Latest Worldwide Developments on Personal Data

EU Digital Omnibus: Analysis of key changes.

IAPP Principal Researcher for Privacy Law and Policy Müge Fazlioglu, CIPP/E, CIPP/US, and Research and Insights Director Joe Jones examine key components of the draft texts for the European Commission's Digital Omnibus and Digital Omnibus on AI. They note that while the draft packages will change and take many months to finalize, it is important to grasp the "the motivation behind and substance" of impactful proposals to amend aspects of the digital rulebook, including the EU General Data Protection Regulation and the AI Act.

Click on the link for the full story.

ICO urges Home Office to clarify reports of racial bias in law enforcement facial recognition programs.

The U.K. Information Commissioner's Office is urging the Home Office to clarify a report by the National Physical Laboratory that found facial recognition technology used by law enforcement could show racial bias when identifying individuals, the Guardian reports. Researchers found the false positive identification rate for white suspects is significantly lower than Asian and Black suspects. In a statement, ICO Deputy Commissioner Emily Keaney said public confidence in law enforcement's use of technology is "paramount" and "any perception of bias and discrimination can exacerbate mistrust."

Click on the link for the full story.

Ancestry updates policy to prevent individuals' biometric data from being used to solve crimes.

A policy update to genealogy company Ancestry's terms of service will prevent law enforcement from using the company's biometric database to solve crimes, The New York Times reports. While Ancestry's data has helped law enforcement solve 1,400 cases, the company never explicitly allowed authorities to use its data. Per the updated terms, law enforcement must now seek a warrant to obtain access to specific Ancestry data.

Click on the link for the full story.

EU Digital Omnibus: What the proposed changes to the concept of personal data mean in practice.

Baumgartner Baumann Partner Ulrich Baumgartner, CIPP/E, analyzes the EU Digital Omnibus' proposed changes to the definition of personal data in Article 4(1) of the EU General Data Protection Regulation, noting it is "one of the most consequential" changes offered. He explains how potentially revising the definition of personal data "not only defines the scope of application of the GDPR but also has practical implications for other legal acts of the EU Digital Rulebook such as the Artificial Intelligence Act or the Data Act."

Click on the link for the full story.

ICO fines password manager for lax security measures leading to 2022 breach.

The U.K. Information Commissioner's Office fined password manager LastPass 1.2 million GBP following a 2022 data breach impacting 1.6 million U.K. users. The ICO alleged LastPass failed to implement "robust technical and security measures," which enabled a hacker to access a corporate laptop belonging to an EU-based employee. That access allowed the hacker to embed malware onto a U.S.-based employee's computer to gain master password access.

Click on the link for the full story.

UK regulators cover targeted support messaging in direct marketing.

The U.K. Information Commissioner's Office and the Financial Conduct Authority issued a joint statement on how targeted support messaging interacts with direct marketing provisions contained in data protection law. The regulators' guidance covers obligations such as data transparency and having a valid lawful basis for collecting information. It also offers ways to provide information not covered by direct marketing rules, including displaying a message on website or app and an automated message during inbound calls.

Click on the link for the full story.

CalPrivacy issues guidance for launch of DROP system.

The California Privacy Protection Agency published guidance for the launch of its Delete Request and Opt-out Platform. Beginning 1 Jan. 2026, state residents will be able to access the DROP system and file deletion requests to registered data brokers. Starting 1 Aug. 2026, data brokers must begin to process qualified deletion requests, and CalPrivacy will update the DROP system with new requests to be processed every 45 days. Editor's note: IAPP Staff Writer Alex LaCasse reported on CalPrivacy's demonstration of the DROP system at the Privacy. Security. Risk. 2025 conference in San Diego.

Click on the link for the full story.

Social media safety, privacy literacy and gentle parenting.

Australia's Online Safety Amendment Act barring children under age 16 from accessing social media platforms entered into force 10 Dec., charting a new path for children's online safety that will be closely watched around world. Though Australia is the first country to outright prohibit children from accessing social media, IAPP Principal Researcher for Privacy Law Müge Fazlioglu, CIPP/E, CIPP/US, explains, "proposals to protect children's information online have envisioned various degrees of parental oversight and included a range of restrictions on and requirements for online platforms." She outlines the various frameworks in play alongside Australia's new rules.

Click on the link for the full story.

Reddit files lawsuit with Australia's High Court over social media ban.

Reddit filed a lawsuit with Australia's High Court that aims to overturn the country's new law barring children under age 16 from accessing social media platforms, Reuters reports. In its lawsuit, Reddit, which is not subject to the new age limit rules, names the Commonwealth of Australia and Communications Minister Anika Wells as defendants. The platform alleged the ban violates free speech protections contained in the Commonwealth of Australia Constitution Act.

Click on the link for the full story.

China's CAC seeks comment on risk assessment draft guidance.

The Cyberspace Administration of China released a draft version of its "Measures for Network Data Security Risk Assessment" and is seeking feedback. The measures are intended to standardize network data security risk assessment activities and ensure network data is used lawfully and effectively. The draft rules call for risk assessments every three years that can be conducted by network data processors or "entrusted third-party assessment agencies." The deadline for public comment is 5 Jan. 2026.

Click on the link for the full story.

IAPP Weekly News 08.12.2025 - 12.12.2025