Latest Worldwide Developments on Personal Data

CNIL issues guide on data controller, processor identification.

France's data protection authority, the Commission nationale de l'informatique et des libertés, issued guidance detailing the importance of identifying if an organization is a controller, joint controller or processor. The CNIL said organizations should "determine the role of the actors involved in the processing of personal data, following a concrete analysis of the methods of creation and implementation of the processing," and inform data subjects who is processing their data to ensure the organization is compliant with the EU General Data Protection Regulation.

Click on the link for the full story.

The final days of grace: Preparing for the US sensitive data rule.

The U.S. Department of Justice will begin enforcing its rule against bulk sensitive data transfers to designated "countries of concern" 8 July. IAPP Research and Insights Analyst Cheryl Saniuk-Heinig, CIPP/E, CIPP/US, and IAPP Cybersecurity Law Center Managing Director Jim Dempsey break down what covered entities should be considering in the leadup to the effective date while outlining a DOJ-issued FAQ guide intended to help with compliance efforts.

Click on the link for the full story.

CNIL issues guidance on handling personal information in employee surveys.

France's data protection authority, the Commission nationale de l'informatique et des libertés, released guidance on protecting personal information collected from workplace surveys. The CNIL recommended employers implement anonymous surveys and allow questionnaires to "remain optional and employees or agents must be properly informed and their rights respected."

Click on the link for the full story.

Ireland's DPC issues GDPR fine over biometrics program.

Ireland's Data Protection Commission fined the Department of Social Protection 550,000 euros over allegations related to the use of biometric face matching technologies for a public services registration program. The agency found the DSP did not have a lawful basis for collecting the data, was not transparent and did not include some details in its impact assessment as required under the EU General Data Protection Regulation.

Click on the link for the full story.

Norway's DPA finds 6 websites violated data sharing rules.

Norway's data protection authority, Datatilsynet, said it found six websites' use of tracking pixels allegedly violated the law by illegally sharing visitors' personal data with third parties. The websites ranged from public services for children, an online pharmacy, a health diagnostic service and more. Alleged violations by website 116111.no resulted in a NOK250,000 fine.

Click on the link for the full story.

US court denies privacy class-action lawsuit against Google.

The U.S. District Court for the Northern District of California denied a lawsuit class-action status after consumers claimed Google allegedly collected personal information from Chrome browsers without consent, Reuters reports. Meanwhile, MediaPost reports a separate case before the U.S. District Court for the Northern District of California regarding claims over Google's use of analytics tools on health care websites will proceed.

Click on the link for the full story.

Asia Pacific Privacy Authorities Forum issues anonymization guide.

Singapore's Personal Data Protection Commission published new guidelines on anonymization. The guide is the product of a collaborative effort among Asia Pacific Privacy Authorities Forum and aims to outline basic concepts and practical steps around anonymization practices to protect personal data.

Click on the link for the full story.

Bulgaria's CPDP releases guidance on personal data leaks.

Bulgaria's Personal Data Protection Commission released guidance for individuals on what to do after they accidentally leak their own personal data. The CPDP suggested consumers monitor bank accounts, contact the organization or individual involved and ensure passwords are changed and security settings are updated.

Click on the link for the full story.

CAC releases draft vehicle data transfer guidance.

The Cyberspace Administration of China, along with other relevant authorities, drafted guidelines for how to secure automobile data in cross-border transfers. Interested parties are encouraged to send feedback to the agency by 13 July.

Click on the link for the full story.

South Korea's PIPC fines universities for data breach.

South Korea's Personal Information Protection Commission issued fines totaling KRW966 million to Jeonbuk National University and Ewha Womans University after they allegedly did not protect students' personal information, leading to large-scale data breaches. The PIPC will request the Ministry of Education "disseminate information so that personal information management in the national university academic information management system can be strengthened and review the relevant information so that it can be reflected in university evaluations, etc."

Click on the link for the full story.

IAPP Weekly News 09.06.2025 - 13.06.2025