Latest Worldwide Developments on Personal Data

CNIL issues guidance on strengthening database security.

France's data protection authority, the Commission nationale de l'informatique et des libertés, published guidance for increasing the cybersecurity of large databases after an uptick in data breaches in 2024. The CNIL's recommendations included advising entities maintaining large databases to secure access to the information system via multifactor authentication as well as logging, analyzing and setting limits on data flows.

Click on the link for the full story.

Ireland's DPC finalizes TikTok decision with potential data transfer ban.

Ireland's Data Protection Commission delivered its final decision on TikTok's alleged unlawful EU data transfer, fining the company 530 million euros and proposing a potential ban on EU transfers to China if corrective measures are not adopted in the coming months. The DPC also highlighted new revelations regarding TikTok's storage of EU data on Chinese servers, which may bring further scrutiny.

Click on the link for the full story.

DeepSeek resumes operations in South Korea after suspension.

AI startup DeepSeek relaunched in South Korea after the company was suspended from the country's app stores due to data protection concerns, Reuters reports. DeepSeek was allowed to reenter South Korea's digital market after the company revised its privacy notice and assumed compliance with the country's Personal Information Protection Act.

Click on the link for the full story.

CPPA, ICO sign cooperation agreement.

The California Privacy Protection Agency and the U.K. Information Commissioner's Office signed a declaration of cooperation, which represents a further step toward harmonizing privacy and data protection across the two jurisdictions. The declaration enables the two agencies to facilitate joint research and education, share best practices, coordinate meetings between respective agency staffers, and develop mutual collaboration mechanisms.

Click on the link for the full story.

US lawmakers urge FTC to establish safeguards for neural data.

U.S. Senate Minority Leader Chuck Schumer, D-N.Y., along with Sens. Maria Cantwell, D-Wash., and Edward Markey, D-Mass., sent a letter to the Federal Trade Commission urging the agency to establish safeguards for companies' use of neural data, MedTechDive reports. The letter claimed a lack of regulations around brain computer interface technology allows companies to collect consumers' sensitive biometric data without restrictions.

Click on the link for the full story.

ANPD completes DPO compliance sweep.

Brazil's data protection authority, the Autoridade Nacional de Proteção de Dados, announced a successful review of 20 companies' level of compliance with data protection officer requirements under the General Personal Data Protection Law. The inspection, which began in November 2024, primarily focused on controllers frequently cited in data subjects' requests due to the lack of a dedicated DPO. The ANPD will continue monitoring the data controllers for six months to ensure continued compliance.

Click on the link for the full story.

NCSC releases report on protecting sensitive data with cryptography.

The U.K. National Cyber Security Centre released a report on cryptography techniques that can help organizations comply with data protection obligations. The report detailed advanced cryptography techniques, including Fully Homomorphic Encryption and Multiparty Computation, which can be used "to tackle problems that can't be solved simply by encrypting, decrypting, signing, and verifying information."

Click on the link for the full story.

Microsoft announces new digital commitments for Europe.

In a company blog post, Microsoft Vice Chair and President Brad Smith unveiled five new European digital commitments amid a "time of geopolitical volatility," while referencing trans-Atlantic trade disputes. The commitments include expanding Microsoft's cloud and AI infrastructure in Europe, protecting the privacy of EU data and defending the EU's cybersecurity.

Click on the link for the full story.

EDPB to review UK adequacy extension, potential independent body adequacy.

The European Data Protection Board will discuss the European Commission's proposed extension to the U.K.'s adequacy decision at its 5 May plenary meeting. The EDPB will also review the European Patent Organisation's efforts to obtain data protection adequacy.

Click on the link for the full story.

Canada's OPC, UK's ICO call for data protection agreement for 23andMe bankruptcy disputes.

The Office of the Privacy Commissioner of Canada, along with the U.K. Information Commissioner's Office, sent a letter urging U.S. trustees in the 23andMe bankruptcy dispute to comply with data protection regulations and increase efforts to protect biometric data collected and stored by 23andMe. Privacy Commissioner Philippe Dufresne said compliance with privacy laws is "of the utmost importance given the significant concerns that Canadians may have about the protection of their personal information going forward, especially given that some of the data has previously been subject to a breach."

Click on the link for the full story.

IAPP Weekly News 28.04.2025 - 02.05.2025