Latest Worldwide Developments on Personal Data

EDPB to discuss BCRs approval protocol, PNR implementation.

The European Data Protection Board will discuss a procedure for how to approve binding corporate rules for controllers and processors under the EU General Data Protection Regulation during its 13 March meeting. The group will also discuss a statement on implementing the Passenger Name Record Directive after the Court of Justice of the European Union issued a ruling on its validity.

Click on the link for the full story.

EDPS publishes 2020-24 enforcement review.

The European Data Protection Supervisor released its 2020-24 mandate review detailing the authority's enforcement actions and its strategy for protecting individuals' privacy. The EDPS will continue its enforcement efforts aiming to bolster organizations' compliance with privacy regulations while combating online harms, such as child sexual abuse material and cyber threats.

Click on the link for the full story.

EDPB issues statement on CJEU's PNR data ruling.

The European Data Protection Board issued a statement on the Court of Justice of the European Union's decision on the use of passenger name record data by law enforcement to prevent violent crimes. The EDPB issued several recommendations to improve the PNR Directive, including passenger information holders deleting additional third-party data beyond what is outlined in the CJEU ruling and establishing an "objective link" between a specific passenger and allegations of intent to commit serious offenses in order to access PNR data.

Click on the link for the full story.

South Korea's PIPC fines travel company for data breach.

South Korea's Personal Information Protection Commission issued a KRW757 million fine against Modetour Network after the travel company's alleged insufficient data security safeguards led to a data breach affecting more than 3 million consumers. Modetour Network must notify consumers by publishing information about the PIPC's enforcement on its website, as well as strengthen its cybersecurity policies and ensure its standards are compliant with the Personal Information Protection Act.

Click on the link for the full story.

APA introduces safeguards for psychological, neural data.

The American Psychological Association's Council of Representatives approved new policies to protect individuals' psychological and neural data collected by consumer devices. The safeguards aim to address "the need for ethical collection, storage and use of data gathered from direct-to-consumer software and wearable devices."

Click on the link for the full story.

Belgium's DPA opens consultation on direct marketing guidance.

Belgium's Data Protection Authority is seeking feedback on its updated guidance on direct marketing practices. The update is accompanied by a data protection checklist to ensure marketing campaigns align with the EU General Data Protection Regulation. A public consultation on the guidelines is open through 10 May.

Click on the link for the full story.

FTC reports consumers lost $12.5B to fraud.

The U.S. Federal Trade Commission reported consumers lost USD12.5 billion to fraud in 2024, a 25% increase compared to 2023. The agency said imposter scams, online shopping issues, and business and job opportunities were the top three categories of fraud.

Click on the link for the full story.

Luxembourg's CNPD advises on consent as GDPR legal basis.

Luxembourg's National Commission for Data Protection issued a reminder about the importance of user consent when used as a legal basis for processing under the EU General Data Protection Regulation. The CNPD's updated information specifies "under what conditions consent can be considered valid" under the GDPR.

Click on the link for the full story.

European Parliament approves travel data transfer agreement with Canada.

The European Parliament approved an agreement to allow secure passenger name record data, including individuals' travel and contact information, to be shared between the EU and Canada. The agreement aims to protect consumer information and prevent sensitive data from being processed while allowing the transfer of "relevant and appropriate analytical information containing PNR data."

Click on the link for the full story.

Hong Kong's PCPD says 109K people affected by data breach.

Hong Kong's Office of the Privacy Commissioner for Personal Data found more than 109,000 individuals were affected by a data breach that allegedly occurred because of a fault within the Integrated Companies Registry Information System's e-service system. The breach affected individuals' sensitive personally identifiable information, though the PCPD does not believe "personal data had been subject to any unauthorised or accidental access.”

Click on the link for the full story.

IAPP Weekly News 10.03.2025 - 14.03.2025