Issue 208

EU & UK

  • Guernsey’s Office of the Data Protection Authority published guidance covering data sharing, handling data subject access requests, as well as environmental, social, and governance reporting.
  • French data protection authority imposed a fine of EUR 105,000 on NS Cards France SAS for violation of the General Data Protection Act.
  • None of your business (NOYB) filed a complaint against Meta Platforms Ireland Limited with the Austrian data protection authority, alleging that Meta does not provide ease of withdrawing consent, in violation of the General Data Protection Regulation.
  •  French data protection authority published a draft practical guide for transfer impact assessment and invited public comments on the same. 

AMERICAS

  • Mexico’s National Institute for Transparency, Access to Information, and Personal Data Protection published a report summarizing the fines it had imposed for violations of the Federal Law on Protection of Personal Data Held by Private Parties in 2023.
  • The California Privacy Protection Agency released its draft strategic plan to protect consumers’ privacy, ensure that businesses and consumers are well informed about their rights and obligations, and enforce the law against businesses that violate their privacy rights.
  • The Federal Trade Commission issued a proposed order prohibiting X-Mode Social, Inc. and its successor Outlogic, LLC. from sharing or selling any sensitive location data to settle allegations that the company sold sensitive location data without first obtaining informed consent from consumers in violation of the Federal Trade Commission Act.
  • Senate Bill 24-041 on Privacy Protections for Children’s Online Data was introduced in the Colorado State Senate and assigned to the Business, Labor, and Technology Committee.

ASIA PACIFIC

  • The Cyber Security Agency of Singapore (CSA) published the Safe App Standard for mobile applications.
  • Japan’s Personal Information Protection Commission updated its Q&A on the Act on the Protection of Personal Information and added example five to its data breach report guidance to clarify proxy reporting by cloud providers.
  • China’s National Information Security Standardization Technical Committee (TC260) requested public comments on two draft national standards.