Latest Worldwide Developments on Personal Data

China releases guidelines for autonomous vehicles' algorithms.

China's Ministry of Science and Technology released guidelines for automated driving systems, which "must demonstrate a high degree of respect for human life and actively seek effective strategies to minimise harm," the South China Morning Post reports. The guidelines state algorithms used in autonomous vehicles must be documented in a comprehensive manner and open to inspection by authorities.

Click on the link for the full story.

Court overrules Facebook fan page decision by Germany's BfDi.

Germany's Federal Commissioner for Data Protection and Freedom of Information said its 2023 decision regarding a government fan page on Facebook that violated data protection laws was overturned by the 13th Chamber of the Cologne Administrative Court. The court still upheld parts of the decision and dismissed three of Meta's four claims. The BfDi said it was reviewing the decision to consider its next steps.

Click on the link for the full story.

Netherlands' DPA issues guidance for ensuring human oversight of ADMT.

The Netherlands' data protection authority, Autoriteit Persoonsgegevens, published guidelines for organizations to maintain "meaningful human intervention" when using automated decision-making technology. The guidance outlines components of meaningful intervention and best practices for implementation based on prior stakeholder input. It also offers practical examples to ensure human oversight of decisions rendered by ADMT systems.

Click on the link for the full story.

Microsoft SharePoint server hack could fuel downstream attacks, researchers say.

Microsoft announced hackers exploited a "zero-day" vulnerability in an on-premise SharePoint server and at least three China-based hacking groups have exploited the breach, potentially as early as 7 July, Axios reports. Security researchers indicated organizations relying on SharePoint are "sitting ducks" as hackers have reportedly stolen machine keys that could allow for subsequent hacks of organizations once the SharePoint vulnerability is patched. There are more than 100 estimated victims that include federal and state agencies, universities and utility companies.

Click on the link for the full story.

The Coldplay incident: Nobody said it was easy.

The viral "kiss cam" moment at a recent Coldplay concert that publicized the private life of a technology company CEO and its head of human resources prompted Goodwin Procter Partner Omer Tene to ask, "Is there privacy in public, online or off, in an age when everything is recorded, stored, analyzed, sliced and diced and sold to advertisers?" Tene discussed how in a time when millions of people are competing to grab the world's attention online, even the world's elite "aren't immune" from having reputation-altering episodes being captured online.

Click on the link for the full story.

Ofcom issues final version of transparency reporting guidance.

The U.K. Office of Communications published the final version of its transparency reporting guidance under the Online Safety Act. The guide outlines how Ofcom will exercise its transparency powers while providing stakeholders with information on how the process will work in practice. Online service providers covered under the law will be required to publish transparency reports that address the Ofcom obligations contained in the agency's transparency notices.

Click on the link for the full story.

CNIL publishes latest DPO survey results.

France's data protection authority, the Commission nationale de l'informatique et des libertés, published the results of the fourth edition of its survey of data protection officers. The CNIL surveyed 3,625 DPOs and found 58% of them worked in an organization that viewed compliance with data protection laws as positive. To maximize the economic benefits of employing a DPO, the CNIL recommends involving the DPO in certain executive meetings and incorporating data protection into a corporate social responsibility strategy.

Click on the link for the full story.

NOYB releases report on pay-or-consent implications.

Privacy advocacy group NOYB released a report detailing pay-or-consent models' consent obligations and potential privacy harms ahead of the European Data Protection Board's expected guidelines on the matter. The report noted, while digital advertisers argue the models support the economy, online advertising maintains approximately 10% of digital services revenue.

Click on the link for the full story.

Poland's DPA fines McDonald's for alleged data protection violations.

Poland's data protection authority, Urząd Ochrony Danych Osobowych, fined McDonald's Polska PLN16.9 million for allegedly violating data protection laws by outsourcing its work scheduling process using employees' personal information without assessing the risks. It comes after McDonald's reported a data breach and an investigation which found the processor, 24/7 Communication, was also at fault and fined PLN183,858.

Click on the link for the full story.

California adopts cybersecurity audit rule, outlining 'reasonable' cybersecurity.

After the California Privacy Protection Agency approved a package of regulations that include requirements for cybersecurity audits, IAPP Cybersecurity Law Center Managing Director Jim Dempsey writes the rule "effectively represents the agency's definition of what constitutes the 'reasonable' cybersecurity that is required under California law." Dempsey outlines what constitutes "reasonable" cybersecurity practices under state law and analyzes other relevant aspects of the rule.

Click on the link for the full story.

IAPP Weekly News 21.07.2025 - 25.07.2025