Latest Worldwide Developments on Personal Data

EDPB seeks information-sharing network across EU digital regulators.

The European Data Protection Board is calling on the European Commission to establish a legal basis for an information-sharing network between EU digital regulators of all competences. The board's proposal is based on a "growing need" for regulators "operating in adjacent areas of competence" to increase collaboration. "This will help remove barriers to cooperation and help improve enforcement outcomes and cross-regulatory coherence," EDPB Chair Anu Talus said in a statement.

Click on the link for the full story.

Law firm's data breach draws class-action suit.

A class-action lawsuit filed to the U.S. District Court for the District of Columbia alleges insufficient security measures led to a breach of law firm WilmerHale's databases, Reuters reports. Impacted data included individuals' names and Social Security numbers, but WilmerHale stated the hackers "obtained a limited set of information ⁠from the firm." The complainants alleged the May cyberattack was "preventable" and the firm did not provide full transparency into details of the breach.

Click on the link for the full story.

Ofcom report outlines effectiveness of OSA age verification requirements.

The U.K. Office of Communications published a report highlighting increased age assurance compliance under the Online Safety Act. From July 2025 to January 2026, effective child age verification deployments nearly doubled from 25% to 43%. Despite improvements, Ofcom CEO Melanie Dawes indicated "the job is not done," particularly with the age assurance being a core component of the U.K.'s proposed social media ban for users under age 16. Dawes also highlighted a new Ofcom investigation into TikTok age checks. Meanwhile, TechRadar reports U.K. Parliamentary Under-Secretary of State for AI and Online Safety Kanishka Narayan said the government will not block virtual private network use despite their potential use to bypass the incoming social media ban.

Click on the link for the full story.

Use of genetic data to crack cold cases tests EU data protection standards.

The Wall Street Journal reports on the privacy debate in Europe over law enforcement's ability to use genetic data to support and close criminal investigations. The latest instance occurred in France, where national authorities bypassed genetic privacy laws to solve a case involving a serial rapist. Authorities and victims' families are advocating to make DNA checks regular practice, with law enforcement in Denmark, the Netherlands and Spain prepared to roll out or already using the checks.

Click on the link for the full story.

UK to implement social media curfews for teens.

The U.K. Department for Science, Innovation and Technology announced it will require social media companies to enable the ability to restrict account access after a certain time for users age 16 and 17, Wired reports. U.K. Secretary of State for Science, Innovation and Technology Liz Kendall said though the feature can be disabled by users, the measures aim to be "crucial in helping young people get the sleep they need, focus on school and college, and spend more quality time with family and friends, all of which are fundamental to building a happy, healthy, and fulfilling adult life." The curfew complements the U.K.'s under-16 social media ban.

Click on the link for the full story.

ENISA issues Cyber Resilience Act guidance for SMEs.

The EU Agency for Cybersecurity issued a report detailing steps small and medium-sized enterprises can take to prepare to comply with the Cyber Resilience Act. Among the resources is the Cyber Resilience Maturity Assessment Model, which bolsters cybersecurity standards and prevents potential vulnerabilities. The guidance comes after a survey by ENISA found 70% of respondents requested technical support for CRA requirements due to resource and compliance expense concerns.

Click on the link for the full story.

Latest EDPB guidelines: anonymization and web scraping.

IAPP Research and Insights Director Joe Jones will host a LinkedIn Live 27 July on the European Data Protection Board adopting new draft guidelines on anonymization and web scraping in the context of AI. Jones will be joined by Deputy Head of the EDPB Secretariat Gwendal Le Grand to discuss key elements of both draft guides, which remain under public consultation through 30 Oct.

Click on the link for the full story.

Garante fines telecom after security shortcomings led to data breaches.

Italy's data protection authority, the Garante, issued a 1,715,600 euro fine to telecommunications company Wind Tre for allegedly carrying "serious security deficiencies" within its IT systems that produced two instances of unauthorized access which led to data breaches. The February 2025 incidents came after hackers posing as company IT support convinced employees working in two different stores to grant them access to internal company systems. According to the Garante, more than 365,000 customers had personal information compromised between the breaches, 41,359 of whom had payment information reportedly stolen.

Click on the link for the full story.

Latvia's DVI releases guidance on organizations' data sharing with AI tools.

Latvia's Data State Inspectorate released guidance detailing organizations' standards for sharing information when using AI tools for business purposes. The DVI said organizations should use AI responsibly, making sure individuals' names, medical history, contracts or other sensitive identifiable information is not shared with AI tools.

Click on the link for the full story.

Study highlights privacy shortcomings of women's reproductive health apps.

Research led by the Mozilla Foundation analyzed the privacy practices of six prominent women's reproductive health tracking apps. The study found some apps share data with analytics companies and use "privacy-washing" tactics to promote app safety to users. On a 1-to-10 safety scale, three apps scored below five while open-source app Euki received a 10-rating.

Click on the link for the full story.

IAPP Weekly News 13.07.2026-17.07.2026