Latest Worldwide Developments on Personal Data

Netherlands' DPA plans action against noncompliant cookie banner websites.

The Netherlands' data protection authority, the Autoriteit Persoonsgegevens, said a majority of noncompliant cookie banners have been updated following a sweep of more than 200 websites. The AP said it is now taking action against those that have not, which may lead to an investigation or fine. The DPA also published guidance on how to build a strong data processing agreement after a cyberattack, providing recommendations for limiting damage from a given incident.

Click on the link for the full story.

ICO details changes to public sector enforcement approach.

The U.K. Information Commissioner's Office updated its definitions of public sector organizations considered in scope for data protection regulations and fines. The update includes a focus on improvements before punitive actions, trying to reduce unintended consequences for public services and people and clarifying expectations. The changes derived from public consultation and were made in conjunction with changes to how the agency approaches public sector enforcement.

Click on the link for the full story.

Hyundai confirms sensitive data breach impacting millions.

Automaker Hyundai announced North American customers' sensitive personal data, including Social Security numbers and drivers' license information, was breached after a cyberattack in February, Forbes reports. Hackers allegedly remained undetected within the company's system for nine days before being discovered. Hyundai, whose North American system contains approximately 2.7 million customers, said it will continue to develop its cybersecurity safeguards with "additional security enhancements designed to mitigate future risk."

Click on the link for the full story.

Study analyzes ChatGPT users' in-app behavior.

The Washington Post analyzed 47,000 ChatGPT user interactions, finding users tend to use the model to ask specific questions or as emotional support instead of a productivity tool. The study revealed many users provided the chatbot with sensitive personal details about themselves in conversation. Users also tended to believe ChatGPT agreed with them almost 10 times more often than it disagreed, with models allegedly shifting responses when they detected the user's opinion. Meanwhile, advocacy group Public Citizen sent a letter to OpenAI regarding concerns over its video generation model Sora 2's alleged deepfake abilities and copyright concerns.

Click on the link for the full story.

Group behind Oracle hack names victims in pressure campaign.

TechCrunch reports The Washington Post is among the victims of the recent Oracle software hack, alongside Harvard University and an American Airlines subsidiary. The hack is believed to have occurred when the ransomware gang Clop exploited vulnerabilities in Oracle's E-Business Suite software. Clop had mentioned the publication as one of its victims in a post possibly meant to pressure the company into providing a ransom payment.

Click on the link for the full story.

European Commission's digital omnibus draft includes easing GDPR requirements for AI developers.

The European Commission's digital omnibus will include a proposed overhaul of the EU General Data Protection Regulation that would ease compliance burdens on AI developers, according to draft documents seen by Politico. The draft includes new exceptions for AI developers for processing special categories of data, including individuals' religious or political affiliation, to train their model. Former German Member of European Parliament Jan Philipp Albrecht, who helped draft the GDPR, said the Commission "should be fully aware that this is undermining European standards dramatically."

Click on the link for the full story.

EDPS issues guidance for AI risk management.

The European Data Protection Supervisor published guidance to support data controllers in conducting risk assessments while developing, procuring and deploying AI. The guidelines are meant for EU institutions, offices and agencies but can also be useful for private groups looking to comply with data protection laws. They touch on risk management methodology, life cycle development and notions of interoperability, as well as looking into specific risks and their technical solutions.

Click on the link for the full story.

California's OAL approves final Delete Act regulations.

The California Privacy Protection Agency announced the Office of Administrative Law approved the regulations necessary to implement the Delete Act. Beginning 1 Jan. 2026 when the regulations enter into force, state residents can begin using CalPrivacy's new Delete Request and Opt-out Platform to request deletion of all personal information held by multiple data brokers. Starting 1 Aug., registered data brokers will be required to access the DROP system every 45 days to retrieve and process deletion requests.

Editor's note: IAPP Staff Writer Alex LaCasse reported on the first public demonstration of CalPrivacy's DROP system at the Privacy. Security. Risk. 2025.

Click on the link for the full story.

ANPD instructs Meta to audit WhatsApp data sharing practices.

Brazil's data protection authority, the Autoridade Nacional de Proteção de Dados, ordered Meta to complete an independent external audit of WhatsApp's personal data sharing practices. The order aims to determine whether legal obligations extend beyond operator requirements and to create a compliance plan to improve transparency around data sharing. The order relates to an ANPD inquiry into 2021 updates to WhatsApp's privacy notice for Brazilian users.

Click on the link for the full story.

Cyberattacks on educational institutions rise to 861%.

A report by Zscaler found cyberattacks targeting educational institutions have risen by 861% with the introduction of advanced classroom technology, including internet-connected and Internet of Things devices, EdScoop reports. The company said the evolution of edtech devices and limited budgets among schools has "inadvertently created an expansive attack surface."

Click on the link for the full story.

IAPP Weekly News 10.11.2025 - 14.11.2025