CDP Institute

The privacy lawsuit that Texas’ attorney general wanted to bring against Google for misleading residents has been stopped on appeal.  The court ruled that Google has insufficient ties to the state, so is not within the state’s jurisdiction. The Texas AG claimed Google had misled consumers about location tracking data collection and how that data was being used.

In a first, the EU General Court has fined its own European Commission for failing to adequately comply with its data protection regulations. The Court determined the Commission transferred personal data, including IP address and web browser metadata, of a German citizen to Meta in the US without proper safeguards.

Amendment No. 13 to the Israel Privacy Protection Law (IPPL) is set to go into effect this year and will bring legislation closer in line to the EU’s GDPR. Changes include expanding personal information to include any data related to an identifiable person, mandatory appointment of a privacy protection and data security controller, and granting broader enforcement authority to Israel’s privacy regulator.

PowerSchool, the parent company of Naviance, has been hacked exposing the personal data of more than 60 million K-12 students and teachers. The software, which hosts attendance, finance and staff management data, also includes grades and school performance information. The company has said the incident has been contained.

Details of the settlement, which will be made public later this year, will benefit Australian Facebook users who used the site between 2013 and 2015.

The CJEU has taken issue with receiving too many GDPR violations, so it decided victims of data privacy violations can only file 2x/month. Max Schrems, activist and head of noyb (None of your business) non-profit, sensibly pointed out that the right to privacy should not be an on-again, off-again proposition – limited to twice monthly.

Ireland’s Data Protection Commission (DPC) delivered a €251M (US$261M) fine for a 2018 data breach that affected ~29 million Facebook accounts worldwide, including ~3 million users in the EU/EEA. The regulator’s determination was that the company hadn’t provided adequate information in its breach notification, that it didn’t fully document steps taken to remedy problems, and that it hadn’t ensured protection in system design.

Without admitting culpability, Apple has agreed to settle a Siri class action for $95 million for an alleged breach of privacy.  Those who purchased or owned Apple devices between September 2014 and December 2024 may be eligible for part of the settlement. The suit claimed Siri activated and recorded conversations even when users didn’t initiate it via the “Hey, Siri” prompt, and that 3rd-party Apple contractors were able to access private conversations.

Myanmar’s controversial new cybersecurity law makes unauthorized use of a VPN service a crime eligible for punishment of up to six months in prison and fines of up to 2 million kyats (almost $1,000).

The draft of India’s Digital Personal Data Protection (DPDP) has been released for comment and includes a rule that would require explicit parental consent for children under 18 to open a social media account. Data fiduciaries at companies would be responsible for verifying that appropriate permission has been obtained and that the individual granting the consent is an adult. The deadline for DPDP feedback is February 18th.