CDP Institute

DeepSeek, the Chinese company that just sent shockwaves through the tech industry with its announcement of a chatbot to rival ChatGPT and similar products at a fraction of the price, is now being flagged by privacy regulators. Italy and Ireland want answers about the platform's processing of their citizen's data, and Taiwan has banned use of the app by public sector workers and at key infrastructure locations. 

The European Court of Justice has ruled that the European Data Protection Board (EDPB) has the authority to direct national data supervisors. In this case, the EDPB, which had challenged the Irish Data Protection Commissioner’s decisions in three suits, told the regulator to further investigate GDPR violations by Meta and WhatsApp.

New York’s legislature passed an amendment to its health law to prohibit the sale of regulated heath information and limit how data, including reproductive health information, can be processed. The bill now goes to the governor’s desk to be signed.

A Common Sense Media survey of more than a thousand US teens found 64% distrustful of tech companies and of how their data was being collected and used. Nearly the same amount, 62%, didn’t believe companies would prioritize safety over profits.

The company had been paying consumers in cryptocurrency for providing their iris scans, but the regulator determined this process did not allow people to give their free and unequivocal consent for data use.

Changes will include blocking and disallowing sharing of raw data it collects from health care facilities and ensuring that any local data shared has express consumer consent.

The US Federal Trade Commission (FTC) settles with General Motors putting a 5-year moratorium on the company to keep it from selling driver location data it collected. This follows a discovery that GM had been collecting and selling the data of millions of consumers without their intended consent. This was because the sign-up process for GM’s OnStar service was confusing to users who were unclear what they were agreeing to.

A suit seeking $1,000/user payout has been filed in the US against LinkedIn Premium claiming the platform shared private messages of users with other companies after automatically opting them in to a program that provided data for training AI. The filing also claimed the company knew it was in violation of what users agreed to and that this was part of a patterns of concealing its actions.

Somalia has new national ID cards that are creating controversy because of speculation that they have been specially timed to coincide with the elections. However, the country’s National Identification and Regulatory Authority (NIRA) denied that saying citizens will continue using the ID cards on an ongoing basis after the elections, which isn’t really an explanation of how instituting them now related isn’t election-related.

ISACA’s global privacy report based on input from 1,600 IT and cybersecurity professionals in Europe indicates that while privacy is deemed essential by organizations, spending is trending down. As a result, two-thirds of respondents reported their jobs were more stressful compared with five years ago and only 38% were confident of their company’s ability to safeguard consumer data.

Key rule changes to COPPA are set to include redefining “mixed audience website or online services,” adding biometrics and government-issued identifiers as personal information, and limiting the retention period of a child’s personal data to only the time necessary for the period the information had been collected for.

The company, which had admitted last fall to having had a breach that impacted 100 million users, now revised the count to 190 million.