Latest Worldwide Developments on Personal Data

Quebec's DPA issues guidance for 23andMe customers following bankruptcy.

Quebec's data protection authority, Commission d'accès à l'information du Québec, published guidance for citizens who may have had their genetic data compromised following the bankruptcy of testing company 23andMe. The CAI reminded 23andMe customers that they can configure their account preferences so their sensitive data is not retained in a research facility or bio bank, as well as listing information on deleting their accounts and genetic information entirely.

Click on the link for the full story.

AEPD translates Singpore DPA's guide for generating synthetic data.

Spain's data protection authority, the Agencia Española de Protección de Datos, published a Spanish translation of Singapore's Personal Data Protection Commission's Guide to Synthetic Data Generation. The translated guide is geared toward educating Spanish data controllers, processors and data protection officers on best practices for incorporating synthetic data to prevent personal data from being compromised.

Click on the link for the full story.

Google abandons latest cookie deprecation plan.

Google Vice President of Privacy Sandbox Anthony Chavez announced the company will forego its initiative to end third-party cookies and end work to develop a "new standalone prompt for third-party cookies." Chavez noted the decision was spurred by "divergent perspectives" across the advertising ecosystem on "making changes that could impact the availability of third-party cookies."

Click on the link for the full story.

EDPB, EDPS release 2024 annual reports.

The European Data Protection Board published its 2024 annual report highlighting a range of work and undertakings toward "making the (EU General Data Protection Regulation) understandable and practical for all." Meanwhile, European Data Protection Supervisor Wojciech Wiewiórowski presented the EDPS's annual report, which includes recent preparations for AI development and use in the EU.

Click on the link for the full story.

CNIL outlines risks of compromised data.

France's data protection authority, the Commission nationale de l'informatique et des libertés, published a fictitious case highlighting the risks of unsecured access to data held by subcontractors. The CNIL outlined how to react to the breach, proper notification to the authority and affected individuals, and how to limit risks.

Click on the link for the full story.

China releases guidelines on financial data transfers abroad.

Six Chinese government agencies, including the People's Bank of China and the National Financial Regulatory Administration, released joint guidelines for facilitating the cross-border sharing of domestic and foreign financial institutions' data. The guidelines clarify the circumstances and conditions for transfers, as well as security assessment exemptions and where standard contractual clauses can be applied.

Click on the link for the full story.

Europol report studies criminal exploitation of biometric systems.

A Europol report studied the potential for criminals to exploit biometric identification systems. "By researching and identifying how criminals might exploit weaknesses, authorities can take more effective and targeted countermeasures. This new Europol report identifies potential ways of exploiting vulnerabilities, thus enabling law enforcement agencies to update their systems and detect such incidents during investigations," the agency said.

Click on the link for the full story.

German DPAs closely monitoring Volkswagen's new data processing.

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Bavaria's State Office for Data Protection Supervision and the Lower Saxony State Commissioner for Data Protection are in communication with Volkswagen about new data processing in customer vehicles to improve and develop driver assistance and driving safety systems. The DPAs have "closely monitored this technological innovation" to "safeguard the rights of data subjects at an early stage, and to encourage compliance with data protection requirements."

Click on the link for the full story.

Japan-UK data adequacy agreement expanded.

Japan's Personal Information Protection Commissioner Shuhei Ohshima and U.K. Minister of State for Data Protection and Telecoms Chris Bryant issued a joint statement reaffirming and expanding the scope of the Japan-U.K. data adequacy agreement. The new arrangements extend protections "to new areas such as academia and the public sector and facilitate collaborative research and administrative cooperation beyond the scope of the existing partnership between Japan and the UK."

Click on the link for the full story.

Hamburg DPA reviews 1,000 websites for third-party services compliance.

In response to a number of consumer complaints, the Hamburg Commissioner for Data Protection and Freedom of Information conducted an automated review of 1,000 randomly selected websites to learn the extent to which they deploy third-party services without consent. The review found 185 websites had third-party services embedded on their pages that track users upon accessing the sites.

Click on the link for the full story.

IAPP Weekly News 21.04.2025 - 25.04.2025