CDP Institute

A data breach of nearly all AT&T customers via third-party vendor Snowflake has just resulted in a $370,000 payment to the hackers. And, while this is not unusual, it may be a strategy US companies cannot use for long, if a planned law is passed.  The Ransomware and Financial Stability Act 2024, a bipartisan law introduced this spring, would set a limit of $100,000 companies could pay for ransom in a cyber-attack.

EU regulators are charging Elon Musk’s X with violating the Digital Services Act (DSA), including deceiving users via use of dark pattern practices, including allowing them to self-verify their identity, which goes against industry practice of identity confirmation from trustworthy sources. This is one of a number of potential violations regulators are exploring and if proven could result in penalties for X of up to 6% of global annual turnover.

Pennsylvania’s Act 33 is a new law designed to strengthen protection of citizens following a data breach. Scheduled to go into effect late September, Act 33 mandates strict time limits in which organizations must provide notification of a data breach and requires companies to provide free credit monitoring to people whose data has been compromised.

In an unprecedented move, the US Federal Trade Commission (FTC) and Los Angeles District Attorney’s Office charged NGL (“not gonna lie”), a popular social media app downloaded millions of times, with cyber bullying and threatening teens and children. The company will be required to pay $5 million as part of a settlement that claimed its employees hooked kids into paying for services and preyed on them by tricking them into believing false messages of threats or solicitations produced by the company were sent by real users.

The ANPD, Brazil’s regulator, has banned Meta’s use of Brazilian citizen data for AI training. The company, which recently decided to give itself permission to use Facebook, Messenger, and Instagram data from Brazilian users, has been given five working days to comply or risk daily fines of 50,000 reais (around $8,808). Pittance in Meta terms, but still a good stand to take in one of Meta’s largest markets.

Cyber Press discovered a 9.4GB leak of Twitter data containing nearly 200 million records. This leaves users vulnerable to phishing attacks, identity theft and exploitation of data.

The Rhode Island Data Transparency and Privacy Protection Act (RI-DTPPA) has just become the newest US state law and will take effect in 2026. It puts obligations on controllers that process personal data, either by doing business in the state or providing products or services to residents. Much of the protection is similar to that provided in other states, including confirmation of data, and the right for users to correct, delete, and opt-out of targeted advertising. However, the law does not obligate use of a user-selected universal opt-out mechanism (UOOM)... Read More >

Responding to legal pushback since it launched in Chile a year ago, Worldcoin will now bar children and adolescents from using biometric iris-scans in exchange for WLD tokens. The practice, which did not include requiring age-verification, prompted controversy and legal challenges. It has, unfortunately, so far resulted in the firm collecting scans on a whopping 1% of the Chilean population.

Human Rights Watch has found images of children, some newly born, others in school or at play – from all across Australia – and including First Nations’ children, have been scraped from the web into a large LAION-58 data set. Numbers are not certain, since Human Rights Watch reviewed fewer than .0001% of the 5.85 billion images and captions held within the LAION-58 data set and used for AI training. But the rights group sounded the alarm because of the high risks to children and because data included in the... Read More >

Unlike Google which can see, record and keep track of what you write and edit, Proton Docs data is inaccessible by Proton and data is stored in the cloud and governed in accordance with strict Swiss data privacy laws.