Latest Worldwide Developments on Personal Data

Sweden's DPA fines company for lax data security in 2025 breach case.

Sweden's data protection authority, the Integritetsskyddsmyndigheten, issued a SEK6 million fine to Sportadmin following an investigation into a 2025 data breach of the company. The IMY claimed a hacker stole personally identifiable information on 2.1 million people from Sportadmin and published it on the dark web. The IMY investigation found the company suffered from "technical and organizational deficiencies" prior to the attack.

Click on the link for the full story.

China's CAC seeks feedback on financial data guidance.

The Cyberspace Administration of China is seeking feedback on its guidelines for classifying and grading financial information service data. The document looks to standardize data processing activities in financial services under China's cybersecurity and data protection laws. It applies to information such as business data, financial market data and organizational information. The deadline for feedback is 23 Feb.

Click on the link for the full story.

TikTok's new US policies allow user location data collection.

TikTok updated its U.S. policies allowing companies to collect consumers' approximate location data after the company signed an agreement to shift its operations to the U.S. to prevent a ban on the platform, BBC News reports. Location sharing can be turned off, though TikTok is also looking to use its AI tools to collect data on user platform interactions.

Click on the link for the full story.

CNIL fines information system for inadequate data practices leading to a breach.

France's data protection authority, the Commission nationale de l'informatique et des libertés, fined the France Travail information system 5 million euros after alleged insufficient data protection practices allowed hackers using social engineering to compromise Cap Emploi advisor accounts. An investigation revealed registered individuals from the last 20 years had their data breached, including social security numbers, addresses and phone numbers. France Travail was ordered to implement corrective measures or face an additional 5,000 euro-daily penalty.

Click on the link for the full story.

Data Governance Act: Mapping the interplays with the GDPR.

The IAPP Research and Insights Team's EU Digital Laws Report 2025 maps the interplay between the EU General Data Protection Regulation and other relevant instruments in the EU digital rulebook. A new series of IAPP infographics depicts the extent of individual interplay outlined in the report. This installment covers the Data Governance Act.

Click on the link for the full story.

French president vows to move quickly on social media age limitation bill.

French President Emmanuel Macron plans to quickly advance a law to ban social media for children under age 15, with the goal of implementing it by September, Euractiv reports. Bills in the French Parliament can be read once in each chamber under an expedited bill process the government can use. The ban would be one of several considered internationally as more regulators show concern about the negative effects social media platforms can have on children.

Click on the link for the full story.

Poland's DPA fines postal service for DPO's lack of independence.

Poland's data protection authority, the Urząd Ochrony Danych Osobowych, announced a PLN978,000 fine against the country's postal carrier, Poczta Polska, for failure to maintain the independence of its data protection officer. The UODO opened an investigation following the company reporting a data breach where an unauthorized person gained access to personal information contained on a form. The investigation found the company's DPO held a dual "managerial and substantive position in the organization directly related to the processing of personal data" beyond their DPO role.

Click on the link for the full story.

Netherlands' DPA issues report on municipal employees committing personal data breaches.

The Netherlands' data protection authority, Autoriteit Persoonsgegevens, published a study examining the conditions under which municipal civil servants commit personal data breaches. The AP found there are generally 10-20 data breaches per year committed by civil servants unlawfully accessing personal data. Typically, workers are either coerced by a criminal organization to access personal data, dealing with family trouble or wanted information on a celebrity.

Click on the link for the full story.

Google Assistant recording lawsuit yields $68M settlement.

Google agreed to pay a USD68 million settlement to resolve a class-action lawsuit in the U.S. District Court for the Northern District of California claiming its Google Assistant listened to users' conversations and then used the collected voice data to serve targeted advertising, Reuters reports. Google reportedly denied the allegations, but agreed to the settlement to avoid incurring the costs associated with litigating the case.

Click on the link for the full story.

EDPB highlights children's data protection work, new resource hub.

The European Data Protection Board commemorated Data Protection Day 2026 by highlighting its children's online safety work and priorities. Among the future deliverables are guidelines for children's data processing, included in the EDPB's 2024-27 strategy. The board also announced it will soon launch "Privacy for Kids," a dedicated hub for children, parents and teachers to access resources that support children's data protection education.

Click on the link for the full story.

IAPP Weekly News 26.01.2026 -30.01.2026