Latest Worldwide Developments on Personal Data

CNIL issues guidance for parents on sharing children's images online.

France's data protection authority, the Commission nationale de l'informatique et des libertés, released guidance for parents on the potential risks of sharing videos or images of their children. The CNIL said it does not recommend sharing any content related to children online, but urged parents to implement safeguards such as reducing images of children's faces, making accounts private and asking children for their consent to be posted online.

Click on the link for the full story.

10 tips to prepare for the EU Cyber Resilience Act.

With companies preparing for the EU Cyber Resiliency Act to enter into force in a year, former IAPP Research and Insights Analyst Cheryl Saniuk-Heinig, CIPP/E, CIPP/US, and Mayer Brown Partner Ana Bruder write, "organizations that embed security early will avoid steep penalties and gain a competitive advantage through demonstrable resilience" if their "planning and execution" begin in short order. Saniuk-Heinig and Bruder offer 10 tips to help guide preparations while offering an infographic outlining the regulation more broadly.

Click on the link for the full story.

ICO issues guidance for preventing student insider cyberattacks against schools.

Click on the link for the full story.

French lawmaker calls for TikTok children's safety investigation.

Reuters reports Member of French Parliament Arthur Delaporte is calling for a criminal probe into TikTok after the parliamentary committee he chairs released the results of a study looking into the platform's psychological effects on children. The panel recommended children under age 15 be banned from social media and an online curfew for children aged 15-18.

Click on the link for the full story.

Employees accuse Meta of failing to protect user safety on products.

A former WhatsApp employee is alleging Meta did not comply with a U.S. Federal Trade Commission deal to improve the platform's security and fired him when those issues were raised internally, The Washington Post reports. Meanwhile, Reuters reports two former Meta researchers went before a U.S. Senate subcommittee to describe whistleblower complaints alleging the company shut down internal child safety research on its virtual-reality platform.

Click on the link for the full story.

CNIL survey looks into economic benefits of DPOs.

France's data protection authority, the Commission nationale de l'informatique et des libertés, conducted a survey on how having a data protection officer at a company can affect its economic standing. The survey found larger companies tend to benefit from a perception of being more legally compliant and careful with data if they have a DPO on staff, with the majority of survey participants seeing it as an opportunity as opposed to a constraint.

Click on the link for the full story.

Finland's DPA fines bank for alleged security vulnerabilities.

Finland's Office of the Data Protection Ombudsman issued a 1.8 million euro fine to S-Bank after the company allegedly implemented a new login system without ensuring the system was secure, leading to a data breach. Deputy Data Protection Commissioner Annina Hautala said the office's enforcement, particularly in the banking sector, shows "organizations need to invest in adequate information security and testing, taking into account the risks associated with the processing of their personal data."

Click on the link for the full story.

EDPB approves guidelines on GDPR, DSA interplay.

The European Data Protection Board adopted guidelines on the interplay between the EU General Data Protection Regulation and the Digital Services Act. The guidelines are geared toward helping member state data protection authorities and the EDPB interpret how the GDPR should be applied to certain DSA requirements, such as notice-and-action systems for reporting illegal content and provisions governing recommender systems.

Click on the link for the full story.

CNIL issues guidance on school surveillance systems.

France's data protection authority, the Commission nationale de l'informatique et des libertés, released guidance on schools' use of surveillance systems, and what safeguards schools must implement to protect students' privacy. The guide indicated only authorized employees should be able to view data collected from surveillance cameras and noted schools must comply with data deletion and retention standards.

Click on the link for the full story.

UK ethics group looks at biometric voice recognition use cases.

The U.K. Biometrics and Forensics Ethics Group conducted a study on the technical, ethical and legal use of voice recognition technology in the public sector. The report looks at potential use cases in both law enforcement and government user services instances.

Click on the link for the full story.

IAPP Weekly News 08.09.2025 - 12.09.2025