Latest Worldwide Developments on Personal Data

Turkey's Parliament approves under age 15 social media ban.

Turkey's Parliament banned children under age 15 from accessing social media, The New York Times reports. The new legislation is expected to be signed into law by President Recep Tayyip Erdogan. Proponents claim it will help curb social media addiction, protect children from cyberbullying and limit their exposure to harmful content. The law would enter into force gradually and does not name what platforms would be covered. The measure also does not state how age will be verified besides platform accessibility through a government-operated portal, raising concerns among privacy advocates.

Click on the link for the full story.

Ireland's Supreme Court dismisses DPC's appeal on stay of TikTok data transfer fine.

Ireland's Supreme Court dismissed the Data Protection Commission's appeal to lift a prior stay issued on its 530 million euro EU General Data Protection Regulation fine against TikTok, The Irish Times reports. The DPC's appeal sought clarification on whether national or EU law needs to be applied when granting a stay. The court ruled the DPC's decision to fine TikTok was not done jointly with EU data protection authorities, leaving the legal proceedings to follow national law.

Click on the link for the full story.

Netherlands' DPA issues draft ADMT guidelines under GDPR.

Attorneys at Hogan Lovells broke down draft guidelines released by the Netherlands' data protection authority, Autoriteit Persoonsgegevens, on the right to explanation for automated-decision making technology under the EU General Data Protection Regulation. Under the guidelines, organizations are only permitted to use ADMT if it is necessary to meet the terms of a contract with an individual, if it is permitted by law or an individual has given consent to its use.

Click on the link for the full story.

CNIL issues activity report guidance for DPOs.

France's data protection authority, the Commission nationale de l'informatique et des libertés, published guidance for data protection officers to assist them with drafting and submitting their activity reports. The CNIL said that while DPOs are not required to draft activity reports, doing so remains a good practice because it allows compliance management reporting to elevate to the highest levels of an organization and allows the CNIL to assess an organization's data protection maturity over time.

Click on the link for the full story.

Nigeria's DPA discards $32.8M fine against Meta.

Nigeria's Data Protection Commission dropped its USD32.8 million fine against Meta over the company's alleged personal data processing practices, raising concerns over the authority's enforcement and transparency obligations, Business Insider Africa reports. The NDPC previously issued the fine against Meta after it allegedly found the company collected individuals' data without consent for targeted advertising and facilitated "unauthorised cross-border data transfers." The NDPC waived the fine after a confidential settlement in October 2025.

Click on the link for the full story.

US Supreme Court weighs privacy implications of geofence warrants.

The U.S. Supreme Court heard oral arguments in Chatrie v. United States, a case weighing whether law enforcement's use of geofence warrants violate individuals' Fourth Amendment protections against unreasonable government searches. IAPP Staff Writer Lexie White reported on the privacy implications associated with geofence warrants and conflicting opinions among Supreme Court justices.

Click on the link for the full story.

US health insurance database exposed providers' Social Security numbers.

The Centers for Medicare and Medicaid Services' new health directory allegedly exposed the Social Security numbers of healthcare professionals, The Washington Post reports. The database was opened to the public for several weeks as part of the center's data transparency initiatives. The CMS said it has "taken steps to address it promptly and reinforce safeguards around data submission and validation."

Click on the link for the full story.

South Korea's PIPC revises guidelines for drafting privacy notices.

South Korea's Personal Information Protection Commission released revised Guidelines for Drafting Personal Information Processing Policies to reflect advances of generative AI and new technologies that allow for "on-device" data processing. The revision features five main components, including issuing a privacy notice for on-device processing if data is not transmitted to an external server and requiring data controllers to issue specific information on how they protect data subjects' rights in their privacy notice.

Click on the link for the full story.

European Commission claims Meta breached its children's online safety terms.

Potential reforms to the EU's landmark AI Act are facing a delay after the European Parliament and the Council of the European Union were unable to reach a common negotiating position. After 12 hours of negotiations that began 28 April and concluded in the early morning hours the next day, the institutions decided to resume talks next month. IAPP Editorial Director Jedidiah Bracy reports on the latest developments.

Click on the link for the full story.

Online therapy app collected sensitive patient data.

Online therapy app Talkspace allegedly collected patients' sensitive personal data from therapy sessions, allowing a patient, Jennifer Kamrass, to have her private therapy sessions and transcripts used against her in a lawsuit, Proof News reports. While Talkspace noted it anonymizes patient data, Kamrass' records were secured by her former employer in a lawsuit over wrongful termination. A report to Talkspace investors claimed it collected more than 140 million messages and transcripts from patient therapy sessions to use to train their AI model.

Click on the link for the full story.

IAPP Weekly News 27.04.2026 - 01.05.2026