Latest Worldwide Developments on Personal Data

European Council approves new rules to streamline cross-border GDPR enforcement.

The Council of the European Union approved new rules to enhance cooperation between member state data protection authorities on cross-border enforcement of the EU General Data Protection Regulation. The rules aim to improve administrative procedures, including a new 12-month limit for simple cooperation cases and 15 months for more complex cases. The new rules enter into force 20 days after publication in the Official Journal and become applicable 15 months after that date.

Click on the link for the full story.

CNIL-commissioned survey unpacks value of customer data in advertising.

France's data protection authority, the Commission nationale de l'informatique et des libertés, released information about the value of consumers' personal data in advertising and why consumers should be cautious about allowing companies to collect their data. The CNIL's survey with Harris Interactive found 65% of individuals were willing to sell their data for up to 30 euros a month. The survey also found 60% of respondents were "unwilling to pay for services that better protect their personal data also unwilling to sell their data, regardless of the amount."

Click on the link for the full story.

Norway's DPA conducts audit of credit reporting agencies.

Norway's data protection authority, Datatilsynet, released a report on its audit of credit reporting agencies' personal data processing practices. While the audit did not find any compliance concerns, the DPA's Legal Advisor Jasmin Omer said the probe allowed the DPA to get insight into "practice in the area, and have provided the companies with detailed guidance based on our interpretation of the regulations."

Click on the link for the full story.

Spanish court orders GDPR penalties over Meta's alleged unfair advertising practices.

The mercantile court No. 15 of Madrid ordered Meta to pay 455 million euros in penalties to 81 Spanish legacy media companies for violations of the EU General Data Protection Regulation between 2018 and 2023, The Independent reports. The court ruled Meta exercised an unfair market advantage over the companies during the period by processing web users' personal information to create more effective advertising. "Meta had an advantage that Spanish online media could not match," the court wrote in a statement.

Click on the link for the full story.

PCLOB issues report on FBI's use of open source information.

The U.S. Privacy and Civil Liberties Oversight Board released a report detailing the Federal Bureau of Investigation's use of public records and data broker data. The PCLOB found the FBI does not purchase continuous location data, although the agency does use facial recognition tools with safeguards in place. The report claimed despite the agency's safeguards, "the collection and use of open source information may pose risks to privacy and civil liberties, especially when aggregated with other information that may reveal sensitive personal data."

Click on the link for the full story.

Google seeks dismissal of $2.3B claims around ad-related data processing.

Google urged the U.S. District Court for the Northern District of California to dismiss disgorgement efforts that aim to force the company to change data processing standards within its advertising practices and pay the plaintiffs USD2.3 billion in its recently resolved lawsuits, Reuters reports. Meanwhile, members of Meta's leadership team will pay USD190 million to shareholders over claims the company collected Facebook users' personal data without consent.

Click on the link for the full story.

Croatia's DPA fines telecom 4.5M euros for alleged GDPR violations.

Croatia's Personal Data Protection Agency, AZOP, issued a 4.5 million euro fine to a telecommunications operator after the company's personal data processing practices allegedly did not comply with the EU General Data Protection Regulation. AZOP found the "processor engaged by the controller for the purposes of the telephone sales service did not have even basic protection measures implemented, which the controller was obliged to check before the start of the processing of personal data in accordance with Article 28" of the GDPR.

Click on the link for the full story.

European Commission launches DMA cloud-computing probes.

The European Commission launched an investigation into how the Digital Markets Act applies to the cloud-computing market. The probe will examine potential competition issues in the cloud market, including those stemming from interoperability obstacles and "limited or conditioned access for business users to data." The Commission also announced DMA probes into Amazon and Microsoft's cloud services. Meanwhile, France's National Cybersecurity Agency and Germany's Federal Office for Information Security issued a joint statement calling for the EU to enhance its digital sovereignty in cloud computing.

Click on the link for the full story.

AEPD issues encryption guide for freelancers, SMEs.

Spain's data protection authority, the Agencia Española de Protección de Datos, published encryption guidance for freelancers and small and medium-sized enterprises that is applicable to different areas of their operations, including email transmission, cloud storage, and information locally stored on devices. The guide uses practical examples of real data breaches handled by the AEPD, showing how the lack of encryption measures adversely impacted the data subjects.

Click on the link for the full story.

CarePro agrees to settle data breach lawsuit for $1.3M.

CarePro Health Services will pay USD1.3 million to settle a class-action lawsuit over a cyberattack that breached the data of 151,499 individuals, The HIPAA Journal reports. The lawsuit alleged the company's inadequate safeguards allowed an unauthorized third party to obtain individuals' sensitive personal data including Social Security numbers and financial information.

Click on the link for the full story.

IAPP Weekly News 17.11.2025 - 21.11.2025