Latest Worldwide Developments on Personal Data

Ransomware attack on health care company breaches 2.7M patients' data.

A ransomware attack on health care company DaVita breached the sensitive personally identifiable information of 2.7 million patients, Cybernews reports. The company said a ransomware group potentially obtained patients' social security numbers, financial information, addresses and health insurance data during the breach.

Click on the link for the full story.

TransUnion data security incident exposes the data of 4.4M users.

Reuters reports 4.4 million TransUnion consumers had their information breached through a data security incident involving a third-party used for the company's U.S. consumer support division. TransUnion said it has "quickly contained the issue, which did not involve our core credit database or include credit reports."

Click on the link for the full story.

Norway's DPA releases guidance on protecting personal data during elections.

Norway's data protection authority, Datatilsynet, issued guidance for political parties on how to protect individuals' personal data during campaigns. The DPA noted that political parties must ensure their data collection practices are compliant with privacy regulations while remaining transparent about how personal data is used and limiting the amount of data collected.

Click on the link for the full story.

UK court reverses decision potentially limiting data breach claims.

Legal Futures reports the U.K. Court of Appeal overturned a High Court ruling that put limitations around plaintiffs' rights to raise collective-action claims over data breaches. Lord Justice Mark Worby indicated the reversal stemmed from the High Court's unnecessary application of a "threshold of seriousness" that needed to be met for breach claims to proceed. KP Law Partner Kingsley Hayes, who represented the plaintiffs, said the Court of Appeal decision "makes clear that unlawful processing alone is enough to found a claim."

Click on the link for the full story.

Whistleblower alleges DOGE uploaded sensitive data of 300M to cloud.

U.S. Department of Government Efficiency employees at the Social Security Administration allegedly copied U.S. citizens sensitive personal information into a cloud server, CNN reports. A whistleblower complaint against the agency claimed if a malicious actor obtained access to the server, "Americans may be susceptible to widespread identity theft, may lose vital health care and food benefits, and the government may be responsible for re-issuing every American a new Social Security number at great cost."

Click on the link for the full story.

Malaysia's DPA opens consultation on proposed PDP Regulations amendments.

Malaysia's data protection authority, Jabatan Perlindungan Data Peribadi, issued a consultation paper on proposed amendments to the Personal Data Protection Regulations 2013. The draft amendments aim to clarify existing terms and definitions while introducing new ones, expanding compliance guidance and enhancing investigatory powers. The comment period closes 8 Sept.

Click on the link for the full story.

Politicians' and reporters' Spotify listening habits shared.

Several public figures, including U.S. Vice President JD Vance, have had their Spotify playlists shared on a website called The Panama Playlists after they unknowingly left their accounts public, The New York Times reports. Spotify said its legal team has contacted the creator of Panama Playlists, as the website "is in violation of our User Guidelines, which make clear that you may not scrape information like listening activity from the service via manual or automated means."

Click on the link for the full story.

US President Trump proposes increased tariffs, sanctions over global digital rules impacting Big Tech.

Reuters reports U.S. President Donald Trump floated the potential for increased tariffs against global jurisdictions that place digital taxes on U.S.-based technology companies. The Trump administration is reportedly considering tariffs and sanctions against the EU or member state representatives in charge of implementing the Digital Services Act, specifically focusing on the EU's regulatory framework. A Department of State spokesperson did not comment on the potential actions, but noted the administration is "monitoring increasing censorship in Europe with great concern."

Click on the link for the full story.

The World Bank publishes report on global data market safety, stability.

The World Bank issued its Global Regulations, Institutional Development, and Market Authorities Perspective Toolkit, which includes a module to support benchmarking and shaping policies for global data markets. The report covers regulations, institutional arrangements and enforcement activities that are necessary to make global data markets safe, trustworthy and competitive. Among the report's considerations are privacy and data transfer rules as well as data protection enforcers' powers, resources and enforcement work.

Click on the link for the full story.

Poland's DPA fines bank over unlawful ID card scans.

Poland's data protection authority, the Urząd Ochrony Danych Osobowych, fined ING Bank Śląski's PLN18.5 million regarding insufficient analysis of the necessity and proportionality of customer data collection. The bank allegedly did not perform a risk assessment and justification analysis for its identification card scans to verify customers over an 18-month period.

Click on the link for the full story.

IAPP Weekly News 25.08.2025 - 29.08.2025