The White House claimed Chinese intelligence agencies hacked U.S. Treasury Department workstations, breaching government documents, The New York Times reports. The Treasury Department said it is working to determine the impact of the breach and will continue to "work with the private sector and government agencies to protect the financial system from hacking."Full story
The California Privacy Protection Agency fined data brokers Infillion and The Data Group USD54,200 and USD46,600, respectively, after alleged noncompliance with data broker registration requirements under the Delete Act. The agency also noted 2025 data broker registration is now open through 31 Jan.Full story
The European Data Protection Board's opinion on the lawful use of personal data for the development and deployment of AI models delves into key questions and clarifications companies are grappling with as they try to balance governance and innovation. Bird & Bird's Alex Jameson, Izabela Kowalczuk-Pakula, Willy Mikalef and Nils Lölfing highlight key takeaways from the opinion that data protection professionals should bear in mind moving forward.Full story
The IAPP Research and Insights Team created an infographic detailing the key dates digital responsibility professionals should be aware of for 2025. The graphic contains effective dates of new digital legislation entering into force around the world next year, regulatory consultation periods and major anniversaries, as well as IAPP events.Full story
Incogni's Mariam Volobueva, Brenden Arakaki and Adam Choliński emphasize that protecting employees' personal information is a way to reduce spear phishing risk for organizations. They discuss why employee data is the "easiest entry point" for those attacks, while outlining the lines of defense available to companies.Full story
The EU AI Office released the second draft of the General-Purpose AI Code of Practice, which incorporates feedback received on its first draft published 14 Nov. The second draft looks to provide a "future-proof" code that will be critical for AI models released after 2 Aug. 2025, which will be subjected to new rules for general-purpose AI. The third draft of the code is anticipated to be released the week of 17 Feb.
Brazil's data protection authority, the Autoridade Nacional de Proteção de Dados, issued guidance detailing data protection officers' obligations under the General Data Protection Law. The guidance aims to "indicate good practices for personal data processing agents" to ensure consumers' data is secure and organizations are compliant with the LGPD.Full story
Companies are increasingly looking to streamline compliance efforts across multiple jurisdictions while proactively seeking to minimize friction to remediate potential compliance gaps. The recent release of BigID's Data Activity Monitoring and Compliance Dashboard tools aims to help solve both concerns. IAPP Staff Writer Alex LaCasse spoke with BigID Chief Marketing Officer Sarah Hospelhorn about the launch. Full story
The Wall Street Journal reports on the reluctance compliance executives have in regards to using AI-integrated software to aid digital regulatory compliance.
The California Privacy Protection Agency announced increases in California Consumer Privacy Act civil penalties, which are allowed by law and are indexed to the state Consumer Price Index. Businesses will now be subjected to a USD26.6 million penalty of their gross revenue for CCPA violations, which is up from USD25 million. Monetary damages, administrative fines and civil penalties also increased by modest amounts.Full story