Latest Worldwide Developments on Personal Data

Switzerland's DPA publishes updated cookie guidance.

Switzerland's Federal Data Protection and Information Commissioner issued updated guidance on cookie use. The guidance explains when using cookies requires a website operator to obtain consent and provides information on the risks associated with collecting location data, as well as the circumstances under which implementing a "cookie paywall" or a pay-or-consent model is lawful.

Click on the link for the full story.

NOYB: Austria's DPA finds Microsoft 365 tracked students without consent.

Austria's Data Protection Authority allegedly found Microsoft 365 Education tracked users without their consent, violating data protection regulations, France 24 reports. The DPA launched an investigation into Microsoft after privacy group NOYB claimed the software collected users' information, including children's data, for advertising purposes. Microsoft said it will review the decision, though the company noted its software "meets all required data protection standards, and institutions in the education sector can continue to use it in compliance with" the EU General Data Protection Regulation.

Click on the link for the full story.

Australia's court fines company AUD5.8 million for role in medical data breach.

Australia's Federal Court fined the parent company of MedLab Pathology for violations of the Privacy Act stemming from a 2022 data breach that compromised the personal information of more than 223,000 patients. Australian Clinical Labs was fined AUD5.8 million after investigators found ACL's senior management was involved in the decision-making for integrating MedLab's IT systems into ACL's core environment and whether the hack constituted an eligible data breach, as well as its "failure to act with sufficient care and diligence in managing the risk of a cyberattack" on MedLabs.

Click on the link for the full story.

EDPB organizing anonymization, pseudonymization stakeholder event.

The European Data Protection Board is organizing a stakeholder event seeking input on anonymization and pseudonymization "following the clarification on the scope of the concept of personal data provided by the Court of Justice of the European Union's judgement in EDPS v Single Resolution Board." According to the news release, the event will take place by year's end.

Click on the link for the full story.

Third-party ID verification photos may have been leaked, Discord says.

A cyberattack on a third party used by messaging service Discord may have led to the leak of 70,000 photo IDs of Discord users, the BBC reports. The photos of government IDs are used by the platform for age verification purposes. The adversary reportedly gained access to Discord's systems through the platform's customer support provider. Users' personal information, including names, addresses, ID numbers and some credit card information may have been compromised. Discord said it is working with law enforcement to investigate the scale of the incident.

Click on the link for the full story.

Survey estimates 612K UK businesses targeted by cyberattacks in last year.

A recent cyberattack against Jaguar-Land Rover that has halted production since 1 Sept., and cost the company approximately 50 million GBP per week in lost productivity, is part of a wave of attacks against major businesses and charities in the U.K. this year, the BBC reports. A U.K. government-issued Cyber Security Breaches Survey estimated 612,000 businesses and 61,000 charities were targeted across the U.K. in the last 12 months. The survey found the average cost of responding to a cyberattack is 8,260 GBP.

Click on the link for the full story.

European Commission, EDPB issue joint guidelines on DMA-GDPR interplay.

The European Data Protection Board and European Commission endorsed joint guidelines on the interplay between the EU General Data Protection Regulation and Digital Markets Act. The aim is to "facilitate" the appropriate application of the DMA and GDPR, as well as increase legal certainty for stakeholders. The EDPB and Commission also launched a joint public consultation on the first version of the guidelines, which will be open until 4 Dec. "The guidelines will help gatekeepers, business users and individuals to better understand their obligations and rights under the DMA, and ensure a consistent, effective and complementary application of the DMA and EU data protection law," EDPB Board Chair Anu Talus said.

Click on the link for the full story.

Norway's DPA issues response to IP data disclosure consultation.

Norway's data protection authority, Datatilsynet, said it does not support a proposal introduced by the Ministry of Digitalisation and Public Administration and the Ministry of Justice and Public Security that would allow internet protocol data to be disclosed to law enforcement. The proposal would only allow the data to be used to combat crime and find suspects. However, the DPA raised concerns about how IP data could potentially be linked to existing information about individuals in police databases. The DPA said it recommends the IP data disclosure go through the courts to "strengthen both legal certainty and trust in the measure."

Click on the link for the full story.

New Zealand privacy commissioner releases guidance on child safety info-sharing.

New Zealand's Office of the Privacy Commissioner said, although the Privacy Act includes provisions to protect children from having their information shared, individuals concerned about a child's wellbeing can share information with law enforcement. Commissioner Michael Webster said it is "important people working with children know they can share information about risks to a child's wellbeing or safety with other agencies or people who are in a position to help keep that child safe. ... The value of the Privacy Act is to help agencies keep that information safe, not to prevent agencies from sharing it when they need to."

Click on the link for the full story.

Denmark, Italy weigh in on social media age restriction efforts.

Danish Prime Minister Mette Frederiksen confirmed the government will seek to ban several social media platforms for children under age 15, Euractiv reports. She did not specify which platforms she would be limiting access to, but said some social media would be accessible to children as young as 13 with a parent's permission. Her comments come as more EU members consider limiting social media by age under the Digital Services Act. In Italy, the president of the data protection authority, the Garante, commented on changes to a proposed age limit law, including the authority's ability to block platforms abroad.

Click on the link for the full story.

IAPP Weekly News 06.10.2025 - 10.10.2025