Latest Worldwide Developments on Personal Data

ICO fines outsourcing firm Capita 14M GBP for 2023 data breach.

A London-based outsourcing firm was fined a combined 14 million GBP by the U.K. Information Commissioner's Office following a 2023 data breach that resulted in the theft of 6.6 million people's personal data. Both Capita PLC and Capita Pension Solutions received fines of 8 million GBP and 6 million GBP respectively. The cyberattack reportedly took place in March 2023 when a Capita employee accidentally downloaded a malicious file on a company device. Despite a "high priority" breach warning was raised within 10 minutes and some automated controls were deployed to contain the breach, Capita did not quarantine the device for 58 hours, the ICO said.

Click on the link for the full story.

Identity hacks continue to be popular cyberattack method, per Microsoft report.

The Record reports password-related identity attacks continue to be a leading method of cyberattacks despite more sophisticated methods coming online, according to Microsoft. The company looked at current cybersecurity issues in its Digital Defense Report 2025 and found hackers are seeking multiple methods to obtain credentials, including IT scams and infostealing malware, based on trends from July 2024 to June 2025. Taking over victims' accounts stood out in a time when ransomware, AI and nation-state attacks are gaining prevalence in the cybercrime world.

Click on the link for the full story.

Apple loses appeal in UK over access to encrypted cloud data.

The U.K. Investigatory Powers Tribunal dismissed an appeal by Apple against a new Home Office order to provide law enforcement access to U.K. users' encrypted data stored on iCloud, Computer Weekly reports. Under the Home Office's order, only U.K. users' encrypted data would be made available to law enforcement. The prior U.K. government notice to Apple caused a diplomatic confrontation with the U.S. over concerns the U.K. government would access U.S. Apple customers' data. Following the ruling, Apple confirmed it would be unable to offer its Advanced Data Protection service to U.K. customers, instead of complying with the order. A separate legal appeal over the new Apple order brought by campaign groups Privacy International and Liberty is anticipated to continue.

Click on the link for the full story.

OAIC issues guidance for conducting age assurance under social media law.

The Office of the Australian Information Commissioner released guidance for social media companies and third-party age assurance providers for complying with both the Privacy Act 1988 and Part 4A of the Online Safety Act 2021 when the new law setting a minimum age for accessing social media enters into force 10 Dec. Part 4A establishes that covered entities may need to process personal information for conducting age assurance, and the guidance serves to assist companies to meet the more stringent requirements to comply with the law.

Click on the link for the full story.

Leaked report identifies 'systemic failures' with credit card company's security controls.

A leaked report from the Office of the Australian Information Commissioner obtained by The Sydney Morning Herald "found systemic failures" with American Express' cybersecurity protocols, which has potentially left more than 1 million Australian cardholders at risk. Per the report, the OAIC began investigating the credit card company in March 2023 when an individual reported a man he briefly dated allegedly accessed American Express systems to illegally spy on him. The company maintained the illegal access was the result of a sole actor and had been addressed. However, the report indicated the company allegedly did not monitor employee access for upward of 78% of customer accounts. In a statement, the OAIC said the report is "preliminary" and no official findings have been made.

Click on the link for the full story.

Florida attorney general sues Roku for allegedly selling children's sensitive personal data.

The Florida Attorney General's Office of Parental Rights filed a lawsuit against streaming device company Roku, alleging violations of the state Digital Bill of Rights and Deceptive and Unfair Trade Practices Act. The lawsuit alleges Roku sold children's sensitive personal data, including their viewing history and voice recordings, without parental consent. The lawsuit also alleges Roku misrepresented the "effectiveness of its privacy controls and opt-out tools," according to the Attorney General James Uthmeier.

Click on the link for the full story.

Google released from UK privacy sandbox commitments.

The U.K. Competition and Markets Authority said it released Google from the commitments it made to block third-party cookies on its Chrome browser after the company said it would no longer do so. The authority said in June it intended to do so and sought public feedback on the decision. The commitments were originally meant to ensure Google designed its privacy sandbox in a way to ensure its own advertising technology services were not prioritized over competitors.

Click on the link for the full story.

EDPB selects GDPR's transparency requirements for coordinated enforcement framework 2026.

During its most recent plenary meeting, the European Data Protection Board chose its topic of focus for the fifth round of its coordinated enforcement action in 2026. For the CEF, participating member state data protection authorities will focus aligning their work on the EU General Data Protection Regulation's transparency and information obligations under Articles 12-14. "This right to be informed is a core element of transparency and ensures that individuals have more control over their data," the EDPB stated.

Click on the link for the full story.

Lawsuits concerning LinkedIn's tracking pixel use to move forward.

The U.S. District Court for the Northern District of California determined three lawsuits related to LinkedIn's alleged violation of the state's constitution and the California Invasion of Privacy Act can go forward, Bloomberg Law reports. The complaints argued LinkedIn's use of tracking pixels on four health-related websites collected the plaintiff's data without consent. LinkedIn argued the case should be dismissed because plaintiffs provided consent and did not adequately demonstrate that LinkedIn intended to use the data for its own purposes.

Click on the link for the full story.

Takeaways from a recent German court case on employee background checks.

Orrick Herrington & Sutcliffe Partner Christian Schröder wrote about the impact of a German Federal Labor Court's ruling on claims for damages related to a recruitment procedure. He argues companies should be careful about what data they collect for background checks, be explicit about their data collection and that collecting public data may not be considered justified under the General Data Protection Regulation unless there is a specific reason in order to avoid liability.

Click on the link for the full story.

IAPP Weekly News 13.10.2025 - 17.10.2025