Latest Worldwide Developments on Personal Data

UK government drops request for backdoor access to Apple's encrypted data.

The White House finalized an agreement for the U.K. government to drop its demand for Apple to provide access to encrypted cloud data, The New York Times reports. Apple previously withdrew the Advanced Data Protection Feature in iCloud for U.K. customers while the government, citing the Investigatory Powers Act of 2016, was pushing Apple to provide a backdoor into its end-to-end encryption. In June, U.S. lawmakers voiced opposition to the U.K. demand.

Click on the link for the full story.

ICO rolls out DUA Act guidance consultations.

The U.K. Information Commissioner's Office announced consultations toward two draft guides to help clarify incoming data protection law amendments under the Data (Use and Access) Act. One guide will outline "recognised legitimate interest" as a lawful basis for data processing while the other guide covers new requirements and procedures for handling data protection complaints. Consultations for each guide conclude in October.

Click on the link for the full story.

OPC advises on federal agencies' biometric practices.

The Office of the Privacy Commissioner of Canada released new guidance covering the use of biometric technologies by federal agencies under the Privacy Act. The guide touches on what to do before collection and how to ensure data stays safe while being stored. It follows the release of the OPC's broader biometrics guidance earlier in August.

Click on the link for the full story.

A view from Brussels: The implementation challenges of the EU Data Act.

IAPP Managing Director, Europe, Isabelle Roccia, CIPP/E, writes the EU has enacted a package of rules in recent years all specifically geared toward facilitating data use and sharing, with the obvious and well-meaning intent of creating more value out of it — including the Data Act. As its 12 Sept. applicable date nears, Roccia highlights the implementation challenges the Data Act raises for digital governance professionals.

Click on the link for the full story.

US appeals court upholds FCC's ability to impose data breach rules.

The U.S. Court of Appeals for the 6th Circuit said the Federal Communications Commission is allowed to impose stronger data breach notifications on the telecommunications industry, CyberScoop reports. The FCC updated its requirements last year for telecoms to report any customer who lost personally identifiable information during a data breach, which was challenged by trade groups.

Click on the link for the full story.

UK foundation's research shows social media platforms still recommend harmful content.

A review of social media platforms by the Molly Rose Foundation in the U.K. found Instagram and TikTok still recommended harmful content, including promotions of suicide, despite content moderation rules contained in the Online Safety Act recently entering into force, the Guardian reports. The foundation opened dummy accounts pretending to be a 15-year-old girl who engaged with suicide, self-harm and depression-related content. According to the foundation's research, of the videos recommended by the platforms, 97% of Instagram reels and 96% of TikTok videos contained harmful content.

Click on the link for the full story.

Telecom operator breach impacts 850K Belgian customers.

France-based telecommunications operator Orange confirmed approximately 850,000 Belgian customers were swept up in a recent data breach, Politico reports. Names, telephone numbers, SIM card details, tariff plans and the Personal Unlocking Key codes were among the data hackers gained access to. Orange informed relevant authorities of the incident while cybersecurity professionals said the company is asking for customers to prove actual harm in any breach claims.

Click on the link for the full story.

Austrian court rules against newspaper's pay-or-consent model.

Austria's Federal Administrative Court upheld a 2023 decision by Austria's Data Protection Authority finding newspaper Der Standard violated the EU General Data Protection Regulation with its pay-or-consent advertising model, Euronews reports. Der Standard appealed the DPA's initial action, arguing the collection of "granular" consent was not practical. The latest decision is likely be appealed and could ultimately end up to the Court of Justice of the European Union.

Click on the link for the full story.

Roblox bolsters children's online safety policies.

Online game platform Roblox announced children's safety policy updates that block certain interactions and content for younger users, MediaPost reports. Roblox said when its new systems identify a "server with a high volume of violative user behavior, the system will automatically take that server down. Our team will then work with the developer to see if adjustments can be made to prevent that behavior in the future."

Click on the link for the full story.

Latvia's DPA advises on handling deletion requests.

Latvia's Data State Inspectorate outlined consideration for deleting individuals' personal data deletion requests. The DVI said the request itself should not be deleted when fulfilling an individual's deletion request because the request can be used for documenting that the deletion request was honored and used as evidence in subsequent DVI compliance checks.

Click on the link for the full story.

IAPP Weekly News 18.08.2025 - 22.08.2025