Latest Worldwide Developments on Personal Data

WhatsApp banned on US House staff devices.

The U.S. House Chief Administrative Officer Catherine Szpindor barred staff from using messaging app WhatsApp due to data security concerns, Axios reports. Despite WhatsApp's end-to-end encryption, Szpindor claimed the app was "high-risk to users due to the lack of transparency in how it protects user data, absence of stored data encryption, and potential security risks involved with its use."

Click on the link for the full story.

Berlin DPA calls on Apple, Google to ban DeepSeek from app stores.

The Berlin Commissioner for Data Protection and Freedom of Information requested both Apple and Google block Chinese generative AI model DeepSeek from their app stores, CNBC reports. "DeepSeek has not been able to convincingly demonstrate to my authority that the data of German users is protected in China at a level equivalent to that of the European Union," BlnBDI Commissioner Meike Kamp said. "Chinese authorities have extensive access rights to personal data within the sphere of influence of Chinese companies."

Click on the link for the full story.

US court strikes down HIPAA rule on sensitive health data.

The U.S. District Court for the Northern District of Texas ruled to invalidate the Health Insurance Portability and Accountability Act rule on the disclosure of individuals' personal health data in legal investigations. The rule was aimed to protect data associated with women's reproductive health and gender transitions, among other sensitive data categories. Judge Matthew Kacsmaryk said HHS "lacked clear delegated authority" to establish protections around "medical information produced by politically favored medical procedures."

Click on the link for the full story.

Denmark's DPA updates guidance for DPOs.

Denmark's data protection authority, Datatilsynet, updated its guidance and resources for data protection officers. The update aims to provide DPOs tools and resources to ensure their organizations comply with data protection regulations. The additions to the resource compendium include an FAQ page and a podcast highlighting DPOs efforts.

Click on the link for the full story.

CNIL publishes security recommendations after 16B login credentials stolen.

France's data protection authority, the Commission nationale de l'informatique et des libertés, issued guidance following media reports of 16 billion login credentials were stolen in prior data breaches and aggregated. The CNIL recommends users monitor their sensitive digital accounts for unauthorized activity, change passwords where necessary and utilize multifactor authentication.

Click on the link for the full story.

HHS pushes for individuals to wear health tracking devices.

The U.S. Secretary of Health and Human Services Robert F. Kennedy Jr. indicated his department will roll out an ad campaign urging individuals to use health tracking devices, ZDNET reports. The plan brings concerns over potential broad collection of sensitive biometric data and tracking of individuals' health and location data.

Click on the link for the full story.

Belgium's DPA dismisses NOYB complaints due to standing.

Belgium's Data Protection Authority dismissed 16 complaints filed by privacy rights organization NOYB. In dismissing the cases, the APD ruled interest groups, such as NOYB, can only file complaints if they are acting on behalf of individual citizens and not the organization itself.

Click on the link for the full story.

Singapore's PDPC, CSA urge organizations to stop using NRIC numbers.

Singapore's Personal Data Protection Commission and Cyber Security Agency released joint guidance urging organizations to stop using National Registration Identity Card numbers to verify individuals' identity. The guidance recommended companies use tools such as strong passwords, security tokens, facial recognition and fingerprint scans for authentication to protect NRIC numbers from being breached.

Click on the link for the full story.

Netherlands' DPA says law enforcement must follow data deletion requirements.

The Netherlands' data protection authority, Autoriteit Persoonsgegevens, alleged national law enforcement agencies are not following data deletion policies. AP Chairman Aleid Wolfsen told the House of Representatives of the Netherlands that authorities must comply with deletion obligations as "there are concrete risks associated with retaining police data for such a long time for the people whose data is stored in the police systems."

Click on the link for the full story.

ICE brings facial recognition tool into fieldwork.

U.S. Immigration and Customs Enforcement is using a tool called Mobile Fortify to identify individuals by pointing a phone camera at them, 404 Media reports. The underlying technology is used at airports to verify when people are entering and exiting the country.

Click on the link for the full story.

IAPP Weekly News 23.06.2025 - 27.06.2025