Latest Worldwide Developments on Personal Data

CNIL issues guidance on mobile apps.

France's data protection authority, the Commission nationale de l'informatique et des libertés, issued guidance for mobile app designers on protecting users' data and complying with the EU General Data Protection Regulation. The guidance detailed consent obligations and privacy requirements for mobile apps and noted the CNIL will launch an initiative to investigate mobile app companies' privacy practices

Click on the link for the full story.

Google releases research on differential privacy frameworks.

Google published research on differential privacy on trust graphs, aiming to allow users to have control over their data by sharing information to individuals they trust. The proposed algorithm could help protect individuals' privacy as "platforms move towards varied models of trust, from data sharing initiatives in healthcare, to individual data sharing choices on social platforms."

Click on the link for the full story.

CFPB withdraws rule limiting data brokers' ability to sell sensitive personal data.

The U.S. Consumer Financial Protection Bureau published a note in the Federal Register announcing it was withdrawing proposed rules to limit the ability of U.S.-based data brokers to sell individuals' sensitive personal information, Wired reports. In the CFPB's note, acting Director Russell Vought wrote the rule did not align with the CFPB's "current interpretation of the (Fair Credit Reporting Act)."

Click on the link for the full story.

EDPS highlights data protection guidance for policymakers.

The European Data Protection Supervisor Wojciech Wiewiórowski released information detailing recent guidance that aims to ensure EU co-legislators prioritize the protection of citizens' information. Wiewiórowski said the guidance includes "a checklist of items that the European Commission, the European Parliament and the Council should take into account to both meet a given legislation's objectives, whilst maintaining a high standard of personal data protection for its citizens."

Click on the link for the full story.

Apple partners with Synchron to advance its brain implant used to control devices.

Apple has partnered with Synchron on its brain computer interface implant, which can help individuals with disabilities navigate their devices, The Wall Street Journal reports. The technology uses an implant which can read brain signals and "translates the signals into selecting icons on a screen."

Click on the link for the full story.

Denmark's DPA, digital agency issue joint guidance for cookie compliance.

Denmark's data protection authority, Datatilsynet, and the Agency for Digital Government published joint guidance for website and app developers using cookies and other similar technologies. The guidance provides an overview of the Cookie Executive Order and complying with the EU General Data Protection Regulation.

Click on the link for the full story.

CNIL issues guidance detailing school data breach response obligations.

France's data protection authority, the Commission nationale de l'informatique et des libertés, issued guidance on data breach response obligations for data protection officers and administrative employees in the education sector. The guidance noted schools must be in compliance with data protection regulations, enlist safeguards to prevent data breaches and respond quickly to data security incidents.

Click on the link for the full story.

South Korea's PIPC fines online retailer for PIPA violations.

South Korea's Personal Information Protection Commission issued a KRW1.37 billion to online retailer Temu for alleged violations of the Personal Information Protection Act. The PIPC claimed Temu did not appoint PIPA-mandated domestic representatives for data handling in countries it transferred data to. Additionally, the PIPC made a recommendation to require multinational companies to designate a domestic agent to foster better accountability under the PIPA.

Click on the link for the full story.

European Commission alleges TikTok's advertising may violate DSA.

The European Commission announced it was not receiving sufficient information from TikTok regarding the content of its advertisements, how users are targeted by advertisements and the buyers of ads, which are all requirements under the EU Digital Services Act, The Wall Street Journal reports. "In our preliminary view, TikTok is not complying with the DSA in key areas," Commissioner Henna Virkkunen said. If found in violation, TikTok would be subject to fines up to 6% of its annual revenue.

Click on the link for the full story.

ICO to hold public consultation on updated encryption guidelines.

The U.K. Information Commissioner's Office opened a public consultation on the updates made to its draft guidance on encryption. The updated guidance includes sections on Internet of Things technology, compliance expectations and case studies to help organizations identify if their encryption is sufficient. The consultation closes 24 June.

Click on the link for the full story.

IAPP Weekly News 12.05.2025 - 16.05.2025