Latest Worldwide Developments on Personal Data

European Commission proposes to reform portions of GDPR.

The European Commission presented a plan to simplify the Digital Single Market, which includes targeted reform of the EU General Data Protection Regulation. The proposal aims to simplify or extend "certain measures currently applicable to small and medium-sized enterprises to include small mid-cap enterprises that have 'outgrown the SME definition'," writes IAPP Research and Insights Director Joe Jones, who notes that "the reopening of the GDPR will now animate heightened consultation, discussion and debate on whether and where to redraw the lines set in 2016."

Click on the link for the full story.

EU, UK look to bolster biometric data security.

The EU and the U.K. announced they have agreed on a security and defense partnership and will cooperate on a variety of security issues, including law enforcement use of facial recognition programs. The partnership aims to increase security and enhance "biometric data exchange mechanisms," among other areas.

Click on the link for the full story.

Microsoft files lawsuit against malware company.

Microsoft filed a lawsuit against information-stealing malware company Lumma Stealer after 400,000 Microsoft computers were affected by the company's malware, Reuters reports. Microsoft claimed the "growth and resilience of Lumma Stealer highlight the broader evolution of cybercrime and underscores the need for layered defenses and industry collaboration to counter threats."

Click on the link for the full story.

EU member states push European Commission to create age-verification system.

France, Greece and Spain are lobbying the European Commission to introduce an EU age-verification system and establish a minimum age for social media access, Euractiv reports. According to a policy document reviewed by the publication, the digital ministers of the countries claimed "poorly designed digital products and services" are causing a variety of health issues in minors who "are constantly exposed to trivial or comparative contents."

Click on the link for the full story.

Cryptocurrency company faces class-action lawsuit for alleged Illinois BIPA violations.

Cryptocurrency company Coinbase is facing a class-action lawsuit after users claimed its identity verification systems violate the Illinois Biometric Information Privacy Act, Cointelegraph reports. The lawsuit alleged Coinbase violated BIPA because it allowed third-party companies to "use its software to verify and authenticate users, including Plaintiffs, and its software does so by collecting biometric data."

Click on the link for the full story.

Denmark's DPA completes breach notification guidance update.

Denmark's data protection authority, Datatilsynet, updated its guidance on how to handle personal data breaches and data subject notification. The guidance updates lawful practices for notifications to individuals and the Datatilsynet.

Click on the link for the full story.

Kenya's DPA publishes Data Protection Act guidance compendium.

Kenya's Office of the Data Protection Commissioner released sectoral and situational guidelines to aid Data Protection Act compliance. The guidance documents cover specific fields as well as targeted data processing, including children's and biometric data. Affected entities are encouraged to submit feedback on the guidelines through 30 May.

Click on the link for the full story.

Consumer Reports finds grocery chain uses personal data to create profiles.

Consumer Reports found grocery chain Kroger allegedly used consumers' personal information to create marketing profiles, sharing sometimes inaccurate user data with advertisers. Capital Strategies Director John Marshall raised concerns over Kroger's tool to predict consumers' income and warned, "Kroger could use accurate data to target discounts at higher income shoppers while leaving lower income consumers to pay full price."

Click on the link for the full story.

CNIL fines marketer for alleged GDPR consent violations.

France's data protection authority, the Commission nationale de l'informatique et des libertés, issued a 900,000 euro fine to data broker Solocal Marketing Services over alleged consent violations under the French Post and Electronic Communications Code and the EU General Data Protection Regulation. The CNIL said, because the company uses data collected by data brokers, it must "ensure that individuals have expressed valid consent before carrying out its prospecting campaigns."

Click on the link for the full story.

Garante issues 5M euro fine to US chatbot developer.

Italy's data protection authority, the Garante, issued a 5 million euro fine to the company operating the Replika chatbot and launched an investigation to ensure the accuracy of personal data processed by chatbot's AI model. Beginning in February 2023, U.S.-based Luka did not provide the Garante with legal bases about its processing operations and with its privacy notice. Also in 2023, Luka did not provide the mechanism it uses to verify users' ages.

Click on the link for the full story.

IAPP Weekly News 19.05.2025 - 23.05.2025