Garante, the Italian data authority, found web publisher Caffeina Media Srl in violation of GDPR because its Google Analytics use resulted in the capture of EU personal data. This included device IP addresses, browser information, and visit dates and times – data which was subsequently transferred to the US. The Italian DPA also warned other local sites to check their own compliance. This follows a similar CNIL decision in France.

Colorado, one of 5 US states with a new privacy law, has just passed a biometrics law that limits use of facial recognition by state government agencies and higher ed institutions. This law requires organizations that intend to “develop, procure or use” facial recognition technology to provide notice of intent, including how the data will be stored and protected. Prior to beginning use of a system, agencies will need to submit an accountability report, and they must also train users to ensure compliance with related prohibitions.