CDP Institute

Very interesting read.

DISA Global Solutions, a US company that screens employee data, was hacked exposing data, including social security numbers, financial account and credit information, of 3.3 million people. The data was vulnerable for two months before the company discovered it.

Mozilla, which had made a controversial update to Firefox Terms of Use that implied it could broadly access customers’ private data, is responding to significant backlash and trying to walk back its language. The situation was exacerbated by anger over the fact it also removed a promise included in Firefox’s FAQ section to never sell user data.

France is strengthening data protection in telemedicine via new regulations that received CNIL approval. This will include mandatory predictive impact assessments.

The UK Information Commissioner’s Office (ICO) is investigating TikTok, Reddit and Imgur to find out whether UK teen and children’s data is being suitably protected. This is part of ongoing investigation into how individual social media and video sharing platforms handle youth data and has resulted in specific changes at X, SendIt, Viber among others, to location data tracking, data sharing, and ad targeting practices.

This comes as Musk’s xAI introduced Grok-3, the latest iteration of its chatbot.

The state’s proposition is that businesses that track geolocation of individuals for fleet management, sales, or logistics should face new restrictions to how they collect and use of geolocation data.

A new rule for companies that transfer personal U.S. data to “countries of concern” such as Russia and China will go into effect on April 8.  Issued by the National Security Division of the U.S. Department of Justice and finalized on January 8, the rule prohibits the transfer of some data and sets conditions to govern transfers of other information.  It includes commercial transactions that are not governed by other transfer restrictions. While the new regime in Washington has frozen many regulations developed by its predecessor, there is no indication... Read More >

US Consumer groups, federal employees, unions and attorneys general have been filing lawsuits to protect private data being accessed in mass quantities by Elon Musk’s DOGE group. Most cite the Privacy Act of 1974, which prohibits release of federal records without consent, and some do in conjunction with other laws, including, the Computer Fraud and Abuse Act, the Federal Information Security Management Act, and the Education Department privacy statute. Requests range from stopping access to requiring deletion of data already obtained.

Lawmakers in Maryland have proposed a new bill, the Maryland Data Privacy Act, to protect residents’ data by prohibiting police and local officials from sharing personal data or granting access to databases without a state or federal warrant.

Australia passed the Online Safety Amendment (Social Media Minimum Age) Act, in 2024 which placed responsibility for controlling children’s access to social media on providers. However, a recent study of more than 1,500 children there conducted by eSafety, indicates they can easily bypass the controls with 80% of those surveyed who were aged 8 to 12 used one or more of the eight social media services in 2024 – despite policies prohibiting users under 13.

As a result, the company will no longer provide its UK users its Advanced Data Protection (ADP) protection and UK user files will be accessible to Apple and shareable with law enforcement.