Issue 269

EU & UK

  • The EU Commission hosted a consultation on draft guidelines on minors’ protection under DSA.
  • The EDPB adopted opinions on the draft decisions of the Dutch Supervisory Authority regarding the Controller BCR of Signify and ASML Groups.
  • EDPB published the final version of guidelines on data transfers to third-country authorities and SPE training material on AI and data protection.
  • The French SA fined CALOGA EUR 80000, reflecting the large user impact, the company’s market presence, profits from the breaches, and its closure in 2024.
  • The Court of Appeal of Stockholm fined Spotify SEK 58 million for failing to comply with the GDPR regarding data subject rights. 
  • The EDPB issued an opinion under Article 70(1)(e) of the GDPR, in line with its mandate to ensure consistent application of the regulation across the EU.

AMERICAS

  • The U.S. International Trade Administration launched its international privacy certifications under the Global Cross-Border Privacy Rules and Global Privacy Recognition for Processors Systems.
  • A U.S. House subcommittee hearing on the U.K.-U.S. CLOUD Act drew bipartisan pushback against the U.K.’s attempt to access encrypted Apple cloud data.
  • The DAA has launched a process to explore new guidance on applying its Self-Regulatory Principles to AI systems using interest-based advertising data.
  • The ad industry urged California officials to revise proposed privacy rules, including one mandating risk assessments for using sensitive location data in ads.
  • Connecticut passed a bill amending its Data Privacy Act, expanding the scope, redefining sensitive data, raising the minimum age to 17, and adding rights to challenge profiling and access third-party data sale lists

ASIA PACIFIC

  • The NZ Privacy Commissioner found Foodstuffs North Island’s facial recognition trial compliant with the Privacy Act, while urging businesses to ensure legal adherence.
  • The Regulations on Government Data Sharing, adopted by China’s State Council, govern data sharing between government departments and authorised organisations, excluding state secrets.