Issue 289

EU

  • European Commission has released the Digital Omnibus Regulation Proposal.
  • France’s data protection authority published its survey findings on personal data monetization.
  • AZOP, Croatian data protection agency imposed a EUR 4.5 million fine on a telecom provider for GDPR violations.
  • The Irish Council for Civil Liberties filed a complaint against the European Commission for using ChatGPT in public documents.
  • EU Council adopted new legislation to aimed at expediting of cross-border data protection complaints.
  • IAPP Europe Data Protection Congress 2025 held in Brussels.
  • European Commission issued a report on the implementation of the Digital Services Act.
  • European Court of Justice delivered a ruling on direct marketing.
  • EU Data Protection Supervisor published a guidance on AI system risk management.
  • Civil society organizations issued an open letter to EU Commission against internal draft of Digital Omnibus initiative.

Americas

  • Ontario’s Information and Privacy Commissioner updated its Privacy Impact Assessment guide.
  • ANPD, Brazil’s data protection agency issued preventive directive following inquiry into WhatsApp data used by Meta.
  • Meta agreed to a USD 190 million settlement in shareholder’s lawsuit relating to privacy concerns.
  • DoorDash reported a data breach that exposed customers’ phone numbers and physical addresses.
  • New York’s law on AI Companion safeguards officially came into force.

APAC

  • Monetary Authority of Singapore launched a consultation on proposed AI risk management guidelines.
  • Thailand’s Personal Data Protection Committee opened consultation on draft Personal Data Protection Act.
  • South Korea’s Ministry of Science and ICT began consultation on the AI Act’s draft Enforcement Decree.
  • Data Security Council of India released its insight brief on Digital Personal Data Protection Rules.

Africa