Latest Worldwide Developments on Personal Data

CNIL releases 2025-28 action plan for European, international coordination.

France's data protection authority, the Commission nationale de l'informatique et des libertés, released a three-year action plan focused on international data protection standards, European cooperation and a stronger network of influence.

Click on the link for the full story.

Vehicle privacy concerns on the rise.

Bloomberg Law reports on the proliferation of privacy and surveillance issues stemming from connected vehicles and license plate readers. Privacy advocates are particularly alarmed by transparency around the use of in-car and on-road surveillance practices by law enforcement.

Click on the link for the full story.

Lithuania's DPA issues DPO guidance.

Lithuania's State Data Protection Inspectorate published guidance for data protection officers. The guidance focuses on applying Articles 37, 38 and 39 of the EU General Data Protection Regulation, which deal with DPO appointments and how to ensure their independence.

Click on the link for the full story.

Slovenia's DPA says schools must comply with data protection standards.

Slovenia's Maribor District Court upheld the Information Commissioner's decision stating educational institutions must comply with data protection by design and default standards. The DPA claimed schools must ensure their security providers maintain an adequate level of data protection and establish clear guidelines on data processing and deletion.

Click on the link for the full story.

Cyberattack on vehicle rental service breaches drivers' personal information.

An unauthorized third party targeting vehicle rental service company Hertz allegedly breached consumers' personally identifiable information, including drivers' license numbers, Bloomberg reports. Hertz said the breach occurred after a malicious actor gained access to its software vendor Cleo Communications.

Click on the link for the full story.

Turkey's KVKK releases guidance on electronic payment data processing.

Turkey's data protection authority, the Kişisel Verileri Koruma Kurumu, released guidance on best practices to protect people's information in the digital payment and financial field. It touches on the roles of data controllers and processors, what counts as personal data and when it can to be processed.

Click on the link for the full story.

OAIC details plans for Children's Online Privacy Code development.

The Office of the Australian Information Commissioner outlined plans to develop the Children's Online Privacy Code. The process will have three phases, including general consultation and research papers covering impacts to specific age groups. The OAIC expects a draft code will be submitted for public consultation in 2026.

Click on the link for the full story.

Netherlands' DPA warns 50 websites for violating cookie laws.

The Netherlands' data protection authority, the Autoriteit Persoonsgegevens, ordered 50 organizations to stop using misleading cookie banners or face investigation as part of its website monitoring program. The agency cited preemptive cookie placement, obstructive refusal policies and checking the permission box as the default option as potential infractions.

Click on the link for the full story.

Croatia seeks feedback on cybersecurity self assessment guidelines.

Croatia's Institute for Information Systems Security released a draft guide on how to implement cybersecurity self assessments. The guidance aims to "define the procedure and systematize the data necessary to determine the level of compliance of established measures." The public feedback deadline is 15 May.

Click on the link for the full story.

Greece's DPA addresses data protection in electronic debt auctions.

Greece's Hellenic Data Protection Authority indicated data controllers connected to electronic auctions must follow data protection rules and ensure systems protect individuals' sensitive data by design. Data controllers are obligated to only include necessary anonymized data to safeguard sensitive information.

Click on the link for the full story.

IAPP Weekly News 14.04.2025 - 18.04.2025