Latest Worldwide Developments on Personal Data

Denmark's DPA releases guidance on disclosing employment information.

Denmark's data protection authority, Datatilsynet, released guidance on disclosing employees' information to contracting authorities, aiming to help strike a balance between compliance obligations for employment contracts and data protection. Datatilsynet noted suppliers must "find a basis for the disclosure in the balancing of interests rule in Article 6(1)(f) of the General Data Protection Regulation. Given the purpose of the employment clauses, there will generally be such weighty legitimate interests that these could form the basis for the disclosure of the information in question."

Click on the link for the full story.

South Korea's PIPC announces fines for insufficient data security.

South Korea's Personal Information Protection Commission issued fines totaling KRW177.6 million to three businesses for alleged insufficient data security measures to combat query language injection attacks. The incidents were marked by backend database manipulation through code injection. Meanwhile, the PIPC will release information into its preliminary adequacy review of new blockchain-based services, including a review of personal identification risks and implementation of data subject rights and legal processing of cross-border data transfers.

Click on the link for the full story.

FCC fines Comcast $1.5M for data breach.

The U.S. Federal Communications Commission announced it will fine Comcast USD1.5 million after a third-party vendor used by the company experienced a cyberattack that breached consumers' personal data, Reuters reports. Comcast said it will implement new security standards, including enhanced vendor oversight and standards, as the company remains "committed to continually strengthening our cybersecurity policies and protections to safeguard customer data."

Click on the link for the full story.

Germany's DSK proposes improvements to children's data protection.

Germany's Conference of Independent Data Protection Supervisory Authorities of the Federal and State Governments proposed 10 changes to the EU General Data Protection Regulation that aim to improve its coverage of children's data protection efforts. Commissioner for Data Protection and Freedom of Information of Berlin Meike Kamp said the recommendations aim to "strengthen data protection for young people, for example by banning personalized advertising or implementing child-friendly default settings in social networks."

Click on the link for the full story.

California's attorney general announces $1.4M CCPA settlement.

California Attorney General Rob Bonta announced a settlement in a lawsuit against Jam City for USD1.4 million after the company allegedly violated the California Consumer Privacy Act's user opt-out provisions. Bonta noted consumers should be able to opt out of the collection and sale of their personal data with a process that is "simple, transparent, and easy to navigate," adding his office will continue to scrutinize mobile gaming companies that flout the law.

Click on the link for the full story.

Poland's competition watchdog files antitrust charges against Apple.

Poland's Office of Competition and Consumer Protection, the UOKIK, brought antitrust proceedings against Apple for its App Tracking Transparency Framework. While the framework aims to allow users to opt out of companies' personalized advertising, the UOKIK noted the language used in consent agreements might impact competition by making consumers avoid consent.

Click on the link for the full story.

China's CAC posts draft PIPL regulations for large online platforms.

The Cyber Administration of China opened a public consultation on draft Personal Information Protection Law regulations for large online platforms with more than 50 million registered users. The regulations include various adherence to protection principles, specific children's data protection obligations and data protection officer requirements. The deadline for the feedback in 22 Dec. The CAC is also seeking feedback on new cybersecurity labels and a catalogue of products that would be subjected to those labels. Those comments are due 6 Dec.

Click on the link for the full story.

eSafety Commissioner launches resources outlining Australia's social media restrictions.

Australia's eSafety Commissioner launched an online hub to explain the country's new social media age restriction laws that go into effect in December. The hub includes resources such as an assessment guide and frequently asked questions. Meanwhile, The Sydney Morning Herald reports Malaysia wants to implement a social media ban similar to Australia's next year, joining many countries now considering placing age limits on social media as concerns about the addictive effects and mental harm on children have grown. Editor's note: Australia eSafety Commissioner Julie Inman-Grant spoke about the agency's work in an episode of The Privacy Advisor Podcast.

Click on the link for the full story.

Raft of US children's online safety bills could move forward soon.

The U.S. House Energy and Commerce Committee plans to release several bills regarding children's online safety and may hold a public hearing on them in early December, Bloomberg Government reports. Bills potentially up for debate include the Kids Online Safety Act, the Children and Teens' Online Privacy Protection Act, Sammy's Law and the App Store Accountability Act. The bills seek to expand protective measures for children, including adding parental controls, age verification rules and requiring more actions from social media platforms to keep young users safe. Editor's note: IAPP Managing Director, Washington, D.C., Cobun Zweifel-Keegan, CIPP/US, CIPM, wrote about this Congress' digital policy positions.

Click on the link for the full story.

CISA urges quick adoption of mobile security practices.

The U.S. Cybersecurity and Infrastructure Security Agency released guidance on best practices for mobile communications securities after identifying cyber espionage activity from Chinese government-related actors. The best practices are specifically aimed at senior government, military and political positions who might possess government information and thus be targeted more than others. The agency warned those people should "assume that all communications between mobile devices — including government and personal devices — and internet services are at risk of interception or manipulation."

Click on the link for the full story.

IAPP Weekly News 24.11.2025 - 28.11.2025