Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

OpenAI Confirms Data Theft Following Supply Chain Attack

OpenAI has acknowledged a security breach resulting in data theft, stemming from a supply chain attack involving the TanStack npm packages. This incident highlights the growing vulnerabilities within software supply chains, where compromise of a single component can have far reaching implications for downstream users and their data. The confirmation by OpenAI, a leading AI developer, underscores the critical need for robust security postures even among technologically advanced organizations. The nature of the stolen data was not fully disclosed, but any compromise of an AI company's data can have significant implications for intellectual property and potentially user privacy. This event also raises questions about the security practices employed by third party software component providers.

Today's question

Regarding "journalism exceptions" under Article 85, GDPR allows Member States to:

  1. Member States may not create any journalism exceptions, in keeping with the principle of transparency
  2. Provide derogations for press and media processing activities
  3. Grant blanket exemptions to all media content producers, subject to proportionate compliance measures
  4. largely eliminate data protection for media organizations, following the applicable notification procedures

Answer this question on the site

Worth knowing

  1. US Bank Shared Customer Data with Unauthorized AI Application

    A US bank self reported a security lapse after inadvertently sharing customer data with an unauthorized artificial intelligence application. This incident highlights the growing risks associated with the integration of AI tools without proper data governance and security protocols. Financial institutions handle highly sensitive personal information, making such data exposures particularly concerning for customer privacy and regulatory compliance.

  2. Lawmakers Investigate Instructure Following Multiple Canvas Data Breaches

    US lawmakers are demanding answers from Instructure, the company behind the Canvas learning management system, concerning multiple data breaches. This scrutiny follows reports of stolen student data and doubts regarding hackers' claims of data deletion. The sensitivity of student data, coupled with repeated security incidents, underscores significant privacy risks in educational technology and calls for enhanced accountability from providers.

  3. CNIL Discusses Digital Euro Privacy Framework

    The French data protection authority CNIL has published discussions regarding the confidentiality and privacy implications of the digital euro. This initiative reflects ongoing efforts to embed privacy by design into emerging digital currencies. Addressing data protection concerns during the design phase is crucial for public trust and widespread adoption of digital payment systems.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.