Latest Worldwide Developments on Personal Data

CNIL offers consumers advice on data protection after a breach.

France's data protection authority, the Commission nationale de l'informatique et des libertés, released guidance on what a person can do if their personal data was leaked or stolen. The CNIL noted it cannot confirm if someone's information was compromised in a breach but affected organizations must do so.

Click on the link for the full story.

Mexico's cybersecurity framework in 2025: A practitioner's guide.

Mexico has been working for more than a decade to codify a unified cybersecurity legal framework, which currently "handles cyber-risk through a collection of rules written for other purposes," OBEX Cybersecurity co-founder and CEO Jersain Llamas Covarrubias, CIPP/E, writes. Llamas Covarrubias gives an overview of the "four fundamental pillars" that guide organizations' cybersecurity compliance, while also providing insight into several pieces of draft legislation that would implement a more comprehensive cybersecurity regime.

Click on the link for the full story.

TikTok launches new parental controls.

TikTok announced it will roll out new child safety tools, advanced parental controls for teen accounts screen time that cover children's privacy and screen time management. The platform also introduced its Well-being Missions feature that provides users with a "series of short, engaging missions designed to help people develop long-term balanced digital habits."

Click on the link for the full story.

OpenAI nixes indexed private chats.

PC Magazine reports OpenAI removed the option to have private ChatGPT conversations published on search engine results after many appeared to contain personal information. The chats have been removed from Google but are still appearing on other search engines, which the company said it is working to fix.

Click on the link for the full story.

Researchers develop wireless version of biometric identifier.

TechRadar reports on a biometrics technology called WhoFi, which relies on nonvisual signatures to create a digital fingerprint and identify a person. Researchers at La Sapienza University in Rome claim the system only needs to be operating on a Wi-Fi network to sense humans and does not collect personal data.

Click on the link for the full story.

Latvia's DVI offers advice for online store data collection.

Latvia's Data State Inspectorate wrote about how much data is appropriate to gather when operating an online store. The agency noted information required to fulfill an order, especially customer data that is unique, should only be used for its original purpose.

Click on the link for the full story.

Garante warns of misused video surveillance in shops.

Italy's data protection authority, the Garante, told the president of the business association Confcommercio-Imprese per l'Italia to be mindful of video surveillance misuse in shops after several reports from law enforcement. The association said it was committed to raising awareness among its members about proper usage.

Click on the link for the full story.

Google's database containing business' data targeted in cyberattack.

Google's Threat Intelligence Group announced hacking group ShinyHunters hacked into Google's Salesforce database, accessing information about businesses, Axios reports. Google said in a blog post the hackers gained access to the system for a short period of time and only obtained "basic and largely publicly available business information."

Click on the link for the full story.

New Zealand privacy commissioner establishes Biometric Processing Privacy Code.

New Zealand Privacy Commissioner Michael Webster announced the Biometric Processing Privacy Code will enter into force 3 Nov. under the Privacy Act. The code will establish specific privacy rules for organizations that process biometric data, such as how to assess proportionality, adopting biometric data privacy safeguards and informed collection. Organizations will have until 3 Aug. 2026 to comply with the code's requirements.

Click on the link for the full story.

Norway's DPA issues guidance on adjusting ad settings on pay-or-consent platforms.

Norway's data protection authority, Datatilsynet, published guidance on how consumers can bypass pay-or-consent models on Meta platforms by adjusting their advertising settings to use the platform without paying while receiving nonpersonalized ads. Datatilsynet Head of International Tobias Judin said the DPA would prefer the option is easily accessible for consumers, as it is "important that users have real freedom of choice when they are asked for consent."

Click on the link for the full story.

IAPP Weekly News 04.08.2025 - 08.08.2025