Legal basis for targeted advertising purposes under China’s Personal Information Protection Law (PIPL). www.linkedin.com/posts/luisal... (2023）京0491民初1410号，审结日期为2024年2月1日

During these two days in January, my attention is focused on Chinese court rulings related to the Personal Information Protection Law (PIPL).

Australia’s privacy regulator will start 2026 with its first-ever compliance sweep, conducting a targeted review of selected businesses’ privacy policies to ensure they meet strict rules. See www.oaic.gov.au/news/media-c...

The Guangzhou Internet Court published an updated version of the fact sheet summarising key case law on "contract" as a legal basis under China’s Personal Information Protection Law (PIPL).

Following the enactment of executive regulation by the governments of India, Egypt, & Vietnam, there is optimism that Indonesia's Ministry of Communication and Digital will issue the Government Regulation ("RPP PDP") under Law No. 27 of 2022 on Personal Data Protection by 2026.

Following the enactment of execusite regulation by the governments of India, Egypt, and Vietnam, there is optimism that Indonesia's Ministry of Communication and Digital will issue the Government Regulation ("RPP PDP") under Law No. 27 of 2022 on Personal Data Protection by 2026.

The CA Delete Request and Opt-out Platform is officially live. See privacy.ca.gov/drop/.

Vietnam has officially issued the Decree guiding the implementation of the Personal Data Protection Law (PDPL). The Decree enters into force on 1 January 2026. See lnkd.in/ejdkRF5w.

The Guangzhou Internet Court published an updated version of the fact sheet summarising key case law on protection of personal data under China's PIPL. See lnkd.in/ehtv6v7W.

Korea’s DPA will prioritize BCRs, SCCs, and AI legal frameworks. Belgium’s DPA announced a 2026-2028 strategy focusing on adtech and data brokers. Brazil’s DPA set new rules for children’s data. Ecuador’s DPA plans regulation of biometric, credit, health data, data portability, and protection seals.

Peru's DPA issued regulation on data protection officer.

Unsurprisingly, then, one of the keys to an AI developer’s success is its ability to find information and sources that its competitors do not have.

X. AI LLC v. Bonta xAI filed a federal lawsuit alleging a California law requiring AI companies to reveal their training data is an unconstitutional “trade-secrets-destroying disclosure regime” that threatens the industry. Credits: Titus Wu Source: lnkd.in/eB3zEj-

X.AI LLC v. Bonta xAI filed a federal lawsuit alleging a California law requiring AI companies to reveal their training data is an unconstitutional “trade-secrets-destroying disclosure regime” that threatens the industry. Credits: Titus Wu Source: lnkd.in/eB3zEj-x.

After examining China's PIPL and Administrative Measures for Personal Information Protection Compliance Audits, here are my thoughts:

The CAC has issued a directive requiring companies to submit their audit reports on protecting children’s personal data to CAC authorities by 31 January 2026. On 14 February 2025, the CAC issued the “Administrative Measures for Personal Information Protection Compliance Audits.

On December 17, 2025, Attorney General Ken Paxton secured a first-of-its-kind temporary restraining order against Hisense. The Court ordered Hisense to cease the collection, the use, sale, transfer, disclosure, and sharing of personal data of TX consumers through ACR technology.

On December 17, 2025, Attorney General Ken Paxton secured a first-of-its-kind temporary restraining order against Hisense. The Court ordered Hisense to cease the collection, the use, sale, transfer, disclosure, and sharing of personal data of TX consumers through ACR technology.

The CAC has issued a directive requiring companies to submit their audit reports on protecting children’s personal data from the previous year to CAC authorities by 31 January 2026.

The New York Responsible AI Safety and Education (RAISE) Act has been formally adopted as Article 44-B within Chapter 20 of the General Business section of New York State law. From @nysenate: www.nysenate.gov/legislation/...

The Federal Commissioner for Data Protection and Freedom of Information just published a comprehensive handout on the use of AI in public authorities, which you can now access at lnkd.in/era4n5K4.

Article 5 of Law No. 151 of 2020 allows personal data transfers to countries that offers an adequate level of data protection, pending a Center-issued license. Article 16 of Decree requires controllers & processors to obtain a license and consent before making data transfers.

Traveling!

Sunday's Morning: An Overview of Executive Decree 816 of 2025, Implementing Egypt’s Personal Data Protection Law. Using children's personal data:

Sunday's Morning: An Overview of Executive Decree 816 of 2025, Implementing Egypt’s Personal Data Protection Law. Decree 816 requires processors to use personal data for AI purposes in line with local, regional, and international principles, ensuring no harm to data subjects.

