Latest Worldwide Developments on Personal Data

OpenAI announces launch of cybersecurity model.

OpenAI is planning a limited launch of its GPT-5.4-Cyber model with cybersecurity vulnerability detection capabilities, Yahoo reports. The announcement comes after Anthropic restricted access to its Claude Mythos after concerns were raised over the potential misuse of the tool's ability to identify and exploit security issues. OpenAI said its new tool aims to "enable as many legitimate defenders as possible" by using "systems that can validate trustworthy users and use cases in more automated and more objective ways."

Click on the link for the full story.

EU regulators weigh intersection of GDPR, DSA requirements.

In an analysis for Tech Policy Press, Stanford Law School's Program in Law, Science and Technology Director of Platform Regulation Daphne Keller outlined considerations and impacts with the intersection between the requirements of the EU General Data Protection Regulation and the Digital Services Act. Keller noted the Court of Justice of the European Union's Russmedia ruling that "prioritized" GDPR enforcement could have a significant impact if GDPR rules are used to substitute "the detailed notice, action, and appeal rules of the DSA.”

Click on the link for the full story.

US Treasury Secretary claims proposed order would require banks to collect citizenship data.

U.S. Secretary of the Treasury Scott Bessent said a proposed executive order would require financial institutions to collect consumer citizenship information in an effort to continue the White House's immigration enforcement, The Hill reports. The order would allegedly require individuals to submit identification, such as birth certificates or passports, to banks to verify that they are U.S. citizens.

Click on the link for the full story.

EDPB adopts formalized DPIA assessment template.

The European Data Protection Board adopted a written data protection impact assessment template, aligning with the board's Helsinki statement. The template is geared toward assisting organizations' structure, harmonize and document their DPIA reporting processes. Meanwhile, the EDPB may potentially adopt guidelines for the use of personal data for scientific research purposes and discuss best practices for using generative AI tools, according to its 15-16 April plenary meeting agenda.

Click on the link for the full story.

CNIL publishes final guidance on tracking pixel use.

France's data protection authority, Commission nationale de l'informatique et des libertés, issued its final guidelines on tracking pixel technologies. For entities deploying tracking pixels, the CNIL's guidance contains several recommendations, including to clarify and define the role of each actor using pixels, and clarify the procedures for collecting, withdrawing and proving consent.

Click on the link for the full story.

EDPB approves scientific research guidance, Europrivacy certification criteria for transfers.

The European Data Protection Board announced deliverables from its recent plenary, including the adoption of guidelines for processing data for scientific research, which is open for public consultation until 25 June. The guide clearly states the EDPB's interpretation of scientific research and six factors to consider when processing research data besides scope and purpose. The board also adopted opinions on the Europrivacy certification criteria, including one supporting its use by data importers outside the EU to facilitate data transfers. Additionally, a "sprint team" was approved to expedite finalization of the EDPB's anonymization guide.

Click on the link for the full story.

Kenya's DPA publishes draft data transfer guidance.

Kenya's Office of the Data Protection Commissioner introduced draft guidelines for international data transfers. The guide describes how Data Protection Act requirements apply to transfers, outlines the privacy concerns specific to transfers to and from the country, and provides an outline of appropriate transfer mechanisms. It also explains the data security challenges Kenya has faced with its transfer regime, including various cybersecurity risks and "widespread adoption of cloud computing and the interconnection of numerous organisational systems and devices."

Click on the link for the full story.

European Commission's age verification app 'technically ready,' rollout to come.

The European Commission announced its age verification app has advanced out of its pilot program and will soon be available to member states and the private sector. The app aims to support children's online safety compliance with Article 28 of the Digital Services Act but may also prove helpful with potential social media age restrictions the bloc is considering. IAPP News Editor Joe Duball reports on the Commission's hopes for implementation.

Click on the link for the full story.

OECD report outlines global implications, considerations for social media bans.

The Organisation for Economic Co-operation and Development released a report detailing global efforts to implement social media restrictions for underage users. The report noted that while the bans aim to protect children online, online harms cannot be exclusively prevented by restricting individuals' social media access. The OECD said while social media restrictions could help improve children's online safety, regulators should also focus on design features that would prevent inappropriate or harmful material on platforms.

Click on the link for the full story.

South Korea's telecom regulator announces hundreds of geolocation data violations.

South Korea's Media and Communications Commission announced penalties totaling approximately KRW1.3 billion to 373 operators related to alleged unlawful use of geolocation data. The alleged violations included insufficient transparency around data processing policies, omitted information from customer terms of service and failure to disclose business suspension or closure. The penalties were the result of a 2023 probe into the practices of 1,137 relevant operators.

Click on the link for the full story.

IAPP Weekly News 13.04.2026 - 17.04.2026