Latest Worldwide Developments on Personal Data

CNIL creates guide to data retention periods for common HR processes.

France's data protection authority, the Commission nationale de l'informatique et des libertés, created a new guidance framework for controllers to identify retention periods for human resources data. The guide does not cover retention periods for data contained in individual employees' personnel files, but instead relates to frequent HR processes, including recruiting data, administrative management of personnel, compensation data and company vehicle data.

Click on the link for the full story.

Iran threatens to attack US tech companies.

Iran's Islamic Revolutionary Guard Corps threatened to strike U.S. technology companies' offices in the Middle East in retaliation for conflicts with the U.S. and Israel, Wired reports. The IRGC urged employees of companies, including Apple, Google, IBM, Intel, Microsoft, Tesla and Boeing, to evacuate offices in the Middle East. The IRGC previously attacked Amazon Web Services' data centers in the Middle East, impacting its servers.

Click on the link for the full story.

France's Senate approves social media ban for underage users.

France's Senate approved a social media ban for individuals under age 15, though Parliament will have to come to an agreement over certain aspects of the bill after the Senate added additional amendments, Euronews reports. The National Assembly's lower house previously passed a version of the bill that would delete social media accounts of those under age 15, while the upper house amended the legislation to require parental consent before allowing underage users to access social platforms that could be considered harmful.

Click on the link for the full story.

FCC urges US Supreme Court to rule in favor of fines for telecoms' location data collection.

The U.S. Federal Communications Commission and consumer advocacy groups are urging the U.S. Supreme Court to rule in favor of the FCC's fines against telecommunications companies AT&T and Verizon for allegedly collecting geolocation information without consent, MediaPost reports. The companies argued the FCC's claims as well as the fines issued against them have impacted their reputations without due process. Meanwhile, Google requested a judge from the U.S. District Court for the Southern District of California appeal a jury's decision to fine the company USD425 million for allegedly collecting user analytics after they opted out of data collection.

Click on the link for the full story.

FBI warns of security risks associated with foreign apps.

The FBI released a public service announcement raising concerns about China-based mobile apps' data collection and potential security risks. The agency said U.S. users should remain cautious about what data the apps ask to collect and recommended users disable data sharing, update passwords and only download apps from verified app stores.

Click on the link for the full story.

European Commission insists key pieces of digital rulebook untouchable in US talks.

The European Commission confirmed negotiations are ongoing over a U.S. role in shaping the bloc's amended digital policies, Euractiv reports. The Commission has publicly reiterated that key elements of its digital rulebooks, including the EU Digital Services Act and Digital Markets Act, are not to be renegotiated with the U.S. A Commission spokesperson said the talks with the U.S. are to establish a "dialogue to reinforce our cooperation on digital technologies and markets.

Click on the link for the full story.

Canadian government launches review of Privacy Act.

The government of Canada announced it launched a review of the Privacy Act, a federal law that governs more than 250 government institutions that collect, use, disclose and secure Canadian citizens' personal data. According to the government's announcement, the Privacy Act has not been "substantially" updated since its implementation in 1983. President of the Treasury Board Shafqat Ali said, "Safeguarding the personal information of Canadians is essential to maintaining public trust. Updating the Privacy Act will reinforce privacy protections and help ensure government institutions operate in a transparent and accountable manner in the digital age.

Click on the link for the full story.

Advocates warn children's online safety over-correction could erode free speech online.

Some digital rights advocates warn the Kids Online Safety Act may lay the groundwork for an online censorship regime following the multimillion dollar verdict in the social media addiction trial against Meta in California, Rolling Stone reports. Electronic Frontier Foundation Director of Federal Affairs India McKinney said a law like KOSA, aimed at protecting children online, may exacerbate the problem. She said they "have to identify the population to know who gets special protections" without being able to do so in a "privacy-protected way.”

Click on the link for the full story.

US court approves settlement to allow Google users to limit the personal data shared in RTB auctions.

The U.S. District Court for the Northern District of California approved Google's settlement in a class-action lawsuit that will allow users to limit their data shared in real-time bidding auctions after the lawsuit claimed the company's RTB practices violated consumer privacy, MediaPost reports. Connecticut Attorney General William Tong showed his approval of the settlement noting Google's new RTB mechanisms and "account-level design would permit consumers to maintain their signed-in status while opting out of full RTB with a single election that applies across all devices.

Click on the link for the full story.

UK FCA, ICO release guidance on navigating consumers' data in sensitive situations.

The U.K. Financial Conduct Authority and the Information Commissioner's Office released guidance on the regulatory obligations of companies that process individuals' sensitive data, particularly those who could be considered more vulnerable. The ICO said organizations must ensure they are compliant with privacy regulations, such as the U.K. General Data Protection Regulation, anonymize personal data when possible and remain transparent about how consumer data will be collected and processed.

Click on the link for the full story.

IAPP Weekly News 30.03.2026 - 03.04.2026