Latest Worldwide Developments on Personal Data

AEPD reports nearly 19,000 complaints received in 2024.

Spain's data protection authority, the Agencia Española de Protección de Datos, said AI, video surveillance, internet services, commerce, transportation and hospitality were the most common issues of the 18,855 complaints received in 2024. The agency said it responded to 62 emergency interventions through its priority reporting channels, which was a 72% increase compared to 2023.

Click on the link for the full story.

Data analysis firm expands US government data sharing support.

The White House is expanding the work of data analysis firm Palantir across the U.S. government after President Donald Trump signed an executive order in March calling for federal agencies to share data across their operations, The New York Times reports. Palantir's Foundry product has been integrated with "at least" four federal agencies, including the Department of Homeland Security and Department of Health and Human Services. Additionally, Palantir is in reported talks with the Social Security Administration and Internal Revenue Service to sell its technology to the agencies.

Click on the link for the full story.

Records show US collecting migrant children's data in criminal database.

Wired reports the U.S. government has collected the DNA of hundreds of thousands of migrant children in a national database used to track criminals, according to release records. The data is expected to be stored indefinitely, and privacy advocates say the practice represents an escalation in the surveillance of migrants.

Click on the link for the full story.

OCR reaches settlement over unauthorized data access.

The U.S. Department for Health and Human Services' Office for Civil Rights settled with Florida health care provider BayCare Health System over a complaint that unauthorized personnel had access to sensitive health information. The company agreed to a corrective action plan and paid the agency USD800,000.

Click on the link for the full story.

Motivations for upholding ban on US sensitive data transfers to adversarial countries.

The Chertoff Group Senior Advisor Daniel Sutherland, CIPP/G, and IAPP Cybersecurity Law Center Managing Director Jim Dempsey wrote for Lawfare to examine the Trump administration's support of the U.S. law banning bulk sensitive data transfers to adversarial regimes that was established under the Biden administration. Sutherland and Dempsey recap how the Biden order came to be viewed as a critical national security tool, which includes the banning of Kaspersky software in the U.S. and the ongoing data privacy issues surrounding TikTok.

Click on the link for the full story.

Customer contact data stolen in Adidas data breach.

Adidas said the contact information of people reaching out to its customer service desk was stolen after the company sustained a data breach, BBC News reports. Passwords and payment data were not affected, but consumer advocacy group “Which?” warned customers should be wary of unsolicited phone calls and to keep an eye on their banking statements.

Click on the link for the full story.

GDPR simplification opinion, EU digital rulebook mapping among EDPB plenary items.

The European Data Protection Board published the agenda of its 3 June plenary meeting. Notably, the board will discuss a joint opinion with the European Data Protection Supervisor on the simplification of recordkeeping requirements under Article 30(5) of the EU General Data Protection Regulation. Also listed for discussion and potential adoption are a mandate for a mapping exercise on the EU digital rulebook and guidelines for data transfers or disclosures not authorized by EU law under Article 48 of the GDPR.

Click on the link for the full story.

LexisNexis reports sensitive data affected in breach.

Wired reports data analytics company LexisNexis Risk Solutions disclosed more than 360,000 consumers' sensitive information was stolen in a recent data breach of a third-party supplier. Names, birthdates, phone numbers, postal and email addresses, social security numbers, and driver license numbers were among the information breached. The company did not disclose if it had received a ransom demand.

Click on the link for the full story.

Denmark's DPA develops new cybersecurity measures.

Denmark's data protection authority, Datatilsynet, added two additional cybersecurity measures to its existing catalog under its "malicious activity" tab. The new measures were developed in response to an increased number of data breaches due to hacking activities.

Click on the link for the full story.

Inside the handling of the Salt Typhoon breach.

The U.S. government allegedly did not make telecommunication companies aware of the Salt Typhoon hack affecting more than one million individuals' data until after it had been made public, CyberScoop reports. The delayed response was one of many criticisms of the government's handling of the breach, which some former and current government officials rejected, arguing a coordinated effort was made to notify affected parties.

Click on the link for the full story.

IAPP Weekly News 26.05.2025 - 30.05.2025