Issue 279

EU & UK

  • The European Court of Justice upheld the EU–US Data Privacy Framework. 
  • The European Commission released a draft adequacy decision for Brazil. 
  • CJEU clarifies in the context of a transfer of pseudonymised data to third parties
  • CNIL fined Google EUR 325 million and Shein EUR 150 million for consent violations.
  • The EDPS published a report on Data Protection Impact Assessments and its key conclusions.

AMERICAS

  • Google was ordered to pay USD 425 million for allegedly tracking users’ app activity even after it was disabled in settings. 
  • Texas AG sued PowerSchool for data breach of more than 880,000 students and teachers.  
  • The California State Assembly passed a bill on the notification of data breaches.  
  • Public bodies in New Jersey proposed rulemaking under the state’s Data Privacy Act. 
  • The Information and Privacy Commissioner of Ontario issued the first monetary penalty under its health privacy law.

ASIA PACIFIC

  • The Cyber Security Agency of Singapore published its report on the cyber landscape  
  • China’s Ministry of Justice amended the Cybersecurity Law to strengthen legal responsibilities.