Latest Worldwide Developments on Personal Data

Italian court cancels 15M euro fine against OpenAI.

A Rome court recently annulled a 15 million euro data protection fine against OpenAI, Reuters reports. The court did not immediately release justification for its ruling and Italy's data protection authority, the Garante, declined to comment. The fine was originally issued by the Garante in December 2024 over allegations OpenAI unlawfully used personal data to train its ChatGPT chatbot.

Click on the link for the full story.

ICO issues guidance for DUAA's UK GDPR changes to legitimate use provisions.

The U.K. Information Commissioner's Office published guidance on how the Data Use (and Access) Act modifies the U.K. General Data Protection Regulation's legitimate use provisions to allow for pre-approved uses of personal data to further the public interest. Meanwhile, the ICO also issued guidance clarifying the circumstances under which personal data can be reused in a manner consistent with the purpose limitation principle.

Click on the link for the full story.

Spain's DPA, competition authority issue joint DSA guidance on age assurance tech.

Spain’s data protection authority, the Agencia Española de Protección de Datos, and the National Commission for Markets and Competition published a joint analysis of the EU Digital Services Act's Article 28 governing age assurance technology and the design of services by online platforms. The AEPD and CNMC said age assurance involves three different technological approaches. Once a platform determines they need to implement a solution, it must determine the appropriate method to do so using five criteria, including a system's accuracy and reliability.

Click on the link for the full story.

Digital Services Act: Mapping the Interplays with the GDPR.

The IAPP Research and Insights Team's EU Digital Laws Report 2025 maps the interplay between the EU General Data Protection Regulation and other relevant instruments in the EU digital rulebook. A new series of IAPP infographics depicts the extent of individual interplay outlined in the report. This installment covers the Digital Services Act.

Click on the link for the full story.

EDPB SPE report examines GDPR one-stop-shop decisions on legitimate interest.

The European Data Protection Board's Support Pool of Experts released a report outlining EU General Data Protection Regulation decisions on legitimate interest under the one-stop-shop mechanism. The report highlights examples of contextual applications of legitimate interest by data controllers and how data protection authorities assessed those cases.

Click on the link for the full story.

Switzerland's DPA issues consumer guide on data protection for wearables.

Switzerland's Federal Data Protection and Information Commissioner published guidelines for consumers' use of wearable devices. The guide introduces data protection concepts around smartwatches, fitness trackers and smart glasses, and covers impacts to users and third parties. There is a section dedicated to "increased sensitivity" around smart glasses and further considerations they raise. Editor's note: IAPP Research and Insights Analyst Brandon LaLonde, CIPM, outlined smart glasses' potential benefits and privacy implications.

Click on the link for the full story.

US senators look to introduce bill to ban government use of Chinese robots.

U.S. Sens. Tom Cotton, R-Ark., and Chuck Schumer, D-N.Y., plan to introduce a bill that would ban the U.S. government from purchasing or using robots created by China-based companies due to potential national security concerns, Reuters reports. U.S. Rep. Elise Stefanik, R-N.Y., highlighted the importance of implementing the bill to bolster U.S.-based technology companies by continuing "to promote and propel America's robotics superiority while safeguarding our privacy and national security from adversaries."

Click on the link for the full story.

ICO, Ofcom release statement on age assurance obligations.

The Digital Regulation Cooperation Forum published a joint policy statement by the U.K. Office of Communications and the Information Commissioner's Office detailing how online services can continue to meet age verification obligations while protecting consumers' personal information with a risk-based compliant privacy strategy. The statement aims to provide organizations with clarity on age assurance tools, noting "when implementing age assurance, you should consult the relevant Ofcom and ICO guidance to ensure the age assurance process you implement fulfils your online safety and data protection obligations."

Click on the link for the full story.

Jury finds Meta, YouTube liable in landmark social media addiction trial.

A Los Angeles County court jury ordered a combined USD6 million in punitive and compensatory damages be paid by Meta and YouTube after finding the platforms liable in a landmark social media addiction trial, The New York Times reports. Jurors found the addictive nature of Meta and YouTube's respective design features, including algorithmic recommendations and continuous scrolling led to the plaintiff's mental health distress. The plaintiff's attorney said executives' testimony and internal documents "prove these companies chose profits over children." Meta and Google, YouTube's parent company, plan to appeal.

Click on the link for the full story.

European Commission opens formal DSA probe into Snapchat.

The European Commission launched a formal investigation into a range of alleged Digital Services Act violations by Snapchat. The Commission claimed the social platform has insufficient age assurance measures, noting it suspects Snapchat relies on self-declaration for verification while there is no tool available to report potential underage users. Additionally, the Commission alleged Snapchat's design features "do not provide sufficient privacy, safety, and security protections for minors." Separately, the Commission issued preliminary findings on DSA allegations related to adult websites' children's risk assessments and mitigations.

Click on the link for the full story.

IAPP Weekly News 23.03.2026 - 27.03.2026