CDP Institute

Regulators from the Netherlands and France have announced they were fining Uber €290 million (~$324 million) for GDPR violation with drivers’ data that was transferred to the U.S. The data, which included locations, taxi licenses, payment details and in some cases even criminal and medical data, was relayed to servers in the United States.

Enzo BioChem, a testing lab company, was found negligent by the attorneys general of New York, Connecticut, and New Jersey, which together fined the company $4.5 million. The finding was that poor data security practice by the company enabled a ransomware attack and a data breach of records of ~2.4 million patients.

Botswana has introduced a Data Protection Bill in an effort to address privacy violations while its Data Protection Act (DPA) awaits full implementation. The Bill provides amendments to the DPA, including extending the application of the Act to the state and to data controllers outside the country.

The Children’s Advertising Review Unit (CARU) of BBB National Programs in the US found KidGeni, a generative AI art platform for children, in violation of the Children’s Online Privacy Protection Act (COPPA) and of CARU’s Privacy Guidelines. Issues included the company’s failing to provide parents and guardians sufficient information on its practices, failing to obtain their consent before collecting data, and not providing sufficient review and deletion options.

The tool has sections on different industries, including finance, health, law, education, insurance, retail, and others and it can be used to check for updates as rules change.