The U.S. House of Representatives passed the TAKE IT DOWN Act 409-2 and sent it to President Donald Trump for his signature. The bill requires website operators to remove nonconsensual explicit images and videos, including AI-generated deepfake content, within 48 hours of a user request.
While companies are embracing embedding privacy principles into their product development processes, Meta Product Privacy Program Manager Rahul Chidugulla, CIPM, opines a "critical blind spot often remains in safeguarding user data within their internal systems." He offers recommendations for conducting privacy reviews as part of internal data analytics reviews, such as building infrastructure to understand when user data is queried and implementing access controls.Full story
The California Privacy Protection Agency opened a public comment period on its proposed Delete Request and Opt-out Platform regulations. The draft DROP regulations are part of the rulemaking process for the state's Delete Act. The regulations are a tool allowing state residents to delete their personal information stored by CPPA-registered data brokers with a single request.
Brazil's data protection authority, the Autoridade Nacional de Proteção de Dados, announced a successful review of 20 companies' level of compliance with data protection officer requirements under the General Personal Data Protection Law. The inspection, which began in November 2024, primarily focused on controllers frequently cited in data subjects' requests due to the lack of a dedicated DPO.
The U.K. National Cyber Security Centre released a report on cryptography techniques that can help organizations comply with data protection obligations. The report detailed advanced cryptography techniques, including Fully Homomorphic Encryption and Multiparty Computation, which can be used "to tackle problems that can't be solved simply by encrypting, decrypting, signing, and verifying information."Full story
Connected vehicle subscription features, such as cameras that collect collision information, could allow law enforcement agencies to use consumer data for government surveillance, Wired reports. Vehicle subscription features collect sensitive user information, including geolocation and phone data, that may be provided by automakers to law enforcement agencies for investigations.Full story
Israel's Privacy Protection Authority released draft guidelines on how the Privacy Protection Law applies to AI systems. The guidance covers lawful bases for processing training data, consensual public data use, general consent standards and more. Public comments on the draft guide are due 5 June.Full story
The U.S. government has collected vast amounts of information about U.S. citizens, raising concerns over how sensitive data could be used, The Atlantic reports. White House spokesperson Harrison Fields said the U.S. Department of Government Efficiency is combining citizens' data from various government agencies to "identify fraud and prevent criminals from exploiting hardworking American taxpayers."Full story
The Hamburg Commissioner for Data Protection and Freedom of Information published guidelines on the EU Data Act that highlight "the need for action and outlines the options for data protection oversight." Additionally, the HmbBfDI will hold a 15 May forum on the Data Act's implementation and its potential "tension" with EU General Data Protection Regulation compliance.Full story
The Saudi Data and AI Authority published draft rules for "controls, procedures, and requirements" under the Personal Data Protection Law. The draft rules, under consultation through 20 May, detail how the law applies to the commercial, professional and nonprofit entities.Full story