Latest Worldwide Developments on Personal Data

CNIL publishes guidance for retailers' augmented cameras use.

France's data protection authority, the Commission Nationale de l'Informatique et des Libertés, issued guidance for retailers using augmented camera systems at self-checkout to protect individuals' rights. The CNIL said use of augmented cameras is lawful, however, retailers must comply with the EU General Data Protection principles of defining a legal basis to use the cameras, data minimization and providing a right of opposition, such as operating a staffed checkout line without augmented cameras.

Click on the link for the full story.

US officials' use of message archiving software raises security concerns.

U.S. officials are using TeleMessage software to archive conversations on the Signal app, raising concerns that sensitive national security messages could be vulnerable, The Washington Post reports. U.S. Sen. Ron Wyden, D-Ore., is urging the Department of Justice to investigate TeleMessage's security, claiming government officials "have been provided with a shoddy Signal knockoff that poses a number of serious security and counterintelligence threats."

Click on the link for the full story.

Apple to appeal EU DMA fine.

Politico reports Apple will appeal the 500 million euro fine for alleged violations of the EU Digital Markets Act, arguing the European Commission did not work with the company to find a compliant solution ahead of making a decision. The Commission said it is up to developers to comply with the law.

Click on the link for the full story.

Italy's Garante fines energy provider for alleged data sharing, telemarketing practices.

Italy's data protection authority, the Garante, fined Acea Energia for 3 million euros and other associated companies 850,000 euros for allegedly violating telemarketing laws and illegally processing personal data. The Garante found companies used lists of people who had switched energy providers to target them for new contracts.

Click on the link for the full story.

EDPB, EDPS express 'preliminary support' for GDPR record keeping simplification proposal.

The European Data Protection Board and European Data Protection Supervisor jointly adopted a letter responding to the European Commission's proposal to simplify the EU General Data Protection Regulation's record keeping obligations. In their joint letter, the EDPB and EDPS stated they would offer "preliminary support" to the proposal on the condition that it would not impact the controllers' and processors' other GDPR requirements.

Click on the link for the full story.

US court awards damages to Meta after NSO Group's hacking of WhatsApp.

The U.S. District Court for the Northern District of California awarded USD167 million to Meta after a six-year legal fight against the Israeli cybersecurity firm NSO Group that hacked 1,400 WhatsApp accounts of journalists, human rights activists, and government officials, The New York Times reports. In December 2024, the court found the NSO Group broke U.S. cybersecurity laws when it installed its Pegasus spyware on WhatsApp accounts in 20 countries. WhatsApp pledged to donate damages received to digital rights organizations.

Click on the link for the full story.

Estonia Data Protection Inspectorate issues guidance for e-commerce data protection.

Estonia's Data Protection Inspectorate issued guidance for e-commerce companies on protecting consumer data under the EU General Data Protection Regulation and the Electronic Communications Act. DPI Data Security Expert Eleri Pilliroog said companies' efforts to bolster data protection could prevent security incidents, as a "data leak can result in both financial losses and permanent reputational damage. Putting security first is a key factor for long-term success and helps avoid such concerns."

Click on the link for the full story.

South Korea's PIPC issues guidance for citizens to control their personal data through MyData system.

South Korea's Personal Information Protection Commission published a guide to inform individuals of their rights when requesting the transmission of their personal data. The guidance is geared toward helping individuals using the MyData system, which is being expanded to all sectors in the economy. The system allows individuals to exercise control over their personal data and transfer it to entities of their choosing.

Click on the link for the full story.

US CISA issues guidance for entities operating critical infrastructure systems.

The U.S. Cybersecurity and Infrastructure Security Agency published guidance for preventing cyberattacks on entities' operational technology and industrial control systems in critical infrastructure. Mitigation measures include removing operational tech connections to the public internet, changing default passwords, and establishing secure remote access to operational tech networks.

Click on the link for the full story.

Latvia's DPA advises on landlord information handling.

Latvia's Data State Inspectorate discussed what personal data a landlord is allowed to request when selecting tenants or entering into a lease agreement. The advisory information about education, salary, and rental history is allowed when screening tenants, but identification and financial information is only allowed when entering into a lease.

Click on the link for the full story.

IAPP Weekly News 05.05.2025 - 09.05.2025