Latest Worldwide Developments on Personal Data

US government criticizes UK's proposed under-16 social media ban.

In response to a U.K. government consultation on potential online safety legislation that would ban children under age 16 from accessing social media, in part, the U.S. government urged the U.K. not to pursue such a measure, saying it may create hardship for U.S. technology companies, the Guardian reports. In comments published by the U.S. embassy in London, the U.S. government criticized the proposed “prescribed one-size-fits-all government restrictions” using “blunt regulatory instruments.”

Click on the link for the full story.

23andMe settles its data breach class-action lawsuit for $46.7M.

During its bankruptcy proceedings, 23andMe agreed to settle its class-action lawsuit for USD46.7 million after consumers' sensitive personal information was allegedly breached in a 2023 cyberattack, Bloomberg reports. The company is currently working to liquidate the rest of its assets and contest a lawsuit by California Attorney General Rob Bonta that claims the company did not do enough to protect users' personal data.

Click on the link for the full story.

75% of the tech industry reporting increased legal exposure on data privacy, security in US.

Norton Rose Fulbright published its 2026 Annual Litigation Trends Survey. Key findings include that cybersecurity and data privacy exposure is highest in the technology sector, with 75% of respondents reporting increased legal exposure on the U.S. national level and 72% reporting increased legal exposure on the state level. Additionally, 69% of technology respondents said data breaches are the most likely incident to trigger a class-action lawsuit. Another emerging trend is that legal exposure on both the state and federal level related to AI increased 50% and 53%, respectively, among technology respondents.

Click on the link for the full story.

Australia's OAIC orders complainant to not disclose full data breach decision.

The Office of the Australian Information Commissioner ordered an individual who filed a complaint against American Express not to disclose the full details of its decision due to concerns about the company's potential cybersecurity vulnerabilities, ABC News reports. The complainant previously raised concerns about employee access to consumers' sensitive personal information.

Click on the link for the full story.

Canadian government proposes under-16 social media ban in Safe Social Media Act.

The Canadian government introduced the Safe Social Media Act that proposed to ban children under age 16 from social media platforms, The Wall Street Journal reports. If adopted by Parliament, the legislation would allow most social media platforms to seek exemptions to certain obligations if they meet safety requirements established by a new regulator created under the bill. Adult content websites would not be eligible for the exemptions and the age limit would not apply to AI chatbots or video game platforms.

Click on the link for the full story.

Irish High Court upholds core GDPR ruling against TikTok.

An Irish High Court ruling released Thursday in the court's registry upheld significant portions of the Data Protection Commission's enforcement action against TikTok over violations of the EU General Data Protection Regulation. The court confirmed the company was in violation of Articles 46 and 13 over data transfers to China and transparency obligations. The court also largely upheld the 530 million euro fine. On procedural grounds, the court flagged some issues related to how the DPC handled later evidence in the case — notably Project Clover — which means some corrective orders, such as suspending transfers, may need reconsideration. The court also reinforced that companies must "verify, guarantee and demonstrate" that international data transfers meet EU-level protections.

Click on the link for the full story.

Nigeria's DPA, Meta announce 2-year campaign to strengthen data protection practices.

The Nigeria Data Protection Commission and Meta announced a two-year campaign to promote data privacy awareness, build regulatory capacity and strengthen data protection for Nigerian citizens, The Guardian Nigeria reports. The campaign was established via a court-approved settlement last year after the NDPC previously investigated the company's data processing practices in the country.

Click on the link for the full story.

EDPB meets with European Commissioner, adopts common breach notification template.

During its June plenary meeting, the European Data Protection Board met with European Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection Michael McGrath. The EDPB urged the European Commission to not adopt the proposed definition of personal data in the Digital Omnibus negotiations and strengthen cross-regulatory cooperation. Additionally, the EDPB adopted a "common template for reporting data breach notifications" for member state data protection authorities.

Click on the link for the full story.

ICO announces temporary governance changes.

In announcing the completion of an independent workplace investigation into U.K. Information Commissioner John Edwards, the Information Commissioner's Office said there would be "temporary governance changes" to how the office functions. The investigation into Edwards, who has not worked in his role since 26 Feb., found "there is a case to answer," and he would not be working throughout the remainder of the process. The next steps will be determined by the Department for Science, Innovation and Technology, and the ICO's deputy commissioners will assume Edwards' nondelegable responsibilities in the interim.

Click on the link for the full story.

Meta removes facial recognition software from smart glasses app.

Shortly after WIRED revealed Meta had embedded an unreleased facial recognition system in an app, the company removed the capability when the magazine reanalyzed the code. The newest version of the app, Meta AI, a companion to Meta's smart glasses, did not contain the unactivated facial recognition software. The system was originally called NameTag.

Click on the link for the full story.

IAPP Weekly News 08.06.2026 - 12.06.2026