Latest Worldwide Developments on Personal Data

ICO publishes guidance on anonymization, pseudonymization.

The U.K. Information Commissioner's Office issued guidance on anonymization and pseudonymization practices. The guide is intended to help individuals and organizations better understand the strengths and weaknesses of various techniques, covering how to ensure effectiveness through accountability and governance requirements.

Click on the link for the full story.

Denmark's DPA details data protection impacts of connected cars.

Denmark's data protection agency, Datatilsynet, discussed the challenges surrounding connected cars. The agency noted the consent mechanisms around sharing data with car manufacturers is often unclear and noted data protection laws demand you be able to opt out of data collection if desired.

Click on the link for the full story.

Latvia's DVI releases guidance on video surveillance in educational settings.

Latvia's Data State Inspectorate discussed the use of video surveillance in schools and how a legal basis for using surveillance must be determined before implementing the technology. The DVI said school data protection officers must assess the potential risks of using video surveillance to ensure students' privacy remains protected.

Click on the link for the full story.

Poland's DPA issues DPIA guidance.

Poland's data protection authority, the Urząd Ochrony Danych Osobowych, issued guidance to help data controllers understand when a data protection impact assessment should be conducted. The UODO lists 12 types of processing operations and examples of what constitutes high-risk activity that could violate an individual's rights.

Click on the link for the full story.

CNIL releases recommendations for multifactor authentication.

France's data protection authority, the Commission nationale de l'informatique et des libertés, published recommendations on how to use multifactor authentication for better data protection. The agency noted any authenticators must also comply with the EU General Data Protection Regulation, specifically with requirements around legal basis, data minimization and retention periods.

Click on the link for the full story.

ICO reviews children's financial data collection practices.

The U.K. Information Commissioner's Office reviewed how the financial services sector handles children's data collection and details what improvements could be made. The findings included a need to revisit privacy information as children age and more of a distinction between marketing toward children and adults. Separately, the ICO addressed planned improvements to its complaint response times.

Click on the link for the full story.

Microsoft to roll out Consent Mode for improved ad privacy.

Microsoft's advertising unit announced it will fully implement its Consent Mode 5 May. The adjustable feature aims to improve regulatory compliance around user consent signals while fostering user trust and increasing advertising performance. Consent Mode recognizes signal sharing through IAB's Transparency and Consent Framework and other consent management platforms.

Click on the link for the full story.

Ireland's DPC expected to fine TikTok 500M euros.

Ireland's Data Protection Commission is anticipated to issue a 500 million euro EU General Data Protection Regulation fine to TikTok's parent company, ByteDance, for allegedly transferring personal data to China, Bloomberg reports. The final decision, which has yet to be published by the DPC, will reportedly call on TikTok to halt unlawful processing of EU individuals' data in China.

Click on the link for the full story.

European Commission to introduce potential GDPR reform.

Politico reports the European Commission plans to introduce a proposal to reform the EU General Data Protection Regulation in the "coming weeks," according to European Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection Michael McGrath. The reform, part of a broader simplification of EU digital rules, is expected to focus on easing the GDPR's reporting requirements for small and medium-sized businesses.

Click on the link for the full story.

Lithuania's DPA concludes review of online retailers' data processing practices.

Lithuania's State Data Protection Inspectorate recommends online stores conduct regular audits of privileged access rights, create a destruction process, use encryption to protect data and more as part of a review of online store data practices. The review was carried out as part of the agency's planned 2024 monitoring activities.

Click on the link for the full story.

IAPP Weekly News 31.03.2025 - 04.04.2025