Latest Worldwide Developments on Personal Data

NIST finalizes cryptography standard for small electronics.

The U.S. National Institute of Standards and Technology released four variants of a cryptography standard to help small networked electronic devices protect against cyberattacks. The standard is built around algorithms in the Ascon family, which NIST selected in 2023 to develop protections for technology such as medical implants and RFID tags.

Click on the link for the full story.

UK age-check requirements drop visits to explicit content websites.

The Guardian reports explicit adult content material websites are reporting lower traffic volume from U.K. users after the Online Safety Act's age verification requirements took effect. Online platforms are also required to prevent children from seeing harmful content, which some reports say has led to age checks for alcoholic recovery forums or political content.

Click on the link for the full story.

French, German cyber regulators outline zero-trust LLM security.

France's National Agency for Information Systems Security, Agence nationale de la sécurité des systèmes d’information, and Germany's Federal Office for Information Security published a joint paper examining design standards and typical risks associated with zero-trust large language models. Recommendations include limiting access rights to the systems, boosting transparency with algorithmic decision-making processes and ensuring human supervision.

Click on the link for the full story.

US state attorneys general call for changes to Instagram location-sharing practice.

Thirty-seven U.S. state attorneys general wrote a letter to Instagram Head Adam Mosseri urging changes to the platform's newly implemented location-sharing feature. The group said the feature should not be usable by minors and needs a clear alert feature for when it is on and how it is used. Instagram said people must opt into location sharing for it to be active.

Click on the link for the full story.

Hotels in Italy hit in data theft scheme, Garante says.

Italy's data protection authority, the Garante, said it is investigating reports of data breaches at several hotels, where thousands of images of passports, identity cards and other documents from guests were stolen. The Garante advised people who suspect their information may have been compromised to contact where they stayed for confirmation.

Click on the link for the full story.

OCR issues new HIPAA Privacy Rule guidance.

The U.S. Department of Health and Human Services' Office for Civil Rights published updated Health Insurance Portability and Accountability Act Privacy Rule guidance, which includes new FAQs about permitted disclosures of personal health information to "value-based care arrangements," The HIPAA Journal reports. The guidance means patients are not required to provide authorization to a HIPAA-covered entity to release their PHI to another health care provider. Meanwhile, OCR issued guidance on what types of PHI patients can request access to.

Click on the link for the full story.

Ireland's DPC opens inquiry into children's health system data issues.

Ireland's Data Protection Commission said it is opening an inquiry into whether a data breach occurred at a Children's Health Ireland facility in Tallaght. The DPC said it received reports of issues with the physical safety and security of records at the hospital as well as a notification from CHI.

Click on the link for the full story.

Canada's OPC issues revised biometric guidelines.

The Office of the Privacy Commissioner of Canada published updated guidelines for the use of biometric technology following a public consultation. Key revisions include clarifying definitions and use of key terms, aligning guidance and legal requirements, and updating criteria for assessing appropriate use in the private sector. "Organizations need to approach the use of biometric information in a privacy-protective way, building privacy considerations at the beginning of any new program or initiative," Privacy Commissioner Philippe Dufresne said in a statement.

Click on the link for the full story.

Meta announces new tools for organizing privacy compliance tasks.

Meta launched its Federation Platform and Privacy Waves programs aimed at a "sustainable approach to operationalizing privacy work." The Federation Platform will break down large compliance efforts into workstreams across thousands of engineers, while the Privacy Waves program will organize the relevant tasks for each initiative to set monthly schedules for enabling proactive privacy work.

Click on the link for the full story.

How the GDPR is influencing other countries' privacy practices.

The Center for European Policy Analysis released an analysis of where European-styled privacy regulations have spread in the world following the implementation of the EU General Data Protection Regulation. The report includes an interactive map and breaks down where the GDPR applies and where elements of it crop up in other regulations.

Click on the link for the full story.

IAPP Weekly News 11.08.2025 - 15.08.2025