Latest Worldwide Developments on Personal Data

CNIL releases cookie consent guidance.

France's data protection authority, the Commission nationale de l'informatique et des libertés, issued guidance on cookie consent practices and how organizations can determine if they do not need to obtain consent from consumers before using performance statistics tools. The CNIL recommended companies implement data deletion standards and provide users with information about data collection tools.

Click on the link for the full story.

Google open sources Zero-Knowledge Proof cryptography tools.

Google announced it open sourced its Zero-Knowledge Proof libraries in collaboration with Sparkasse to comply with EU age assurance regulations and protect individuals' personal data while confirming their identity. Google said open sourcing the cryptography tools "will make it much easier for private and public sector developers to build their own privacy-enhancing applications and digital ID solutions, meeting an urgent need."

Click on the link for the full story.

Infographic: US Data Security Program cheat sheet.

IAPP Cybersecurity Law Center Managing Director Jim Dempsey and Research and Insights Analyst Cheryl Saniuk-Heinig published an overview of the U.S. Data Security Program's controls to prevent foreign adversaries from accessing sensitive U.S. data. The cheat sheet covers the program's scope, select definitions, compliance obligations, enforcement and more.

Click on the link for the full story.

CNIL, DPO association develop digital safety guide for parents.

France's data protection authority, the Commission nationale de l'informatique et des libertés, and the French Association of Data Protection Officers developed a toolkit to help parents manage digital technology and prevent cyber risks in the home. The kit is meant to be distributed to DPOs, who will then use it to teach parents in their workplace.

Click on the link for the full story.

Croatia's DPA issues several fines over alleged GDPR violations.

Croatia's Personal Data Protection Agency announced eight administrative fines totaling 350,500 euros over EU General Data Protection Regulation claims. The Croatian Insurance Bureau and a sports betting organization were among the penalized entities, each receiving a fine related to respective issues maintaining adequate data security safeguards in compliance with the GDPR.

Click on the link for the full story.

CNIL finalizes TIA guidance.

France's data protection authority, the Commission nationale de l'informatique et des libertés, released the final version of its guide on data transfer impact assessments. The CNIL described the guide as providing "a methodology that identifies the steps prior to carrying out" a TIA. The regulator also outlined the changes to the final guide following a prior public consultation.

Click on the link for the full story.

Australia's cyber groups team up to create security guides.

The Australian Signals Directorate's Cyber Security Centre published joint guidance with the Council of Small Business Organisations Australia and Cyber Wardens on how businesses can secure their accounts and devices. The guide proposes multifactor authentication, password managers, antivirus software and other security measures. The agency also reminded businesses to review their cybersecurity protocols to ward against hackers.

Click on the link for the full story.

UK Tribunal rules in favor of the ICO's TikTok decision.

The U.K. First-tier Tribunal found the decision by the Information Commissioner's Office to issue a 12.7 million GBP fine against TikTok for alleged U.K. General Data Protection Regulation violations was justified. Information Commissioner John Edwards said the Tribunal's ruling is a "significant step forward in our being able to hold TikTok, and other similar platforms, to account for how they use people's information, particularly children's, when providing their online services."

Click on the link for the full story.

Netherlands' DPA says ransomware attacks doubled in 2024.

The Netherlands' data protection authority, the Autoriteit Persoonsgegevens, indicated reports of data theft by ransomware doubled in 2024. The agency said organizations surveyed by the agency reported an average loss of 100,000 euros as a result of the attacks.

Click on the link for the full story.

Mississippi asks US appellate court to allow enforcement of age verification law.

Mississippi is asking the U.S. Court of Appeals for the 5th Circuit to allow the state to enforce its age verification law after a judge previously ruled the law violated individuals' First Amendment rights, MediaPost reports. Mississippi Attorney General Lynn Fitch said, "requiring age verification and parental consent are common ways to protect minors from harms," and argued blocking the bill will hurt minors' online safety.

Click on the link for the full story.

IAPP Weekly News 07.07.2025 - 11.07.2025