Latest Worldwide Developments on Personal Data

ICO releases consumer guidance for pay-or-consent models.

The U.K. Information Commissioner's Office released information for consumers on pay-or-consent advertising models. The ICO guidance provides the public with examples of how pay or consent works, how to withdraw consent and options consumers can take if a model is "unfair" or "not compliant." The ICO noted companies must allow consumers the right to opt out and withdraw consent though companies may choose not to provide services or access to individuals who opt out.

Click on the link for the full story.

Norwegian appeals court upholds NOK65M fine of Grindr for selling user data.

Norway's Borgarting Court of Appeal issued a ruling upholding the NOK65 million fine to dating app Grindr for selling sensitive user data to third-party advertisers without obtaining proper consent, NRK reports. The fine was originally issued by Norway's data protection authority, Datatilsynet, and upheld in the District Court. As part of the Court of Appeal ruling, Grindr is required to pay an additional NOK550,000 in legal fees.

Click on the link for the full story.

Apple fights DMA in arguments before European General Court.

In Apple's legal challenge to the EU Digital Markets Act before the European General Court, Apple lawyer Daniel Beard said the DMA "imposes hugely onerous and intrusive burdens," Bloomberg reports. Apple is challenging the DMA in a three-pronged legal argument by claiming the EU cannot compel Apple to make competitors' hardware work with the iPhone, making the App Store subject to DMA requirements and the prior decision to investigate whether iMessage should have been subject to DMA rules. European Commission lawyer Paul-John Loewenthal responded in court by saying Apple "decides who gets it and who can offer their products and services to iPhone users. And through such control, Apple has locked in more than a third of European smartphone users."

Click on the link for the full story.

European Commission issues preliminary notice of DSA violations to Meta, TikTok.

The European Commission issued a preliminary finding that both Meta and TikTok allegedly violated the transparency requirements under the EU Digital Services Act for failing to provide researchers sufficient access to public data. The Commission also claims Meta did not provide users with a mechanism to report illegal content on Facebook and Instagram. Both companies now have the opportunity to review the investigatory files and address the Commission's preliminary findings. If the claims go unaddressed, the companies could face fines up to 6% of global turnover.

Click on the link for the full story.

8 countries sign onto the UK Product Security and Telecommunications Infrastructure.

The U.K. government announced several countries will adopt the U.K.'s minimum cybersecurity protections for connected devices during Singapore's International Cyber Week. Per the agreement, connected devices that meet Singapore's cybersecurity standards will now be protected under the U.K.'s Product Security and Telecommunications Infrastructure. Along with Singapore, the other countries signing onto the agreement are Australia, Brunei, Finland, Germany, Hungary, Japan and South Korea.

Click on the link for the full story.

EDPS proposes hosting event to promote cross-border enforcement collaboration.

The European Data Protection Supervisor is proposing Digital Clearinghouse 2.0 for 26 Jan. 2026, which will feature representatives from EU data protection authorities to discuss and coordinate common issues with cross-border cooperation. The EDPS said, "effective cross-regulatory cooperation is necessary to ensure consistent application of recent laws such as the Data Governance Act, Digital Markets Act, Digital Services Act, Data Act, and Artificial Intelligence Act.”

Click on the link for the full story.

The common themes at the heart of a high-profile data access request.

Ropes & Gray looked at the legal takeaways of a highly publicized data subject access request concerning television presenter Gregg Wallace. The post digs into Article 15 of the U.K. General Data Protection Regulation and guidance from the Information Commissioner's Office, specifically with regard to large volumes of documents and how to handle requests for time extensions, redactions and exemptions. The post noted access requests are a "leveller," because they do not discriminate between people based on social status.

Click on the link for the full story.

Netherlands' DPA fines credit rating agency for misuse of personal data.

The Netherlands Data Protection Authority ("Authority") imposed a fine of €2.7 million on Experian Nederland, a credit rating agency, for alleged misuse of personal data. The Authority launched an investigation following complaints from consumers that they were unable to pay their telephone and electricity bills in installments or were forced to pay high deposits when changing electricity providers. The Authority found that Experian prepared credit reports on customers at their request and collected data on customers' negative payment behavior, which resulted in individuals facing higher costs. It was also found that Experian did not adequately inform individuals affected by this situation.

Click on the link for the full story.

IAPP releases PDF for US Data Privacy Litigation series.

The IAPP Research and Insights Team is republishing their U.S. Data Privacy Litigation series as a single PDF. The six-part series explores privacy litigation trends in areas including breach of contract and warranties, website tracking and security breaches from 2020-24.

Click on the link for the full story.

Why monitoring for genetic data misuse is different than typical data breach responses?

The Wall Street Journal reports on the downside of genetic monitoring services after ancestry company 23andMe said it would offer it for five years to people impacted by a massive cyberattack in 2023. Cybersecurity professionals say limited monitoring does little for those affected as genetic data is permanent, unlike banking numbers and passwords more often targeted in data breaches. While some say genetic data is not as easy to abuse, the lifetime of potential exposure is worrying for the victims.

Click on the link for the full story.

IAPP Weekly News 20.10.2025 - 24.10.2025