Latest Worldwide Developments on Personal Data

CNIL fines software company 1.7M euros for insufficient protection measures.

France's data protection authority, the Commission nationale de l'informatique et des libertés, fined software design company Nexpublica France 1.7 million euros for allegedly having insufficient technical and organizational measures to prevent a data breach of its PCRM product. The CNIL began investigating Nexpublica in late 2022 after users of the PCRM portal tool noticed they could access third-party documents. Audits prior to the breaches revealed data security vulnerabilities, but the probe found that the company did not fix them.

Click on the link for the full story.

European Commission to pursue further digital regulatory enforcement against Big Tech.

The European Commission is reportedly preparing to ramp up enforcement efforts of its digital rulebook against Big Tech firms in 2026, the Financial Times reports. Instead of pursuing new digital regulations, the Commission will focus on increasing enforcement of existing rules, such as the EU General Data Protection Regulation, the Digital Markets Act and Digital Services Act, which could lead to further diplomatic strain between U.S. leadership and the EU.

Click on the link for the full story.

EU to begin work on biometric-sharing partnership with the US.

Euractiv reports EU countries will share biometric data, such as fingerprints and facial scans, with the U.S. to maintain visa-free travel. The Enhanced Border Security Partnerships will be discussed by the European Commission with the U.S. this year, but then individual countries will negotiate their own agreements as to which databases they will share. The European Data Protection Supervisor issued a September 2025 opinion calling for enhanced data protection measures to support the the new partnerships.

Click on the link for the full story.

Poland's DPA to monitor medical groups, visa data processors.

Poland's data protection authority, the Urząd Ochrony Danych Osobowych, said it would inspect medical entities' handling of children's data, marketing groups, online delivery platforms and those that process personal data in the visa system as part of its 2026 monitoring plan. The plan is based on complaints the authority received last year and the areas it considers to be problematic.

Click on the link for the full story.

FTC to hold workshop on monitoring consumer harms from personal data use.

The U.S. Federal Trade Commission will hold a workshop 26 Feb. to better assess how the agency can monitor consumer harms and benefits from the collection and use of their data. The workshop will also include panel discussions on the impact of data breaches on consumers, efforts to minimize those impacts, and the cost and benefits of behavioral and contextual advertising.

Click on the link for the full story.

Cyberattack on Condé Nast allegedly breached 2.3M user records.

A cyberattack on media company Condé Nast allegedly breached 2.3 million user records, including consumers' names, addresses, emails and phone numbers, after the hacker claimed it urged the company to resolve vulnerabilities within its system, Ars Technica reports. The hacker threatened to release an additional 40 million records from Condé Nast's publications including Vogue, The New Yorker and Vanity Fair.

Click on the link for the full story.

Hamburg's DPA develops questionnaire for legitimate interest determinations.

The Hamburg Commissioner for Data Protection and Freedom of Information released an analysis tool to help organizations check if they have established legitimate interest for their data-processing activities. The questionnaire touches on what objectives are being pursued with data processing, whether the right kind of data is being collected and how is the audit of legitimate interest recorded and updated.

Click on the link for the full story.

European Commission issues document retention order to X over deepfake images.

The European Commission ordered the social platform X to preserve all documents related to training its AI chatbot, Grok, through the end of 2026, Reuters reports. The order follows the Commission's prior remarks condemning the platform for allegedly allowing the circulation of deepfake nude images of women and children reportedly generated by Grok. Meanwhile, the U.K. Information Commissioner's Office issued a statement acknowledging the consumer complaints about the circulation of Grok deepfakes, noting it had contacted the company about its efforts to comply with U.K. data protection law.

Click on the link for the full story.

Ireland's Tánaiste calls for ID-verified social media accounts in EU.

In an interview with Extra, Ireland's Tánaiste and Minister of Finance Simon Harris said Ireland's government will push for the establishment of government identification-verified social media accounts for users when it assumes the Presidency of the Council of the European Union, beginning 1 July. Harris also said Ireland's government will advocate for the introduction of a ban on children under age 16 from accessing social media, similar to Australia's law. Editor's note: The IAPP's Müge Fazlioglu, CIPP/E, CIPP/US, outlined global efforts to build children's online safety frameworks.

Click on the link for the full story.

European Commission could designate WhatsApp as a VLOP under DSA.

Meta's WhatsApp could be designated as a very large online platform under the Digital Services Act by the European Commission as early as the end of January, Euractiv reports. Upon receiving a VLOP designation, which carries a threshold of 45 million average monthly users, Meta would be required to mitigate systemic risk posed by WhatsApp, as it does already for Facebook and Instagram. However, the law will not apply to WhatsApp direct messaging services and only its public messaging channels.

Click on the link for the full story.

IAPP Weekly News 05.01.2026 - 09.01.2026