Latest Worldwide Developments on Personal Data

ANPD publishes initial guidance on implementing age verification mechanisms.

Brazil's data protection authority, Agência Nacional de Proteção de Dados, released preliminary guidelines for implementing age verification mechanisms by platforms and technology products likely to be accessed by children and the general public. The guidelines represent the ANPD's initial parameters for the implementation of the mechanisms outlined in the Digital ECA. Per the guidelines, the ANPD will assume an oversight role to ensure entities covered by the guidelines implement the age verification mechanism in a privacy-preserving manner until final guidelines are developed following a public consultation.

Click on the link for the full story.

Supreme Court of Canada hears Facebook's Cambridge Analytica appeal.

CBC News reports the Supreme Court of Canada delayed its judgment in Meta's appeal of a 2024 Federal Court of Appeal decision on the Office of the Privacy Commissioner of Canada's enforcement of Facebook's insufficient transparency leading to the Cambridge Analytica scandal in the 2010s. There was no timeline given for a final ruling. Meta lawyers claimed the limits to its responsibilities once a user consents to third-party data use while the OPC's legal team argued for user controls and safety.

Click on the link for the full story.

CNIL releases guidance on sound recording within video surveillance systems.

France's data protection authority, the Commission nationale de l'informatique et des libertés, issued guidance on when audio recordings can be collected alongside video surveillance systems. The CNIL outlined requirements for companies, noting organizations who collect audio within their video surveillance must disclose the purpose of the data collected and ensure they are compliant with data deletion policies.

Click on the link for the full story.

Garante fines financial institution 17.6M euros for alleged data processing violations.

Italy's data protection authority, the Garante, issued a 17.6 million euro fine to the financial institution Intesa Sanpaolo for allegedly engaging in the unlawful data processing of 2.4 million customers. According to the Garante, Intesa Sanpaolo's customer profiling to complete transfers of customers' data to its digital bank subsidiary, Isybank, did not carry an appropriate legal basis. The Garante also alleged transparency issues, finding customers "could not reasonably have foreseen" the unlawful processing based on the context and the information provided.

Click on the link for the full story.

Meta announces Instagram will no longer use end-to-end encryption.

Meta announced Instagram will no longer use end-to-end encryption within its direct messages after facing pushback over the potential child safety concerns associated with encrypted messages, Engadget reports. Meta said it made the decision due to many users not opting in to end-to-end encryption, though Meta CEO Mark Zuckerberg previously said, despite concerns, "the majority of folks ... believe that strong encryption is positive."

Click on the link for the full story.

European Commission, EDPB release public comments from GDPR-DMA interplay consultation.

The European Commission and European Data Protection Board published the stakeholder comments received through a public consultation on joint guidelines on the interplay between the EU General Data Protection Regulation and the Digital Markets Act. The Commission and EDPB received more than 100 submissions from a variety of parties, including small and medium-sized enterprises, trade and business associations, gatekeepers, civil society, consumer organizations and academics. The Commission also said the final guidelines are anticipated to be adopted in the last quarter of 2026.

Click on the link for the full story.

CNIL issues guidance detailing obligations with filtering web proxy.

France's data protection authority, the Commission nationale de l'informatique et des libertés, issued guidance on data protection considerations for filtering web proxy servers, which may help organizations block or restrict certain content that could bolster compliance. The guide aims to provide recommendations and compliance solutions to data controllers and information systems' security officers looking to combat cybersecurity threats and deploy filtering web proxy servers.

Click on the link for the full story.

OAIC issues age assurance guidance.

The Office of the Australian Information Commissioner published guidance on age assurance technologies. After new age assurance requirements went into effect under the eSafety-registered Age-Restricted Material Codes 9 March, the OAIC said the guidance is geared toward supporting entities not covered under the social media minimum age requirement to choose the right age assurance solution to mitigate privacy issues.

Click on the link for the full story.

EU officials discuss digital simplification, interplay goals at EDPB workshop.

Consensus views are coming into focus among EU officials on streamlining the bloc's digital rulebook to better support innovation. But according to leaders' comments at the European Data Protection Board's workshop on regulatory interplay, simplification does not mean drawing firm lines on potential and necessary convergence of rules. IAPP News Editor Joe Duball reports on workshop remarks from European Commission Executive Vice-President for Technological Sovereignty, Security and Democracy Henna Virkkunen and European Parliament Committee on Civil Liberties, Justice and Home Affairs Chair Javier Zarzalejos.

Click on the link for the full story.

CJEU rules GDPR data subject access requests are not absolute.

The Court of Justice of the European Union issued a decision on the potential for data subject access requests to become abusive to the data controller. The case involved an Austrian citizen who subscribed to a newsletter covering German optician company Brillen Rottler. Upon subscribing, the data subject filed a DSAR with the company, which considered the request abusive and denied it. The CJEU's ruling stated data subject rights are not absolute and provisions of the EU General Data Protection Regulation allowing for the exercising of rights can be abused.

Click on the link for the full story.

IAPP Weekly News 16.03.2026 - 20.03.2026