Latest Worldwide Developments on Personal Data

Germany's BfDI finds potential data protection violations in federal website compliance sweep.

Germany's Federal Commissioner for Data Protection and Freedom of Information conducted an automated compliance check of more than 500,000 individual web pages on federal websites and found 40 pages contained YouTube videos directly embedded on them. The BfDI said users' IP addresses are still transmitted to YouTube if a user views the embedded video without their consent, which could be a violation of the Telecommunications-Digital-Services-Data Protection Act.

Click on the link for the full story.

Luxembourg's CNPD posts guidance on retention periods.

Luxembourg's National Commission for Data Protection published guidelines for payment service providers on the retention periods of personal data. The agency noted the guidance is not exhaustive, but it acknowledges the unique circumstances around providers' collection practices and how innovation has "increased the ability of payment service providers to collect, store, combine, and analyze a wide range of data about their users."

Click on the link for the full story.

ICO opens consultation on cross-border transfer guidance updates.

The U.K. Information Commissioner's Office opened a public consultation on its existing cross-border data transfer guidance. The ICO said it hopes to learn what parts of the guidelines are helpful, what areas are difficult to apply and what tools could make data transfers easier. The review comes following finalization of the Data (Use and Access) Act. The consultation closes 7 Aug.

Click on the link for the full story.

Spain's AEPD reports on early 2025 enforcement activities.

Spain's data protection authority, the Agencia Española de Protección de Datos, published a report detailing its enforcement activities during the first half of 2025. The AEPD said it has seen a 30% increase in complaints, as well as more inquires related to AI in the medical, legal and public services domains.

Click on the link for the full story.

IAPP updates 'Key Dates 2025' calendar.

The IAPP Research and Insights Team updated its Key Dates 2025 infographic. The calendar features the effective dates for significant legislative requirements, regulatory consultation periods, anniversaries and IAPP events.

Click on the link for the full story.

State court jury awards California Android users $314M in Google data harvesting lawsuit.

A Santa Clara County Superior Court jury awarded more than USD314.6 million in a 2019 class-action lawsuit against Google alleging it collected data from Californian's Android phones while they were idle, Reuters reports. The plaintiffs claimed the harvested information was used for targeted advertising that consumed their cellular data at their expense. Google said it plans to appeal while still facing a federal class-action lawsuit with similar allegations filed on behalf of Android users from all 50 states.

Click on the link for the full story.

EDPB commits to supporting GDPR simplification, harmonized enforcement.

The European Data Protection Board adopted a statement outlining its plan to support simplification of EU General Data Protection Regulation compliance. The board agreed to develop templates to streamline aspects of compliance, including data breach reporting, along with other resources. Board members also made commitments to "enhance consistency of the application and enforcement" of the GDPR.

Click on the link for the full story.

Netherlands' DPA says ransomware attacks doubled in 2024.

The Netherlands' data protection authority, the Autoriteit Persoonsgegevens, indicated reports of data theft by ransomware doubled in 2024. The agency said organizations surveyed by the agency reported an average loss of 100,000 euros as a result of the attacks.

Click on the link for the full story.

Peru's health care regulator fines clinic for breaching Shakira's information.

Peru's health care regulator, Susalud, issued a PEN688,750 fine to the Delgado Clinic after the clinic allegedly shared singer Shakira's health data on social media, Bloomberg reports. Susalud said the breach violated the singer's "dignity and intimacy," and emphasized patients' data should remain safeguarded.

Click on the link for the full story.

Security vulnerabilities allegedly found within EU border software.

A report by the European Data Protection Supervisor allegedly showed EU border software, the Schengen Information System II, has cybersecurity vulnerabilities, Bloomberg reports. The system was found to be highly vulnerable due to concerns that its shift to the EU's Entry/Exit System, which uses the internet, could make it easier for hackers to obtain sensitive data. The SIS database aims to detect illegal immigrants and criminals and collect individuals' biometric data.

Click on the link for the full story.

IAPP Weekly News 30.06.2025 - 04.07.2025