Issue 325

APAC

  • The Indian Parliament listed a bill proposing parental consent for children to access social media and online gaming platforms.
  • South Korea’s PIPC imposed a fine of KRW 168 million on an outsourcing service company for inadequate access controls and authentication safeguards.
  • Japan’s House of Councillors passed a bill to amend the Act on the Protection of Personal Information.
  • Singapore’s PDPC and IMDA published a federated learning guide and new use cases under the Privacy-Enhancing Technologies Sandbox.
  • South Korea’s PIPC issued clarification on data portability requirements governing automated data scraping.

EMEA

  • The European Commission issued binding measures under Digital Markets Act concerning a technology company’s Android AI interoperability and search data sharing.
  • UK’s ICO imposed a fine of GBP 130,000 on a marketing company for unlawful direct marketing calls.
  • France’s CNIL published FAQs on implementing its recommendation regarding tracking pixels in emails.  
  • Italy’s Garante sanctioned a telecommunications company EUR 1.71 million over security failures leading to data breach.
  • The European Data Protection Board instructed Belgium’s Data Authority to assess the merits of NOYB’s cookie banner complaint against a public broadcasting company.
  • The Hungarian National Bank stated that banks would bear losses from unauthorized cyber fraud if strong customer authentication was not implemented.
  • The European Commission and AI Board assessed the Code of Practice on transparency of AI-generated content.
  • Slovenia’s Information Commissioner published FAQs on deepfakes and personal data protection.
  • Poland’s Data Management Act, implementing the EU Data Governance Act entered into force.
  • The UK’s DSIT sought evidence for data regulation in the age of AI and other data intensive technologies.  
  • The EU Court of Justice ruled that online publishing of anti-doping violations must comply with the GDPR.
  • The Netherlands’ AP published new guidelines and implementation tool for generative AI. 
  • Israel’s Privacy Protection Authority published recommendations for the safe personal use of AI agents.

Americas

  • U.S. Senators introduced the Digital Age Assurance Act to establish a device level age assurance framework.
  • Canada’s securities regulator published updated cybersecurity findings and guidance for registered firms. 
  • The FTC ordered a resident screening company to pay USD 2.25 million for alleged violations of the Fair Credit Reporting and FTC Act.
  • Texas’ AG secured a temporary injunction requiring a communications platform to implement age assurance and child safety protections.
  • A coalition of U.S. Attorneys General secured a USD 18 million settlement with a genetic testing company for its 2023 data breach. 
  • Illinois’ Governor signed the Children’s Social Media Safety Act establishing age assurance and child safety requirements for online platforms.
  • Hawaii enacted the AI Disclosure and Safety Act, strengthening safeguards for AI companion services.