Issue 300

APAC

  • The Supreme Court of India cautioned a major social media platform against using citizens’ private information for targeted advertising.  
  • South Korean Personal Information Protection Commission announced the results of its 2025 evaluation of personal information processing policies.  
  • China’s CAC introduced new regulations classifying online information that may affect minors.  
  • Personal Data Protection Commission of Taiwan published draft measures on maintaining security of personal data files.  
  • Singapore’s Infocomm Media Development Authority released model framework for governance of agentic AI.  
  • AI Regulation Law establishing liability for processing of personal data using AI came into force in Uzbekistan.

EMEA

  • European Union and Brazil adopted mutual adequacy decisions, creating largest area of secure data flow.  
  • The UK Information Commissioner’s Office fined two companies a combined GBP 225,000 for sending unsolicited marketing communications.  
  • France’s CNIL issued final recommendations on collecting user consent across multiple devices.  
  • European Data Protection Board established cooperation procedure for authorization of contractual clauses and adoption of Standard Contractual Clauses under GDPR.  
  • Spanish Data Protection Agency reported receipt of more than 2,700 notifications of personal data breach in 2025.  
  • Monaco’s Personal Data Protection Authority issued opinion on draft law relating to confidentiality in medical, medico-social or social context.  
  • European Commission launched investigation into AI assistant and social media company’s recommender system under Digital Services Act.  
  • Liechtenstein’s Data Protection Office released guidance regarding handling of personal data during due diligence in company sale.  
  • CNIL launched a consultation on proof of consent in marketing sector.  
  • EU Commission initiated proceedings to help technology company comply with Digital Markets Act obligations on interoperability and online search data sharing.

Americas

  • California’s Attorney General issued a cease-and-desist letter to AI company to stop creation and distribution of deepfake, inappropriate images and child sexual abuse material.  
  • Electronic Privacy Information Centre developed people-first model chatbot bill, addressing key data privacy violations.  
  • Brazil’s Data Protection Agency, Federal Prosecution Office and Consumer Secretariat issued joint recommendations to social media company to stop inappropriate AI content.  
  • Social Media Regulation Act passed by South Carolina General Assembly.  
  • US Department of Justice’s lawsuit seeking data of California voters dismissed by the Federal Court.