Latest Worldwide Developments on Personal Data

ICO issues guide for using automated profiling tools.

The U.K. Information Commissioner's Office published guidelines for entities using automated profiling tools, as defined by the U.K. General Data Protection Regulation, in trust and safety processes. The guidance features frequently asked questions on topics, including how to demonstrate compliance with data protection law and data minimization requirements, and explains how recommendations can be applied to Online Safety Act compliance practices. The ICO noted the guidance is under review and may change as certain elements of the Data (Use and Access) Act enter into force.

Click on the link for the full story.

ICO releases guidance on public disclosure of documents.

The U.K. Information Commissioner's Office released guidance aimed at organizations disclosing documents to the public. The guidelines detail how to look for hidden personal information to ensure it is not accidentally released or breached. "This crucial step cannot be missed," ICO Deputy Commissioner Emily Keaney said of document reviews while citing prior instances of accidental breaches by the Police Service of Northern Ireland and the Ministry of Defence.

Click on the link for the full story.

UK Online Safety Act's age verification provisions take force.

The U.K.'s Office of Communications advised on the Online Safety Act's age verification requirements, which took force 25 July. The required verification and assurance practices are geared toward protecting minors from harmful content online. Ofcom also launched its assessment initiative aiming to provide a review of platforms' content moderation tools, algorithm configurations and measures to prevent adult strangers from contacting minors.

Click on the link for the full story.

Minnesota's comprehensive privacy law takes force.

The Minnesota Consumer Data Privacy Act took effect 31 July. The law contains common data subject rights and business requirements around data protection assessments and consent for the processing of sensitive personal data. It also has unique provisions for user rights around automated decision-making and profiling, and an implied obligation to appoint a chief privacy officer or organizational privacy lead. The law's 30-day cure period will sunset 31 Jan. 2026.

Click on the link for the full story.

Google to begin US rollout for age assurance tools.

Google will begin to launch age-assurance tools to some U.S. users over the coming weeks. The tools aim to identify underage individuals to ensure additional privacy tools are implemented and personalized advertising is disabled. Google noted it designed its approach "with user privacy in mind" and it "does not involve collecting additional data or sharing granular user information with all apps and websites."

Click on the link for the full story.

US representatives introduce bipartisan bill to protect genetic data.

U.S. Reps. Zoe Lofgren, D-Calif., and Ben Cline, R-Va., introduced the Don't Sell My DNA Act, a bipartisan effort to protect individuals' biometric data collected by genetic testing companies. The bill was created in response to the controversy surrounding 23andMe's bankruptcy proceedings and aims to update the current Bankruptcy Code to block biometric data from being sold as an asset when a genetic testing company files for bankruptcy.

Click on the link for the full story.

CNIL opens consultation on cybersecurity recommendations for filtering web gateways.

France's data protection authority, the Commission nationale de l'informatique et des libertés, opened a public consultation on its draft recommendation on cybersecurity features of filtering web gateways. The recommendation is geared toward data controllers using gateway filters to secure employees, agents, service providers and external visitors when they web browse on an organization's network. The consultation closes 30 Sept.

Click on the link for the full story.

Ireland's DPC launches tools to help protect vulnerable adults.

Ireland's Data Protection Commission said it has launched a toolkit to protect vulnerable adults' data. It provides templates, examples and practical advice to help organizations navigate EU and national data protection laws.

Click on the link for the full story.

Garante raises concerns about health data sharing with AI platforms.

Italy's data protection authority, the Garante, is urging users to remain cautious about uploading medical records or files onto AI platforms for health advice. Before sharing this information, users should be aware of the platform's data retention and deletion policies, the Garante said.

Click on the link for the full story.

EDPS closes complaint against European Commission for its Microsoft 365 use.

The European Data Protection Supervisor announced the European Commission completed the necessary remedies to resolve data protection issues outlined by the EDPS over the Commission's use of Microsoft 365 in March 2024. The compliance measures undertaken by the Commission included limits on what types of personal data is processed by the Commission using Microsoft 365 and a halt on transfers to third countries that have not been deemed adequate by the Commission.

Click on the link for the full story.

IAPP Weekly News 28.07.2025 - 01.08.2025