The U.S. Department of Justice issued the final rule implementing the Biden administration's executive order preventing the access and transfer of citizens' sensitive personal data to adversarial countries. According to a DOJ fact sheet, the final rule identifies certain classes of prohibited, restricted and exempted data transfers, as well as identifying the persons covered under the rule.
Italy's data protection authority, the Garante, fined OpenAI 15 million euros over alleged EU General Data Protection Regulation violations. The Garante claimed the company did not adequately identify a legal basis for processing personal data toward the development and deployment of its AI products.
Bavaria's State Office for Data Protection Supervision ordered biometric and blockchain company Worldcoin to establish additional EU General Data Protection Regulation compliance measures before resuming EU operations. After a formal investigation, the BayLDA will require Worldcoin to generate a data deletion process and a consent mechanism for certain data processing within 30 days of the order taking effect.
The U.S. Equal Employment Opportunity Commission published a fact sheet discussing potential violations of employment discrimination laws stemming from required use of wearable technology and subsequent biometric data collection, Reuters reports. EEOC Chair Charlotte Burrows said organizations "must be vigilant in following the law to ensure that they do not create a new form of discrimination.
The U.S. Federal Trade Commission finalized its order against Marriott International and Starwood Hotels and Resorts to implement an information security program following data breaches involving more than 344 million customers.
The U.K. Information Commissioner's Office is seeking feedback on updated guidelines for storage and access technologies. The updated guidelines cover the lawful use of user tracking practices, including third-party cookies, pixel tracking and device fingerprinting.
The White House claimed Chinese intelligence agencies hacked U.S. Treasury Department workstations, breaching government documents, The New York Times reports. The Treasury Department said it is working to determine the impact of the breach and will continue to "work with the private sector and government agencies to protect the financial system from hacking."Full story
The California Privacy Protection Agency fined data brokers Infillion and The Data Group USD54,200 and USD46,600, respectively, after alleged noncompliance with data broker registration requirements under the Delete Act. The agency also noted 2025 data broker registration is now open through 31 Jan.Full story
The European Data Protection Board's opinion on the lawful use of personal data for the development and deployment of AI models delves into key questions and clarifications companies are grappling with as they try to balance governance and innovation. Bird & Bird's Alex Jameson, Izabela Kowalczuk-Pakula, Willy Mikalef and Nils Lölfing highlight key takeaways from the opinion that data protection professionals should bear in mind moving forward.Full story
The IAPP Research and Insights Team created an infographic detailing the key dates digital responsibility professionals should be aware of for 2025. The graphic contains effective dates of new digital legislation entering into force around the world next year, regulatory consultation periods and major anniversaries, as well as IAPP events.Full story