Latest Worldwide Developments on Personal Data

Data breach in South Korea impacts more than 90% of adult citizens.

A data breach sustained by South Korea's largest online retailer, Coupang, reportedly compromised the personal information of more than 90% of the country's adult population, The Wall Street Journal reports. The breach was discovered 18 Nov. after a customer reported suspicious activity on their account. An investigation found the alleged hacker worked as a software developer for authentication systems at Coupang. Names, phone numbers and other sensitive data, including apartment access codes, were accessed in the breach.

Click on the link for the full story.

Texas sues TV manufacturers for alleged illegal data collection.

The Texas Attorney General's Office said it is suing five television makers — Sony, Samsung, LG, Hisense and TCL Technology Group — for allegedly collecting personal data through automated content recognition technology. The attorney general's office accused the companies of illegally recording people and engaging in deceptive and exploitative practices. The latter two companies are based in China, which Attorney General Ken Paxton said poses an additional risk because of China's National Security Law requiring companies based there to share information with the government.

Click on the link for the full story.

Council of the European Union, MEPs approve updated cross-border GDPR enforcement regulation.

European Parliament and the Council of the European Union finalized the revised streamlined cross-border enforcement procedural rules for administering the EU General Data Protection Regulation. Key components of the regulation include how to establish cooperation procedures for national data protection authorities involved in cross-border investigations, lodging complaints, early resolution mechanisms and deadlines for issuing decisions.

Click on the link for the full story.

Meta to integrate age verification into its platforms.

Meta will partner with age-verification tool provider K-ID to use the verification system AgeKey with the aim of ensuring its social platforms are compliant with children's online safety laws, the Financial Times reports. Meta Global Head of Safety Antigone Davis said Meta's use of AgeKey could "create more uniformity so that age verification ... is going to look more similar across each of the different apps."

Click on the link for the full story.

EDPS issues report detailing digital wallets' data protection considerations.

The Office of the European Data Protection Supervisor released a report on Digital Identity Wallets, examining various mechanisms that could be used to ensure user data remains protected while using a digital ID. The report states digital IDs should allow the user to be in control of data use, while noting user trust will dictate the success of identity solutions. It also stated data protection by design is "essential to provide the necessary assurance features while avoiding enabling any possible tracking options."

Click on the link for the full story.

CAC finalizes data deletion standards.

The Cyberspace Administration of China announced the national standard for deleting information in electronic products was approved and released 2 Dec. The standard is mandatory and will go into effect 1 Jan. 2027. The CAC's goal with the standards is to create a uniform process for information erasure and to prevent data leaks when electronics such as phones and computers are sold secondhand.

Click on the link for the full story.

NIST issues guidance on the use of smart devices for home health care.

The U.S. National Institute of Standards and Technology released health care patient and provider guidance on the use of smart devices in home health care settings. NIST specifically called attention to voice-activated digital assistants and telehealth cybersecurity, noting security measures should be enabled to prevent malicious actors from potentially gaining access to patients' health information or hospital databases. The guidance also outlined the potential risks in play, including data exfiltration and manipulation.

Click on the link for the full story.

Cyberattack impacts SoundCloud's user data.

Audio streaming platform SoundCloud experienced a data breach after hacking group ShinyHunters gained access to a database containing some users' email address and basic profile data, BleepingComputer reports. The incident disrupted SoundCloud's systems and may have compromised data from more than 20% of its users.

Click on the link for the full story.

European Commission establishes Data Act Legal Helpdesk.

The European Commission launched the Data Act Legal Helpdesk to offer public and private entities assistance with implementing the regulation. The helpdesk is designed to help small and medium-sized enterprises and serves as a complement to existing tools and guidance supporting EU Data Act compliance efforts.

Click on the link for the full story.

NOYB claims TikTok monitored user activity across apps.

Privacy advocacy group NOYB filed a complaint with Austria's Data Protection Authority against TikTok, Grindr and AppsFlyer over alleged user tracking, Reuters reports. NOYB claimed TikTok potentially violated the EU General Data Protection Regulation after it tracked users' Grindr activity through AppsFlyer without consumer consent. TikTok noted the data was collected for targeted advertising and analytics.

Click on the link for the full story.

IAPP Weekly News 15.12.2025 - 19.12.2025