Latest Worldwide Developments on Personal Data

EU member states' leaked Digital Omnibus compromise proposal eliminates revised GDPR definition of 'personal data'.

According to a leaked draft compromise text on the proposed EU Digital Omnibus, the Council of the European Union proposed completely striking the European Commission's potential changes to the EU General Data Protection Regulation's definition of "personal data." EU member state diplomats are expected to discuss the proposed reversal and its broader Omnibus opinion at a 27 Feb. meeting.

Click on the link for the full story.

Researchers find database containing sensitive personal data of millions.

Researchers from cybersecurity company UpGuard claimed to discover a large database on cloud service provider Hetzner that contained more than 3 million email addresses and 2 million personal records, including Social Security numbers, Wired reports. The researchers noted the data did not come entirely from cyberattacks and was removed from the platform on 21 Jan.

Click on the link for the full story.

ICO fines Reddit 14.47M GBP over improper age assurance checks.

The U.K. Information Commissioner's Office issued a 14.47 million GBP fine against Reddit for alleged children's privacy violations. The ICO claimed Reddit did not apply robust age assurance mechanisms and allowed users to self-report their age before accessing mature content. "Let me be clear. Companies operating online services likely to be accessed by children have a responsibility to protect those children by ensuring they're not exposed to risks through the way their data is used," Information Commissioner John Edwards said. Additionally, the ICO said Reddit did not conduct a data privacy impact assessment for minors prior to January 2025.

Click on the link for the full story.

Poland's DPA fines transport company over alleged GDPR violations.

Poland's data protection authority, Urząd Ochrony Danych Osobowych, issued two fines totaling PLN11.5 million against mail courier DPD Polska for alleged EU General Data Protection Regulation violations. The UODO claimed the courier did not obtain personal data processing agreements with third-party carriers or ensured external carriers abided by prescribed data processing instructions, resulting in breaches of confidentiality and accountability principles.

Click on the link for the full story.

Garante orders halt on Amazon warehouse's employee monitoring.

Italy's data protection authority, the Garante, ordered an immediate ban of employee data processing at an Italy-based Amazon distribution center after a probe into the facility's monitoring practices. The distribution center had an attendance tracking system that collected sensitive personal data on more than 1,800 current and former employees' work statuses retained over a 10-year period. Four on-site cameras collecting footage of employee activities must also be disabled under the Garante order.

Click on the link for the full story.

Israel's PPA, Ministry of Health issue deidentification guidance for medical information.

Israel's Privacy Protection Authority and Ministry of Health issued a guide for deidentifying medical data. The guide contains information on common methods of anonymization, as well as challenges of the anonymization process and how to conduct re-identification risk assessments. Meanwhile, the PPA issued guidance on the Law on the Installation of Cameras for the Protection of Toddlers in Daycare Centers, which includes ensuring cameras record video only and are only used to ensure children's safety during operating hours.

Click on the link for the full story.

Israel's PPA issues opinion on PPL consent obligations.

Israel's Privacy Protection Authority issued an opinion stating what it considers to be informed consent under the Privacy Protection Law. The PPA noted organizations must ensure it understands potential power imbalances between consumers and organizations, and provides individuals with information about what they are consenting to. The opinion stated in cases where consent is implied, "it is advisable, as much as possible, to approach the individual for their express consent, especially in cases of collecting sensitive information or taking action that could result in a serious violation of privacy."

Click on the link for the full story.

How AI chatbot interactions are reshaping privacy risks.

The New York Times reports on how the proliferation and growing sophistication of AI chatbots are reframing views on data privacy risks. Concerns around general data consumption remain mostly unchanged, even as chatbots consume more data through user interactions. However, the increasing collection and retention of more highly sensitive personal data shared in conversation is a key issue in relation to higher risks of cyberattacks and data breaches.

Click on the link for the full story.

NAI releases report on privacy considerations when deploying health-related advertising.

The Network Advertising Initiative released a report detailing how organizations can protect users' sensitive personal information related to health-related advertisements. The report outlines factors to consider in health data processing, including source, contents and intended use. It covers how organizations must ensure their data-driven advertising practices do not violate U.S. federal or state regulation, or NAI Self-Regulatory Framework standards.

Click on the link for the full story.

Security obligations under GDPR still apply, even if data is anonymous in the hands of an attacker.

The recent U.K. Court of Appeal ruling in DSG Retail Limited v. The Information Commissioner "held that where a controller processes personal data, the controller can't use the fact that data is anonymous in the hands of a third party ... to argue that the controller had no obligation to take appropriate measures to keep the data secure in the first place," Bird & Bird Partner Ruth Boardman writes. She discussed how the Upper Tribunal issued its ruling, in part, because "it would mean there would be no need to protect against ransomware in circumstances where the attacker cannot identify data subjects" under the U.K. General Data Protection Regulation.

Click on the link for the full story.

IAPP Weekly News 23.02.2026 - 27.02.2026