Privacy and Cybersecurity Roundup Covers New Data Rules and Security Safeguards
Summary
A March 2026 roundup covers European and U.S. privacy guidance and laws, including rules for legitimate-interest processing, health-data cloud security, children’s platforms, genetic-data safeguards and AI-content provenance.
Key points
- The EDPB digest reviewed 62 one-stop-shop decisions and five binding decisions, finding recurring failures in documenting legitimate interest, demonstrating necessity and balancing rights.
- The UK ICO says personal-data reuse requires a compatibility assessment and a lawful basis; recognized legitimate interest is limited to five statutory purposes.
- CNIL guidance prohibits audio recording integrated with video surveillance, while allowing narrowly scoped, manually triggered standalone audio capture under strict safeguards.
- Dutch AP cloud guidance emphasizes ongoing processor due diligence, Article 32 security measures, tested exit plans and healthcare security standards including NEN 7510.
- Spanish data-protection authorities’ guidance for educational platforms calls for strict purpose limits, DPIAs, controls on data flows and subprocessors, and timely incident notification.
- Utah H.B. 182 restricts certain genetic-sequencing technologies and foreign access or storage of genetic data; covered entities must use reasonable encryption and access controls.
- GPEN’s 2025 sweep assessed 876 child-facing platforms; age checks were circumvented in 72% of cases where used, and 71% lacked privacy communications tailored to children.
Article Details
- Event Type
- Multiple regulatory guidance and legislative developments on privacy, data protection, and AI, alongside a social media liability verdict and a global review of children’s privacy protections.
- Impact
- The updates set or clarify requirements for lawful data reuse, AI-content provenance, cloud processing of health data, children’s data protection, and the use and storage of genetic data. The Dutch guidance highlights security, provider due diligence, and exit-planning obligations for health-data cloud services. The California jury found Meta and YouTube liable for harm linked to platform design and awarded approximately $6 million; both companies indicated they would appeal. The GPEN sweep found persistent gaps in children’s privacy protections across 876 platforms.
Vendors
Products
InstagramSuperior Court delivered the first verdict in U.S. social media addiction litigation, finding Meta (Instagram) and YouTube liable for harm caused to a young user through platform design. Damages of approximately $6SnapchatTikTok and Snapchat had settled claims in the same case shortly before trial, leaving Meta and YouTube as the remaining defendants.TikTokTikTok and Snapchat had settled claims in the same case shortly before trial, leaving Meta and YouTube as the remaining defendants.YouTube🇺🇸 US Jury Finds Meta and YouTube Liable in First Social Media Addiction Trial (KGM Case)
Countries
CanadaThe Global Privacy Enforcement Network (GPEN), coordinated by the Office of the Privacy Commissioner of Canada, the UK ICO, and the Guernsey DPA, has published the results of its 2025 global sweep of websites and mobileSpain🇪🇸 Spain DPAs Issue Joint Guidance on Educational Platforms and Children’s DataUnited Statesby, affiliated with, or distributed by entities connected to a “foreign adversary,” as defined under U.S. federal regulations. Entities currently using such equipment must remove or permanently disable it and
Industries
EducationThe decalogue consolidates existing GDPR requirements but applies them in the education context:Healthcareexpectations under the GDPR and sector-specific frameworks. The document is directed primarily at healthcare providers and other organizations acting as controllers when outsourcing processing to cloud providers.Social media🇺🇸 US Jury Finds Meta and YouTube Liable in First Social Media Addiction Trial (KGM Case)Technology🇺🇸 Utah Restricts Use of Foreign Genetic Sequencing Technology and Data Storage