU Digital Services Act. The inquiry aims to determine whether the platforms engage in potentially manipulative practices within their algorithms, and if consumers are given options over their recommender system feeders.

Click on the link for the full story.

Ireland's DPC launches probe into SHEIN's data transfers.

Ireland's Data Protection Commission launched a formal investigation into Infinite Styles Services' compliance with the EU General Data Protection Regulation when transferring data from the EU to China. Deputy Commissioner Graham Doyle noted the inquiry into SHEIN Ireland "is an important strategic priority for the DPC and we intend to cooperate closely with our peer European Supervisory Authorities as part of the investigation."

Click on the link for the full story.

IAPP Weekly News 04.05.2026 - 08.05.2026