Latest Worldwide Developments on Personal Data

Luxembourg court overturns CNPD's 746M euro fine against Amazon for alleged GDPR violations.

The Luxembourg Court of Appeal overturned the National Commission for Data Protection's 746 million euro fine against Amazon for allegedly violating the EU General Data Protection Regulation by not asking for consumers' consent before processing their data, Luxembourg Times reports. The court sent the issue back to the CNPD to be assessed after ruling the authority did not determine whether Amazon intentionally violated the GDPR before issuing the fine. Amazon released a statement saying it was "pleased" with the decision and emphasized that "customer privacy is a top priority."

Click on the link for the full story.

New Zealand's OPC offers new education sector privacy guide.

The Office of the Privacy Commissioner of New Zealand released guidance for educators and relevant school staff on personal data use and protection. The guidelines outline minors' privacy rights, education technology, and health and learning support information. Privacy Commissioner Michael Webster said the guide "uses a range of real-world scenarios to help them make good privacy decisions with confidence."

Click on the link for the full story.

Garante fines electric company 2M euros for alleged personal data processing violations.

Italy's data protection authority, the Garante, issued a 2 million euro fine to Acea Energia after the company allegedly processed the personal data of more than 1,200 consumers while not maintaining appropriate data deletion measures. Following its investigation, the Garante said it found insufficient technical and organizational measures to "prevent any fraudulent use of documents acquired by door-to-door agents or the company's partners." Acea Energia must update its polices to comply with privacy regulations and implement data security safeguards, the Garante said.

Click on the link for the full story.

EDPB considers GDPR DPIA template, regulatory interplay guidance mandate.

The European Data Protection Board published the agenda for its 10 March plenary meeting. Key agenda items include discussion and potential adoption of a standard EU General Data Protection Regulation data protection impact assessment template and issuing a formal request for a mandate from the European Commission to develop joint guidelines with the Commission on the interplay between data protection and competition law. The board will also continue discussion on guidance on GDPR-AI Act interplay.

Click on the link for the full story.

CalPrivacy opens preliminary consultation on improving privacy rights, user opt outs.

The California Privacy Protection Agency is seeking preliminary comments on potential regulatory reforms that would simplify the ability to exercise privacy rights and address any issues users face with opt-out preference signals. The agency sent out specific questions regarding challenges businesses and consumers face due to existing regulations, aiming to future dialogue on new or updated regulations. The consultation closes 6 April.

Click on the link for the full story.

CNIL releases guide for DGA's recognized status for data altruistic organizations.

France's data protection authority, the Commission nationale de l'informatique et des libertés, published an FAQ for EU Data Governance Act regulations, which creates a recognized status for EU data altruistic organizations. Key topics include how entities register as a data delivery support organization under the DGA and how they should be structured legally to meet the criteria of the law.

Click on the link for the full story.

New Zealand parliamentary subcommittee releases report on children's online safety.

New Zealand House of Representatives Education and Workforce Committee released a report detailing online harms for underage users and ways the government can address potential online safety gaps. The report urged the government to increase enforcement and regulatory penalties for platforms with potentially harmful content, introduce age restrictions for social platforms and establish an online safety regulator that has "a full suite of modern regulatory tools and a flexible mandate that allows it to be nimble in response to emerging harms and technologies."

Click on the link for the full story.

ICO urges platforms to improve age assurance compliance.

The U.K. Information Commissioner's Office published a letter sent to social media and video-sharing platforms calling for increased measures to ensure age verification practices properly protect children online. The letter aims to clearly state ICO expectations that "platforms with a minimum age must move beyond relying on children to self-declare their ages, which they can easily bypass." ICO CEO Paul Arnold said, "modern technology (is) at (companies') fingertips" and they "need to be ready to demonstrate what they're doing."

Click on the link for the full story.

EDPB-EDPS joint opinion on sensitive data provisions under proposed Biotech Act.

The European Data Protection Board and the European Data Protection Supervisor released their joint opinion on the European Commission's proposed Biotech Act, which aims to update rules around clinical trials in the biotechnology and biomanufacturing sectors. The opinion focused on the "sensitivity of health and genetic data processed" during trials and recommended a range of considerations to ensure simplified legal frameworks maintain a high standard of data protection. Data retention limits, regulatory consistency and clearly defined roles for data controllers were among the recommendations.

Click on the link for the full story.

Digital Markets Act: Mapping the Interplays with the GDPR.

The IAPP Research and Insights Team's EU Digital Laws Report 2025 maps the interplay between the EU General Data Protection Regulation and other relevant instruments in the EU digital rulebook. A new series of IAPP infographics depicts the extent of individual interplay outlined in the report. This installment covers the Digital Markets Act.

Click on the link for the full story.

IAPP Weekly News 09.03.2026 - 13.03.2026