Latest Worldwide Developments on Personal Data

EDPS issues guidance on DPO role within EUIs.

The European Data Protection Supervisor published guidance after it previously adopted two measures to strengthen the role of data protection officers within EU institutions. The first measure was adopted 18 Dec. 2025 and clarified the EDPS's interpretation of how the DPO should function within EUIs, while the other measure, adopted 16 Jan., requires EUIs to obtain clearance from the EDPS before terminating their DPO. The EDPS said the two measures together "clarify both the EDPS's expectations and the applicable procedural requirements" and should be implemented immediately.

Click on the link for the full story.

Discord to introduce age-assurance checks.

The social platform Discord will begin requiring users to submit a facial scan or upload copies of their ID to access adult content, the BBC reports. Users who do not will be placed into a teen-appropriate experience by default, which means the content they see and how they communicate will be restricted unless they submit to the age check to prove they are an adult.

Click on the link for the full story.

EDPB, EDPS detail concerns over personal data definition in joint opinion on Digital Omnibus.

The European Data Protection Board and European Data Protection Supervisor issued their much-anticipated joint opinion on the European Commission's Digital Omnibus proposal 11 Feb. While both were generally receptive to the objectives of the Omnibus package, they also outlined several areas where the Commission could revise the package. Most notably, the opinion stated the Omnibus does not reflect the Court of Justice of the European Union precedent establishing the definition of "personal data" under the EU General Data Protection Regulation. IAPP Staff Writer Alex LaCasse reports on the key elements of the joint opinion.

Click on the link for the full story.

CJEU rules Meta can challenge EDPB's binding WhatsApp decision.

The Court of Justice of the European Union ruled Meta has the right to appeal the European Data Protection Board's 2021 WhatsApp decision resulting in a 225 million euro EU General Data Protection Regulation fine over transparency and data processing allegations. IAPP Staff Writer Lexie White reports on the CJEU's ruling and how the decision could allow organizations to more easily challenge enforcement decisions.

Click on the link for the full story.

Meta, Snap, TikTok agree to independent testing to evaluate teen mental health protections.

Meta, Snap and TikTok agreed to participate in independent products testing to evaluate how their respective platforms protect teenagers' mental health, The Washington Post reports. Platforms will be graded on specific criteria, including if they mandate breaks for users, provide options to stop endless scrolling and other safety and transparency considerations. The voluntary program is supported by the Mental Health Coalition.

Click on the link for the full story.

Notes on the updated Global Privacy Law and DPA Directory and major privacy developments.

The IAPP Research and Insights team recently updated its Global Privacy Law and DPA Directory. The update accounts for the latest data protection figures released by global data protection authorities and a range of legislative developments in the EU, India and more. IAPP Westin Fellow Will Simpson, AIGP, CIPP/US, offers a snapshot look at the update.

Click on the link for the full story.

CJEU says observed personal data is collected directly from the data subject — what it means in practice.

The Court of Justice of the European Union issued a December 2025 clarifying individuals' data is considered personal data if it is directly collected from the data subject. Myriad AI Compliance, Cybersecurity and Operational Risk Consultant František Nonnemann details what the clarification means for EU General Data Protection Regulation enforcement and additional regulatory efforts.

Click on the link for the full story.

Garante to probe Amazon workplace monitoring.

Italy's data protection authority, the Garante, will join the National Labor Inspectorate in a joint supervisory initiative covering allegations around workplace surveillance practices at select Amazon distribution centers. The supervision seeks to understand "potential critical issues in the acquisition and processing of workers' personal data and in the use of video surveillance systems in the absence of the guarantees required by the Workers' Statute."

Click on the link for the full story.

Netherlands' DPA warns open-source AI agents could be 'Trojan horse' containing malware.

The Netherlands' data protection authority, Autoriteit Persoonsgegevens, issued a warning to organizations against using popular open-source AI agents, such as OpenClaw, over security risks. The AP said many of the plug-ins developed for these agents contain malware that could lead to a data breach and account takeovers. Cybersecurity professionals consider these type of agents to be a "Trojan horse," where login credentials and access to cryptocurrency accounts are stolen when users grant AI agents device access.

Click on the link for the full story.

Portugal moves toward child social media restrictions.

The Assembly of the Portuguese Republic approved the first reading of proposed requirements to limit minors' exposure to social media, Reuters reports. The bill, which passed 148-69, calls for explicit parental consent to allow children ages 13-16 to access social media. Noncompliance could result in fines of up to 2% of company revenue, Social Democratic Party lawmaker Paulo Marcelo said before the vote. Meanwhile, Time named Australian eSafety Commissioner Julie Inman Grant to its Time100 Health 2026 list, recognizing Inman Grant for her efforts to bolster online safety through enforcing Australia's under age 16 social media ban.

Click on the link for the full story.

IAPP Weekly News 09.02.2026 - 13.02.2026