SypherPrivacyTalks - March 2025 - Week 13

Welcome to #SypherPrivacyTalks — Your news and article roundup. Bringing you the top privacy & compliance stories of the week.

Dad demands OpenAI delete ChatGPT’s false claim that he murdered his kids

arstechnica.com • 4 min read

😱 A Norwegian man was horrified to discover that ChatGPT had falsely accused him of killing his children.
According to a complaint filed by EU digital rights group Noyb, the man checked what ChatGPT would say about him and was shocked when it falsely claimed he was in prison for murdering two children and attempting to kill a third. Noyb said ChatGPT's fabricated story combined real personal details - such as the number and gender of his children and his home town - with completely false information… read more

GDPR ruling has commercial implications for credit reference agencies

pinsentmasons.com • 5 min read 

🏦 A recent ruling by the EU's highest court could force credit reference agencies to change their business models.
The ruling by the Court of Justice of the EU (CJEU) could increase the compliance burden for these agencies, depending on their current data processing practices. They may have to disclose more information about profiling to individuals and, more fundamentally, rethink their entire profiling methodology… read more

Romanian real estate developer fined for unsolicited messages

startupcafe.ro • 2 min read

💶 Romanian property developer One United Properties has been fined €2,000 for violating the GDPR by sending unsolicited commercial messages, following an investigation by the Romanian Data Protection Authority (ANSPDCP), which was completed in February 2025.
The data subject made several requests for confirmation of whether their personal data was being processed by the company and whether it had been deleted, as they were receiving unsolicited commercial messages… read more (article in Romanian)

Compliance and security of medical records: the CNIL launches a public consultation on a draft recommendation

cnil.fr • 6 min read

🏥After inspecting and formally notifying several healthcare institutions, the CNIL has drafted a recommendation for electronic patient record (EPR) compliance and security. 
This document outlines applicable rules and is open for public consultation for French healthcare establishments until May 16, 2025... read more (article in French)

A view from Brussels: Privacy and competition walk into a bar

iapp.org • 3 min read

🕵️‍♂️ EU privacy and competition regulators are separately evaluating "pay-or-consent" models. The European Data Protection Board issued guidance in April 2024, while the Commission's competition team investigates Meta's approach. Meta argues its model is compliant, but preliminary findings suggest otherwise. France's CNIL proposes harmonizing these regulatory frameworks as the Commission's decision approaches on March 25th, 2025… read more

--

Get connected with us on LinkedIn or by subscribing to our weekly newsletter. We do our best to select the most interesting and relevant content in our field and deliver it to you in a bite-sized format, so you can stay up to date on topics such as Privacy Management & Compliance.

Photo by Markus Spiske on Unsplash