Saturday's night: Understanding Executive Decree 816 of 2025, which enforces Egypt's Personal Data Protection Law. Is there a conflict between Article 2(2) of Executive Decree 816 of 2025 and Law No. 151 of 2020 when other legal bases are provided under Article 6 of the law?

Saturday's night: Understanding Executive Decree 816 of 2025, which enforces Egypt's Personal Data Protection Law (Law No. 151 of 2020).

The Hungarian DPA notes that banks use various tools, some not easily classified as AI, for credit scoring (lnkd.in/ePJ47RJq). The EDPB will propose guidelines on how the AI Act relates to data protection law in 2026, which may address these practices.

The draft requires providers to inform users when they're interacting with AI, forbids using user interactions or sensitive data for AI training, and mandates offering users the option to delete past interaction data like chat history. www.cac.gov.cn/2025-12/27/c...

Egypt has officially issued the Executive Decree 816 of 2025, which operationalize Egypt's Personal Data Protection Law (Law No. 151 of 2020). Executive Decree 816 of 2025: lnkd.in/enuM2HST. Law No. 151 of 2020: www.linkedin.com/posts/luisal...

This week, the Official Journal published @platombe.bsky.social 's appeal to the @eucourtofjustice.bsky.social Here's an expert opinion from German's Federal Ministry of the Interior that concludes that US authorities also have access to data stored in EU data centers www.heise.de/news/Gutacht...

China’s Cyberspace Administration released the Draft Interim Measures for the Administration of Anthropomorphic AI Interaction Services for public comment. The Measures are expected to take effect in 2026.

In our corner of the world, FTC enforcement is pored over, dissected, and drives how we advise on risk. So when this administration starts setting aside previous enforcement, it naturally throws a lot into flux. I wrote on this week's Rytr reversal: advertisinglaw.fkks.com/post/102lz36...

After five years since Egypt enacted the Personal Data Protection Law (Law No. 151 of 2020), the Executive Decree 816 of 2025 has finally been issued and is now in effect. As soon as a text-searchable version becomes available, this will be published. www.linkedin.com/posts/luisal...

Unexpectedly, after five years since Egypt enacted the Personal Data Protection Law (Law No. 151 of 2020), the Executive Decree has finally been issued and is now in effect. Unfortunately, I don't speak Arabic.

Friday's reading: Report on the use of artificial intelligence in banking (lnkd.in/emuqnc4a) as well as the findings from Liechtenstein’s Data Protection Authority regarding the legal bases for chatbots ( lnkd.in/ecng9Q2s).

The Digital Omnibus Regulation Proposal states that personal data may be processed for AI systems based on legitimate interests. VZBV has assessed the draft from consumers' perspective and suggest regulations balancing consumer needs, AI development, and European competitiveness.

The ANDP’s regulatory commitments include: · Personal data processing by AI systems · Handling children's data per LGPD and ECA Digital · Public sector data processing · Handling sensitive and biometric data · Large-scale and IoT-related processing · Standard Contractual Clauses

The Digital Omnibus Regulation Proposal extends Article 13 GDPR’s derogation to cases where data processing is unlikely to pose high risk and the data subject likely already knows the information. However, the CJEU in Case C-422/24 emphasized:

Yesterday, the Belgian DPA announced its strategy for 2026-2028, focusing on adtech and data brokerage (lnkd.in/eh-dz-Ek). Today, Brazil's DPA revealed its 2026-2027 plan (lnkd.in/eVMtZb4X) along with new regulatory commitments, which include AI.

In its final decision, the Munich Higher Regional Court (OLG) clarified key GDPR issues in scraping cases, including data minimization and privacy by design requirements. Story: lnkd.in/e2dudtQm.

The Italian Competition Authority has ordered Meta to immediately suspend the WhatsApp Business Solution Terms in order to preserve access to the WhatsApp platform for Meta AI’s competitors. See lnkd.in/eineTxVb. Credits: Thomas Höppner Unofficial translation:

The French Data Protection Authority (DPA) has announced that it has fined a data processor for not implementing adequate security measures to protect personal data handled by a sub-processor. See www.legifrance.gouv.fr/cnil/id/CNIL....

Material scope of PIPEDA @privacylawyer.ca

The Baden-Württemberg Data Protection Authority has released an updated version of its navigator AI and data protection guide. The new version can now be found under lfdi-bw.de/onkida.