Latest Worldwide Developments on Personal Data

ICO updates ADMT guidelines.

The U.K. Information Commissioner's Office updated guidance on how the U.K. General Data Protection Regulation applies to the automated decision-making technology. Notable among the changes are new details on how Article 22A applies to ADMT used on decisions with significant impacts. It sets out a new section on ADMT safeguards and user rights while more explicitly spelling out restrictions around ADMT undertakings.

Click on the link for the full story.

DOJ urges US appellate court to rule VPPA constitutional.

The U.S. Department of Justice filed a brief to the Court of Appeals for the 1st Circuit in favor of upholding the constitutionality of the Video Privacy Protection Act in a First Amendment case between media company Hearst Corporation and an app user, MediaPost reports. The DOJ wrote, "As the name suggests, the Video Privacy Protection Act is a privacy statute, protecting sensitive information without regard to the content of any message in which the disclosure might be contained."

Click on the link for the full story.

ICO establishes campaign to support children's privacy education.

The U.K. Information Commissioner's Office launched its "Switched on to privacy" campaign, which aims to support parents with children ages 4-11 and help them educate their children about online privacy. According to ICO research, 24% of children in that age range have shared their full name or address online, 22% have shared personal information with AI chatbots and 35% of parents believe their child would share personal information in exchange for game tokens or rewards.

Click on the link for the full story.

Greece to ban kids under age 15 from social platforms.

Greece's Prime Minister Kyriakos Mitsotakis said children under age 15 will be banned from using social platforms beginning 1 Jan. 2027 due to the potential impact on children's mental health, BBC reports. If companies do not comply with the ban, Greece's Digital Governance Minister Dimitris Papastergiou warned the authority will issue penalties that reflect "up to 6% of their global turnover." Mitsotakis also urged the EU to take coordinated action in developing a framework to ban underage users from social platforms by the end of the year.

Click on the link for the full story.

MEPs, EU member states resist European Commission's proposed GDPR reform.

Politico reports on the ongoing stalemate over the European Commission's proposed EU General Data Protection Regulation amendments contained in its Digital Omnibus proposal. Members of European Parliament and the Council of the European Union remain at odds with the Commission on changes to the GDPR, particularly around the regulation's core principles and definitions. Estonian MEP Marina Kaljurand said the Commission worked "rather hastily" on the proposed GDPR reforms and risks "legal uncertainty" while potentially limiting fundamental privacy rights.

Click on the link for the full story.

Qatar's NCSA launches cloud privacy assessment tool.

Qatar's National Cyber Security Agency launched its Cloud Computing Privacy Assessment Tool, which aims to provide organizations with a tool to assess their digital security standards and comply with the Personal Data Privacy Protection Law, ZAWYA reports. The NCSA said the tool will allow organizations to continue to grow in the digital market while promoting privacy standards and risk management efforts.

Click on the link for the full story.

EDPB highlights EU's digital regulatory growth in annual report.

The European Data Protection Board released its 2025 annual report detailing changes in the regulatory landscape and highlighting the EDPB's efforts to strengthen cross-border cooperation, provide organizations with resources to aid compliance and support data protection authorities' enforcement efforts. EDPB Chair Anu Talus noted, the EDPB "prioritised meaningful dialogue with stakeholders to ensure our work reflected real-world needs. Our achievements support economic growth while continuing to protect individuals' fundamental rights to privacy and data protection."

Click on the link for the full story.

ICE confirms use of spyware tools.

The U.S. Immigration and Customs Enforcement acting Director Todd Lyons confirmed in a letter to the U.S. House Committee on Oversight and Government Reform that the agency is using spyware technology, allegedly including Paragon Solutions' Graphite, to track individuals accused of drug trafficking, NPR reports. Electronic Frontier Foundation Senior Staff Technologist Cooper Quintin raised concerns over ICE's alleged use of Graphite, noting invasive surveillance capabilities "should require the strongest judicial oversight and confirmation that such intrusion is necessary and (a) proportionate response to the crime being investigated."

Click on the link for the full story.

ENISA to hold public consultation on EU Digital Wallet proposal.

The European Union Agency for Cybersecurity launched a public consultation on the draft EU Digital Wallet. The consultation aims to solicit feedback from specific components of the European Digital Identity Wallet proposal, including its annexes. ENISA framed digital wallets as a "pivotal step towards a seamless and secure identification in both the physical and digital world" that enhance personal data protection. The deadline to submit comments to ENISA is 30 April.

Click on the link for the full story.

US HHS releases guidance on HIPAA security rule.

The U.S. Department of Health and Human Services released guidance detailing the Health Insurance Portability and Accountability Act Security Rule's Risk Management obligations to protect patient privacy when using digital records. The HHS said organizations and health care providers must ensure they assess overall data security and mitigate potential risks and data protection challenges due to systems' processing of sensitive health information.

Click on the link for the full story.

IAPP Weekly News 06.04.2026 - 10.04.2026