Latest Worldwide Developments on Personal Data

Lithuania revises guidance on what counts as a personal data breach.

Lithuania's State Data Protection Inspectorate updated its guidance on what counts as a personal data breach. The recommendations include three new examples to illustrate when a notification to the authority is not necessary.

Click on the link for the full story.

US court rules Amazon illegally enrolled customers in Prime service, sets jury trial.

The U.S. District Court for the Western District of Washington ruled Amazon violated the Restore Online Shoppers Confidence Act for allegedly not disclosing the terms of its Prime service's automatic renewal before collecting customer billing information. The lawsuit was originally filed by the U.S. Federal Trade Commission in 2023 and alleged Amazon was using dark patterns to coerce customers to enroll in Prime. The judge said the claims should be heard by a jury and set a trial to begin next week.

Click on the link for the full story.

UK employers using tracking technology to monitor workers.

A survey by the Chartered Management Institute found a third of employers in the U.K. are using tracking technology to monitor employee productivity, emails and web history, the Guardian reports. The U.K. Information Commissioner's Office raised concerns about organizational use of surveillance, noting employers must tell workers about their use of tracking to ensure individuals' data remains protected.

Click on the link for the full story.

White House delays US TikTok ban.

The White House announced it will delay the enforcement of the Protecting Americans from Foreign Adversary Controlled Applications Act, allowing U.S. users to continue using the social media platform TikTok. The delay runs through 16 Dec. It is the fourth delay since the law took effect January 2025.

Click on the link for the full story.

ICO offers data security improvement tips.

The U.K. Information Commissioner's Office reminded businesses of practical ways to improve their data security and resilience in light of increasing cyberattacks. The office encouraged backing up data, protecting unattended devices and limiting access as examples to limit vulnerability.

Click on the link for the full story.

Sweden's IMY releases guidance on data controller responsibilities during security incidents.

Sweden's data protection authority, the Integritetsskyddsmyndigheten, issued guidance for data controllers detailing how security incidents where consumer data is published on the dark web should be handled. The IMY said in order to effectively handle the situation, data subjects should be told about the incident immediately to ensure they can also take appropriate action to reduce potential harm.

Click on the link for the full story.

EDPS issues opinion on EU-US immigration data sharing framework.

The European Data Protection Supervisor published its opinion on the European Commission's negotiations toward an EU-U.S. framework for sharing data on security screenings and identity verifications. The proposed framework would allow for data sharing agreements to be signed between individual member states and the U.S., including exchanges of "biometric data (fingerprints), for the purpose of border and immigration control by a third country." EDPS Wojciech Wiewiórowski said, "comprehensive and effective safeguards" around the proposed transfers are "of utmost importance."

Click on the link for the full story.

Investigation finds Ireland smartphone users' location data for sale.

An investigation by RTÉ Prime Time found the sensitive location data of smartphone users in Ireland can be purchased from data brokers. Although the purchased data does not contain consumers' names, their home addresses and daily routines could allow for individuals to be identified. Ireland's Data Protection Commission said it is "currently working to identify the data broker in question and if they are headquartered in Ireland, we will take action ourselves."

Click on the link for the full story.

OAIC finds retailer's facial recognition violated Privacy Act.

The Office of the Australian Information Commissioner announced retailer Kmart Australia violated the Privacy Act with its use of facial recognition technology in stores between June 2020 and July 2022. Australian Privacy Commissioner Carly Kind found Kmart carried out nonconsensual collection of customers' biometric data when there were "less privacy intrusive methods available" to combat fraud.

Click on the link for the full story.

Poland's DPA calls for new laws to ease data sharing restrictions for research.

Poland's data protection authority, the Urząd Ochrony Danych Osobowych, called on the Ministry of Health and Ministry of Science and Higher Education to draft new national laws for protecting personal data in the context of sharing medical data for research purposes. UODO President Mirosław Wróblewski said as Poland sets out to implement EU regulations, such as the Data Act and European Health Data Space, "inconsistent national regulations raise interpretation issues" and their respective scopes do not meet research needs in the medical and scientific fields.

Click on the link for the full story.

IAPP Weekly News 15.09.2025 - 19.09.2025